toolfactory 0.2.1 → 0.3.1

package/src/prompt/review.ts

@@ -0,0 +1,148 @@
+/**
+ * The draft -> evaluate -> iterate loop's evaluator, as `review-prompt`. Pure and deterministic:
+ * it scans the draft (and, when given, the fetched reference prompt) against the
+ * codex-prompt-standard rubric and returns findings plus concrete next-iteration directives.
+ * The taste stays with the calling model; this makes the checklist the skill teaches impossible
+ * to skip.
+ */
+import { ANATOMY, type PromptSection } from "./standard.js";
+
+export interface PromptReviewInput {
+  prompt: string;
+  /** The closest reference prompt's full text (canon §1: fetch it before evaluating). */
+  reference?: string;
+}
+
+export interface CheckResult {
+  id: string;
+  status: "pass" | "warn" | "fail";
+  detail: string;
+}
+
+export interface PromptReviewReport {
+  verdict: "pass" | "polish" | "revise";
+  sections: { present: string[]; missing: string[] };
+  checks: CheckResult[];
+  directives: string[];
+  reference?: { sectionsMissingHere: string[] };
+}
+
+const HARD_WORDS = /\b(?:MUST|NEVER|ALWAYS)\b/g;
+const HEDGES =
+  /\b(?:try to|tries to|consider|maybe|perhaps|probably|if possible|ideally|when appropriate|as needed)\b/gi;
+const PRECEDENCE =
+  /\bpreceden|overrid|takes? precedence|in case of (?:a )?conflict|conflicts? with|direct instructions/i;
+const EXAMPLES = /\b(?:example|for instance|good:|bad:)\b/i;
+const DONE_WHEN = /done when|definition of done|success criteria|checkable|acceptance criteria/i;
+const INJECTION = /ignore (?:all |any |the )?(?:previous|prior|above|earlier)\s+instructions/i;
+const CODEX_SPECIFIC = /\bapply_patch\b|\bcodex-rs\b|\bopenai codex cli\b/i;
+
+const has = (text: string, section: PromptSection): boolean =>
+  section.anchors.some((anchor) => anchor.test(text));
+
+export function reviewPrompt(input: PromptReviewInput): PromptReviewReport {
+  const { prompt, reference } = input;
+  const present = ANATOMY.filter((section) => has(prompt, section));
+  const missing = ANATOMY.filter((section) => !has(prompt, section));
+
+  const checks: CheckResult[] = [];
+  const hard = prompt.match(HARD_WORDS)?.length ?? 0;
+  checks.push(
+    hard > 15
+      ? {
+          id: "must-never-discipline",
+          status: "fail",
+          detail: `${hard} hard imperatives: MUST/NEVER are reserved for the few things that must never happen — demote the rest to positive imperatives.`,
+        }
+      : hard > 8
+        ? {
+            id: "must-never-discipline",
+            status: "warn",
+            detail: `${hard} hard imperatives is close to noise; keep MUST/NEVER for the few things that must never happen.`,
+          }
+        : { id: "must-never-discipline", status: "pass", detail: `${hard} hard imperatives.` },
+  );
+
+  const hedges = prompt.match(HEDGES)?.length ?? 0;
+  checks.push(
+    hedges >= 5
+      ? {
+          id: "positive-imperatives",
+          status: "warn",
