wicked-garden 12.60.0 → 12.61.0

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.60.0"}], "version": "12.60.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.61.0"}], "version": "12.61.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.60.0",
+  "version": "12.61.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": ">=0.8.0",
   "wicked_ledger_version": "^0.6.0",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.60.0",
+  "version": "12.61.0",
   "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [
     "coding-agent",

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [12.61.0] — 2026-10-26
+
+### Fixed
+- **`install.py --from-run` finds the pack in a real run (editor and MCP) (#1351).** The engine runs the install-plan and install Tool phases in the run's worktree and sets `WICKED_TREE` to that worktree's git tree id (wicked-core#776), not a path. Both install scripts read it as a directory, found nothing, and every editor-plugin run failed at install-plan with "found 0 (none)", so the install consent gate was never reached. `--from-run` now searches the worktree (the cwd) and uses `WICKED_TREE` only when it names a directory.
+- **A credential-free MCP server installs (`scripts/mcp/install.py`) (#1351).** The installer assumed every server reads a `<SERVER>_TOKEN` secret. A local-computation server has no upstream, and its config names no `baseUrl` and no auth scheme (`auth` absent, null or `{"scheme": "none"}`). The installer still sent `auth: env:<SERVER>_TOKEN`, crew answered `secret_missing`, and the server was never registered, so a design that correctly invented no credential could not be installed. Such a server now smokes and registers with no secret variable. A server with an upstream, and `--from-npm` installs, are unchanged.
+- **An MCP server delivered without a `package-lock.json` installs (`scripts/mcp/install.py`) (#1352).** A container seat can't reach the npm registry, so the server a `/workflow-mcp-server` run delivers has no lockfile. `npm ci` refuses such a tree, so the install failed after the operator had consented, with only npm's debug-log path as the reason. The installer now copies the server to a transient `<root>/<key>/resolve/`, resolves the dependencies there once with `npm install --package-lock=true --ignore-scripts`, and builds there. The staged copy installs from that lock, and the delivered tree is never written. An npm that writes no lock (`package-lock=false`) fails before anything is built. The plan and the install record say `"lockfile": "resolved at install"`, because those versions were picked at install time and the run never reviewed them. A delivered lock still goes through `npm ci`, and the output says `"lockfile": "delivered"`. A failing npm step now reports npm's own reason instead of its debug-log path. That is the `npm error code` line and the first line after it that isn't metadata, plus the script's own last line (tsc's error) when `npm run build` fails.
+
 ## [12.60.0] — 2026-10-26
 
 ### Fixed
@@ -1212,7 +1219,8 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.60.0...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.61.0...HEAD
+[12.61.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.60.0...v12.61.0
 [12.60.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.59.0...v12.60.0
 [12.59.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.58.0...v12.59.0
 [12.58.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.57.0...v12.58.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.60.0",
+  "version": "12.61.0",
   "type": "module",
   "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [

package/scripts/editor/install.py

@@ -9,7 +9,7 @@ An editor plugin is a ``wicked-pack.json`` spec-2 pack with ``editors[]`` (scaff
 ``scripts/editor/scaffold.py``). Install, idempotent by the pack's ``name``:
 
 1. **Locate**: ``--from-run`` finds the one spec-2 ``wicked-pack.json`` with editors under
-   ``$WICKED_TREE`` (else the cwd), outside node_modules/.git/dist; ``--dir`` names it.
+   the run's worktree (the cwd; ``$WICKED_TREE`` when it names a directory), outside node_modules/.git/dist; ``--dir`` names it.
 2. **Stage** into ``<root>/<name>/next/`` (root: ``--install-root``, ``$WICKED_EDITOR_INSTALL_ROOT``,
    else ``~/.wicked/editors``, a program-owned place): ``wicked-pack.json``, every editor's entry
    file at its manifest path, and the README. Nothing else of the tree is copied (an editor is ONE
@@ -127,11 +127,19 @@ def _is_editor_pack(manifest_path: Path) -> bool:
         return False
 
