threadroot 0.1.4 → 0.1.5

package/dist/index.js

@@ -4,8 +4,8 @@
 import { Command } from "commander";
 
 // src/core/bootstrap.ts
-import { stat as stat9 } from "fs/promises";
-import path23 from "path";
+import { stat as stat10 } from "fs/promises";
+import path24 from "path";
 
 // src/core/doctor.ts
 import { stat as stat5 } from "fs/promises";
@@ -1487,6 +1487,8 @@ async function createConnection(repoRoot, input2, options = {}) {
     risk: input2.risk ?? "medium",
     confirm: input2.confirm ?? input2.risk === "high",
     healthcheck: input2.healthcheck ? { run: input2.healthcheck, expectExitCode: 0 } : void 0,
+    allow: input2.allow ?? [],
+    deny: input2.deny ?? [],
     scope
   };
   const parsed = connectionManifestSchema.safeParse(candidate);
@@ -1716,16 +1718,17 @@ function threadrootSkillContent(provider, scope) {
     "## Workflow",
     "",
     "1. If `threadroot --version` works, use `threadroot`. Otherwise use `npx --yes threadroot@latest` for one-off commands.",
-    "2. If `.threadroot/harness.yaml` is missing and the user wants setup, run `threadroot bootstrap --yes` or `npx --yes threadroot@latest bootstrap --yes`.",
+    "2. If `.threadroot/harness.yaml` is missing and the user wants setup, run `threadroot bootstrap --yes --mcp` or `npx --yes threadroot@latest bootstrap --yes --mcp`.",
     '3. At the start of a coding session, run `threadroot start "<task>"` to get doctor status, project state, relevant skills, tools, memory, and the command map.',
-    '4. For a narrower slice, run `threadroot context "<task>"` and use the returned skills, rules, tools, memory, and references before doing broad file reads.',
-    "5. Use `threadroot tools list`, `threadroot tools check`, and `threadroot run <tool>` for explicit local capabilities. Confirm risky tools when required.",
-    "6. Do not create provider-specific files unless the user asks. Use `threadroot expose <agent>` when native project skill shims are desired.",
+    "4. If the project needs curated capabilities, inspect `threadroot packs list` and install relevant packs with `threadroot packs install <pack>` or `threadroot bootstrap --packs <list>` during setup.",
+    '5. For a narrower slice, run `threadroot context "<task>"` and use the returned skills, rules, tools, memory, and references before doing broad file reads.',
+    "6. Use `threadroot tools list`, `threadroot tools check`, and `threadroot run <tool>` for explicit local capabilities. Confirm risky tools only after human review.",
+    "7. Do not create provider-specific files unless the user asks. Use `threadroot expose <agent>` when native project skill shims are desired.",
     "",
     "## Useful Commands",
     "",
     "```bash",
-    "threadroot bootstrap --yes",
+    "threadroot bootstrap --yes --mcp",
     'threadroot start "<task>"',
     "threadroot doctor",
     "threadroot status",
@@ -1997,6 +2000,56 @@ function authorizeTool(tool, options) {
   return { allowed: true };
 }
 
+// src/core/tools/connection-policy.ts
+function normalize(value) {
+  return value.trim().replace(/\s+/g, " ").toLowerCase();
+}
+function commandBody(command, connectionCommand) {
+  const normalized = normalize(command);
+  const prefix = normalize(connectionCommand);
+  if (normalized === prefix) {
+    return "";
+  }
+  if (normalized.startsWith(`${prefix} `)) {
+    return normalized.slice(prefix.length).trim();
+  }
+  return normalized;
+}
+function includesPattern(command, pattern) {
+  return command.includes(normalize(pattern));
+}
+function authorizeConnectionCommand(connection, command) {
+  const { allow, deny } = connection.manifest;
+  if (allow.length === 0 && deny.length === 0) {
+    return { allowed: true };
+  }
+  if (!command) {
+    return {
+      allowed: false,
+      message: `Connection \`${connection.name}\` defines allow/deny rules, but this tool uses a script that Threadroot cannot policy-check. Use a shell \`run\` tool for connection-backed actions.`
+    };
+  }
+  const body = commandBody(command, connection.manifest.command);
+  const full = normalize(command);
+  const denied = deny.find((pattern) => includesPattern(body, pattern) || includesPattern(full, pattern));
+  if (denied) {
+    return {
+      allowed: false,
+      message: `Connection \`${connection.name}\` denies command fragment \`${denied}\`.`
+    };
+  }
+  if (allow.length > 0) {
+    const allowed = allow.some((pattern) => includesPattern(body, pattern) || includesPattern(full, pattern));
+    if (!allowed) {
+      return {
+        allowed: false,
+        message: `Connection \`${connection.name}\` only allows: ${allow.map((pattern) => `\`${pattern}\``).join(", ")}.`
+      };
+    }
+  }
+  return { allowed: true };
+}
+
 // src/core/tools/interpolate.ts
 var ToolInputError = class extends Error {
   constructor(message) {
@@ -2373,7 +2426,19 @@ async function runTool(repoRoot, options) {
   const values = resolveInputs(tool.manifest, options.input);
   const env = inputEnv(values);
   const execOptions = { cwd: repoRoot, env, timeoutMs: options.timeoutMs, signal: options.signal };
-  const result = tool.manifest.run ? await executeShell(interpolateRun(tool.manifest.run, values), execOptions) : await executeScript(repoRoot, tool.manifest.script, execOptions);
+  const command = tool.manifest.run ? interpolateRun(tool.manifest.run, values) : void 0;
+  if (connection) {
+    const connectionDecision = authorizeConnectionCommand(connection, command);
+    if (!connectionDecision.allowed) {
+      return {
+        status: "blocked",
+        tool: tool.name,
+        reason: "not-allowed",
+        message: connectionDecision.message
+      };
+    }
+  }
+  const result = command ? await executeShell(command, execOptions) : await executeScript(repoRoot, tool.manifest.script, execOptions);
   return { status: "ran", tool: tool.name, result };
 }
 async function checkToolHealth(repoRoot, tool) {
@@ -2401,7 +2466,7 @@ import { homedir as homedir2, tmpdir } from "os";
 import path14 from "path";
 
 // src/core/version.ts
-var THREADROOT_VERSION = "0.1.4";
+var THREADROOT_VERSION = "0.1.5";
 
 // src/core/mcp-check.ts
 var REQUIRED_MCP_TOOLS = [
@@ -3278,7 +3343,7 @@ async function readIfExists2(filePath) {
     throw error;
   }
 }
-function normalize(text) {
+function normalize2(text) {
   return text.toLowerCase().replace(/\s+/g, " ").trim();
 }
 function splitSections(markdown) {
@@ -3294,7 +3359,7 @@ function splitSections(markdown) {
   for (const line of markdown.split(/\r?\n/)) {
     if (/^#{1,6}\s/.test(line)) {
       flush();
-      heading = normalize(line.replace(/^#+\s*/, ""));
+      heading = normalize2(line.replace(/^#+\s*/, ""));
       buffer = [line];
     } else {
       buffer.push(line);
@@ -3304,13 +3369,13 @@ function splitSections(markdown) {
   return sections;
 }
 function novelSections(canonical, other) {
-  const haystack = normalize(canonical);
+  const haystack = normalize2(canonical);
   const seenHeadings = new Set(splitSections(canonical).map((section) => section.heading).filter(Boolean));
   return splitSections(other).filter((section) => {
     if (section.heading && seenHeadings.has(section.heading)) {
       return false;
     }
-    return !haystack.includes(normalize(section.text));
+    return !haystack.includes(normalize2(section.text));
   });
 }
 async function listCursorRules(repoRoot) {
@@ -3544,43 +3609,32 @@ async function initHarness(repoRoot, options = {}) {
   return { name, profile, adapters, skills, tools: tools2, memory, rules, import: report, compiled: written, exposed };
 }
 