+          detail: `${hedges} hedge phrases — every sentence should change behavior; prefer positive imperatives ("run X, then verify Y").`,
+        }
+      : { id: "positive-imperatives", status: "pass", detail: `${hedges} hedge phrases.` },
+  );
+
+  if (prompt.length > 2000 && !PRECEDENCE.test(prompt))
+    checks.push({
+      id: "precedence",
+      status: "warn",
+      detail:
+        "No instruction-precedence rule in a prompt of this size — say what wins when sources conflict (direct instructions > project files > defaults).",
+    });
+  if (prompt.length > 1500 && !EXAMPLES.test(prompt))
+    checks.push({
+      id: "examples",
+      status: "warn",
+      detail:
+        "No examples in a prompt this long — good-vs-bad examples are how subjective qualities (tone, plan quality) get taught.",
+    });
+  if (!DONE_WHEN.test(prompt))
+    checks.push({
+      id: "checkable-criteria",
+      status: "warn",
+      detail: 'No "done when" — every branch of the task should have a checkable criterion.',
+    });
+  if (INJECTION.test(prompt))
+    checks.push({
+      id: "injection-hygiene",
+      status: "fail",
+      detail:
+        "The draft instructs its reader to discard instructions — a prompt must never undermine itself; state precedence instead.",
+    });
+  if (CODEX_SPECIFIC.test(prompt))
+    checks.push({
+      id: "harness-adaptation",
+      status: "warn",
+      detail:
+        "Codex-specific names appear — adapt to the target harness's tools and delivery rules; never copy Codex-specific tool names.",
+    });
+  if (prompt.length < 200)
+    checks.push({
+      id: "length",
+      status: "warn",
+      detail:
+        "Thinner than any Codex prompt section — say who the agent is, what it may do, and how it validates.",
+    });
+  else if (prompt.length > 40_000)
+    checks.push({
+      id: "length",
+      status: "warn",
+      detail:
+        "Very long — output depth and context are budget; cut anything the reference would not need.",
+    });
+
+  const referenceMissing = reference
+    ? ANATOMY.filter((section) => has(reference, section) && !has(prompt, section))
+    : [];
+
+  const directives = [
+    ...missing.map((section) => section.directive),
+    ...referenceMissing.map(
+      (section) => `The reference prompt treats ${section.title}; the draft has no such section.`,
+    ),
+    ...checks.filter((check) => check.status !== "pass").map((check) => check.detail),
+  ];
+  const revise =
+    missing.length > 0 || referenceMissing.length > 0 || checks.some((c) => c.status === "fail");
+  const verdict = revise ? "revise" : checks.some((c) => c.status === "warn") ? "polish" : "pass";
+
+  return {
+    verdict,
+    sections: { present: present.map((s) => s.id), missing: missing.map((s) => s.id) },
+    checks,
+    directives,
+    ...(reference ? { reference: { sectionsMissingHere: referenceMissing.map((s) => s.id) } } : {}),
+  };
+}