 
+def run_tree() -> Path:
+    """The run's worktree for ``--from-run``. The engine runs an install Tool phase IN the worktree and hands
+    ``$WICKED_TREE`` as that worktree's git tree id (wicked-core#776), never a path; reading the id as a path found
+    no pack in any real run. A ``$WICKED_TREE`` that names a directory is still honoured, else the cwd."""
+    named = os.environ.get("WICKED_TREE")
+    return Path(named) if named and Path(named).is_dir() else Path.cwd()
+
+
 def locate(args) -> tuple[Path, dict]:
     if args.dir is not None:
         pack = args.dir
     elif args.from_run:
-        tree = Path(os.environ.get("WICKED_TREE") or os.getcwd())
+        tree = run_tree()
         found = []
         for dirpath, dirnames, filenames in os.walk(tree):
             dirnames[:] = sorted(d for d in dirnames if d not in SKIP_DIRS)
@@ -372,7 +380,7 @@ def consent_refusal(args, env) -> str | None:
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     where = parser.add_mutually_exclusive_group()
-    where.add_argument("--from-run", action="store_true", help="find the one editor pack under $WICKED_TREE (else the cwd)")
+    where.add_argument("--from-run", action="store_true", help="find the one editor pack in the run's worktree (the cwd, or $WICKED_TREE when it names a directory)")
     where.add_argument("--dir", type=Path, help="the pack directory")
     where.add_argument("--uninstall", metavar="NAME", help="unregister and remove an installed editor pack")
     parser.add_argument("--target", type=parse_target, default=("daemon", None),

package/scripts/mcp/install.py

@@ -21,12 +21,18 @@ bound URL for every governed unit). There is no port default: a guessed ``:7701`
 daemon's registry. Neither set exits 2 naming the remedy.
 
 1. **Locate** the server: ``--from-run`` finds the one ``mcp-server.config.json`` under
-   ``$WICKED_TREE`` (else the cwd), outside node_modules/dist; ``--dir`` names it. The key and
+   the run's worktree (the cwd; ``$WICKED_TREE`` when it names a directory), outside node_modules/dist; ``--dir`` names it. The key and
    version come from that config.
 2. **Stage** into ``<root>/<key>/next/`` (root: ``--install-root``, ``$WICKED_MCP_INSTALL_ROOT``,
    else ``~/.wicked/mcp-servers``): ``npm ci --ignore-scripts && npm run build`` in the server
    dir, copy dist/ + package.json + package-lock.json + tools.json + mcp-server.config.json,
    ``npm ci --omit=dev --ignore-scripts`` there. ``--from-npm`` installs the package instead.
+   A server delivered WITHOUT a package-lock.json (a seat with no npm registry cannot write one) is
+   copied to a transient ``<root>/<key>/resolve/`` (removed afterwards, like ``next/``), resolved
+   there with ``npm install --package-lock=true --ignore-scripts`` and built there; the staged copy
+   installs from that lock. The delivered tree is not written. The plan and the record say so
+   (``"lockfile": "resolved at install"``): the versions were chosen at install time, not reviewed
+   in the run.
 3. **Smoke** with ``probe.py``. A failure naming ``<SERVER>_TOKEN`` is a pending credential
    (disclosed, not failed); any other failure exits 1 with ``next/`` removed and nothing else
    touched.
@@ -94,6 +100,17 @@ def env_name_for(key: str) -> str:
     return f"{env_prefix(key)}_TOKEN"
 
 
+def credential_free(config: dict) -> bool:
+    """A server with no upstream has nothing to authenticate to: its committed config names no ``baseUrl`` and no
+    auth scheme (``auth`` absent, null, or ``{"scheme": "none"}``), a local-computation server. It smokes and
+    registers with no secret variable. Any other server, and an --from-npm install (no config to read), reads the
+    one ``<SERVER>_TOKEN`` variable."""
+    if not config or "baseUrl" in config:
+        return False
+    auth = config.get("auth")
+    return auth is None or (isinstance(auth, dict) and auth.get("scheme") == "none")
+
+
 def crew_origin(flag: str | None) -> str:
     """The daemon THIS run belongs to — never a guessed port (garden#1258)."""
     origin = flag or os.environ.get("WICKED_CREW_URL")
@@ -152,14 +169,40 @@ def _now() -> str:
     return datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="seconds")
 