-// src/core/status.ts
-async function harnessStatus(repoRoot, options = {}) {
-  let harness;
-  try {
-    harness = await resolveHarness(repoRoot, { home: options.home });
-  } catch (error) {
-    if (error instanceof HarnessError) {
-      return { exists: false };
-    }
-    throw error;
-  }
-  const files = await compile(repoRoot, harness);
-  const drift = await detectDrift(repoRoot, files);
-  return {
-    exists: true,
-    manifest: {
-      name: harness.manifest.name,
-      profile: harness.manifest.profile,
-      adapters: harness.manifest.adapters,
-      toolsAllow: harness.manifest.tools.allow
-    },
-    counts: {
-      skills: harness.skills.length,
-      rules: harness.rules.length,
-      tools: harness.tools.length,
-      memory: harness.memory.length
-    },
-    drift
-  };
-}
-
-// src/core/bootstrap.ts
-var DEFAULT_TASK = "start this project";
-async function harnessExists(repoRoot) {
-  return pathExists2(path23.join(repoRoot, ".threadroot", "harness.yaml"));
-}
-async function pathExists2(target) {
+// src/core/packs/index.ts
+import { createHash as createHash2 } from "crypto";
+import { cp as cp2, lstat, mkdir as mkdir10, readFile as readFile11, readdir as readdir5, stat as stat9 } from "fs/promises";
+import path23 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { parse as parseYaml3 } from "yaml";
+import { z as z4 } from "zod";
+var packManifestSchema = z4.object({
+  name: z4.string().min(1),
+  version: z4.literal(1),
+  description: z4.string().min(1),
+  skills: z4.array(z4.string()).default([]),
+  tools: z4.array(z4.string()).default([]),
+  rules: z4.array(z4.string()).default([]),
+  connections: z4.array(z4.string()).default([])
+});
+var DIST_DIR2 = path23.dirname(fileURLToPath2(import.meta.url));
+var PACKAGE_ROOT_FROM_BUNDLE2 = path23.resolve(DIST_DIR2, "..");
+var PACKAGE_ROOT_FROM_DIST2 = path23.resolve(DIST_DIR2, "../../..");
+var PACKAGE_ROOT_FROM_SRC2 = path23.resolve(DIST_DIR2, "../../../..");
+var PACK_CANDIDATES = [
+  path23.join(PACKAGE_ROOT_FROM_BUNDLE2, "packs"),
+  path23.join(PACKAGE_ROOT_FROM_DIST2, "packs"),
+  path23.join(PACKAGE_ROOT_FROM_SRC2, "packs")
+];
+async function exists5(target) {
   try {
     await stat9(target);
     return true;
@@ -3591,155 +3645,530 @@ async function pathExists2(target) {
     throw error;
   }
 }
-function modeFor(options) {
-  return options.yes && !options.dryRun ? "write" : "dry-run";
-}
-async function bootstrapProject(repoRoot, options = {}) {
-  const task = options.task?.trim() || DEFAULT_TASK;
-  const mode = modeFor(options);
-  const write2 = mode === "write";
-  const notes = [];
-  const existed = await harnessExists(repoRoot);
-  let setup;
-  let init;
-  let exposed;
-  if (!options.noGlobal) {
-    setup = await setupGlobal({
-      agents: options.agents ?? "all",
-      mode,
-      home: options.home,
-      mcp: options.mcp,
-      mcpEntry: options.mcpEntry
-    });
-  } else {
-    notes.push("Skipped global setup because --no-global was set.");
-  }
-  if (!existed && !options.noInit) {
-    if (write2) {
-      init = await initHarness(repoRoot, {
-        import: options.import,
-        profile: options.profile,
-        home: options.home
-      });
-    } else {
-      notes.push(`Would initialize local-only harness at ${path23.join(".threadroot", "harness.yaml")}.`);
+async function firstExisting(candidates) {
+  for (const candidate of candidates) {
+    if (await isPackRoot(candidate)) {
+      return candidate;
     }
-  } else if (existed) {
-    notes.push("Existing harness detected; bootstrap will not reinitialize it.");
-  } else {
-    notes.push("Skipped project initialization because --no-init was set.");
-  }
-  const hasHarnessAfterInit = existed || Boolean(init) || await pathExists2(path23.join(repoRoot, ".threadroot", "harness.yaml"));
-  if (options.expose) {
-    exposed = await exposeProject(repoRoot, {
-      agents: options.expose,
-      mode
-    });
   }
-  let status;
-  let doctorReport;
-  let context;
-  let mcpCheck;
-  if (options.mcp && write2) {
-    mcpCheck = await checkCodexMcp({ repoRoot, home: options.home });
+  return void 0;
+}
+async function bundledPacksDir() {
+  return firstExisting(PACK_CANDIDATES);
+}
+async function isPackRoot(candidate) {
+  let entries;
+  try {
+    entries = await readdir5(candidate, { withFileTypes: true });
+  } catch {
+    return false;
   }
-  if (hasHarnessAfterInit) {
-    status = await harnessStatus(repoRoot, { home: options.home });
-    doctorReport = await doctor(repoRoot, { home: options.home });
-    if (status.exists) {
-      context = await assembleContext(repoRoot, task, { home: options.home, fallbackSkills: true });
+  for (const entry of entries) {
+    if (entry.isDirectory() && await exists5(path23.join(candidate, entry.name, "pack.yaml"))) {
+      return true;
     }
-  } else {
-    notes.push("Skipped doctor/status/context because no harness exists yet.");
   }
-  if (!write2) {
-    notes.push("Run `threadroot bootstrap --yes` to apply this plan.");
+  return false;
+}
+function safeRelative(ref) {
+  const normalized = path23.normalize(ref);
+  if (path23.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path23.sep}`)) {
+    throw new Error(`Unsafe pack reference: ${ref}`);
   }
-  return {
-    mode: write2 ? "write" : "plan",
-    task,
-    harnessExisted: existed,
-    setup,
-    init,
-    expose: exposed,
-    status,
-    doctor: doctorReport,
-    context,
-    mcpCheck,
-    notes
-  };
+  return normalized;
 }
-async function startSession(repoRoot, options = {}) {
-  const task = options.task?.trim() || DEFAULT_TASK;
-  const status = await harnessStatus(repoRoot, { home: options.home });
-  const notes = [];
-  if (!status.exists) {
-    return {
-      task,
-      status,
-      notes: ["No harness found. Run `threadroot bootstrap --yes` first."]
-    };
+async function readPackManifest(packDir) {
+  const file = path23.join(packDir, "pack.yaml");
+  const parsed = packManifestSchema.safeParse(parseYaml3(await readFile11(file, "utf8")));
+  if (!parsed.success) {
+    const detail = parsed.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid pack manifest ${file}: ${detail}`);
   }
-  const doctorReport = await doctor(repoRoot, { home: options.home });
-  const context = await assembleContext(repoRoot, task, { home: options.home, fallbackSkills: true });
-  return { task, status, doctor: doctorReport, context, notes };
+  return parsed.data;
 }
-
-// src/commands/session-output.ts
-function printDoctor(report) {
-  if (!report) {
-    return;
+async function packDirFor(repoRoot, nameOrPath) {
+  if (path23.isAbsolute(nameOrPath)) {
+    const root = path23.resolve(repoRoot);
+    const target = path23.resolve(nameOrPath);
+    const repoRelative = path23.relative(root, target);
+    const bundled2 = await bundledPacksDir();
+    const bundledRelative = bundled2 ? path23.relative(path23.resolve(bundled2), target) : void 0;
+    const insideRepo = repoRelative !== "" && !repoRelative.startsWith("..") && !path23.isAbsolute(repoRelative);
+    const insideBundled = bundledRelative !== void 0 && bundledRelative !== "" && !bundledRelative.startsWith("..") && !path23.isAbsolute(bundledRelative);
+    if (!insideRepo && !insideBundled) {
+      throw new Error(`Pack path must be repo-relative or a built-in pack name: ${nameOrPath}`);
+    }
+    return nameOrPath;
   }
-  const actionable = report.findings.filter((finding3) => finding3.severity !== "info");
-  console.log(actionable.length === 0 ? "doctor: clean" : `doctor: ${report.summary.errors} error(s), ${report.summary.warnings} warning(s)`);
-  for (const finding3 of report.findings.slice(0, 8)) {
-    const label = finding3.severity === "info" ? "hint" : finding3.severity;
-    const suffix = finding3.path ? ` (${finding3.path})` : "";
-    console.log(`- ${label} ${finding3.code}: ${finding3.message}${suffix}`);
+  if (nameOrPath.startsWith(".") || nameOrPath.includes("/") || nameOrPath.includes("\\")) {
+    return toRepoPath(repoRoot, nameOrPath);
   }
-  if (report.findings.length > 8) {
-    console.log(`- ... ${report.findings.length - 8} more finding(s)`);
+  const bundled = await bundledPacksDir();
+  if (bundled) {
+    return path23.join(bundled, nameOrPath);
   }
+  return toRepoPath(repoRoot, path23.join("packs", nameOrPath));
 }
-function printStatus(status) {
-  if (!status) {
-    return;
-  }
-  if (!status.exists) {
-    console.log("harness: missing");
-    return;
+async function directFiles(dir, ext) {
+  try {
+    const entries = await readdir5(dir, { withFileTypes: true });
+    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(ext)).map((entry) => path23.join(dir, entry.name)).sort();
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
   }
-  console.log(`harness: ${status.manifest.name} (${status.manifest.profile})`);
-  console.log(`adapters: ${status.manifest.adapters.length > 0 ? status.manifest.adapters.join(", ") : "none (local-only)"}`);
-  console.log(
-    `objects: ${status.counts.skills} skills, ${status.counts.rules} rules, ${status.counts.tools} tools, ${status.counts.memory} memory`
-  );
 }
-function printContext(context) {
-  if (!context) {
-    return;
-  }
-  console.log(`task: ${context.task}`);
-  if (context.skills.length > 0) {
-    const skillLabel = context.skills.some((skill) => skill.score > 0) ? "relevant skills:" : "starter skills:";
-    console.log(skillLabel);
-    for (const skill of context.skills.slice(0, 8)) {
-      console.log(`- ${skill.name} - ${skill.when}`);
+async function skillEntries(dir) {
+  try {
+    const entries = await readdir5(dir, { withFileTypes: true });
+    const result = [];
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = path23.join(dir, entry.name);
+      if (entry.isFile() && entry.name.endsWith(".md")) {
+        result.push(full);
+      }
+      if (entry.isDirectory() && await exists5(path23.join(full, "SKILL.md"))) {
+        result.push(full);
+      }
     }
-  } else {
-    console.log("relevant skills: none matched; run `threadroot skills list` to inspect all skills.");
-  }
-  if (context.tools.length > 0) {
-    console.log("available tools:");
-    for (const tool of context.tools.slice(0, 8)) {
-      console.log(`- ${tool.name} (${tool.risk}) - ${tool.description}`);
+    return result;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
     }
-  }
-  if (context.memory.length > 0) {
-    console.log(`memory: ${context.memory.map((entry) => entry.type).join(", ")}`);
+    throw error;
   }
 }
-function printCommandMap() {
+async function collectObjects(packDir, manifest) {
+  async function resolveRef(ref) {
+    const safe = safeRelative(ref);
+    const local = path23.resolve(packDir, safe);
+    if (await exists5(local)) {
+      return local;
+    }
+    return path23.resolve(packDir, "..", "..", safe);
+  }
+  return {
+    skills: [
+      ...await Promise.all(manifest.skills.map(resolveRef)),
+      ...await skillEntries(path23.join(packDir, "skills"))
+    ],
+    tools: [
+      ...await Promise.all(manifest.tools.map(resolveRef)),
+      ...await directFiles(path23.join(packDir, "tools"), ".yaml")
+    ],
+    rules: [
+      ...await Promise.all(manifest.rules.map(resolveRef)),
+      ...await directFiles(path23.join(packDir, "rules"), ".md")
+    ],
+    connections: [
+      ...await Promise.all(manifest.connections.map(resolveRef)),
+      ...await directFiles(path23.join(packDir, "connections"), ".yaml")
+    ]
+  };
+}
+function baseName(source) {
+  const parsed = path23.basename(source) === "SKILL.md" ? path23.dirname(source) : source;
+  return path23.basename(parsed, path23.extname(parsed));
+}
+async function listPacks(repoRoot) {
+  const dirs = [toRepoPath(repoRoot, "packs"), await bundledPacksDir()].filter((dir) => Boolean(dir));
+  const seen = /* @__PURE__ */ new Set();
+  const packs = [];
+  for (const root of dirs) {
+    let entries;
+    try {
+      entries = await readdir5(root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || seen.has(entry.name)) {
+        continue;
+      }
+      const packDir = path23.join(root, entry.name);
+      if (!await exists5(path23.join(packDir, "pack.yaml"))) {
+        continue;
+      }
+      seen.add(entry.name);
+      packs.push(await inspectPack(repoRoot, packDir));
+    }
+  }
+  return packs.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function inspectPack(repoRoot, nameOrPath) {
+  const packDir = await packDirFor(repoRoot, nameOrPath);
+  const manifest = await readPackManifest(packDir);
+  const objects = await collectObjects(packDir, manifest);
+  return {
+    name: manifest.name,
+    description: manifest.description,
+    path: packDir,
+    skills: objects.skills.map(baseName),
+    tools: objects.tools.map(baseName),
+    rules: objects.rules.map(baseName),
+    connections: objects.connections.map(baseName)
+  };
+}
+async function validateProse(file, kind) {
+  const target = path23.basename(file) === "SKILL.md" ? file : file;
+  const content = await readFile11(target, "utf8");
+  const parsed = parseFrontmatter(content);
+  const schema = kind === "skill" ? skillFrontmatterSchema : ruleFrontmatterSchema;
+  schema.parse(parsed.data);
+}
+async function validateYaml(file, kind) {
+  const content = await readFile11(file, "utf8");
+  const schema = kind === "tool" ? toolManifestSchema : connectionManifestSchema;
+  schema.parse(parseYaml3(content));
+}
+async function validatePack(repoRoot, nameOrPath) {
+  const findings = [];
+  try {
+    const packDir = await packDirFor(repoRoot, nameOrPath);
