vibe-coding-mcp 2.12.1 → 2.14.0

package/SECURITY.md

@@ -0,0 +1,65 @@
+# Security Policy
+
+`vibe-coding-mcp` is an MCP (Model Context Protocol) server that reads source code,
+runs `git` commands, and publishes generated documentation to third-party platforms
+(Notion, Obsidian, GitHub Wiki, Confluence, Slack, Discord). Because it executes
+local commands and makes outbound HTTPS requests on behalf of the calling LLM,
+the threat surface is non-trivial. This document describes the guarantees the
+package makes, what is explicitly out of scope, and how to report vulnerabilities.
+
+## Supported versions
+
+| Version  | Supported |
+|----------|-----------|
+| 2.13.x   | yes       |
+| < 2.13   | no        |
+
+## Threat model
+
+The MCP server runs on the **same trust boundary as the operator's developer
+machine** (or container). It is *not* designed to be exposed to untrusted users
+over a network. The threats actively mitigated are:
+
+| # | Threat                                              | Mitigation (in `src/core/security.ts`)            |
+|---|-----------------------------------------------------|---------------------------------------------------|
+| 1 | Path traversal via tool arguments                   | `validatePathWithinDirectory`, `sanitizeFilename` |
+| 2 | SSRF via webhook URLs (Slack / Discord)             | `validateWebhookUrl` + allowlist of known hosts   |
+| 3 | Plaintext webhook URLs                              | HTTPS-only check inside `validateWebhookUrl`      |
+| 4 | Hung outbound requests / DoS                        | `fetchWithRetry` with timeout + exponential backoff |
+| 5 | Unbounded retries on transient errors               | `maxRetries` cap (default 3) with retry-after honored |
+| 6 | Arbitrary shell injection through `git` invocations | All `git` calls go through `gitExecutor.ts` argv form (no shell) |
+| 7 | Unvalidated tool inputs                             | All tool args parsed through Zod schemas in `src/core/schemas.ts` |
+
+### Out of scope
+
+- **Sandboxing of the host machine.** The MCP server has the privileges of the
+  user running it. Treat tokens (Notion, GitHub, Discord, Slack) as ambient
+  authority and store them in `.env`, not in source control.
+- **Supply-chain attestation for third-party platforms.** We trust the official
+  SDKs (`@anthropic-ai/sdk`, `@notionhq/client`) to handle their own transport
+  security.
+- **Multi-tenant isolation.** Running a single MCP server for multiple users is
+  not a supported deployment.
+
+## Reporting a vulnerability
+
+If you believe you have found a security issue:
+
+1. **Do not open a public GitHub issue.**
+2. Email the maintainers via the GitHub Security Advisories tab on this
+   repository, or open a private advisory at
+   https://github.com/MUSE-CODE-SPACE/vibe-coding-mcp/security/advisories/new
+3. Include a reproduction (minimal MCP tool call, environment, expected vs
+   actual behavior).
+
+We aim to acknowledge reports within 72 hours and to ship a fix or mitigation
+within 14 days for high-severity issues.
+
+## Hardening checklist for operators
+
+- Run `vibe-coding-mcp` inside the smallest reasonable container or user account.
+- Keep `.env` out of version control. Rotate Notion / Slack / Discord tokens
+  if they are ever logged.
+- Pin the package to a known-good version (e.g. `vibe-coding-mcp@2.13.0`) in
+  production rather than using `latest`.
+- Watch the GitHub Actions `CodeQL` workflow for new findings on `main`.

