@0dai-dev/cli 4.3.5 → 4.3.7

package/lib/ai/meta/manifest/mcp-tool-tiers.json

@@ -0,0 +1,435 @@
+{
+  "exposure": {
+    "free": {
+      "count": 49,
+      "tools": [
+        "get_project_manifest",
+        "get_project_context",
+        "get_codebase_map",
+        "get_commands",
+        "get_environment",
+        "get_ai_version",
+        "get_project_health",
+        "mcp_tier_load",
+        "get_bulletins",
+        "get_applied_lock",
+        "get_custom_stacks",
+        "get_discovery",
+        "get_personas",
+        "get_registry",
+        "get_telemetry_summary",
+        "citation_audit",
+        "get_specs",
+        "master_plan_read",
+        "search_experience",
+        "record_experience",
+        "score_candidates",
+        "get_federation",
+        "get_project_graph",
+        "get_model_ratings",
+        "get_anomaly_taxonomy",
+        "get_anomaly_events",
+        "get_anomaly_summary",
+        "get_agent_activity",
+        "get_ghost_critiques",
+        "get_token_telemetry",
+        "verdict_count",
+        "idle_watchdog_status",
+        "get_pool_state",
+        "pool_query_free",
+        "pool_health",
+        "debug_probe",
+        "parse_content",
+        "memory_add",
+        "memory_search",
+        "memory_list",
+        "memory_delete",
+        "memory_verify",
+        "memory_inject",
+        "gh_label_create",
+        "gh_issue_edit_body",
+        "gh_pr_diff",
+        "propose_file_change",
+        "session_productivity",
+        "session_productivity_pool"
+      ]
+    },
+    "pro": {
+      "count": 113,
+      "tools": [
+        "get_project_manifest",
+        "get_project_context",
+        "get_codebase_map",
+        "get_commands",
+        "get_environment",
+        "get_ai_version",
+        "get_project_health",
+        "mcp_tier_load",
+        "get_bulletins",
+        "get_applied_lock",
+        "get_custom_stacks",
+        "get_discovery",
+        "get_personas",
+        "get_registry",
+        "get_telemetry_summary",
+        "citation_audit",
+        "get_specs",
+        "master_plan_read",
+        "search_experience",
+        "record_experience",
+        "score_candidates",
+        "get_federation",
+        "get_project_graph",
+        "get_model_ratings",
+        "get_anomaly_taxonomy",
+        "get_anomaly_events",
+        "get_anomaly_summary",
+        "get_agent_activity",
+        "get_ghost_critiques",
+        "get_token_telemetry",
+        "verdict_count",
+        "idle_watchdog_status",
+        "get_pool_state",
+        "pool_query_free",
+        "pool_health",
+        "debug_probe",
+        "parse_content",
+        "memory_add",
+        "memory_search",
+        "memory_list",
+        "memory_delete",
+        "memory_verify",
+        "memory_inject",
+        "gh_label_create",
+        "gh_issue_edit_body",
+        "gh_pr_diff",
+        "propose_file_change",
+        "session_productivity",
+        "session_productivity_pool",
+        "get_swarm_status",
+        "swarm_delegate",
+        "peer_delegate_request",
+        "peer_delegate_list",
+        "peer_delegate_status",
+        "peer_delegate_accept",
+        "peer_delegate_decline",
+        "peer_delegate_complete",
+        "peer_delegate_sessions",
+        "swarm_run",
+        "run_task",
+        "watch_tasks",
+        "get_portfolio",
+        "estimate_task_cost",
+        "recommend_model",
+        "get_working_group_profiles",
+        "working_group_deliberate",
+        "get_working_group_history",
+        "working_group_research",
+        "get_audit_log",
+        "scan_secrets",
+        "get_compliance_report",
+        "get_role_policy",
+        "create_spec",
+        "update_decision",
+        "save_session",
+        "submit_feedback",
+        "undo_mutation",
+        "record_anomaly",
+        "pool_checkin",
+        "pool_checkout",
+        "loop_kick",
+        "task_cancel",
+        "idle_watchdog_pause",
+        "web_search",
+        "capture_screenshot",
+        "mcp__openrouter__list_models",
+        "mcp__openrouter__invoke",
+        "get_org_policy",
+        "get_maturity_score",
+        "get_mcp_catalog",
+        "get_agent_teams",
+        "get_plugins",
+        "check_approval",
+        "list_projects",
+        "get_project_health_multi",
+        "get_daily_digest",
+        "get_session",
+        "check_conflicts",
+        "get_activity_feed",
+        "get_knowledge_base",
+        "get_wal",
+        "get_prompt_history",
+        "get_observability",
+        "get_orchestration",
+        "get_graph_context",
+        "trace_task",