+    const manifest = await readPackManifest(packDir);
+    const objects = await collectObjects(packDir, manifest);
+    for (const skill of objects.skills) {
+      await validateProse(path23.basename(skill) === "SKILL.md" ? skill : path23.join(skill, "SKILL.md"), "skill");
+    }
+    for (const rule of objects.rules) await validateProse(rule, "rule");
+    for (const tool of objects.tools) await validateYaml(tool, "tool");
+    for (const connection of objects.connections) await validateYaml(connection, "connection");
+    if (Object.values(objects).every((items) => items.length === 0)) {
+      findings.push({ severity: "warning", message: "Pack does not include any objects." });
+    }
+  } catch (error) {
+    findings.push({ severity: "error", message: error instanceof Error ? error.message : String(error) });
+  }
+  return { ok: !findings.some((finding3) => finding3.severity === "error"), findings };
+}
+async function copyObject(source, destDir) {
+  if ((await lstat(source)).isSymbolicLink()) {
+    throw new Error(`Refusing to install pack object symlink: ${source}`);
+  }
+  const info = await stat9(source);
+  const name = baseName(source);
+  const dest = info.isDirectory() ? path23.join(destDir, name) : path23.join(destDir, path23.basename(source));
+  await mkdir10(destDir, { recursive: true });
+  await cp2(source, dest, { recursive: true, force: true });
+  return dest;
+}
+async function hashFile(filePath) {
+  return createHash2("sha256").update(await readFile11(filePath)).digest("hex");
+}
+async function hashDirectory(root) {
+  const hash = createHash2("sha256");
+  hash.update("threadroot-pack-directory-v1\n");
+  async function walk(dir) {
+    const entries = (await readdir5(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const full = path23.join(dir, entry.name);
+      const rel = path23.relative(root, full).split(path23.sep).join("/");
+      if (entry.isSymbolicLink()) {
+        throw new Error(`Refusing to install pack object with symlink: ${rel}`);
+      }
+      if (entry.isDirectory()) {
+        await walk(full);
+        continue;
+      }
+      if (entry.isFile()) {
+        hash.update(`file:${rel}
+`);
+        hash.update(await readFile11(full));
+        hash.update("\n");
+      }
+    }
+  }
+  await walk(root);
+  return hash.digest("hex");
+}
+async function integrityFor(source) {
+  if ((await lstat(source)).isSymbolicLink()) {
+    throw new Error(`Refusing to hash pack object symlink: ${source}`);
+  }
+  const info = await stat9(source);
+  const digest = info.isDirectory() ? await hashDirectory(source) : await hashFile(source);
+  return `sha256:${digest}`;
+}
+function normalizeLockPath(value) {
+  return value.split(path23.sep).join("/");
+}
+function inside(root, target) {
+  const relative = path23.relative(path23.resolve(root), path23.resolve(target));
+  if (relative === "" || relative.startsWith("..") || path23.isAbsolute(relative)) {
+    return void 0;
+  }
+  return normalizeLockPath(relative);
+}
+function lockObjectPath(packDir, source) {
+  return inside(packDir, source) ?? inside(path23.resolve(packDir, "..", ".."), source) ?? path23.basename(source);
+}
+async function lockEntryForPackObject(packDir, manifest, kind, source, installedAt) {
+  return {
+    name: baseName(source),
+    kind,
+    sourceKind: "local",
+    source: `pack:${manifest.name}`,
+    objectPath: lockObjectPath(packDir, source),
+    integrity: await integrityFor(source),
+    installedAt
+  };
+}
+async function writePackLockEntries(repoRoot, packDir, manifest, objects) {
+  const installedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const entries = await Promise.all([
+    ...objects.skills.map((source) => lockEntryForPackObject(packDir, manifest, "skill", source, installedAt)),
+    ...objects.tools.map((source) => lockEntryForPackObject(packDir, manifest, "tool", source, installedAt)),
+    ...objects.rules.map((source) => lockEntryForPackObject(packDir, manifest, "rule", source, installedAt)),
+    ...objects.connections.map(
+      (source) => lockEntryForPackObject(packDir, manifest, "connection", source, installedAt)
+    )
+  ]);
+  let lock = await readLockFile(projectLockPath(repoRoot));
+  for (const entry of entries) {
+    lock = upsertLockEntry(lock, entry);
+  }
+  await writeLockFile(projectLockPath(repoRoot), lock);
+}
+async function installPack(repoRoot, nameOrPath) {
+  const validation = await validatePack(repoRoot, nameOrPath);
+  if (!validation.ok) {
+    throw new Error(validation.findings.map((finding3) => finding3.message).join("; "));
+  }
+  const packDir = await packDirFor(repoRoot, nameOrPath);
+  const manifest = await readPackManifest(packDir);
+  const objects = await collectObjects(packDir, manifest);
+  await Promise.all([
+    ...objects.skills.map((source) => copyObject(source, projectObjectDir(repoRoot, "skills"))),
+    ...objects.tools.map((source) => copyObject(source, projectObjectDir(repoRoot, "tools"))),
+    ...objects.rules.map((source) => copyObject(source, projectObjectDir(repoRoot, "rules"))),
+    ...objects.connections.map((source) => copyObject(source, projectObjectDir(repoRoot, "connections")))
+  ]);
+  await writePackLockEntries(repoRoot, packDir, manifest, objects);
+  return inspectPack(repoRoot, packDir);
+}
+
+// src/core/status.ts
+async function harnessStatus(repoRoot, options = {}) {
+  let harness;
+  try {
+    harness = await resolveHarness(repoRoot, { home: options.home });
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      return { exists: false };
+    }
+    throw error;
+  }
+  const files = await compile(repoRoot, harness);
+  const drift = await detectDrift(repoRoot, files);
+  return {
+    exists: true,
+    manifest: {
+      name: harness.manifest.name,
+      profile: harness.manifest.profile,
+      adapters: harness.manifest.adapters,
+      toolsAllow: harness.manifest.tools.allow
+    },
+    counts: {
+      skills: harness.skills.length,
+      rules: harness.rules.length,
+      tools: harness.tools.length,
+      memory: harness.memory.length
+    },
+    drift
+  };
+}
+
+// src/core/bootstrap.ts
+var DEFAULT_TASK = "start this project";
+async function harnessExists(repoRoot) {
+  return pathExists2(path24.join(repoRoot, ".threadroot", "harness.yaml"));
+}
+async function pathExists2(target) {
+  try {
+    await stat10(target);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+function modeFor(options) {
+  return options.yes && !options.dryRun ? "write" : "dry-run";
+}
+function parseListOption(value) {
+  return (value ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+}
+async function bootstrapProject(repoRoot, options = {}) {
+  const task = options.task?.trim() || DEFAULT_TASK;
+  const mode = modeFor(options);
+  const write2 = mode === "write";
+  const notes = [];
+  const existed = await harnessExists(repoRoot);
+  let setup;
+  let init;
+  let exposed;
+  let packs;
+  if (!options.noGlobal) {
+    setup = await setupGlobal({
+      agents: options.agents ?? "all",
+      mode,
+      home: options.home,
+      mcp: options.mcp,
+      mcpEntry: options.mcpEntry
+    });
+  } else {
+    notes.push("Skipped global setup because --no-global was set.");
+  }
+  if (!existed && !options.noInit) {
+    if (write2) {
+      init = await initHarness(repoRoot, {
+        import: options.import,
+        profile: options.profile,
+        home: options.home
+      });
+    } else {
+      notes.push(`Would initialize local-only harness at ${path24.join(".threadroot", "harness.yaml")}.`);
+    }
+  } else if (existed) {
+    notes.push("Existing harness detected; bootstrap will not reinitialize it.");
+  } else {
+    notes.push("Skipped project initialization because --no-init was set.");
+  }
+  const hasHarnessAfterInit = existed || Boolean(init) || await pathExists2(path24.join(repoRoot, ".threadroot", "harness.yaml"));
+  if (options.expose) {
+    exposed = await exposeProject(repoRoot, {
+      agents: options.expose,
+      mode
+    });
+  }
+  const packNames = parseListOption(options.packs);
+  if (packNames.length > 0) {
+    if (!hasHarnessAfterInit) {
+      notes.push("Skipped pack installation because no harness exists yet.");
+    } else if (write2) {
+      packs = [];
+      for (const packName of packNames) {
+        packs.push(await installPack(repoRoot, packName));
+      }
+    } else {
+      notes.push(`Would install pack(s): ${packNames.join(", ")}.`);
+    }
+  }
+  let status;
+  let doctorReport;
+  let context;
+  let mcpCheck;
+  if (options.mcp && write2) {
+    mcpCheck = await checkCodexMcp({ repoRoot, home: options.home });
+  }
+  if (hasHarnessAfterInit) {
+    status = await harnessStatus(repoRoot, { home: options.home });
+    doctorReport = await doctor(repoRoot, { home: options.home });
+    if (status.exists) {
+      context = await assembleContext(repoRoot, task, { home: options.home, fallbackSkills: true });
+    }
+  } else {
+    notes.push("Skipped doctor/status/context because no harness exists yet.");
+  }
+  if (!write2) {
+    notes.push("Run `threadroot bootstrap --yes` to apply this plan.");
+  }
+  return {
+    mode: write2 ? "write" : "plan",
+    task,
+    harnessExisted: existed,
+    setup,
+    init,
+    expose: exposed,
+    packs,
+    status,
+    doctor: doctorReport,
+    context,
+    mcpCheck,
+    notes
+  };
+}
+async function startSession(repoRoot, options = {}) {
+  const task = options.task?.trim() || DEFAULT_TASK;
+  const status = await harnessStatus(repoRoot, { home: options.home });
+  const notes = [];
+  if (!status.exists) {
+    return {
+      task,
+      status,
+      notes: ["No harness found. Run `threadroot bootstrap --yes` first."]
+    };
+  }
+  const doctorReport = await doctor(repoRoot, { home: options.home });
+  const context = await assembleContext(repoRoot, task, { home: options.home, fallbackSkills: true });
+  return { task, status, doctor: doctorReport, context, notes };
+}
+
+// src/commands/json.ts
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+
+// src/commands/session-output.ts
+function printDoctor(report) {
+  if (!report) {
+    return;
+  }
+  const actionable = report.findings.filter((finding3) => finding3.severity !== "info");
+  console.log(actionable.length === 0 ? "doctor: clean" : `doctor: ${report.summary.errors} error(s), ${report.summary.warnings} warning(s)`);
+  for (const finding3 of report.findings.slice(0, 8)) {
+    const label = finding3.severity === "info" ? "hint" : finding3.severity;
+    const suffix = finding3.path ? ` (${finding3.path})` : "";
+    console.log(`- ${label} ${finding3.code}: ${finding3.message}${suffix}`);
+  }
+  if (report.findings.length > 8) {
+    console.log(`- ... ${report.findings.length - 8} more finding(s)`);
+  }
+}
+function printStatus(status) {
+  if (!status) {
+    return;
+  }
+  if (!status.exists) {
+    console.log("harness: missing");
+    return;
+  }
+  console.log(`harness: ${status.manifest.name} (${status.manifest.profile})`);
+  console.log(`adapters: ${status.manifest.adapters.length > 0 ? status.manifest.adapters.join(", ") : "none (local-only)"}`);
+  console.log(
+    `objects: ${status.counts.skills} skills, ${status.counts.rules} rules, ${status.counts.tools} tools, ${status.counts.memory} memory`
+  );
+}
+function printContext(context) {
+  if (!context) {
+    return;
+  }
+  console.log(`task: ${context.task}`);
+  if (context.skills.length > 0) {
+    const skillLabel = context.skills.some((skill) => skill.score > 0) ? "relevant skills:" : "starter skills:";
+    console.log(skillLabel);
+    for (const skill of context.skills.slice(0, 8)) {
+      console.log(`- ${skill.name} - ${skill.when}`);
+    }
+  } else {
+    console.log("relevant skills: none matched; run `threadroot skills list` to inspect all skills.");
+  }
+  if (context.tools.length > 0) {
+    console.log("available tools:");
+    for (const tool of context.tools.slice(0, 8)) {
+      console.log(`- ${tool.name} (${tool.risk}) - ${tool.description}`);
+    }
+  }
+  if (context.memory.length > 0) {
+    console.log(`memory: ${context.memory.map((entry) => entry.type).join(", ")}`);
+  }
+}
+function printCommandMap() {
   console.log("agent command map:");
   console.log('- `threadroot start "<task>"` - begin a focused agent session');
   console.log('- `threadroot context "<task>"` - get relevant skills, tools, rules, and memory');
@@ -3781,6 +4210,9 @@ function printBootstrapReport(report) {
       console.log(`- ${entry.label}: ${entry.status} ${entry.path}${suffix}`);
     }
   }
+  if (report.packs && report.packs.length > 0) {
+    console.log(`packs: ${report.packs.map((pack) => pack.name).join(", ")}`);
+  }
   printStatus(report.status);
   printMcpCheck(report.mcpCheck);
   printDoctor(report.doctor);
@@ -3813,13 +4245,18 @@ async function runBootstrap(repoRoot, options) {
     task: options.task,
     mcp: options.mcp,
     expose: options.expose,
+    packs: options.packs,
     noGlobal: options.global === false,
     noInit: options.init === false,
     import: options.import,
     profile: options.profile ? profileIdSchema.parse(options.profile) : void 0,
     mcpEntry: options.mcp ? mcpEntryForCurrentProcess() : void 0
   });
-  printBootstrapReport(report);
+  if (options.json) {
+    printJson(report);
+  } else {
+    printBootstrapReport(report);
+  }
   if (report.mode === "write" && report.doctor && !report.doctor.ok) {
     process.exitCode = 1;
   }
@@ -3846,17 +4283,25 @@ async function runCompileCommand(repoRoot, options) {
 }
 