package/dist/core/mcpServerFactory.d.ts

@@ -0,0 +1,30 @@
+/**
+ * MCP server factory — builds a fully-wired `McpServer` instance using the
+ * high-level `@modelcontextprotocol/sdk` API. Used by both entry points
+ * (`src/index.ts` and `src/stdio.ts`) so they expose an identical surface:
+ * 15 tools, 3 resources (one of which is a template), 3 prompts.
+ *
+ * High-level vs low-level: previously both entry points constructed a
+ * low-level `Server` and registered request handlers for
+ * `ListToolsRequestSchema` / `CallToolRequestSchema`. We now use
+ * `McpServer.registerTool()`, `.resource()`, and `.prompt()` — the SDK turns
+ * those registrations into the same JSON-RPC surface, but adds first-class
+ * resources and prompts support along the way.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+declare const SERVER_NAME = "vibe-coding-mcp";
+declare const SERVER_VERSION = "2.14.0";
+/**
+ * Build a new `McpServer` instance populated with all 15 tools, the resource
+ * set, and the prompt set. The returned server is not yet connected to a
+ * transport — caller is responsible for `server.connect(transport)`.
+ */
+export declare function createMcpServer(): McpServer;
+/** Counts surfaced for smoke-testing + observability. */
+export declare function getCapabilityCounts(): {
+    tools: number;
+    resources: number;
+    prompts: number;
+};
+export { SERVER_NAME, SERVER_VERSION };
+//# sourceMappingURL=mcpServerFactory.d.ts.map

package/dist/core/mcpServerFactory.js

@@ -0,0 +1,136 @@
+/**
+ * MCP server factory — builds a fully-wired `McpServer` instance using the
+ * high-level `@modelcontextprotocol/sdk` API. Used by both entry points
+ * (`src/index.ts` and `src/stdio.ts`) so they expose an identical surface:
+ * 15 tools, 3 resources (one of which is a template), 3 prompts.
+ *
+ * High-level vs low-level: previously both entry points constructed a
+ * low-level `Server` and registered request handlers for
+ * `ListToolsRequestSchema` / `CallToolRequestSchema`. We now use
+ * `McpServer.registerTool()`, `.resource()`, and `.prompt()` — the SDK turns
+ * those registrations into the same JSON-RPC surface, but adds first-class
+ * resources and prompts support along the way.
+ */
+import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { TOOL_REGISTRY } from './toolRegistry.js';
+import { createErrorResponse, ToolError } from './errors.js';
+import { STATIC_RESOURCE_DESCRIPTORS, readSessionsList, readSessionDetail, readConfig, } from './resources.js';
+import { PROMPT_DESCRIPTORS, findPrompt } from './prompts.js';
+import { listSessions } from './sessionStorage.js';
+const SERVER_NAME = 'vibe-coding-mcp';
+const SERVER_VERSION = '2.14.0';
+/**
+ * Build a new `McpServer` instance populated with all 15 tools, the resource
+ * set, and the prompt set. The returned server is not yet connected to a
+ * transport — caller is responsible for `server.connect(transport)`.
+ */
+export function createMcpServer() {
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, {
+        capabilities: {
+            tools: {},
+            resources: {},
+            prompts: {},
+        },
+    });
+    registerTools(server);
+    registerResources(server);
+    registerPrompts(server);
+    return server;
+}
+/** Wire all 15 tools from the shared registry. */
+function registerTools(server) {
+    for (const tool of TOOL_REGISTRY) {
+        const { name, description } = tool.descriptor;
+        // Use `registerTool` with the Zod schema for the input. The SDK uses
+        // `normalizeObjectSchema` internally, which accepts our pre-built
+        // `z.object(...)` instances. SDK pre-validates `args` before calling the
+        // handler; our handler then re-runs `validateInput()` defensively.
+        server.registerTool(name, {
+            description,
+            inputSchema: tool.inputZodSchema,
+        }, async (args) => {
+            try {
+                const result = await tool.handler(args);
+                return {
+                    content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+                };
+            }
+            catch (error) {
+                return createErrorResponse(error);
+            }
+        });
+    }
+}
+/** Register the static + templated resources. */
+function registerResources(server) {
+    // Static: sessions/list
+    server.resource('sessions-list', 'vibe-coding://sessions/list', { description: STATIC_RESOURCE_DESCRIPTORS[0].description, mimeType: 'application/json' }, async (uri) => {
+        const content = await readSessionsList(uri.toString());
+        return { contents: [content] };
+    });
+    // Static: config
+    server.resource('config', 'vibe-coding://config', { description: STATIC_RESOURCE_DESCRIPTORS[1].description, mimeType: 'application/json' }, async (uri) => {
+        const content = readConfig(uri.toString());
+        return { contents: [content] };
+    });
+    // Template: sessions/{id}
+    server.resource('session-detail', new ResourceTemplate('vibe-coding://sessions/{id}', {
+        // List variants of the template — enumerate stored session IDs so
+        // clients can autocomplete the {id} placeholder.
+        list: async () => {
+            const { sessions } = await listSessions({ limit: 50 });
+            return {
+                resources: sessions
+                    .filter((s) => s.id !== 'list')
+                    .map((s) => ({
+                    uri: `vibe-coding://sessions/${s.id}`,
+                    name: s.title || s.id,
+                    description: s.summary?.slice(0, 120) ?? '',
+                    mimeType: 'application/json',
+                })),
+            };
+        },
+    }), {
+        description: 'Full read-only detail of one captured session (code contexts, design decisions, metadata).',
+        mimeType: 'application/json',
+    }, async (uri, variables) => {
+        const id = Array.isArray(variables.id) ? variables.id[0] : variables.id;
+        const content = await readSessionDetail(uri.toString(), id ?? '');
+        return { contents: [content] };
+    });
+}
+/** Register all prompts from the shared prompts module. */
+function registerPrompts(server) {
+    for (const descriptor of PROMPT_DESCRIPTORS) {
+        // Build a Zod raw-shape from the prompt's argument list so the SDK can
+        // surface argument metadata in `prompts/list`.
+        const shape = {};
+        for (const arg of descriptor.arguments) {
+            const base = z.string().describe(arg.description);
+            shape[arg.name] = arg.required ? base : base.optional();
+        }
+        server.prompt(descriptor.name, descriptor.description, shape, (args) => {
+            const prompt = findPrompt(descriptor.name);
+            if (!prompt) {
+                throw new ToolError(`Prompt not found: ${descriptor.name}`, 'NOT_FOUND');
+            }
+            const result = prompt.build(args);
+            return {
+                description: result.description,
+                messages: result.messages,
+            };
+        });
+    }
+}
+/** Counts surfaced for smoke-testing + observability. */
+export function getCapabilityCounts() {
+    return {
+        tools: TOOL_REGISTRY.length,
+        // 2 static + 1 template = 3 logical resources
+        resources: STATIC_RESOURCE_DESCRIPTORS.length + 1,
+        prompts: PROMPT_DESCRIPTORS.length,
+    };
+}
+export { SERVER_NAME, SERVER_VERSION };
+//# sourceMappingURL=mcpServerFactory.js.map