package/src/prompt/standard.ts

@@ -0,0 +1,93 @@
+/**
+ * The codex-prompt-standard rubric, as data. The prose canon is
+ * `.agents/skills/codex-prompt-standard/SKILL.md` — it ships inside the OpenClaw plugin and
+ * syncs to every dev harness; this module is the same guidance shaped for `review-prompt` to
+ * evaluate against. `review.test.ts` pins every anchor below to the canon text so the two
+ * cannot drift apart silently.
+ */
+
+export interface PromptSection {
+  id: string;
+  title: string;
+  /** Substring of the canon SKILL.md this section is pinned to (drift guard). */
+  canonAnchor: string;
+  /** Any hit marks the section present in a draft or a reference prompt. */
+  anchors: RegExp[];
+  /** The next-iteration instruction when the section is missing. */
+  directive: string;
+}
+
+/** The anatomy a Codex-class prompt reliably contains, in order (canon §2). */
+export const ANATOMY: PromptSection[] = [
+  {
+    id: "identity",
+    title: "one-sentence identity",
+    canonAnchor: "One-sentence identity",
+    anchors: [/\byou are\b/i, /\bacting (?:for|on behalf of|as)\b/i],
+    directive:
+      "Open with one sentence of identity: who the model is, where it runs, how it is expected to behave.",
+  },
+  {
+    id: "capabilities",
+    title: "capability inventory",
+    canonAnchor: "Capability inventory",
+    anchors: [/\byou can\b/i, /\bcapabilit/i, /\b(?:available|your) tools?\b/i],
+    directive: "State the capability inventory: what the agent can receive and emit.",
+  },
+  {
+    id: "how-you-work",
+    title: '"How you work" sections',
+    canonAnchor: '"How you work" sections',
+    anchors: [/how you work/i, /\bpreceden/i, /\bpersisten/i, /\bautonom/i, /\btone\b/i],
+    directive:
+      'Add "how you work" sections: personality and tone, instruction precedence, the autonomy and persistence contract.',
+  },
+  {
+    id: "planning",
+    title: "planning guidance",
+    canonAnchor: "Planning guidance",
+    anchors: [/\bplan\b/i, /\bpersist until\b/i, /before (?:acting|starting|diving)/i],
+    directive:
+      "Add planning guidance with explicit high-quality vs low-quality examples for what a good plan is.",
+  },
+  {
+    id: "execution-criteria",
+    title: "execution criteria",
+    canonAnchor: "Execution criteria",
+    anchors: [/\bMUST\b/, /\bNEVER\b/, /scope creep/i, /no unrelated changes/i],
+    directive:
+      "Add execution criteria: hard MUST/NEVER lists, root-cause fixes, no scope creep, no unrelated changes.",
+  },
+  {
+    id: "validation",
+    title: "validation philosophy",
+    canonAnchor: "Validation philosophy",
+    anchors: [/\bverify\b/i, /\bvalidat/i, /before claiming done/i, /\bdone when\b/i],
+    directive:
+      "Add the validation philosophy: start specific, broaden as confidence grows, verify before claiming done.",
+  },
+  {
+    id: "final-message",
+    title: "final-message guidance",
+    canonAnchor: "Final-message guidance",
+    anchors: [/final message/i, /\boutput depth\b/i, /\bfinal reply\b/i],
+    directive:
+      "Add final-message guidance: output depth matches task size; skip formatting for trivial replies.",
+  },
+];
+
+export interface PromptConvention {
+  id: string;
+  /** Substring of the canon SKILL.md this convention is pinned to (drift guard). */
+  canonAnchor: string;
+}
+
+/** Convention anchors the canon must mention; the checks in review.ts implement them. */
+export const CONVENTIONS: PromptConvention[] = [
+  { id: "positive-imperatives", canonAnchor: "Positive imperatives" },
+  { id: "precedence", canonAnchor: "Explicit precedence" },
+  { id: "must-never-discipline", canonAnchor: "MUST/NEVER reserved" },
+  { id: "examples", canonAnchor: "Good-vs-bad examples" },
+  { id: "harness-adaptation", canonAnchor: "Adapt to the target harness" },
+  { id: "checkable-criteria", canonAnchor: "checkable criterion" },
+];

package/src/surfaces/openclaw-native.test.ts

@@ -122,7 +122,7 @@ describe("openclaw-native", () => {
   it("projects only the operations OpenClaw can run and pins the scaffold in one place", () => {
     const files = emitted(project());
     const manifest = JSON.parse(files[`${HOST_DIR}/openclaw.plugin.json`] ?? "{}");
-    expect(manifest.contracts).toEqual({ tools: ["echo"] });
+    expect(manifest.contracts).toEqual({ tools: ["hello_echo"] });
     expect(manifest.activation).toEqual({ onStartup: true });
     expect(surface.verdict?.(shoot, project())).toEqual({
       kind: "excluded",
@@ -133,6 +133,7 @@ describe("openclaw-native", () => {
     expect(files[`${HOST_DIR}/README.md`]).toContain("`shoot` — requires browser");
 
     const pkg = JSON.parse(files[`${HOST_DIR}/package.json`] ?? "{}");
+    expect(pkg.devDependencies).toMatchObject(OPENCLAW_SCAFFOLD.devDependencies);
     expect(pkg.openclaw).toEqual({
       extensions: ["./dist/index.js"],
       compat: { pluginApi: OPENCLAW_SCAFFOLD.pluginApi },
@@ -168,7 +169,7 @@ describe("openclaw-native", () => {
     expect(index).toContain("api.registerControlUiDescriptor(descriptor)");
     // Neither registrar is a manifest contract key; both are what the inspector expects to see.
     expect(JSON.parse(files[`${HOST_DIR}/openclaw.plugin.json`] ?? "{}").contracts).toEqual({
-      tools: ["echo"],
+      tools: ["hello_echo"],
     });
     expect(
       JSON.parse(files[`${HOST_DIR}/package.json`] ?? "{}").pluginInspector.plugin.expect
@@ -212,6 +213,10 @@ describe("openclaw-native", () => {
 