 // src/commands/context.ts
-async function runContext(repoRoot, task) {
+async function runContext(repoRoot, task, options = {}) {
   let context;
   try {
     context = await assembleContext(repoRoot, task);
   } catch (error) {
     if (error instanceof HarnessError) {
-      console.log("No harness found. Run `tr init` first.");
+      if (options.json) {
+        printJson({ ok: false, error: "harness_missing", message: "No harness found. Run `tr init` first." });
+      } else {
+        console.log("No harness found. Run `tr init` first.");
+      }
       return;
     }
     throw error;
   }
+  if (options.json) {
+    printJson(context);
+    return;
+  }
   console.log(`task: ${context.task}`);
   if (context.skills.length > 0) {
     console.log("\nskills:");
@@ -3889,7 +4334,7 @@ async function runContext(repoRoot, task) {
 
 // src/commands/diff.ts
 import fs3 from "fs/promises";
-import path24 from "path";
+import path25 from "path";
 async function readIfExists3(filePath) {
   try {
     return await fs3.readFile(filePath, "utf8");
@@ -3948,7 +4393,7 @@ async function runDiff(repoRoot) {
   const files = await compile(repoRoot, harness);
   let changed = 0;
   for (const file of files) {
-    const existing = await readIfExists3(path24.join(repoRoot, file.path));
+    const existing = await readIfExists3(path25.join(repoRoot, file.path));
     if (existing === void 0) {
       changed += 1;
       console.log(`+ ${file.path} (new)`);
@@ -3969,8 +4414,15 @@ async function runDiff(repoRoot) {
 }
 
 // src/commands/doctor.ts
-async function runDoctor(repoRoot) {
+async function runDoctor(repoRoot, options = {}) {
   const report = await doctor(repoRoot);
+  if (options.json) {
+    printJson(report);
+    if (!report.ok) {
+      process.exitCode = 1;
+    }
+    return;
+  }
   const actionable = report.findings.filter((finding3) => finding3.severity !== "info");
   const hints = report.findings.filter((finding3) => finding3.severity === "info");
   if (actionable.length === 0) {
@@ -4063,13 +4515,13 @@ async function runInit(repoRoot, options) {
 }
 
 // src/commands/install.ts
-import path27 from "path";
+import path28 from "path";
 
 // src/core/install/fetch.ts
 import { execFile } from "child_process";
 import { mkdtemp as mkdtemp2, rm as rm4 } from "fs/promises";
 import os2 from "os";
-import path25 from "path";
+import path26 from "path";
 import { promisify } from "util";
 var run = promisify(execFile);
 function cloneUrl(ref) {
@@ -4090,7 +4542,7 @@ async function git(cwd, args) {
 }
 async function fetchGitSource(ref) {
   const url = cloneUrl(ref);
-  const dir = await mkdtemp2(path25.join(os2.tmpdir(), "threadroot-fetch-"));
+  const dir = await mkdtemp2(path26.join(os2.tmpdir(), "threadroot-fetch-"));
   const cleanup = () => rm4(dir, { recursive: true, force: true });
   try {
     if (ref.ref) {
@@ -4112,9 +4564,9 @@ async function fetchGitSource(ref) {
 }
 
 // src/core/install/install.ts
-import { cp as cp2, mkdir as mkdir10, readFile as readFile11, readdir as readdir5, stat as stat10, writeFile as writeFile10 } from "fs/promises";
-import { createHash as createHash2 } from "crypto";
-import path26 from "path";
+import { cp as cp3, mkdir as mkdir11, readFile as readFile12, readdir as readdir6, stat as stat11, writeFile as writeFile10 } from "fs/promises";
+import { createHash as createHash3 } from "crypto";
+import path27 from "path";
 var NAME_RE5 = /^[a-z0-9][a-z0-9-]*$/;
 var KIND_DIR = {
   skill: "skills",
@@ -4126,8 +4578,8 @@ function objectExt(kind) {
   return kind === "tool" || kind === "connection" ? ".yaml" : ".md";
 }
 function safeRepoPath(objectPath) {
-  const normalized = path26.normalize(objectPath);
-  if (path26.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path26.sep}`)) {
+  const normalized = path27.normalize(objectPath);
+  if (path27.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path27.sep}`)) {
     throw new Error(`Unsafe object path: ${objectPath}`);
   }
   return normalized;
@@ -4141,7 +4593,7 @@ function inferKind(objectPath, override) {
   if (segments.includes("tools")) return "tool";
   if (segments.includes("connections")) return "connection";
   if (segments.includes("rules")) return "rule";
-  const ext = path26.extname(objectPath).toLowerCase();
+  const ext = path27.extname(objectPath).toLowerCase();
   if (ext === ".yaml" || ext === ".yml") return "tool";
   if (ext === ".md") return "skill";
   throw new Error(
@@ -4149,20 +4601,20 @@ function inferKind(objectPath, override) {
   );
 }
 function deriveName(objectPath) {
-  const base = path26.basename(objectPath, path26.extname(objectPath));
+  const base = path27.basename(objectPath, path27.extname(objectPath));
   if (!NAME_RE5.test(base)) {
     throw new Error(`Invalid object name \`${base}\` (use lowercase letters, digits, and dashes).`);
   }
   return base;
 }
-async function hashDirectory(root) {
-  const hash = createHash2("sha256");
+async function hashDirectory2(root) {
+  const hash = createHash3("sha256");
   hash.update("threadroot-directory-v1\n");
   async function walk(dir) {
-    const entries = (await readdir5(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
+    const entries = (await readdir6(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const full = path26.join(dir, entry.name);
-      const rel = path26.relative(root, full).split(path26.sep).join("/");
+      const full = path27.join(dir, entry.name);
+      const rel = path27.relative(root, full).split(path27.sep).join("/");
       if (entry.isSymbolicLink()) {
         throw new Error(`Refusing to install skill directory with symlink: ${rel}`);
       }
@@ -4173,7 +4625,7 @@ async function hashDirectory(root) {
       if (entry.isFile()) {
         hash.update(`file:${rel}
 `);
-        hash.update(await readFile11(full));
+        hash.update(await readFile12(full));
         hash.update("\n");
       }
     }
@@ -4182,8 +4634,8 @@ async function hashDirectory(root) {
   return hash.digest("hex");
 }
 async function validateSkillDirectory2(sourcePath, expectedName) {
-  const skillPath = path26.join(sourcePath, "SKILL.md");
-  const parsed = parseFrontmatter(await readFile11(skillPath, "utf8"));
+  const skillPath = path27.join(sourcePath, "SKILL.md");
+  const parsed = parseFrontmatter(await readFile12(skillPath, "utf8"));
   const result = skillFrontmatterSchema.safeParse(parsed.data);
   if (!result.success) {
     const detail = result.error.issues.map((issue) => issue.message).join("; ");
@@ -4192,7 +4644,7 @@ async function validateSkillDirectory2(sourcePath, expectedName) {
   if (result.data.name !== expectedName) {
     throw new Error(`Skill directory name \`${expectedName}\` must match SKILL.md name \`${result.data.name}\`.`);
   }
-  return await hashDirectory(sourcePath);
+  return await hashDirectory2(sourcePath);
 }
 async function installObject(repoRoot, rawSource, options = {}) {
   const ref = parseSourceRef(rawSource);
@@ -4212,7 +4664,7 @@ async function installObject(repoRoot, rawSource, options = {}) {
     objectPath = safeRepoPath(within);
     refLabel = ref.ref;
     const fetched = await fetchGitSource(ref);
-    sourcePath = path26.join(fetched.dir, objectPath);
+    sourcePath = path27.join(fetched.dir, objectPath);
     resolved = fetched.sha;
     cleanup = fetched.cleanup;
   } else {
@@ -4227,19 +4679,19 @@ async function installObject(repoRoot, rawSource, options = {}) {
     const destDir = scope === "user" ? userObjectDir(dirKey, options.home) : projectObjectDir(repoRoot, dirKey);
     let destPath;
     let integrity;
-    const info = await stat10(sourcePath);
+    const info = await stat11(sourcePath);
     if (info.isDirectory()) {
       if (kind !== "skill") {
         throw new Error("Only skill objects may be installed from a directory.");
       }
       integrity = `sha256:${await validateSkillDirectory2(sourcePath, name)}`;
-      destPath = path26.join(destDir, name);
-      await mkdir10(destDir, { recursive: true });
-      await cp2(sourcePath, destPath, { recursive: true, force: true });
+      destPath = path27.join(destDir, name);
+      await mkdir11(destDir, { recursive: true });
+      await cp3(sourcePath, destPath, { recursive: true, force: true });
     } else {
-      const content = await readFile11(sourcePath, "utf8");
-      destPath = path26.join(destDir, `${name}${objectExt(kind)}`);
-      await mkdir10(destDir, { recursive: true });
+      const content = await readFile12(sourcePath, "utf8");
+      destPath = path27.join(destDir, `${name}${objectExt(kind)}`);
+      await mkdir11(destDir, { recursive: true });
       await writeFile10(destPath, content, "utf8");
       integrity = `sha256:${hashContent(content)}`;
     }
@@ -4292,7 +4744,7 @@ async function runInstall(repoRoot, source, options) {
     if (installed.kind === "skill" && installed.entry.sourceKind !== "local") {
       console.log("  note: inspect external skills before trusting bundled scripts, assets, or allowed tools.");
       if (scope === "project") {
-        console.log(`  inspect: threadroot skills inspect ${path27.relative(repoRoot, installed.path)}`);
+        console.log(`  inspect: threadroot skills inspect ${path28.relative(repoRoot, installed.path)}`);
       }
     }
   } catch (error) {
@@ -4304,7 +4756,7 @@ async function runInstall(repoRoot, source, options) {
 // src/mcp/server.ts
 import readline from "readline";
 import { stdin as input, stdout as output } from "process";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 function defineTool(spec) {
   return spec;
 }
@@ -4316,7 +4768,7 @@ var toolRegistry = [
       { task: { type: "string", description: "The coding task to assemble context for." } },
       ["task"]
     ),
-    args: z4.object({ task: z4.string().min(1) }),
+    args: z5.object({ task: z5.string().min(1) }),
     run: async (repoRoot, args) => {
       const harness = await loadHarnessOrNull(repoRoot);
       if (!harness) {
@@ -4329,7 +4781,7 @@ var toolRegistry = [
     name: "skills_list",
     description: "List the skills defined in this repo's harness (name, when, tags).",
     inputSchema: objectSchema({}),
-    args: z4.object({}),
+    args: z5.object({}),
     run: async (repoRoot) => {
       const harness = await loadHarnessOrNull(repoRoot);