package/dist/core/mcpServerFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpServerFactory.js","sourceRoot":"","sources":["../../src/core/mcpServerFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ;KACF,CACF,CAAC;IAEF,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,MAAiB;IACtC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAE9C,qEAAqE;QACrE,kEAAkE;QAClE,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,CAAC,YAAY,CACjB,IAAI,EACJ;YACE,WAAW;YACX,WAAW,EAAE,IAAI,CAAC,cAAyC;SAC5D,EACD,KAAK,EAAE,IAAa,EAAE,EAAE;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;iBACnE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAS,iBAAiB,CAAC,MAAiB;IAC1C,wBAAwB;IACxB,MAAM,CAAC,QAAQ,CACb,eAAe,EACf,6BAA6B,EAC7B,EAAE,WAAW,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EACzF,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,iBAAiB;IACjB,MAAM,CAAC,QAAQ,CACb,QAAQ,EACR,sBAAsB,EACtB,EAAE,WAAW,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EACzF,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,CAAC,CACF,CAAC;IAEF,0BAA0B;IAC1B,MAAM,CAAC,QAAQ,CACb,gBAAgB,EAChB,IAAI,gBAAgB,CAAC,6BAA6B,EAAE;QAClD,kEAAkE;QAClE,iDAAiD;QACjD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACvD,OAAO;gBACL,SAAS,EAAE,QAAQ;qBAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC;qBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACX,GAAG,EAAE,0BAA0B,CAAC,CAAC,EAAE,EAAE;oBACrC,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE;oBACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE;oBAC3C,QAAQ,EAAE,kBAAkB;iBAC7B,CAAC,CAAC;aACN,CAAC;QACJ,CAAC;KACF,CAAC,EACF;QACE,WAAW,EACT,4FAA4F;QAC9F,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;QACvB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,CAAC,CACF,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,SAAS,eAAe,CAAC,MAAiB;IACxC,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;QAC5C,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,KAAK,GAAiC,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACrE,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,SAAS,CAAC,qBAAqB,UAAU,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAA0C,CAAC,CAAC;YACxE,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,MAAM;QAC3B,8CAA8C;QAC9C,SAAS,EAAE,2BAA2B,CAAC,MAAM,GAAG,CAAC;QACjD,OAAO,EAAE,kBAAkB,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC"}