+        "get_distilled_rules",
+        "get_substrate_health",
+        "gh_pr_merge_safe",
+        "rebase_orchestrator",
+        "fallback_chain_resolver",
+        "memory_traverse",
+        "memory_search_v2"
+      ]
+    }
+  },
+  "discovery": {
+    "core": {
+      "count": 15,
+      "tools": [
+        "mcp_tier_load",
+        "memory_search",
+        "get_project_health",
+        "get_session",
+        "get_bulletins",
+        "get_project_manifest",
+        "get_codebase_map",
+        "get_commands",
+        "get_discovery",
+        "get_specs",
+        "search_experience",
+        "record_experience",
+        "get_activity_feed",
+        "check_approval",
+        "get_role_policy"
+      ]
+    },
+    "on_demand": {
+      "count": 81,
+      "tools": [
+        "get_project_context",
+        "get_environment",
+        "get_ai_version",
+        "get_applied_lock",
+        "get_custom_stacks",
+        "get_personas",
+        "get_registry",
+        "get_telemetry_summary",
+        "citation_audit",
+        "master_plan_read",
+        "score_candidates",
+        "get_federation",
+        "get_project_graph",
+        "get_model_ratings",
+        "get_anomaly_taxonomy",
+        "get_anomaly_events",
+        "get_anomaly_summary",
+        "get_agent_activity",
+        "get_ghost_critiques",
+        "get_token_telemetry",
+        "verdict_count",
+        "idle_watchdog_status",
+        "get_pool_state",
+        "pool_query_free",
+        "pool_health",
+        "debug_probe",
+        "parse_content",
+        "memory_add",
+        "memory_list",
+        "memory_verify",
+        "gh_pr_diff",
+        "session_productivity",
+        "session_productivity_pool",
+        "get_swarm_status",
+        "swarm_delegate",
+        "peer_delegate_request",
+        "peer_delegate_list",
+        "peer_delegate_status",
+        "peer_delegate_accept",
+        "peer_delegate_decline",
+        "peer_delegate_complete",
+        "peer_delegate_sessions",
+        "swarm_run",
+        "run_task",
+        "watch_tasks",
+        "get_portfolio",
+        "estimate_task_cost",
+        "recommend_model",
+        "get_working_group_profiles",
+        "working_group_deliberate",
+        "get_working_group_history",
+        "working_group_research",
+        "get_audit_log",
+        "scan_secrets",
+        "get_compliance_report",
+        "save_session",
+        "loop_kick",
+        "web_search",
+        "capture_screenshot",
+        "mcp__openrouter__list_models",
+        "mcp__openrouter__invoke",
+        "get_org_policy",
+        "get_maturity_score",
+        "get_mcp_catalog",
+        "get_agent_teams",
+        "get_plugins",
+        "list_projects",
+        "get_project_health_multi",
+        "get_daily_digest",
+        "check_conflicts",
+        "get_knowledge_base",
+        "get_wal",
+        "get_prompt_history",
+        "get_observability",
+        "get_orchestration",
+        "get_graph_context",
+        "trace_task",
+        "get_distilled_rules",
+        "get_substrate_health",
+        "memory_traverse",
+        "memory_search_v2"
+      ]
+    },
+    "hidden": {
+      "count": 17,
+      "tools": [
+        "memory_delete",
+        "memory_inject",
+        "gh_label_create",
+        "gh_issue_edit_body",
+        "propose_file_change",
+        "create_spec",
+        "update_decision",
+        "submit_feedback",
+        "undo_mutation",
+        "record_anomaly",
+        "pool_checkin",
+        "pool_checkout",
+        "task_cancel",
+        "idle_watchdog_pause",
+        "gh_pr_merge_safe",
+        "rebase_orchestrator",
+        "fallback_chain_resolver"
+      ]
+    }
+  },
+  "schema_version": 1,
+  "source": "scripts/mcp_tier_config.py",
+  "tiers": {
+    "free_only": {
+      "count": 49,
+      "tools": [
+        "get_project_manifest",
+        "get_project_context",
+        "get_codebase_map",
+        "get_commands",
+        "get_environment",
+        "get_ai_version",
+        "get_project_health",
+        "mcp_tier_load",
+        "get_bulletins",
+        "get_applied_lock",
+        "get_custom_stacks",
+        "get_discovery",
+        "get_personas",
+        "get_registry",
+        "get_telemetry_summary",
+        "citation_audit",
+        "get_specs",
+        "master_plan_read",
+        "search_experience",
+        "record_experience",
+        "score_candidates",
+        "get_federation",
+        "get_project_graph",
+        "get_model_ratings",
+        "get_anomaly_taxonomy",
+        "get_anomaly_events",
+        "get_anomaly_summary",
+        "get_agent_activity",