       if (!harness) {
@@ -4349,7 +4801,7 @@ var toolRegistry = [
     name: "skills_get",
     description: "Return a harness skill's full body and metadata by name.",
     inputSchema: objectSchema({ name: { type: "string", description: "Skill name." } }, ["name"]),
-    args: z4.object({ name: z4.string().min(1) }),
+    args: z5.object({ name: z5.string().min(1) }),
     run: async (repoRoot, args) => {
       const harness = await loadHarnessOrNull(repoRoot);
       const skill = harness?.skills.find((entry) => entry.name === args.name);
@@ -4361,9 +4813,9 @@ var toolRegistry = [
   }),
   defineTool({
     name: "tools_list",
-    description: "List the executable tools defined in this repo's harness (name, inputs, confirm).",
+    description: "List the executable tools defined in this repo's harness (name, inputs, risk, connection, confirm).",
     inputSchema: objectSchema({}),
-    args: z4.object({}),
+    args: z5.object({}),
     run: async (repoRoot) => {
       const harness = await loadHarnessOrNull(repoRoot);
       if (!harness) {
@@ -4374,7 +4826,10 @@ var toolRegistry = [
           name: tool.name,
           description: tool.manifest.description,
           scope: tool.manifest.scope,
+          risk: tool.manifest.risk,
           confirm: tool.manifest.confirm,
+          connection: tool.manifest.connection,
+          healthcheck: Boolean(tool.manifest.healthcheck),
           kind: tool.manifest.run ? "shell" : "script",
           input: tool.manifest.input
         }))
@@ -4385,7 +4840,7 @@ var toolRegistry = [
     name: "tools_check",
     description: "Run configured harness tool healthchecks without running primary tool actions.",
     inputSchema: objectSchema({}),
-    args: z4.object({}),
+    args: z5.object({}),
     run: async (repoRoot) => {
       const harness = await loadHarnessOrNull(repoRoot);
       if (!harness) {
@@ -4396,28 +4851,30 @@ var toolRegistry = [
   }),
   defineTool({
     name: "tools_run",
-    description: "Execute a harness tool locally. Tools marked confirm:true require `confirm: true` after user approval.",
+    description: "Execute a safe harness tool locally. MCP cannot self-confirm risky tools; use `threadroot run <tool> --yes` after human review.",
     inputSchema: objectSchema(
       {
         name: { type: "string", description: "Tool name." },
-        input: { type: "object", description: "Tool inputs as key/value pairs.", additionalProperties: true },
-        confirm: { type: "boolean", description: "Confirm running a tool that requires confirmation." }
+        input: { type: "object", description: "Tool inputs as key/value pairs.", additionalProperties: true }
       },
       ["name"]
     ),
-    args: z4.object({
-      name: z4.string().min(1),
-      input: z4.record(z4.unknown()).optional(),
-      confirm: z4.boolean().optional()
+    args: z5.object({
+      name: z5.string().min(1),
+      input: z5.record(z5.unknown()).optional()
     }),
     run: async (repoRoot, args) => {
       const outcome = await runTool(repoRoot, {
         name: args.name,
         input: args.input,
-        confirmed: args.confirm
+        confirmed: false
       });
       if (outcome.status === "blocked") {
-        return { ok: false, blocked: outcome.reason, message: outcome.message };
+        return {
+          ok: false,
+          blocked: outcome.reason,
+          message: outcome.reason === "needs-confirmation" ? `${outcome.message} Ask the user to run \`threadroot run ${args.name} --yes\` after review.` : outcome.message
+        };
       }
       const { result } = outcome;
       return {
@@ -4440,6 +4897,9 @@ var toolRegistry = [
         description: { type: "string", description: "What the tool does." },
         run: { type: "string", description: "Shell command (use {{param}} for inputs)." },
         script: { type: "string", description: "Harness-relative script path (alternative to run)." },
+        risk: { type: "string", enum: ["low", "medium", "high"], description: "Risk level." },
+        connection: { type: "string", description: "Optional connection dependency." },
+        healthcheck: { type: "string", description: "Command that verifies this tool is available." },
         confirm: { type: "boolean", description: "Ask before running. Defaults to true for agents." },
         scope: { type: "string", enum: ["user", "project"], description: "Tool scope." },
         input: {
@@ -4450,14 +4910,17 @@ var toolRegistry = [
       },
       ["name", "description"]
     ),
-    args: z4.object({
-      name: z4.string().min(1),
-      description: z4.string().min(1),
-      run: z4.string().optional(),
-      script: z4.string().optional(),
-      confirm: z4.boolean().optional(),
-      scope: z4.enum(["user", "project"]).optional(),
-      input: z4.record(z4.unknown()).optional()
+    args: z5.object({
+      name: z5.string().min(1),
+      description: z5.string().min(1),
+      run: z5.string().optional(),
+      script: z5.string().optional(),
+      risk: z5.enum(["low", "medium", "high"]).optional(),
+      connection: z5.string().optional(),
+      healthcheck: z5.string().optional(),
+      confirm: z5.boolean().optional(),
+      scope: z5.enum(["user", "project"]).optional(),
+      input: z5.record(z5.unknown()).optional()
     }),
     run: async (repoRoot, args) => {
       const created = await createTool(
@@ -4467,6 +4930,9 @@ var toolRegistry = [
           description: args.description,
           run: args.run,
           script: args.script,
+          risk: args.risk,
+          connection: args.connection,
+          healthcheck: args.healthcheck ? { run: args.healthcheck, expectExitCode: 0 } : void 0,
           confirm: args.confirm,
           scope: args.scope,
           input: args.input
@@ -4480,7 +4946,7 @@ var toolRegistry = [
     name: "tools_detect",
     description: "Propose starter tools from the repo's existing command surface (scripts, Make/just targets).",
     inputSchema: objectSchema({}),
-    args: z4.object({}),
+    args: z5.object({}),
     run: async (repoRoot) => {
       const harness = await loadHarnessOrNull(repoRoot);
       const profile = harness?.manifest.profile ?? "empty";
@@ -4491,7 +4957,7 @@ var toolRegistry = [
     name: "connections_list",
     description: "List local CLI connections defined in this repo's harness.",
     inputSchema: objectSchema({}),
-    args: z4.object({}),
+    args: z5.object({}),
     run: async (repoRoot) => {
       const harness = await loadHarnessOrNull(repoRoot);
       if (!harness) {
@@ -4514,7 +4980,7 @@ var toolRegistry = [
     name: "connections_check",
     description: "Check local CLI connections and their configured healthchecks.",
     inputSchema: objectSchema({}),
-    args: z4.object({}),
+    args: z5.object({}),
     run: (repoRoot) => checkConnections(repoRoot)
   }),
   defineTool({
@@ -4523,7 +4989,7 @@ var toolRegistry = [
     inputSchema: objectSchema({
       type: { type: "string", description: "Memory type (project, repo-map, current-focus, handoff, pitfalls)." }
     }),
-    args: z4.object({ type: z4.string().optional() }),
+    args: z5.object({ type: z5.string().optional() }),
     run: async (repoRoot, args) => {
       if (args.type) {
         return { type: args.type, body: await readMemory(repoRoot, args.type) };
@@ -4542,21 +5008,21 @@ var toolRegistry = [
       },
       ["type", "note"]
     ),
-    args: z4.object({ type: z4.string().min(1), note: z4.string().min(1) }),
+    args: z5.object({ type: z5.string().min(1), note: z5.string().min(1) }),
     run: (repoRoot, args) => appendMemory(repoRoot, args.type, args.note)
   }),
   defineTool({
     name: "status",
     description: "Return harness state: manifest, object counts, and drift between canonical and compiled outputs.",
     inputSchema: objectSchema({}),
-    args: z4.object({}),
+    args: z5.object({}),
     run: (repoRoot) => harnessStatus(repoRoot)
   }),
   defineTool({
     name: "doctor",
     description: "Check harness validity, compiled output health, MCP hints, and tool trust.",
     inputSchema: objectSchema({}),
-    args: z4.object({}),
+    args: z5.object({}),
     run: (repoRoot) => doctor(repoRoot)
   })
 ];
@@ -4598,7 +5064,8 @@ async function handleMessage(repoRoot, request) {
       const params = request.params;
       const result = await callTool(repoRoot, params?.name, params?.arguments ?? {});
       return resultResponse(request, {
-        content: [{ type: "text", text: typeof result === "string" ? result : JSON.stringify(result, null, 2) }]
+        content: [{ type: "text", text: typeof result === "string" ? result : JSON.stringify(result, null, 2) }],
+        structuredContent: result
       });
     }
     return errorResponse(request, -32601, `Unknown method: ${request.method ?? "<missing>"}`);
@@ -4737,10 +5204,11 @@ Rules:
 Steps:
 1. Check whether Threadroot is available with \`threadroot --version\`.
 2. If it is not available, try \`npm exec threadroot -- --help\` or \`pnpm dlx threadroot --help\`. If this is a local checkout, use \`${localCommand} --help\`.
-3. Run \`threadroot bootstrap --yes --agent all --task "current task"\`. If this is a local checkout, run \`${localCommand} bootstrap --yes --agent all --task "current task"\`.
-4. Run \`threadroot start "current task"\` with the user's actual task.
-5. If the user asks for provider-native project skill files, run \`threadroot expose <agent>\` or \`threadroot expose all\`.
-6. If project-local MCP config is useful, ask before running \`threadroot mcp setup --write\`, then tell the user to reload their agent surface.
+3. Run \`threadroot bootstrap --yes --agent all --mcp --task "current task"\`. If this is a local checkout, run \`${localCommand} bootstrap --yes --agent all --mcp --task "current task"\`.
+4. If the user named a stack or workflow, add curated packs with \`--packs <comma-separated-pack-list>\` when a matching built-in pack exists.
+5. Run \`threadroot start "current task"\` with the user's actual task.
+6. If the user asks for provider-native project skill files, run \`threadroot expose <agent>\` or \`threadroot expose all\`.
+7. If project-local MCP config is useful, ask before running \`threadroot mcp setup --write\`, then tell the user to reload their agent surface.
 