package/dist/core/prompts.d.ts

@@ -0,0 +1,42 @@
+/**
+ * MCP Prompts — pre-baked, parameterized workflows that compose multiple
+ * vibe-coding tools into a single user-facing slash command. Surfaced by
+ * Claude UI in the `/`-menu.
+ *
+ * Each prompt returns a sequence of messages that the LLM should follow,
+ * referencing the appropriate `muse_*` tools.
+ */
+export interface PromptArgument {
+    name: string;
+    description: string;
+    required: boolean;
+}
+export interface PromptDescriptor {
+    name: string;
+    description: string;
+    arguments: PromptArgument[];
+}
+export interface PromptMessage {
+    role: 'user' | 'assistant';
+    content: {
+        type: 'text';
+        text: string;
+    };
+}
+export interface PromptResult {
+    description: string;
+    messages: PromptMessage[];
+}
+/**
+ * All registered prompts. The descriptor block is returned by
+ * `prompts/list`; the `build` function is invoked by `prompts/get`.
+ */
+interface PromptDefinition {
+    descriptor: PromptDescriptor;
+    build: (args: Record<string, string | undefined>) => PromptResult;
+}
+export declare const PROMPT_DESCRIPTORS: PromptDescriptor[];
+export declare function findPrompt(name: string): PromptDefinition | undefined;
+export declare function buildPrompt(name: string, args: Record<string, string | undefined>): PromptResult | null;
+export {};
+//# sourceMappingURL=prompts.d.ts.map