   it("drives manifest, inspector and test from one `registers` declaration", () => {
     const target = voice();
+    target.tool.openclaw = {
+      ...target.tool.openclaw,
+      devDependencies: { openclaw: "2026.9.2", "@types/ws": "^8.18.0" },
+    };
     const files = emitted(target);
     const manifest = JSON.parse(files[`${HOST_DIR}/openclaw.plugin.json`] ?? "{}");
     expect(manifest.contracts).toEqual({ tools: [], realtimeVoiceProviders: ["codex"] });
@@ -223,6 +228,11 @@ describe("openclaw-native", () => {
     });
     // The author's extra dependency merges after the scaffold's; the core is not imported at all.
     expect(pkg.dependencies).toEqual({ ...OPENCLAW_SCAFFOLD.dependencies, ws: "^8.18.0" });
+    expect(pkg.devDependencies).toEqual({
+      ...OPENCLAW_SCAFFOLD.devDependencies,
+      openclaw: "2026.9.2",
+      "@types/ws": "^8.18.0",
+    });
     expect(pkg.peerDependencies.openclaw).toBe(">=2026.8.2");
     expect(pkg.openclaw.compat.pluginApi).toBe(">=2026.8.2");
 
@@ -249,8 +259,8 @@ describe("openclaw-native", () => {
     // when the tool's own result carries a name its output schema promises; leg 3 catches the rest.
     expect(fixtures.fixtures).toEqual([
       {
-        match: { toolName: "echo", hasToolResult: false },
-        response: { toolCalls: [{ name: "echo", arguments: { text: "hello" } }] },
+        match: { toolName: "hello_echo", hasToolResult: false },
+        response: { toolCalls: [{ name: "hello_echo", arguments: { text: "hello" } }] },
       },
       {
         match: { hasToolResult: true, toolResultContains: "echoed" },
@@ -312,7 +322,7 @@ function hasOpenclaw(): boolean {
 }
 
 describe.skipIf(!hasOpenclaw())("openclaw scaffold", () => {
-  it("still matches `openclaw plugins init --type tool`", () => {
+  it("still matches `openclaw plugins init --type tool`", { timeout: 60_000 }, () => {
     expect(scaffoldDrift(project())).toEqual([]);
     // A declared `pluginApi` is an intentional override, not drift.
     expect(scaffoldDrift(voice())).toEqual([]);

package/src/surfaces/openclaw-native.ts

@@ -35,7 +35,7 @@ import {
 /** Transcribed from `openclaw plugins init --type tool`; `validate()` proves them still current. */
 export const OPENCLAW_SCAFFOLD = {
   /** The OpenClaw release the scaffold was taken from (`package.json openclaw.build`). */
-  openclawVersion: "2026.9.2",
+  openclawVersion: "2026.9.4",
   /** `peerDependencies.openclaw` and `openclaw.compat.pluginApi`. */
   pluginApi: ">=2026.5.17",
   private: true,
@@ -86,6 +86,27 @@ export default defineConfig({
  * survive into the projection but allows extra ones: upstream stays the source of truth for
  * everything it does write.
  */
+/**
+ * The version `openclaw plugins init` stamps into its scaffold is the CLI's own version, so
+ * the generated manifest carries the openclaw this project actually pins (author override via
+ * `openclaw.devDependencies.openclaw`), and the scaffold default only when the project rides
+ * `latest`. hosts/openclaw.ts runs the same pin in its drift probe, so the upstream/generated
+ * comparison is identical in every environment.
+ */
+export function openclawVersion(project: Project): string {
+  return project.tool.openclaw?.devDependencies?.openclaw ?? OPENCLAW_SCAFFOLD.openclawVersion;
+}
+
+/**
+ * The gateway has one flat tool namespace, so the plugin's tool names are the tool id prefix
+ * plus the operation name with dots flattened: unprefixed names collide across plugins (two
+ * `web`s) and dotted ones fold onto core tools (`sessions.list` → `sessions_list`). The
+ * kernel, CLI and MCP server keep the bare operation names; only this host renames.
+ */
+export function toolName(project: Project, operation: Operation): string {
+  return `${project.identity.name}_${operation.name.replace(/\./g, "_")}`;
+}
+
 export const OPENCLAW_ADDITIONS = {
   /** Without it `tsc` emits a `dist/` from source that failed type-checking. */
   compilerOptions: { noEmitOnError: true },
@@ -123,6 +144,11 @@ export function registrations(project: Project): Registration[] {
   return project.tool.openclaw?.registers ?? [];
 }
 