 Final response:
 Say exactly:
@@ -4807,11 +5275,11 @@ function agentNotes(agent) {
 }
 
 // src/core/mcp-config.ts
-import { mkdir as mkdir11, readFile as readFile12, writeFile as writeFile11 } from "fs/promises";
-import path28 from "path";
+import { mkdir as mkdir12, readFile as readFile13, writeFile as writeFile11 } from "fs/promises";
+import path29 from "path";
 var TARGETS = [
-  { agent: "copilot", file: path28.join(".vscode", "mcp.json"), key: "servers" },
-  { agent: "cursor", file: path28.join(".cursor", "mcp.json"), key: "mcpServers" },
+  { agent: "copilot", file: path29.join(".vscode", "mcp.json"), key: "servers" },
+  { agent: "cursor", file: path29.join(".cursor", "mcp.json"), key: "mcpServers" },
   { agent: "claude", file: ".mcp.json", key: "mcpServers" }
 ];
 function mcpServerEntry(command, scriptPath) {
@@ -4820,7 +5288,7 @@ function mcpServerEntry(command, scriptPath) {
 async function mergeConfig(filePath, key, entry) {
   let config = {};
   try {
-    const raw = await readFile12(filePath, "utf8");
+    const raw = await readFile13(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object") {
       config = parsed;
@@ -4833,7 +5301,7 @@ async function mergeConfig(filePath, key, entry) {
   const servers = config[key] && typeof config[key] === "object" ? config[key] : {};
   servers.threadroot = { ...entry };
   config[key] = servers;
-  await mkdir11(path28.dirname(filePath), { recursive: true });
+  await mkdir12(path29.dirname(filePath), { recursive: true });
   await writeFile11(filePath, `${JSON.stringify(config, null, 2)}
 `, "utf8");
 }
@@ -4842,7 +5310,7 @@ async function writeProjectMcpConfigs(input2) {
   const targets = agents ? TARGETS.filter((target) => agents.includes(target.agent)) : TARGETS;
   const written = [];
   for (const target of targets) {
-    const filePath = path28.join(input2.repoRoot, target.file);
+    const filePath = path29.join(input2.repoRoot, target.file);
     await mergeConfig(filePath, target.key, input2.entry);
     written.push(target.file);
   }
@@ -4865,6 +5333,10 @@ async function runMcpSetup(repoRoot, options) {
     const scriptPath = process.argv[1];
     const entry = mcpServerEntry(command, scriptPath);
     const result = await writeProjectMcpConfigs({ repoRoot, entry });
+    if (options.json) {
+      printJson(result);
+      return;
+    }
     console.log("Wrote project MCP config:");
     for (const file of result.written) {
       console.log(`- ${file}`);
@@ -4874,11 +5346,23 @@ async function runMcpSetup(repoRoot, options) {
     }
     return;
   }
-  console.log(mcpSetupGuide({ repoRoot, agent: options.agent }));
+  const guide = mcpSetupGuide({ repoRoot, agent: options.agent });
+  if (options.json) {
+    printJson({ guide });
+  } else {
+    console.log(guide);
+  }
 }
 async function runMcpCheck(repoRoot, options) {
   const timeoutMs = options.timeout ? Number.parseInt(options.timeout, 10) : void 0;
   const report = await checkCodexMcp({ repoRoot, timeoutMs });
+  if (options.json) {
+    printJson(report);
+    if (report.status === "error") {
+      process.exitCode = 1;
+    }
+    return;
+  }
   console.log(`Threadroot MCP check: ${report.status}`);
   console.log(`config: ${report.configPath}`);
   if (report.entry) {
@@ -4913,9 +5397,21 @@ async function runRemember(repoRoot, note, options = {}) {
 }
 
 // src/commands/skills.ts
-async function runSkillsList(repoRoot) {
+async function runSkillsList(repoRoot, options = {}) {
   try {
     const harness = await resolveHarness(repoRoot);
+    const skills = harness.skills.map((skill) => ({
+      name: skill.name,
+      origin: skill.origin,
+      description: skill.frontmatter.description,
+      when: skill.frontmatter.when,
+      tags: skill.frontmatter.tags,
+      sourcePath: skill.sourcePath
+    }));
+    if (options.json) {
+      printJson({ skills });
+      return;
+    }
     if (harness.skills.length === 0) {
       console.log("No skills defined. Add folder skills under `.threadroot/skills/<name>/SKILL.md`.");
       return;
@@ -4925,7 +5421,11 @@ async function runSkillsList(repoRoot) {
     }
   } catch (error) {
     if (error instanceof HarnessError) {
-      console.log("No harness found. Run `tr init` first.");
+      if (options.json) {
+        printJson({ skills: [], ok: false, error: "harness_missing", message: "No harness found. Run `tr init` first." });
+      } else {
+        console.log("No harness found. Run `tr init` first.");
+      }
       return;
     }
     throw error;
@@ -4933,6 +5433,13 @@ async function runSkillsList(repoRoot) {
 }
 async function runSkillsValidate(repoRoot, options = {}) {
   const report = options.path ? await validateSkillPath(toRepoPath(repoRoot, options.path)) : await validateSkills(repoRoot);
+  if (options.json) {
+    printJson(report);
+    if (!report.ok) {
+      process.exitCode = 1;
+    }
+    return;
+  }
   if (report.findings.length === 0) {
     console.log("Skills valid.");
     return;
@@ -4947,8 +5454,12 @@ async function runSkillsValidate(repoRoot, options = {}) {
     process.exitCode = 1;
   }
 }
-async function runSkillsInspect(repoRoot, targetPath) {
+async function runSkillsInspect(repoRoot, targetPath, options = {}) {
   const inspection = await inspectSkillPath(toRepoPath(repoRoot, targetPath));
+  if (options.json) {
+    printJson(inspection);
+    return;
+  }
   console.log(`${inspection.name}`);
   console.log(`description: ${inspection.description}`);
   console.log(`path: ${inspection.path}`);
@@ -5010,15 +5521,23 @@ async function runSetup(_repoRoot, options) {
 // src/commands/start.ts
 async function runStart(repoRoot, task, options) {
   const report = await startSession(repoRoot, { task: task ?? options.task });
-  printStartReport(report);
+  if (options.json) {
+    printJson(report);
+  } else {
+    printStartReport(report);
+  }
   if (!report.status.exists || report.doctor && !report.doctor.ok) {
     process.exitCode = 1;
   }
 }
 