package/dist/core/prompts.js

@@ -0,0 +1,158 @@
+/**
+ * MCP Prompts — pre-baked, parameterized workflows that compose multiple
+ * vibe-coding tools into a single user-facing slash command. Surfaced by
+ * Claude UI in the `/`-menu.
+ *
+ * Each prompt returns a sequence of messages that the LLM should follow,
+ * referencing the appropriate `muse_*` tools.
+ */
+const PROMPTS = [
+    {
+        descriptor: {
+            name: 'daily-vibe-log',
+            description: 'Generate a daily vibe coding log summarizing today\'s captured sessions, code contexts, and design decisions.',
+            arguments: [
+                {
+                    name: 'date',
+                    description: 'ISO date (YYYY-MM-DD). Defaults to today.',
+                    required: false,
+                },
+                {
+                    name: 'language',
+                    description: 'Output language: `en` or `ko`. Defaults to `en`.',
+                    required: false,
+                },
+            ],
+        },
+        build: (args) => {
+            const date = args.date || new Date().toISOString().slice(0, 10);
+            const language = (args.language || 'en').toLowerCase() === 'ko' ? 'ko' : 'en';
+            return {
+                description: `Daily vibe log for ${date} (${language}).`,
+                messages: [
+                    {
+                        role: 'user',
+                        content: {
+                            type: 'text',
+                            text: [
+                                `Compile a daily vibe coding log for ${date}.`,
+                                '',
+                                'Workflow:',
+                                `1. Call \`muse_session_history\` with action=\"list\" and filter to sessions whose updatedAt starts with \"${date}\".`,
+                                '2. For each session, call `muse_session_history` with action=\"get\" to fetch full detail.',
+                                '3. Call `muse_session_stats` with action=\"overview\" for productivity numbers.',
+                                '4. Call `muse_create_session_log` with logType=\"daily\" passing the aggregated context.',
+                                `5. Render the final log in ${language === 'ko' ? 'Korean' : 'English'}, grouping by tag and including code-block counts plus key design decisions.`,
+                            ].join('\n'),
+                        },
+                    },
+                ],
+            };
+        },
+    },
+    {
+        descriptor: {
+            name: 'document-session',
+            description: 'Walk a user through documenting a captured vibe coding session — fetch it, extract design decisions, generate a dev document, and (optionally) publish.',
+            arguments: [
+                {
+                    name: 'sessionId',
+                    description: 'Stored session ID (from `muse_session_history` list/save).',
+                    required: true,
+                },
+                {
+                    name: 'documentType',
+                    description: 'README, DESIGN, TUTORIAL, CHANGELOG, API, or ARCHITECTURE. Defaults to DESIGN.',
+                    required: false,
+                },
+                {
+                    name: 'platform',
+                    description: 'Optional publish target: notion, github-wiki, obsidian, confluence, slack, discord. Omit to skip publish.',
+                    required: false,
+                },
+            ],
+        },
+        build: (args) => {
+            const sessionId = args.sessionId ?? '<sessionId>';
+            const documentType = args.documentType || 'DESIGN';
+            const platform = args.platform;
+            return {
+                description: `Document session ${sessionId} as a ${documentType}${platform ? ` and publish to ${platform}` : ''}.`,
+                messages: [
+                    {
+                        role: 'user',
+                        content: {
+                            type: 'text',
+                            text: [
+                                `Document vibe coding session \`${sessionId}\` as a ${documentType}.`,
+                                '',
+                                'Workflow:',
+                                `1. Call \`muse_session_history\` action=\"get\", sessionId=\"${sessionId}\". Read codeContexts + designDecisions.`,
+                                '2. If designDecisions is empty, call `muse_summarize_design_decisions` on the conversationSummary fields.',
+                                `3. Call \`muse_generate_dev_document\` with documentType=\"${documentType}\", passing designDecisions and codeContexts from step 1-2.`,
+                                platform
+                                    ? `4. Call \`muse_normalize_for_platform\` with platform=\"${platform}\", then \`muse_publish_document\` to push the result.`
+                                    : '4. Return the generated Markdown to the user (no publish).',
+                                '5. Summarize what was documented and where it was published.',
+                            ].join('\n'),
+                        },
+                    },
+                ],
+            };
+        },
+    },
+    {
+        descriptor: {
+            name: 'refactor-context',
+            description: 'Extract the refactor-ready context from a session: the code that changed, the design decisions that drove the change, and AST analysis of the new code — ready to paste into a refactor PR description.',
+            arguments: [
+                {
+                    name: 'sessionId',
+                    description: 'Stored session ID.',
+                    required: true,
+                },
+                {
+                    name: 'language',
+                    description: 'Code language hint for AST analysis (typescript, javascript, python, go).',
+                    required: false,
+                },
+            ],
+        },
+        build: (args) => {
+            const sessionId = args.sessionId ?? '<sessionId>';
+            const language = args.language || 'typescript';
+            return {
+                description: `Extract refactor context from session ${sessionId}.`,
+                messages: [
+                    {
+                        role: 'user',
+                        content: {
+                            type: 'text',
+                            text: [
+                                `Extract refactor context from session \`${sessionId}\`.`,
+                                '',
+                                'Workflow:',
+                                `1. Call \`muse_session_history\` action=\"get\", sessionId=\"${sessionId}\".`,
+                                `2. For each non-trivial code block, call \`muse_analyze_code\` with language=\"${language}\" and generateDiagrams=true to surface class/flowchart/dependency diagrams.`,
+                                '3. Call `muse_git` action=\"diff\" for the related repo to attach the actual diff (if a repoPath is in session metadata).',
+                                '4. Assemble a markdown report with sections: Motivation (from design decisions) / What changed (diff stat + diagrams) / Risks / Follow-ups.',
+                                '5. Return the report verbatim so it can be pasted into a refactor PR description.',
+                            ].join('\n'),
+                        },
+                    },
+                ],
+            };
+        },
+    },
+];
+export const PROMPT_DESCRIPTORS = PROMPTS.map((p) => p.descriptor);
+export function findPrompt(name) {
+    return PROMPTS.find((p) => p.descriptor.name === name);
+}
+export function buildPrompt(name, args) {
+    const prompt = findPrompt(name);
+    if (!prompt)
+        return null;
+    return prompt.build(args);
+}
+//# sourceMappingURL=prompts.js.map