+/** Whether the plugin ships `.agents/skills/` directories (`openclaw.skills` in tool.json). */
+export function shipsSkills(project: Project): boolean {
+  return (project.tool.openclaw?.skills?.length ?? 0) > 0;
+}
+
 /**
  * The gateway route and the Control UI tab the plugin adds when the tool also has a `web`
  * surface. Only for the in-process binding: the route hands requests to the core package's own
@@ -257,7 +283,7 @@ function packageJson(
     type: "module",
     private: OPENCLAW_SCAFFOLD.private,
     scripts: { ...OPENCLAW_SCAFFOLD.scripts, ...e2e },
-    files: OPENCLAW_SCAFFOLD.files,
+    files: shipsSkills(project) ? [...OPENCLAW_SCAFFOLD.files, "skills"] : OPENCLAW_SCAFFOLD.files,
     peerDependencies: { openclaw: pluginApi(project), ...extra?.peerDependencies },
     dependencies: { ...OPENCLAW_SCAFFOLD.dependencies, ...core, ...extra?.dependencies },
     devDependencies: {
@@ -268,7 +294,7 @@ function packageJson(
     openclaw: {
       extensions: [OPENCLAW_SCAFFOLD.entry],
       compat: { pluginApi: pluginApi(project) },
-      build: { openclawVersion: OPENCLAW_SCAFFOLD.openclawVersion },
+      build: { openclawVersion: openclawVersion(project) },
     },
     pluginInspector: expectedRegistrations(project, operations).length
       ? pluginInspector(project, operations)
@@ -299,8 +325,9 @@ function pluginManifest(project: Project, operations: Operation[]): Record<strin
     configSchema: configSchema(project),
     uiHints: sensitive.length ? Object.fromEntries(sensitive) : undefined,
     activation: activation(project),
+    skills: shipsSkills(project) ? ["./skills"] : undefined,
     contracts: {
-      tools: operations.map((operation) => operation.name),
+      tools: operations.map((operation) => toolName(project, operation)),
       ...Object.fromEntries(declared),
     },
   }) as Record<string, unknown>;
@@ -404,7 +431,7 @@ const execFileAsync = promisify(execFile);
 ${pythonKernel(project)}`;
   const tools = operations.map(
     (operation) => `    tool({
-      name: ${JSON.stringify(operation.name)},
+      name: ${JSON.stringify(toolName(project, operation))},
       description: ${JSON.stringify(operation.description ?? operation.name)},
       parameters: Type.Unsafe(${literal(normalizeSchema(operation.inputSchema), 6)}),
       ${executeBody(project, operation)}
@@ -565,7 +592,7 @@ import entry from "./index.js";
 
 describe(${JSON.stringify(project.identity.name)}, () => {
   it("declares tool metadata", () => {
-    expect(getToolPluginMetadata(entry)?.tools.map((tool) => tool.name)).toEqual(${JSON.stringify(operations.map((operation) => operation.name))});
+    expect(getToolPluginMetadata(entry)?.tools.map((tool) => tool.name)).toEqual(${JSON.stringify(operations.map((operation) => toolName(project, operation)))});
   });
 ${registrationTest}${web}});
 `;
@@ -611,8 +638,8 @@ function e2eCase(project: Project, operations: Operation[]): E2eCase | undefined
  * would answer OK even for a tool that threw, because the host reports that in a tool message too.
  * An operation that promises no output names has nothing to gate on, so it gets no failure leg.
  */
-function e2eFixtures(kase: E2eCase): string {
-  const name = kase.operation.name;
+function e2eFixtures(project: Project, kase: E2eCase): string {
+  const name = toolName(project, kase.operation);
   return json({
     fixtures: [
       {
@@ -758,19 +785,19 @@ describe(${JSON.stringify(`${id} in a real OpenClaw agent turn`)}, () => {
   it("registers its tools at runtime", async () => {
     const inspected = JSON.parse(await oc(["plugins", "inspect", ${JSON.stringify(id)}, "--runtime", "--json"]));
     expect(inspected.plugin.status).toBe("loaded");
-    expect(inspected.plugin.toolNames).toEqual(${JSON.stringify(operations.map((operation) => operation.name))});
+    expect(inspected.plugin.toolNames).toEqual(${JSON.stringify(operations.map((operation) => toolName(project, operation)))});
   });
 