 // src/commands/status.ts
-async function runStatus(repoRoot) {
+async function runStatus(repoRoot, options = {}) {
   const status = await harnessStatus(repoRoot);
+  if (options.json) {
+    printJson(status);
+    return;
+  }
   if (!status.exists) {
     console.log("No harness found. Run `tr init` first.");
     return;
@@ -5039,261 +5558,16 @@ async function runStatus(repoRoot) {
   }
 }
 
-// src/core/packs/index.ts
-import { cp as cp3, mkdir as mkdir12, readFile as readFile13, readdir as readdir6, stat as stat11 } from "fs/promises";
-import path29 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { parse as parseYaml3 } from "yaml";
-import { z as z5 } from "zod";
-var packManifestSchema = z5.object({
-  name: z5.string().min(1),
-  version: z5.literal(1),
-  description: z5.string().min(1),
-  skills: z5.array(z5.string()).default([]),
-  tools: z5.array(z5.string()).default([]),
-  rules: z5.array(z5.string()).default([]),
-  connections: z5.array(z5.string()).default([])
-});
-var DIST_DIR2 = path29.dirname(fileURLToPath2(import.meta.url));
-var PACKAGE_ROOT_FROM_BUNDLE2 = path29.resolve(DIST_DIR2, "..");
-var PACKAGE_ROOT_FROM_DIST2 = path29.resolve(DIST_DIR2, "../../..");
-var PACKAGE_ROOT_FROM_SRC2 = path29.resolve(DIST_DIR2, "../../../..");
-var PACK_CANDIDATES = [
-  path29.join(PACKAGE_ROOT_FROM_BUNDLE2, "packs"),
-  path29.join(PACKAGE_ROOT_FROM_DIST2, "packs"),
-  path29.join(PACKAGE_ROOT_FROM_SRC2, "packs")
-];
-async function exists5(target) {
-  try {
-    await stat11(target);
-    return true;
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return false;
-    }
-    throw error;
-  }
-}
-async function firstExisting(candidates) {
-  for (const candidate of candidates) {
-    if (await isPackRoot(candidate)) {
-      return candidate;
-    }
-  }
-  return void 0;
-}
-async function bundledPacksDir() {
-  return firstExisting(PACK_CANDIDATES);
-}
-async function isPackRoot(candidate) {
-  let entries;
-  try {
-    entries = await readdir6(candidate, { withFileTypes: true });
-  } catch {
-    return false;
-  }
-  for (const entry of entries) {
-    if (entry.isDirectory() && await exists5(path29.join(candidate, entry.name, "pack.yaml"))) {
-      return true;
-    }
-  }
-  return false;
-}
-function safeRelative(ref) {
-  const normalized = path29.normalize(ref);
-  if (path29.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path29.sep}`)) {
-    throw new Error(`Unsafe pack reference: ${ref}`);
-  }
-  return normalized;
-}
-async function readPackManifest(packDir) {
-  const file = path29.join(packDir, "pack.yaml");
-  const parsed = packManifestSchema.safeParse(parseYaml3(await readFile13(file, "utf8")));
-  if (!parsed.success) {
-    const detail = parsed.error.issues.map((issue) => issue.message).join("; ");
-    throw new Error(`Invalid pack manifest ${file}: ${detail}`);
-  }
-  return parsed.data;
-}
-async function packDirFor(repoRoot, nameOrPath) {
-  if (path29.isAbsolute(nameOrPath)) {
-    return nameOrPath;
-  }
-  if (nameOrPath.startsWith(".") || nameOrPath.includes("/") || nameOrPath.includes("\\")) {
-    return toRepoPath(repoRoot, nameOrPath);
-  }
-  const bundled = await bundledPacksDir();
-  if (bundled) {
-    return path29.join(bundled, nameOrPath);
-  }
-  return toRepoPath(repoRoot, path29.join("packs", nameOrPath));
-}
-async function directFiles(dir, ext) {
-  try {
-    const entries = await readdir6(dir, { withFileTypes: true });
-    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(ext)).map((entry) => path29.join(dir, entry.name)).sort();
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return [];
-    }
-    throw error;
-  }
-}
-async function skillEntries(dir) {
-  try {
-    const entries = await readdir6(dir, { withFileTypes: true });
-    const result = [];
-    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-      const full = path29.join(dir, entry.name);
-      if (entry.isFile() && entry.name.endsWith(".md")) {
-        result.push(full);
-      }
-      if (entry.isDirectory() && await exists5(path29.join(full, "SKILL.md"))) {
-        result.push(full);
-      }
-    }
-    return result;
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return [];
-    }
-    throw error;
-  }
-}
-async function collectObjects(packDir, manifest) {
-  async function resolveRef(ref) {
-    const safe = safeRelative(ref);
-    const local = path29.resolve(packDir, safe);
-    if (await exists5(local)) {
-      return local;
-    }
-    return path29.resolve(packDir, "..", "..", safe);
-  }
-  return {
-    skills: [
-      ...await Promise.all(manifest.skills.map(resolveRef)),
-      ...await skillEntries(path29.join(packDir, "skills"))
-    ],
-    tools: [
-      ...await Promise.all(manifest.tools.map(resolveRef)),
-      ...await directFiles(path29.join(packDir, "tools"), ".yaml")
-    ],
-    rules: [
-      ...await Promise.all(manifest.rules.map(resolveRef)),
-      ...await directFiles(path29.join(packDir, "rules"), ".md")
-    ],
-    connections: [
-      ...await Promise.all(manifest.connections.map(resolveRef)),
-      ...await directFiles(path29.join(packDir, "connections"), ".yaml")
-    ]
-  };
-}
-function baseName(source) {
-  const parsed = path29.basename(source) === "SKILL.md" ? path29.dirname(source) : source;
-  return path29.basename(parsed, path29.extname(parsed));
-}
-async function listPacks(repoRoot) {
-  const dirs = [toRepoPath(repoRoot, "packs"), await bundledPacksDir()].filter((dir) => Boolean(dir));
-  const seen = /* @__PURE__ */ new Set();
-  const packs = [];
-  for (const root of dirs) {
-    let entries;
-    try {
-      entries = await readdir6(root, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      if (!entry.isDirectory() || seen.has(entry.name)) {
-        continue;
-      }
-      const packDir = path29.join(root, entry.name);
-      if (!await exists5(path29.join(packDir, "pack.yaml"))) {
-        continue;
-      }
-      seen.add(entry.name);
-      packs.push(await inspectPack(repoRoot, packDir));
-    }
-  }
-  return packs.sort((a, b) => a.name.localeCompare(b.name));
-}
-async function inspectPack(repoRoot, nameOrPath) {
-  const packDir = await packDirFor(repoRoot, nameOrPath);
-  const manifest = await readPackManifest(packDir);
-  const objects = await collectObjects(packDir, manifest);
-  return {
-    name: manifest.name,
-    description: manifest.description,
-    path: packDir,
-    skills: objects.skills.map(baseName),
-    tools: objects.tools.map(baseName),
-    rules: objects.rules.map(baseName),
-    connections: objects.connections.map(baseName)
-  };
-}
-async function validateProse(file, kind) {
-  const target = path29.basename(file) === "SKILL.md" ? file : file;
-  const content = await readFile13(target, "utf8");
-  const parsed = parseFrontmatter(content);
-  const schema = kind === "skill" ? skillFrontmatterSchema : ruleFrontmatterSchema;
-  schema.parse(parsed.data);
-}
-async function validateYaml(file, kind) {
-  const content = await readFile13(file, "utf8");
-  const schema = kind === "tool" ? toolManifestSchema : connectionManifestSchema;
-  schema.parse(parseYaml3(content));
-}
-async function validatePack(repoRoot, nameOrPath) {
-  const findings = [];
-  try {
-    const packDir = await packDirFor(repoRoot, nameOrPath);
-    const manifest = await readPackManifest(packDir);
-    const objects = await collectObjects(packDir, manifest);
-    for (const skill of objects.skills) {
-      await validateProse(path29.basename(skill) === "SKILL.md" ? skill : path29.join(skill, "SKILL.md"), "skill");
-    }
-    for (const rule of objects.rules) await validateProse(rule, "rule");
-    for (const tool of objects.tools) await validateYaml(tool, "tool");
-    for (const connection of objects.connections) await validateYaml(connection, "connection");
-    if (Object.values(objects).every((items) => items.length === 0)) {
-      findings.push({ severity: "warning", message: "Pack does not include any objects." });
-    }
-  } catch (error) {
-    findings.push({ severity: "error", message: error instanceof Error ? error.message : String(error) });
-  }
-  return { ok: !findings.some((finding3) => finding3.severity === "error"), findings };
-}
-async function copyObject(source, destDir) {
-  const info = await stat11(source);
-  const name = baseName(source);
-  const dest = info.isDirectory() ? path29.join(destDir, name) : path29.join(destDir, path29.basename(source));
-  await mkdir12(destDir, { recursive: true });
-  await cp3(source, dest, { recursive: true, force: true });
-  return dest;
-}
-async function installPack(repoRoot, nameOrPath) {
-  const validation = await validatePack(repoRoot, nameOrPath);
-  if (!validation.ok) {
-    throw new Error(validation.findings.map((finding3) => finding3.message).join("; "));
-  }
-  const packDir = await packDirFor(repoRoot, nameOrPath);
-  const manifest = await readPackManifest(packDir);
-  const objects = await collectObjects(packDir, manifest);
-  await Promise.all([
-    ...objects.skills.map((source) => copyObject(source, projectObjectDir(repoRoot, "skills"))),
-    ...objects.tools.map((source) => copyObject(source, projectObjectDir(repoRoot, "tools"))),
-    ...objects.rules.map((source) => copyObject(source, projectObjectDir(repoRoot, "rules"))),
-    ...objects.connections.map((source) => copyObject(source, projectObjectDir(repoRoot, "connections")))
-  ]);
-  return inspectPack(repoRoot, packDir);
-}
-
 // src/commands/packs.ts
 function printList(label, values) {
   console.log(`${label}: ${values.length > 0 ? values.join(", ") : "none"}`);
 }
-async function runPacksList(repoRoot) {
+async function runPacksList(repoRoot, options = {}) {
   const packs = await listPacks(repoRoot);
+  if (options.json) {
+    printJson({ packs });
+    return;
+  }
   if (packs.length === 0) {
     console.log("No packs found.");
     return;
@@ -5302,8 +5576,12 @@ async function runPacksList(repoRoot) {
     console.log(`${pack.name} - ${pack.description}`);
   }
 }
-async function runPacksInspect(repoRoot, nameOrPath) {
+async function runPacksInspect(repoRoot, nameOrPath, options = {}) {
   const pack = await inspectPack(repoRoot, nameOrPath);
+  if (options.json) {
+    printJson(pack);
+    return;
+  }
   console.log(pack.name);
   console.log(`description: ${pack.description}`);
   console.log(`path: ${pack.path}`);
@@ -5312,8 +5590,15 @@ async function runPacksInspect(repoRoot, nameOrPath) {
   printList("rules", pack.rules);
   printList("connections", pack.connections);
 }
-async function runPacksValidate(repoRoot, nameOrPath) {
+async function runPacksValidate(repoRoot, nameOrPath, options = {}) {
   const report = await validatePack(repoRoot, nameOrPath);
+  if (options.json) {
+    printJson(report);
+    if (!report.ok) {
+      process.exitCode = 1;
+    }
+    return;
+  }
   if (report.findings.length === 0) {
     console.log("Pack valid.");
     return;
@@ -5325,8 +5610,12 @@ async function runPacksValidate(repoRoot, nameOrPath) {
     process.exitCode = 1;
   }
 }
-async function runPacksInstall(repoRoot, nameOrPath) {
+async function runPacksInstall(repoRoot, nameOrPath, options = {}) {
   const pack = await installPack(repoRoot, nameOrPath);
+  if (options.json) {
+    printJson(pack);
+    return;
+  }
   console.log(`Installed pack \`${pack.name}\`.`);
   printList("skills", pack.skills);
   printList("tools", pack.tools);
@@ -5346,17 +5635,37 @@ function parseInputs(pairs = []) {
   }
   return input2;
 }
-async function runToolsList(repoRoot) {
+async function runToolsList(repoRoot, options = {}) {
   let harness;
   try {
     harness = await resolveHarness(repoRoot);
   } catch (error) {
     if (error instanceof HarnessError) {
-      console.log("No harness found. Run `tr init` first.");
+      if (options.json) {
+        printJson({ tools: [], ok: false, error: "harness_missing", message: "No harness found. Run `tr init` first." });
+      } else {
+        console.log("No harness found. Run `tr init` first.");
+      }
       return;
     }
     throw error;
   }
+  const tools2 = harness.tools.map((tool) => ({
+    name: tool.name,
+    description: tool.manifest.description,
+    origin: tool.origin,
+    scope: tool.manifest.scope,
+    risk: tool.manifest.risk,
+    confirm: tool.manifest.confirm,
+    connection: tool.manifest.connection,
+    healthcheck: Boolean(tool.manifest.healthcheck),
+    kind: tool.manifest.run ? "shell" : "script",
+    input: tool.manifest.input
+  }));
+  if (options.json) {
+    printJson({ tools: tools2 });
+    return;
+  }
   if (harness.tools.length === 0) {
     console.log("No tools defined. Add one with `tr tools add` or `tr tools detect`.");
     return;
@@ -5380,6 +5689,11 @@ async function runToolRun(repoRoot, name, options) {
     timeoutMs: options.timeout ? Number(options.timeout) : void 0
   });
   if (outcome.status === "blocked") {
+    if (options.json) {
+      printJson(outcome);
+      process.exitCode = 1;
+      return;
+    }
     if (outcome.reason === "needs-confirmation") {
       console.log(`${outcome.message} Re-run with --yes to confirm.`);
     } else {
@@ -5389,6 +5703,13 @@ async function runToolRun(repoRoot, name, options) {
     return;
   }
   const { result } = outcome;
+  if (options.json) {
+    printJson(outcome);
+    if (!result.ok) {
+      process.exitCode = result.exitCode ?? 1;
+    }
+    return;
+  }
   if (result.stdout) {
     process.stdout.write(result.stdout.endsWith("\n") ? result.stdout : `${result.stdout}
 `);
@@ -5426,7 +5747,11 @@ async function runToolsAdd(repoRoot, name, options) {
     },
     { actor: "human", force: options.force }
   );
-  console.log(`Created ${created.scope} tool \`${name}\` at ${created.path}.`);
+  if (options.json) {
+    printJson(created);
+  } else {
+    console.log(`Created ${created.scope} tool \`${name}\` at ${created.path}.`);
+  }
 }
 function deriveNameFromCommand(command) {
   const first = command.trim().split(/\s+/)[0] ?? "tool";
@@ -5446,29 +5771,42 @@ async function runToolsCreate(repoRoot, options) {
     confirm: options.confirm ?? options.risk === "high"
   });
 }
-async function runToolsCheck(repoRoot) {
+async function runToolsCheck(repoRoot, options = {}) {
   const harness = await resolveHarness(repoRoot);
   if (harness.tools.length === 0) {
-    console.log("No tools defined.");
+    if (options.json) {
+      printJson({ checks: [] });
+    } else {
+      console.log("No tools defined.");
+    }
     return;
   }
   let failures = 0;
+  const checks = [];
   for (const tool of harness.tools) {
     const check = await checkToolHealth(repoRoot, tool);
-    if (check.status === "ok") {
-      console.log(`${tool.name}: ok`);
-    } else if (check.status === "skipped") {
-      console.log(`${tool.name}: skipped - ${check.message}`);
-    } else {
+    checks.push(check);
+    if (!options.json) {
+      if (check.status === "ok") {
+        console.log(`${tool.name}: ok`);
+      } else if (check.status === "skipped") {
+        console.log(`${tool.name}: skipped - ${check.message}`);
+      } else {
+        console.log(`${tool.name}: error - ${check.message}`);
+      }
+    }
+    if (check.status === "error") {
       failures += 1;
-      console.log(`${tool.name}: error - ${check.message}`);
     }
   }
+  if (options.json) {
+    printJson({ checks });
+  }
   if (failures > 0) {
     process.exitCode = 1;
   }
 }
-async function runToolsDetect(repoRoot) {
+async function runToolsDetect(repoRoot, options = {}) {
   let profile;
   try {
     profile = (await resolveHarness(repoRoot)).manifest.profile;
@@ -5478,6 +5816,10 @@ async function runToolsDetect(repoRoot) {
     }
   }
   const candidates = await detectToolCandidates(repoRoot, profile ?? "empty");
+  if (options.json) {
+    printJson({ candidates });
+    return;
+  }
   if (candidates.length === 0) {
     console.log("No starter tools detected.");
     return;
@@ -5491,17 +5833,40 @@ async function runToolsDetect(repoRoot) {
 }
 