package/dist/core/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../src/core/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiCH,MAAM,OAAO,GAAuB;IAClC;QACE,UAAU,EAAE;YACV,IAAI,EAAE,gBAAgB;YACtB,WAAW,EACT,+GAA+G;YACjH,SAAS,EAAE;gBACT;oBACE,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,2CAA2C;oBACxD,QAAQ,EAAE,KAAK;iBAChB;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,kDAAkD;oBAC/D,QAAQ,EAAE,KAAK;iBAChB;aACF;SACF;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,OAAO;gBACL,WAAW,EAAE,sBAAsB,IAAI,KAAK,QAAQ,IAAI;gBACxD,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE;4BACP,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,uCAAuC,IAAI,GAAG;gCAC9C,EAAE;gCACF,WAAW;gCACX,8GAA8G,IAAI,KAAK;gCACvH,4FAA4F;gCAC5F,iFAAiF;gCACjF,0FAA0F;gCAC1F,8BAA8B,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,8EAA8E;6BACrJ,CAAC,IAAI,CAAC,IAAI,CAAC;yBACb;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;KACF;IACD;QACE,UAAU,EAAE;YACV,IAAI,EAAE,kBAAkB;YACxB,WAAW,EACT,yJAAyJ;YAC3J,SAAS,EAAE;gBACT;oBACE,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,4DAA4D;oBACzE,QAAQ,EAAE,IAAI;iBACf;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,gFAAgF;oBAC7F,QAAQ,EAAE,KAAK;iBAChB;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,WAAW,EACT,2GAA2G;oBAC7G,QAAQ,EAAE,KAAK;iBAChB;aACF;SACF;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;YAClD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,OAAO;gBACL,WAAW,EAAE,oBAAoB,SAAS,SAAS,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;gBAClH,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE;4BACP,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,kCAAkC,SAAS,WAAW,YAAY,GAAG;gCACrE,EAAE;gCACF,WAAW;gCACX,gEAAgE,SAAS,0CAA0C;gCACnH,2GAA2G;gCAC3G,8DAA8D,YAAY,6DAA6D;gCACvI,QAAQ;oCACN,CAAC,CAAC,2DAA2D,QAAQ,wDAAwD;oCAC7H,CAAC,CAAC,4DAA4D;gCAChE,8DAA8D;6BAC/D,CAAC,IAAI,CAAC,IAAI,CAAC;yBACb;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;KACF;IACD;QACE,UAAU,EAAE;YACV,IAAI,EAAE,kBAAkB;YACxB,WAAW,EACT,yMAAyM;YAC3M,SAAS,EAAE;gBACT;oBACE,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,oBAAoB;oBACjC,QAAQ,EAAE,IAAI;iBACf;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,2EAA2E;oBACxF,QAAQ,EAAE,KAAK;iBAChB;aACF;SACF;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;YAC/C,OAAO;gBACL,WAAW,EAAE,yCAAyC,SAAS,GAAG;gBAClE,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE;4BACP,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,2CAA2C,SAAS,KAAK;gCACzD,EAAE;gCACF,WAAW;gCACX,gEAAgE,SAAS,KAAK;gCAC9E,kFAAkF,QAAQ,8EAA8E;gCACxK,2HAA2H;gCAC3H,6IAA6I;gCAC7I,mFAAmF;6BACpF,CAAC,IAAI,CAAC,IAAI,CAAC;yBACb;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAEvF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,IAAwC;IAExC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/core/resources.d.ts