 
+NPM_META = ("npm error path ", "npm error syscall ", "npm error errno ", "npm error command ", "npm error workspace ",
+            "npm error location ", "npm error signal ", "npm error cwd ")
+
+
+def _lines(output: str) -> list[str]:
+    return [ln.strip() for ln in (output or "").splitlines()
+            if ln.strip() not in ("", "npm error") and "A complete log of this run" not in ln]
+
+
+def _why(stderr: str, stdout: str = "") -> str:
+    """What went wrong, in one line. npm ends with a pointer at its debug log; its reason is the ``npm error code``
+    line and the first line after it that is not metadata (path, syscall, errno, command), e.g. "npm error code
+    EUSAGE npm error The `npm ci` command can only install with an existing package-lock.json...". A script that
+    failed (``npm error code 1``: npm run build) printed its own reason, usually on stdout (tsc): its last line
+    rides along. With nothing useful on stderr, the last line of stdout."""
+    err, out = _lines(stderr), _lines(stdout)
+    codes = [i for i, ln in enumerate(err) if ln.startswith("npm error code")]
+    if codes:
+        head = err[codes[0]]
+        detail = next((ln for ln in err[codes[0] + 1:] if not ln.startswith(NPM_META)), None)
+        parts = [head, *([detail] if detail else [])]
+        if head == "npm error code 1" and out:
+            parts.append(out[-1])
+        return " ".join(parts)
+    return (err or out or [""])[-1]
+
+
 def _run(argv: list[str], cwd: Path, what: str, timeout: float = NPM_TIMEOUT_S) -> None:
     try:
         done = subprocess.run(argv, cwd=cwd, capture_output=True, text=True, timeout=timeout)
     except (OSError, subprocess.TimeoutExpired) as err:
         raise Failure(1, f"{what} failed: {err}") from err
     if done.returncode != 0:
-        tail = (done.stderr or done.stdout).strip().splitlines()[-1:] or [""]
-        raise Failure(1, f"{what} exited {done.returncode}: {tail[0][:300]}")
+        raise Failure(1, f"{what} exited {done.returncode}: {_why(done.stderr, done.stdout)[:300]}")
 
 
 def _npm() -> str:
@@ -224,6 +267,14 @@ def find_configs(tree: Path) -> list[Path]:
     return found
 
 
+def run_tree() -> Path:
+    """The run's worktree for ``--from-run``. The engine runs an install Tool phase IN the worktree and hands
+    ``$WICKED_TREE`` as that worktree's git tree id (wicked-core#776), never a path; reading the id as a path found
+    no server config in any real run. A ``$WICKED_TREE`` that names a directory is still honoured, else the cwd."""
+    named = os.environ.get("WICKED_TREE")
+    return Path(named) if named and Path(named).is_dir() else Path.cwd()
+
+
 def locate(args) -> tuple[Path | None, dict]:
     if args.dir is not None:
         config_path = args.dir / CONFIG_NAME
@@ -232,7 +283,7 @@ def locate(args) -> tuple[Path | None, dict]:
                 return None, {}
             raise Failure(2, f"{args.dir} has no {CONFIG_NAME}; scaffold the server first")
     elif args.from_run:
-        tree = Path(os.environ.get("WICKED_TREE") or os.getcwd())
+        tree = run_tree()
         found = find_configs(tree)
         if len(found) != 1:
             names = ", ".join(str(p) for p in found) or "none"
@@ -252,8 +303,9 @@ def locate(args) -> tuple[Path | None, dict]:
 
 # ── 3. smoke ───────────────────────────────────────────────────────────────────────────────
 
-def smoke(server_js: Path, var: str) -> tuple[str, dict]:
-    argv = [sys.executable, str(PROBE), "--timeout", str(PROBE_TIMEOUT_S), "--env", var, "--",
+def smoke(server_js: Path, var: str | None) -> tuple[str, dict]:
+    env_args = ["--env", var] if var else []
+    argv = [sys.executable, str(PROBE), "--timeout", str(PROBE_TIMEOUT_S), *env_args, "--",
             "node", str(server_js)]
     try:
         done = subprocess.run(argv, capture_output=True, text=True, timeout=PROBE_TIMEOUT_S + 30)
@@ -262,7 +314,7 @@ def smoke(server_js: Path, var: str) -> tuple[str, dict]:
         return "failed", {"ok": False, "error": f"probe did not run: {err}"}
     if report.get("ok") is True:
         return "ok", report
-    if var in (report.get("stderrNames") or []):
+    if var and var in (report.get("stderrNames") or []):
         return "pending_credential", report
     return "failed", report
 
@@ -311,9 +363,10 @@ def check_key(origin: str, key: str, server_js: Path) -> dict | None:
 