 // src/commands/connections.ts
-async function runConnectionsList(repoRoot) {
+function parseList(value) {
+  return (value ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+async function runConnectionsList(repoRoot, options = {}) {
   let harness;
   try {
     harness = await resolveHarness(repoRoot);
   } catch (error) {
     if (error instanceof HarnessError) {
-      console.log("No harness found. Run `tr init` first.");
+      if (options.json) {
+        printJson({ connections: [], ok: false, error: "harness_missing", message: "No harness found. Run `tr init` first." });
+      } else {
+        console.log("No harness found. Run `tr init` first.");
+      }
       return;
     }
     throw error;
   }
+  const connections = harness.connections.map((connection) => ({
+    name: connection.name,
+    origin: connection.origin,
+    provider: connection.manifest.provider,
+    command: connection.manifest.command,
+    profile: connection.manifest.profile,
+    risk: connection.manifest.risk,
+    confirm: connection.manifest.confirm,
+    healthcheck: Boolean(connection.manifest.healthcheck),
+    allow: connection.manifest.allow,
+    deny: connection.manifest.deny
+  }));
+  if (options.json) {
+    printJson({ connections });
+    return;
+  }
   if (harness.connections.length === 0) {
     console.log("No connections defined. Add one with `tr connections add`.");
     return;
@@ -5528,14 +5893,27 @@ async function runConnectionsAdd(repoRoot, name, options) {
       risk: options.risk,
       confirm: options.confirm,
       healthcheck: options.healthcheck,
+      allow: parseList(options.allow),
+      deny: parseList(options.deny),
       scope: options.scope
     },
     { force: options.force }
   );
-  console.log(`Created ${created.manifest.scope} connection \`${name}\` at ${created.path}.`);
+  if (options.json) {
+    printJson(created);
+  } else {
+    console.log(`Created ${created.manifest.scope} connection \`${name}\` at ${created.path}.`);
+  }
 }
-async function runConnectionsCheck(repoRoot) {
+async function runConnectionsCheck(repoRoot, options = {}) {
   const checks = await checkConnections(repoRoot);
+  if (options.json) {
+    printJson({ checks });
+    if (checks.some((check) => check.status === "error")) {
+      process.exitCode = 1;
+    }
+    return;
+  }
   if (checks.length === 0) {
     console.log("No connections defined.");
     return;
@@ -5556,45 +5934,45 @@ async function runConnectionsCheck(repoRoot) {
 function createProgram(repoRoot = process.cwd()) {
   const program = new Command();
   program.name("threadroot").description("Git for your AI agent harness: one command to bootstrap, one .threadroot source.").version(THREADROOT_VERSION);
-  program.command("bootstrap").description("Plan or apply first-run Threadroot setup for this machine and repository.").option("-y, --yes", "Apply the setup plan. Without --yes, bootstrap prints a dry-run plan.").option("--dry-run", "Print the setup plan without writing files.").option("--agent <list>", "Provider(s): codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").option("--task <task>", "Task used for the initial context slice.").option("--mcp", "Also add Threadroot MCP to Codex global config when Codex is selected.").option("--expose <list>", "Also write project provider skill shims: codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").option("--no-global", "Skip one-time machine-level agent setup.").option("--no-init", "Skip project harness initialization.").option("--no-import", "Skip importing existing vendor files during init.").option("--profile <profile>", "Override the detected project profile during init.").action((options) => runBootstrap(repoRoot, options));
-  program.command("start").argument("[task]", "Task to prepare context for.").option("--task <task>", "Task to prepare context for.").description("Start a focused Threadroot agent session: doctor, status, context, and command map.").action((task, options) => runStart(repoRoot, task, options));
+  program.command("bootstrap").description("Plan or apply first-run Threadroot setup for this machine and repository.").option("-y, --yes", "Apply the setup plan. Without --yes, bootstrap prints a dry-run plan.").option("--dry-run", "Print the setup plan without writing files.").option("--agent <list>", "Provider(s): codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").option("--task <task>", "Task used for the initial context slice.").option("--mcp", "Also add Threadroot MCP to Codex global config when Codex is selected.").option("--expose <list>", "Also write project provider skill shims: codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").option("--packs <list>", "Comma-separated capability packs to install, such as testing,typescript-node.").option("--json", "Print machine-readable JSON.").option("--no-global", "Skip one-time machine-level agent setup.").option("--no-init", "Skip project harness initialization.").option("--no-import", "Skip importing existing vendor files during init.").option("--profile <profile>", "Override the detected project profile during init.").action((options) => runBootstrap(repoRoot, options));
+  program.command("start").argument("[task]", "Task to prepare context for.").option("--task <task>", "Task to prepare context for.").option("--json", "Print machine-readable JSON.").description("Start a focused Threadroot agent session: doctor, status, context, and command map.").action((task, options) => runStart(repoRoot, task, options));
   program.command("init").description("Scaffold a local-only Threadroot harness and import existing vendor files once.").option("--force", "Re-initialize over an existing harness.").option("--no-import", "Skip importing existing vendor files (blank-slate init).").option("--profile <profile>", "Override the detected project profile.").option("--adapters <list>", "Comma-separated adapters: agents,claude,copilot,cursor.").option("--expose <list>", "Comma-separated provider skill shims to write: codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").action((options) => runInit(repoRoot, options));
   program.command("expose").argument("[agent]", "Provider(s) to expose: codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").option("--dry-run", "Show project files that would be written.").option("--check", "Check current project exposure state.").option("--undo", "Remove Threadroot-managed project exposure files.").option("--force", "Replace an existing unmanaged threadroot skill.").description("Write thin provider project skills that point agents at `.threadroot/`.").action((agent, options) => runExpose(repoRoot, agent, options));
   program.command("setup").option("--global", "Install machine-level Threadroot agent bootstrap skills/config.").option("--agent <list>", "Provider(s): codex,claude,cursor,copilot,gemini,windsurf,antigravity,opencode,all.").option("--dry-run", "Show global files that would be written.").option("--check", "Check global Threadroot setup state.").option("--undo", "Remove Threadroot-managed global setup files/blocks.").option("--force", "Replace an existing unmanaged threadroot skill.").option("--mcp", "Also add Threadroot MCP to Codex global config when Codex is selected.").description("Set up Threadroot once per machine for supported coding agents.").action((options) => runSetup(repoRoot, options));
-  program.command("status").description("Show harness state, object counts, and compiled-output drift.").action(() => runStatus(repoRoot));
+  program.command("status").description("Show harness state, object counts, and compiled-output drift.").option("--json", "Print machine-readable JSON.").action((options) => runStatus(repoRoot, options));
   program.command("diff").description("Show the diff between the canonical harness and each compiled vendor file.").action(() => runDiff(repoRoot));
-  program.command("doctor").description("Check harness validity, compiled output health, MCP hints, and tool trust.").action(() => runDoctor(repoRoot));
+  program.command("doctor").description("Check harness validity, compiled output health, MCP hints, and tool trust.").option("--json", "Print machine-readable JSON.").action((options) => runDoctor(repoRoot, options));
   program.command("compile").option("--adapter <adapter>", "Restrict output to one adapter: agents, claude, copilot, or cursor.").description("Compile the canonical harness into vendor files.").action((options) => runCompileCommand(repoRoot, options));
-  program.command("context").argument("<task>", "Task to assemble a relevant harness slice for.").description("Assemble the task-relevant harness slice: skills, rules, tools, and memory.").action((task) => runContext(repoRoot, task));
-  program.command("run").argument("<tool>", "Harness tool name.").option("--input <pair...>", "Tool input as key=value (repeatable).").option("-y, --yes", "Confirm running a tool marked confirm:true.").option("--timeout <ms>", "Override the execution timeout in milliseconds.").description("Execute a harness tool locally.").action((tool, options) => runToolRun(repoRoot, tool, options));
+  program.command("context").argument("<task>", "Task to assemble a relevant harness slice for.").description("Assemble the task-relevant harness slice: skills, rules, tools, and memory.").option("--json", "Print machine-readable JSON.").action((task, options) => runContext(repoRoot, task, options));
+  program.command("run").argument("<tool>", "Harness tool name.").option("--input <pair...>", "Tool input as key=value (repeatable).").option("-y, --yes", "Confirm running a tool marked confirm:true.").option("--timeout <ms>", "Override the execution timeout in milliseconds.").option("--json", "Print machine-readable JSON.").description("Execute a harness tool locally.").action((tool, options) => runToolRun(repoRoot, tool, options));
   program.command("install").argument("<source>", "Object source: local path or git (github:owner/repo/path[@ref]).").option("--kind <kind>", "Object kind: skill, tool, rule, or connection (inferred when omitted).").option("--path <path>", "Path to the object within a git source repo.").option("--user", "Install into the user harness (~/.threadroot) instead of the project.").description("Install a harness object from a local path or git source.").action((source, options) => runInstall(repoRoot, source, options));
   program.command("remember").argument("<note>", "Durable note to record.").option("--type <type>", "Memory type: project, current-focus, handoff, or pitfalls.").description("Append a durable note to harness memory (defaults to handoff).").action((note, options) => runRemember(repoRoot, note, options));
   const memory = program.command("memory").description("Read and append durable harness memory.");
   memory.command("read").argument("<type>", "Memory type: project, repo-map, current-focus, handoff, or pitfalls.").description("Print a memory file.").action((type) => runMemoryRead(repoRoot, type));
   memory.command("append").argument("<type>", "Memory type: project, repo-map, current-focus, handoff, or pitfalls.").argument("<note>", "Note to append.").description("Append a durable note to memory.").action((type, note) => runMemoryAppend(repoRoot, type, note));
   const tools2 = program.command("tools").description("Manage executable harness tools.");
-  tools2.command("list").description("List harness tools.").action(() => runToolsList(repoRoot));
-  tools2.command("check").description("Run configured tool healthchecks.").action(() => runToolsCheck(repoRoot));
-  tools2.command("detect").description("Propose starter tools from the repo's existing command surface.").action(() => runToolsDetect(repoRoot));
-  tools2.command("add").argument("<name>", "Tool name (lowercase, hyphenated).").requiredOption("--description <text>", "What the tool does.").option("--run <command>", "Shell command (use {{param}} for inputs).").option("--script <path>", "Harness-relative script path (alternative to --run).").option("--risk <risk>", "Risk level: low, medium, or high.").option("--connection <name>", "Connection this tool depends on.").option("--healthcheck <command>", "Command that verifies the tool is available.").option("--confirm", "Require confirmation before running.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing tool.").description("Author a new harness tool.").action((name, options) => runToolsAdd(repoRoot, name, options));
-  tools2.command("create").option("--from-command <command>", "Create a tool around an existing command.").option("--description <text>", "What the tool does.").option("--risk <risk>", "Risk level: low, medium, or high.").option("--connection <name>", "Connection this tool depends on.").option("--healthcheck <command>", "Command that verifies the tool is available.").option("--confirm", "Require confirmation before running.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing tool.").description("Guided safe tool builder.").action((options) => runToolsCreate(repoRoot, options));
+  tools2.command("list").option("--json", "Print machine-readable JSON.").description("List harness tools.").action((options) => runToolsList(repoRoot, options));
+  tools2.command("check").option("--json", "Print machine-readable JSON.").description("Run configured tool healthchecks.").action((options) => runToolsCheck(repoRoot, options));
+  tools2.command("detect").option("--json", "Print machine-readable JSON.").description("Propose starter tools from the repo's existing command surface.").action((options) => runToolsDetect(repoRoot, options));
+  tools2.command("add").argument("<name>", "Tool name (lowercase, hyphenated).").requiredOption("--description <text>", "What the tool does.").option("--run <command>", "Shell command (use {{param}} for inputs).").option("--script <path>", "Harness-relative script path (alternative to --run).").option("--risk <risk>", "Risk level: low, medium, or high.").option("--connection <name>", "Connection this tool depends on.").option("--healthcheck <command>", "Command that verifies the tool is available.").option("--confirm", "Require confirmation before running.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing tool.").option("--json", "Print machine-readable JSON.").description("Author a new harness tool.").action((name, options) => runToolsAdd(repoRoot, name, options));
+  tools2.command("create").option("--from-command <command>", "Create a tool around an existing command.").option("--description <text>", "What the tool does.").option("--risk <risk>", "Risk level: low, medium, or high.").option("--connection <name>", "Connection this tool depends on.").option("--healthcheck <command>", "Command that verifies the tool is available.").option("--confirm", "Require confirmation before running.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing tool.").option("--json", "Print machine-readable JSON.").description("Guided safe tool builder.").action((options) => runToolsCreate(repoRoot, options));
   const connections = program.command("connections").description("Manage local CLI connections.");
-  connections.command("list").description("List harness connections.").action(() => runConnectionsList(repoRoot));
-  connections.command("check").description("Run configured connection healthchecks.").action(() => runConnectionsCheck(repoRoot));
-  connections.command("add").argument("<name>", "Connection name (lowercase, hyphenated).").requiredOption("--provider <provider>", "Provider name, such as aws, github, azure, or snowflake.").requiredOption("--command <command>", "Local CLI command, such as aws, gh, az, or snow.").option("--description <text>", "What this connection is for.").option("--profile <profile>", "Local CLI profile/account label.").option("--risk <risk>", "Risk level: low, medium, or high.").option("--confirm", "Require confirmation before connection-backed tools run.").option("--healthcheck <command>", "Command that verifies the connection works.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing connection.").description("Author a local CLI connection manifest.").action((name, options) => runConnectionsAdd(repoRoot, name, options));
+  connections.command("list").option("--json", "Print machine-readable JSON.").description("List harness connections.").action((options) => runConnectionsList(repoRoot, options));
+  connections.command("check").option("--json", "Print machine-readable JSON.").description("Run configured connection healthchecks.").action((options) => runConnectionsCheck(repoRoot, options));
+  connections.command("add").argument("<name>", "Connection name (lowercase, hyphenated).").requiredOption("--provider <provider>", "Provider name, such as aws, github, azure, or snowflake.").requiredOption("--command <command>", "Local CLI command, such as aws, gh, az, or snow.").option("--description <text>", "What this connection is for.").option("--profile <profile>", "Local CLI profile/account label.").option("--risk <risk>", "Risk level: low, medium, or high.").option("--confirm", "Require confirmation before connection-backed tools run.").option("--healthcheck <command>", "Command that verifies the connection works.").option("--allow <patterns>", "Comma-separated allowed command fragments for this connection.").option("--deny <patterns>", "Comma-separated denied command fragments for this connection.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing connection.").option("--json", "Print machine-readable JSON.").description("Author a local CLI connection manifest.").action((name, options) => runConnectionsAdd(repoRoot, name, options));
   const packs = program.command("packs").description("Inspect, validate, and install capability packs.");
-  packs.command("list").description("List built-in and repo-local packs.").action(() => runPacksList(repoRoot));
-  packs.command("inspect").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").description("Inspect a capability pack.").action((nameOrPath) => runPacksInspect(repoRoot, nameOrPath));
-  packs.command("validate").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").description("Validate a capability pack.").action((nameOrPath) => runPacksValidate(repoRoot, nameOrPath));
-  packs.command("install").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").description("Install a capability pack into the project harness.").action((nameOrPath) => runPacksInstall(repoRoot, nameOrPath));
+  packs.command("list").option("--json", "Print machine-readable JSON.").description("List built-in and repo-local packs.").action((options) => runPacksList(repoRoot, options));
+  packs.command("inspect").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").option("--json", "Print machine-readable JSON.").description("Inspect a capability pack.").action((nameOrPath, options) => runPacksInspect(repoRoot, nameOrPath, options));
+  packs.command("validate").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").option("--json", "Print machine-readable JSON.").description("Validate a capability pack.").action((nameOrPath, options) => runPacksValidate(repoRoot, nameOrPath, options));
+  packs.command("install").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").option("--json", "Print machine-readable JSON.").description("Install a capability pack into the project harness.").action((nameOrPath, options) => runPacksInstall(repoRoot, nameOrPath, options));
   const skills = program.command("skills").description("Inspect and validate harness skills.");
-  skills.command("list").description("List harness skills.").action(() => runSkillsList(repoRoot));
-  skills.command("inspect").argument("<path>", "Repo-relative skill file or skill directory.").description("Inspect a skill's metadata, references, scripts, assets, and eval files.").action((targetPath) => runSkillsInspect(repoRoot, targetPath));
-  skills.command("validate").option("--path <path>", "Validate a repo-relative skill file, skill directory, or skill collection.").description("Validate skill frontmatter, naming, trigger descriptions, and progressive-disclosure hygiene.").action((options) => runSkillsValidate(repoRoot, options));
+  skills.command("list").option("--json", "Print machine-readable JSON.").description("List harness skills.").action((options) => runSkillsList(repoRoot, options));
+  skills.command("inspect").argument("<path>", "Repo-relative skill file or skill directory.").option("--json", "Print machine-readable JSON.").description("Inspect a skill's metadata, references, scripts, assets, and eval files.").action((targetPath, options) => runSkillsInspect(repoRoot, targetPath, options));
+  skills.command("validate").option("--path <path>", "Validate a repo-relative skill file, skill directory, or skill collection.").option("--json", "Print machine-readable JSON.").description("Validate skill frontmatter, naming, trigger descriptions, and progressive-disclosure hygiene.").action((options) => runSkillsValidate(repoRoot, options));
   const mcp = program.command("mcp").description("Run or configure the local Threadroot MCP server.");
   mcp.action(() => runMcp(repoRoot));
-  mcp.command("check").option("--timeout <ms>", "Handshake timeout in milliseconds.").description("Verify Codex MCP config and the Threadroot stdio server handshake.").action((options) => runMcpCheck(repoRoot, options));
-  mcp.command("setup").option("--agent <agent>", "all, generic, codex, copilot, cursor, or claude.").option("--write", "Write project-local MCP config files for the agents.").description("Print MCP config snippets and a pasteable agent bootstrap prompt.").action((options) => runMcpSetup(repoRoot, options));
+  mcp.command("check").option("--timeout <ms>", "Handshake timeout in milliseconds.").option("--json", "Print machine-readable JSON.").description("Verify Codex MCP config and the Threadroot stdio server handshake.").action((options) => runMcpCheck(repoRoot, options));
+  mcp.command("setup").option("--agent <agent>", "all, generic, codex, copilot, cursor, or claude.").option("--write", "Write project-local MCP config files for the agents.").option("--json", "Print machine-readable JSON.").description("Print MCP config snippets and a pasteable agent bootstrap prompt.").action((options) => runMcpSetup(repoRoot, options));
   return program;
 }