@@ -0,0 +1,47 @@
+/**
+ * MCP Resources — read-only contextual data exposed via `resources/list` and
+ * `resources/read`. Resources let Claude UI surface vibe-coding state with
+ * @-mentions / slash commands without the LLM having to call a tool first.
+ *
+ * Registered URIs:
+ *   - `vibe-coding://sessions/list`        — list of captured sessions
+ *   - `vibe-coding://sessions/{id}`        — full detail for one session (template)
+ *   - `vibe-coding://config`               — current platform configuration
+ */
+export interface ResourceContent {
+    uri: string;
+    mimeType: string;
+    text: string;
+}
+export interface ResourceDescriptor {
+    uri: string;
+    name: string;
+    description: string;
+    mimeType: string;
+}
+/**
+ * Static resources (fixed URI, returned by `resources/list`).
+ */
+export declare const STATIC_RESOURCE_DESCRIPTORS: ResourceDescriptor[];
+/**
+ * Resource templates — URIs with variables (RFC 6570). Listed separately
+ * by `resources/templates/list`.
+ */
+export declare const RESOURCE_TEMPLATE_DESCRIPTORS: readonly [{
+    readonly uriTemplate: "vibe-coding://sessions/{id}";
+    readonly name: "session-detail";
+    readonly description: "Full read-only detail of one captured session (code contexts, design decisions, metadata).";
+    readonly mimeType: "application/json";
+}];
+/** Read the `sessions/list` resource. */
+export declare function readSessionsList(uri: string): Promise<ResourceContent>;
+/** Read a `sessions/{id}` resource. */
+export declare function readSessionDetail(uri: string, sessionId: string): Promise<ResourceContent>;
+/** Read the `config` resource. */
+export declare function readConfig(uri: string): ResourceContent;
+/**
+ * Dispatch a `resources/read` call by URI. Returns `null` if the URI does
+ * not match any registered resource (caller should surface a proper error).
+ */
+export declare function readResource(uri: string): Promise<ResourceContent | null>;
+//# sourceMappingURL=resources.d.ts.map

package/dist/core/resources.js

@@ -0,0 +1,99 @@
+/**
+ * MCP Resources — read-only contextual data exposed via `resources/list` and
+ * `resources/read`. Resources let Claude UI surface vibe-coding state with
+ * @-mentions / slash commands without the LLM having to call a tool first.
+ *
+ * Registered URIs:
+ *   - `vibe-coding://sessions/list`        — list of captured sessions
+ *   - `vibe-coding://sessions/{id}`        — full detail for one session (template)
+ *   - `vibe-coding://config`               — current platform configuration
+ */
+import { listSessions, getSession } from './sessionStorage.js';
+import { validateConfiguration } from './config.js';
+/**
+ * Static resources (fixed URI, returned by `resources/list`).
+ */
+export const STATIC_RESOURCE_DESCRIPTORS = [
+    {
+        uri: 'vibe-coding://sessions/list',
+        name: 'sessions-list',
+        description: 'List of all captured vibe coding sessions (id, title, tags, timestamps).',
+        mimeType: 'application/json',
+    },
+    {
+        uri: 'vibe-coding://config',
+        name: 'config',
+        description: 'Current publishing platform configuration — which platforms (Notion, GitHub Wiki, Obsidian, Confluence, Slack, Discord) are fully configured via environment variables and which are missing required secrets.',
+        mimeType: 'application/json',
+    },
+];
+/**
+ * Resource templates — URIs with variables (RFC 6570). Listed separately
+ * by `resources/templates/list`.
+ */
+export const RESOURCE_TEMPLATE_DESCRIPTORS = [
+    {
+        uriTemplate: 'vibe-coding://sessions/{id}',
+        name: 'session-detail',
+        description: 'Full read-only detail of one captured session (code contexts, design decisions, metadata).',
+        mimeType: 'application/json',
+    },
+];
+/** Read the `sessions/list` resource. */
+export async function readSessionsList(uri) {
+    const { sessions, total } = await listSessions({ limit: 200 });
+    const body = {
+        total,
+        sessions: sessions.map((s) => ({
+            id: s.id,
+            title: s.title,
+            tags: s.tags,
+            createdAt: s.createdAt,
+            updatedAt: s.updatedAt,
+            codeContextCount: s.codeContextCount,
+            designDecisionCount: s.designDecisionCount,
+        })),
+    };
+    return { uri, mimeType: 'application/json', text: JSON.stringify(body, null, 2) };
+}
+/** Read a `sessions/{id}` resource. */
+export async function readSessionDetail(uri, sessionId) {
+    const session = await getSession(sessionId);
+    if (!session) {
+        // Return an empty-but-valid envelope so clients don't crash.
+        return {
+            uri,
+            mimeType: 'application/json',
+            text: JSON.stringify({ error: 'NOT_FOUND', sessionId }, null, 2),
+        };
+    }
+    return { uri, mimeType: 'application/json', text: JSON.stringify(session, null, 2) };
+}
+/** Read the `config` resource. */
+export function readConfig(uri) {
+    const result = validateConfiguration();
+    return {
+        uri,
+        mimeType: 'application/json',
+        text: JSON.stringify(result, null, 2),
+    };
+}
+/**
+ * Dispatch a `resources/read` call by URI. Returns `null` if the URI does
+ * not match any registered resource (caller should surface a proper error).
+ */
+export async function readResource(uri) {
+    if (uri === 'vibe-coding://sessions/list') {
+        return readSessionsList(uri);
+    }
+    if (uri === 'vibe-coding://config') {
+        return readConfig(uri);
+    }
+    // Template match: vibe-coding://sessions/{id}
+    const sessionMatch = uri.match(/^vibe-coding:\/\/sessions\/([^/]+)$/);
+    if (sessionMatch && sessionMatch[1] !== 'list') {
+        return readSessionDetail(uri, sessionMatch[1]);
+    }
+    return null;
+}
+//# sourceMappingURL=resources.js.map