 # ── 5. register ────────────────────────────────────────────────────────────────────────────
 
-def register(origin: str, key: str, server_js: Path, var: str) -> dict:
-    body = {"name": key, "kind": "mcp-stdio", "command": "node", "args": [str(server_js)],
-            "auth": {"ref": f"env:{var}", "env": var}}
+def register(origin: str, key: str, server_js: Path, var: str | None) -> dict:
+    body: dict = {"name": key, "kind": "mcp-stdio", "command": "node", "args": [str(server_js)]}
+    if var:
+        body["auth"] = {"ref": f"env:{var}", "env": var}
     try:
         status, preview = http_json("POST", f"{origin}/api/v1/mcp/servers/preview", body)
     except (urllib.error.URLError, OSError):
@@ -396,6 +449,19 @@ def _source(server_dir: Path | None, npm_spec: str | None) -> dict:
             "dir": str(server_dir)}
 
 
+def lockfile_state(server_dir: Path | None, npm_spec: str | None) -> str | None:
+    """Whether the server's dependency versions were delivered with it (``"delivered"``) or are chosen when it
+    installs (``"resolved at install"``: no package-lock.json in the server dir). ``None`` for --from-npm."""
+    if npm_spec or server_dir is None:
+        return None
+    return "delivered" if (server_dir / "package-lock.json").is_file() else "resolved at install"
+
+
+def resolve_dir(next_dir: Path) -> Path:
+    """Where a server delivered without a lock is copied, resolved and built: beside next/, and as transient."""
+    return next_dir.with_name("resolve")
+
+
 def stage(server_dir: Path | None, npm_spec: str | None, next_dir: Path) -> Path:
     """Build + copy into next/; the server.js path inside next/."""
     npm = _npm()
@@ -407,15 +473,29 @@ def stage(server_dir: Path | None, npm_spec: str | None, next_dir: Path) -> Path
         server_js = next_dir / "node_modules" / Path(*pkg.split("/")) / "dist" / "server.js"
     else:
         assert server_dir is not None
-        _run([npm, "ci", "--ignore-scripts"], server_dir, "npm ci (server dir)")
-        _run([npm, "run", "build"], server_dir, "npm run build")
-        if not (server_dir / "dist").is_dir():
+        if lockfile_state(server_dir, None) == "delivered":
+            build_dir = server_dir
+            _run([npm, "ci", "--ignore-scripts"], build_dir, "npm ci (server dir)")
+        else:
+            # `npm ci` refuses a tree with no lock, and every server a container seat builds has none (the seat
+            # cannot reach the registry; j6-cert, unit-convert, 2026-10-26). The lock is resolved in a throwaway
+            # copy beside next/, never in the delivered tree: a lock left there would read as "delivered" on the
+            # next plan, and it is a write the consent plan does not list.
+            build_dir = resolve_dir(next_dir)
+            shutil.copytree(server_dir, build_dir, ignore=shutil.ignore_patterns("node_modules", "dist", ".git"))
+            _run([npm, "install", "--package-lock=true", "--ignore-scripts", "--no-audit", "--no-fund"], build_dir,
+                 "npm install (no package-lock.json delivered)")
+            if not (build_dir / "package-lock.json").is_file():
+                raise Failure(1, "npm install wrote no package-lock.json, so the staged copy cannot be installed "
+                                 "from a lock; nothing was installed")
+        _run([npm, "run", "build"], build_dir, "npm run build")
+        if not (build_dir / "dist").is_dir():
             raise Failure(1, f"npm run build left no dist/ in {server_dir}")
         next_dir.mkdir(parents=True)
-        shutil.copytree(server_dir / "dist", next_dir / "dist")
+        shutil.copytree(build_dir / "dist", next_dir / "dist")
         for name in STAGE_FILES:
-            if (server_dir / name).is_file():
-                shutil.copy2(server_dir / name, next_dir / name)
+            if (build_dir / name).is_file():
+                shutil.copy2(build_dir / name, next_dir / name)
         if not (next_dir / "package-lock.json").is_file():
             raise Failure(1, f"{server_dir} has no package-lock.json (npm ci needs it)")
         _run([npm, "ci", "--omit=dev", "--ignore-scripts"], next_dir, "npm ci --omit=dev (staged copy)")
@@ -451,18 +531,20 @@ def do_install(args) -> tuple[int, dict]:
     version = config.get("version")
     if args.from_npm:
         version = NPM_SPEC_RE.match(args.from_npm).group("version")
-    var = env_name_for(key)
+    var = None if credential_free(config) else env_name_for(key)
     root = install_root(args.install_root)
     key_root = root / key
     next_dir = key_root / "next"
     origin = crew_origin(args.crew_url)
     check_key(origin, key, key_root / "current" / installed_rel(args.from_npm))
-    if next_dir.is_symlink():
-        next_dir.unlink()
-    elif next_dir.exists():
-        shutil.rmtree(next_dir)  # a stale half-staged copy from an interrupted run
+    for stale in (next_dir, resolve_dir(next_dir)):  # a half-staged copy from an interrupted run
+        if stale.is_symlink():
+            stale.unlink()
+        elif stale.exists():
+            shutil.rmtree(stale)
     key_root.mkdir(parents=True, exist_ok=True)
 