-  it(${JSON.stringify(`the model calls ${kase.operation.name} and the tool's result reaches the reply`)}, async () => {
+  it(${JSON.stringify(`the model calls ${toolName(project, kase.operation)} and the tool's result reaches the reply`)}, async () => {
     const turn = JSON.parse(
       await oc([
         "agent", "--local", "--agent", "main", "--session-id", \`e2e-\${Date.now()}\`,
         "--model", MODEL, "--thinking", "off", "--timeout", "120", "--json",
         "--message",
-        ${JSON.stringify(`Call the tool named ${kase.operation.name}. Reply with only the exact text returned by that tool.`)},
+        ${JSON.stringify(`Call the tool named ${toolName(project, kase.operation)}. Reply with only the exact text returned by that tool.`)},
       ]),
     );
-    expect(turn.meta.agentMeta.terminalReceipt.successfulToolNames).toContain(${JSON.stringify(kase.operation.name)});
+    expect(turn.meta.agentMeta.terminalReceipt.successfulToolNames).toContain(${JSON.stringify(toolName(project, kase.operation))});
     expect(turn.payloads[0].text).toBe(${JSON.stringify(kase.ok)});
   }, 180_000);
 });
@@ -860,7 +887,7 @@ function readme(project: Project, operations: Operation[], kase?: E2eCase): stri
       "`npm run test:e2e` runs one real OpenClaw agent turn against a scripted OpenAI-compatible",
       "model (`@copilotkit/aimock`, the same package OpenClaw's own QA lane uses). `e2e/fixtures.json`",
       "is projected from `dev.toolfactory/ops.json` and `tool.json`'s `tests.examples`: the model asks",
-      `for \`${kase.operation.name}\` with those arguments, and answers \`${kase.ok}\` only when the tool's own`,
+      `for \`${toolName(project, kase.operation)}\` with those arguments, and answers \`${kase.ok}\` only when the tool's own`,
       "result comes back carrying what its output schema promises.",
       "",
     );
@@ -955,6 +982,13 @@ export const surface: Surface = {
         path: `${HOST_DIR}/vitest.config.ts`,
         content: OPENCLAW_SCAFFOLD.vitestConfig,
       },
+      ...(project.skills ?? []).flatMap((skill) =>
+        skill.files.map((file) => ({
+          kind: "file" as const,
+          path: `${HOST_DIR}/skills/${skill.name}/${file.path}`,
+          content: file.content,
+        })),
+      ),
       {
         kind: "merge",
         path: `${HOST_DIR}/openclaw.plugin.json`,
@@ -984,7 +1018,7 @@ export const surface: Surface = {
             {
               kind: "file" as const,
               path: `${HOST_DIR}/e2e/fixtures.json`,
-              content: e2eFixtures(kase),
+              content: e2eFixtures(project, kase),
             },
             {
               kind: "file" as const,

package/src/surfaces/web.test.ts

@@ -192,7 +192,7 @@ describe("web", () => {
     expect(app).toContain("Authorization: `Bearer ${TOKEN}`");
     // The Secrets panel is the developer's `.env`, and it is the kernel's `/env` that answers.
     expect(app).toContain('new URL("env", document.baseURI).href');
-    expect(app).toContain("toolfactory secrets check");
+    expect(app).toContain("toolfactory secrets-usage check");
     expect(app).toContain('type="password"');
 