package/dist/core/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/core/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAepD;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAyB;IAC/D;QACE,GAAG,EAAE,6BAA6B;QAClC,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,0EAA0E;QACvF,QAAQ,EAAE,kBAAkB;KAC7B;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,gNAAgN;QAClN,QAAQ,EAAE,kBAAkB;KAC7B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C;QACE,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,4FAA4F;QAC9F,QAAQ,EAAE,kBAAkB;KAC7B;CACO,CAAC;AAEX,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG;QACX,KAAK;QACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;SAC3C,CAAC,CAAC;KACJ,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,SAAiB;IACpE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,6DAA6D;QAC7D,OAAO;YACL,GAAG;YACH,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,kBAAkB;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,IAAI,GAAG,KAAK,6BAA6B,EAAE,CAAC;QAC1C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,8CAA8C;IAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACtE,IAAI,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/C,OAAO,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/toolRegistry.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Shared tool registry — single source of truth for all 15 MCP tools.
+ *
+ * Both entry points (`src/index.ts` HTTP transport and `src/stdio.ts` stdio
+ * transport) import from this module so they expose an identical capability
+ * surface. Adding/removing a tool is a single-line change here.
+ */
+import { z } from 'zod';
+/**
+ * MCP-style tool definition object (the JSON-schema descriptor that ships
+ * over the wire to clients via `tools/list`).
+ */
+export interface ToolDescriptor {
+    name: string;
+    description: string;
+    inputSchema: unknown;
+}
+/**
+ * A registered tool — pairs the public JSON-schema descriptor with the
+ * server-side handler (which validates input via a Zod schema then dispatches
+ * to the underlying tool implementation).
+ */
+export interface RegisteredTool {
+    /** Descriptor returned by `tools/list`. */
+    descriptor: ToolDescriptor;
+    /** Zod schema used to validate `tools/call` arguments. */
+    inputZodSchema: z.ZodTypeAny;
+    /** Validated-input handler. Returns the tool's structured result object. */
+    handler: (args: unknown) => unknown | Promise<unknown>;
+}
+/**
+ * All 15 tools, in display order. Edit this array to add/remove/reorder
+ * capabilities. The order here is the order clients see in `tools/list`.
+ */
+export declare const TOOL_REGISTRY: readonly RegisteredTool[];
+/** All tool names exposed by the server. */
+export declare function getToolNames(): string[];
+/** All tool descriptors (for `tools/list`). */
+export declare function getToolDescriptors(): ToolDescriptor[];
+/** Look up a registered tool by its public name. */
+export declare function findTool(name: string): RegisteredTool | undefined;
+/**
+ * Wraps a tool handler invocation into the MCP `tools/call` result envelope.
+ * Used by the low-level transport adapter (kept for backward compatibility);
+ * the high-level `McpServer.tool()` registration in `mcpServerFactory.ts`
+ * uses the handler directly.
+ */
+export declare function callToolByName(name: string, args: unknown): Promise<{
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+//# sourceMappingURL=toolRegistry.d.ts.map