+    lock = lockfile_state(server_dir, args.from_npm)  # before staging: an `npm install` there writes one
     try:
         staged_js = stage(server_dir if not args.from_npm else None, args.from_npm, next_dir)
         smoke_state, probe_report = smoke(staged_js, var)
@@ -471,11 +553,14 @@ def do_install(args) -> tuple[int, dict]:
     except Failure:
         shutil.rmtree(next_dir, ignore_errors=True)
         raise
+    finally:
+        shutil.rmtree(resolve_dir(next_dir), ignore_errors=True)
     swap(key_root)
     current_js = key_root / "current" / staged_js.relative_to(next_dir)
 
     record = {"key": key, "version": version, "source": _source(server_dir, args.from_npm),
-              "command": "node", "args": [str(current_js)], "envNames": [var],
+              **({"lockfile": lock} if lock else {}),
+              "command": "node", "args": [str(current_js)], "envNames": [var] if var else [],
               "installedAt": _now()}
     code = 0
     try:
@@ -552,7 +637,8 @@ def do_plan(args) -> dict:
         _cli_rows(installer([*upsert, *worker_home_args()], download=False), root, worker_writes, skipped)
         operator_writes = list(worker_writes)
         _cli_rows(installer(upsert, download=False), root, operator_writes, skipped)
-    return {"dry_run": True, "key": key, "choices": [
+    lock = lockfile_state(server_dir, args.from_npm)
+    return {"dry_run": True, "key": key, **({"lockfile": lock} if lock else {}), "choices": [
         {"id": "worker", "label": CHOICE_LABELS["worker"], "default": True, "writes": worker_writes},
         {"id": "operator", "label": CHOICE_LABELS["operator"], "writes": operator_writes}],
         "skipped": skipped}
@@ -596,7 +682,7 @@ def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     where = parser.add_mutually_exclusive_group()
     where.add_argument("--from-run", action="store_true",
-                       help=f"find the one {CONFIG_NAME} under $WICKED_TREE (else the cwd)")
+                       help=f"find the one {CONFIG_NAME} in the run's worktree (the cwd, or $WICKED_TREE when it names a directory)")
     where.add_argument("--dir", type=Path, help="the server directory")
     where.add_argument("--uninstall", metavar="KEY", help="unregister and remove an installed server")
     parser.add_argument("--key", help="the server key (must equal the config's key)")

package/skills/mcp-scaffold/SKILL.md

@@ -203,8 +203,8 @@ wicked-garden run scripts/mcp/install.py --uninstall <key> [--target worker|oper
 Installs the built TypeScript server — or updates the installed copy — idempotent by the
 config's `key`:
 
-1. **Locate**: `--from-run` finds the one `mcp-server.config.json` under `$WICKED_TREE`
-   (else the cwd), outside `node_modules`/`dist`; more or fewer than one exits 2 naming the
+1. **Locate**: `--from-run` finds the one `mcp-server.config.json` in the run's worktree (the
+   cwd; `$WICKED_TREE` is the worktree's tree id, used only when it names a directory), outside `node_modules`/`dist`; more or fewer than one exits 2 naming the
    candidates. `--dir` names it. The version is the config's `version`.
 2. **Stage**: `npm ci --ignore-scripts && npm run build` in the server dir, then `dist/`,
    `package.json`, `package-lock.json`, `tools.json` and `mcp-server.config.json` are copied