MCP agent DX: checkpoint lock blocks read-only tools, per-call project scope, duplicate-page substitutions

[Densrt]

Three smaller papercuts from agency-style usage (fleet of projects, SEO page
factories). Tested on 0.277.0 and re-verified on 0.278.0.

1. workflow.next locks out read-only tools

After calling workflow.next {"goal":"design-system-page"}, EVERY subsequent tool
call fails with CHECKPOINT_REQUIRED until checkpoint.ack, including pure reads like
list-pages or meta.get_more_tools (reproduced over stdio). The enforced checkpoint
idea is great for mutations, but blocking discovery/read tools forces interactive
agents into ack round-trips that add no safety. Suggestion: scope the lock to
mutating tools, or add an opt-out for interactive/streaming agents.

2. One project per directory/session

The config binds one directory to one project, sessions are exclusive
(PROJECT_SESSION_BUSY), and no tool takes a project selector. For an agency managing
10+ Webstudio projects on one machine, that means N checkouts and N server processes.
A --project scope at startup or an optional per-call project selector (with the
share-link permission model already in place, permits would still apply) would make
fleet automation dramatically cheaper.

3. duplicate-page with substitutions

duplicate-page only takes pageId/name/path. The most common agency use case for
duplication is programmatic SEO (same page per city/product), which needs find/replace
of text and variable/dataSource references as part of the copy. Doing it after the
fact with replace-text/replace-prop-text does not cover page-scoped
variables/resources cloned by the duplicate. A substitutions option (text map and/or
variable value overrides) on duplicate-page would unlock that workflow in one call.

Related praise: insert-collection in 0.278.0 (atomic Collection + parameters +
bindings, with expression-backed data) is exactly the right direction for this kind
of high-level semantic tool.

[kof]

Implementation plan:

• Allow read-only MCP discovery and inspection tools while a workflow checkpoint is pending; continue blocking mutations and state-changing session tools until checkpoint.ack.
• Make the read/mutation classification derive from existing tool annotations, with regression coverage for operation tools, meta tools, resources, and checkpoint acknowledgement.
• Add an explicit MCP --project <projectId> startup/call scope that resolves existing saved credentials without relinking the current directory.
• Isolate selected-project session/checkpoint data by project so concurrent projects do not share locks or cached state.
• Add duplicate-page substitutions for copied page text and copied page-scoped variable values, applied atomically during duplication.
• Preserve cloned IDs and expression bindings while substitutions affect only the new page and its copied data.
• Document the new project-scoping and duplication workflows, including exact CLI/MCP examples.
• Add meaningful regression tests for all three reported workflows and their failure/edge cases.
• Run a first simplification pass focused on shared policy and data flow.
• Run a second simplification pass focused on API semantics, naming, and removing unnecessary code.
• Review the complete diff for correctness, DRY, organization, compatibility, and test quality; fix every actionable finding.
• Run repository checks and update this checklist with verified results.