     // The smoke drives the real kernel over --http instead of a static server of its own.

package/src/surfaces/web.ts

@@ -153,8 +153,8 @@ export default defineConfig({
       "@fontsource-variable/geist": "^5.3.0",
       "@tailwindcss/vite": "^4.3.3",
       "class-variance-authority": "^0.7.1",
-      cn: "^0.2.6",
-      "lucide-react": "^1.43.0",
+      cn: "^0.3.0",
+      "lucide-react": "^1.46.0",
       react: "^19.2.8",
       "react-dom": "^19.2.8",
       shadcn: "^4.21.0",
@@ -164,11 +164,11 @@ export default defineConfig({
     devDependencies: {
       "@types/node": "^24.13.3",
       "@types/react": "^19.2.18",
-      "@types/react-dom": "^19.2.4",
-      "@vitejs/plugin-react": "^6.1.0",
-      oxlint: "^1.79.0",
+      "@types/react-dom": "^19.2.7",
+      "@vitejs/plugin-react": "^6.1.1",
+      oxlint: "^1.81.0",
       typescript: "~6.0.2",
-      vite: "^8.2.2",
+      vite: "^8.3.0",
     },
   },
   componentsJson: {
@@ -637,7 +637,7 @@ function SecretsPanel() {
         <CardTitle>Secrets</CardTitle>
         <CardDescription>
           Written to this checkout's gitignored <code>.env</code>, which the live tests and
-          <code> toolfactory bootstrap-repo</code> read. Run <code>toolfactory secrets check</code>{" "}
+          <code> toolfactory bootstrap-repo</code> read. Run <code>toolfactory secrets-usage check</code>{" "}
           to ask each registry whether it accepts them.
         </CardDescription>
       </CardHeader>

package/src/surfaces/workflows.ts

@@ -625,7 +625,7 @@ function releaseDocument(
     "`gh workflow run release.yml -f tag=vX.Y.Z` — never `gh run rerun`, which replays the",
     "original run's secret snapshot. `release` first retracts every registry a surface dropped",
     "since the previous tag published to (git is the ledger; `toolfactory unpublish`), and",
-    "`toolfactory secrets status` / `bootstrap-repo` cover the one-time steps that are left.",
+    "`toolfactory secrets-usage status` / `bootstrap-repo` cover the one-time steps that are left.",
   ];
   if (clawhubSelected) {
     jobs["publish-clawhub"] = compact({
@@ -904,7 +904,7 @@ function envExample(project: Project): string {
     lines.push(
       "",
       "# Release credentials (repository secrets; `toolfactory bootstrap-repo` pushes them from .env,",
-      "# `toolfactory secrets status` explains each). Leave one empty to skip that registry.",
+      "# `toolfactory secrets-usage status` explains each). Leave one empty to skip that registry.",
     );
     for (const row of release) {
       lines.push("", `# ${row.id}: ${row.url}`, ...row.secrets.map((name) => `${name}=`));

package/src/toolfactory/cli.ts

@@ -13,7 +13,7 @@ const operations = [...authored, web];
 const program = new Command()
   .name("toolfactory")
   .description("Build an agent tool once; ship it as Agent Skills, MCP servers, Agent Plugins / Claude / Codex / Cursor bundles, OpenClaw and Hermes plugins, CLIs, and packages, with the tests and releases to match.")
-  .version("0.2.1");
+  .version("0.3.1");
 
 for (const op of operations) {
   if (!serves(op, "cli")) continue;

package/src/toolfactory/mcp.ts

@@ -33,7 +33,7 @@ const introspecting = Boolean(process.env.TOOLFACTORY_INTROSPECT);
 
 /** Builds one server instance with every servable operation registered; called once for stdio, once per HTTP request. */
 function createServer(): McpServer {
-  const server = new McpServer({ name: "toolfactory", version: "0.2.1" });
+  const server = new McpServer({ name: "toolfactory", version: "0.3.1" });
   for (const op of operations) {
     if (!introspecting && !serves(op, "mcp")) continue;
     server.registerTool(