+        "get_ghost_critiques",
+        "get_token_telemetry",
+        "verdict_count",
+        "idle_watchdog_status",
+        "get_pool_state",
+        "pool_query_free",
+        "pool_health",
+        "debug_probe",
+        "parse_content",
+        "memory_add",
+        "memory_search",
+        "memory_list",
+        "memory_delete",
+        "memory_verify",
+        "memory_inject",
+        "gh_label_create",
+        "gh_issue_edit_body",
+        "gh_pr_diff",
+        "propose_file_change",
+        "session_productivity",
+        "session_productivity_pool"
+      ]
+    },
+    "pro_only": {
+      "count": 64,
+      "tools": [
+        "get_swarm_status",
+        "swarm_delegate",
+        "peer_delegate_request",
+        "peer_delegate_list",
+        "peer_delegate_status",
+        "peer_delegate_accept",
+        "peer_delegate_decline",
+        "peer_delegate_complete",
+        "peer_delegate_sessions",
+        "swarm_run",
+        "run_task",
+        "watch_tasks",
+        "get_portfolio",
+        "estimate_task_cost",
+        "recommend_model",
+        "get_working_group_profiles",
+        "working_group_deliberate",
+        "get_working_group_history",
+        "working_group_research",
+        "get_audit_log",
+        "scan_secrets",
+        "get_compliance_report",
+        "get_role_policy",
+        "create_spec",
+        "update_decision",
+        "save_session",
+        "submit_feedback",
+        "undo_mutation",
+        "record_anomaly",
+        "pool_checkin",
+        "pool_checkout",
+        "loop_kick",
+        "task_cancel",
+        "idle_watchdog_pause",
+        "web_search",
+        "capture_screenshot",
+        "mcp__openrouter__list_models",
+        "mcp__openrouter__invoke",
+        "get_org_policy",
+        "get_maturity_score",
+        "get_mcp_catalog",
+        "get_agent_teams",
+        "get_plugins",
+        "check_approval",
+        "list_projects",
+        "get_project_health_multi",
+        "get_daily_digest",
+        "get_session",
+        "check_conflicts",
+        "get_activity_feed",
+        "get_knowledge_base",
+        "get_wal",
+        "get_prompt_history",
+        "get_observability",
+        "get_orchestration",
+        "get_graph_context",
+        "trace_task",
+        "get_distilled_rules",
+        "get_substrate_health",
+        "gh_pr_merge_safe",
+        "rebase_orchestrator",
+        "fallback_chain_resolver",
+        "memory_traverse",
+        "memory_search_v2"
+      ]
+    }
+  },
+  "updated_at": "2026-05-30",
+  "upgrade_message": "This tool requires Pro plan ($15/mo). Run: 0dai upgrade"
+}

package/lib/ai/registry/mcp-catalog.json

@@ -0,0 +1,98 @@
+{
+  "managed": true,
+  "schema": 1,
+  "description": "Stack-specific MCP server recommendations. During init/sync, 0dai merges these into .mcp.json based on detected stack.",
+  "common": {
+    "filesystem": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem", "."],
+      "description": "Local filesystem access"
+    },
+    "sequential-thinking": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-sequential-thinking"],
+      "description": "Structured multi-step reasoning. Call as first action for architectural work, multi-file refactors, non-obvious debugging, and plans longer than 3 steps."
+    },
+    "context7": {
+      "command": "npx",
+      "args": ["-y", "@upstash/context7-mcp@latest"],
+      "description": "Current library/framework/SDK documentation lookup. Call resolve-library-id then get-library-docs before writing code that uses a third-party API — training data may be outdated."
+    },
+    "fetch": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-fetch"],
+      "description": "External HTTP content (blog posts, RFCs, changelogs). Use context7 for library docs instead."
+    }
+  },
+  "stacks": {
+    "node": {
+      "servers": {}
+    },
+    "nextjs": {
+      "servers": {}
+    },
+    "react-native": {
+      "servers": {}
+    },
+    "python": {
+      "servers": {
+        "python-repl": {
+          "command": "npx",
+          "args": ["-y", "@anthropic-ai/mcp-server-python"],
+          "description": "Python REPL and execution"
+        }
+      }
+    },
+    "python-service": {
+      "servers": {
+        "python-repl": {
+          "command": "npx",
+          "args": ["-y", "@anthropic-ai/mcp-server-python"],
+          "description": "Python REPL and execution"
+        }
+      }
+    },
+    "fastapi": {
+      "servers": {
+        "python-repl": {
+          "command": "npx",
+          "args": ["-y", "@anthropic-ai/mcp-server-python"],
+          "description": "Python REPL and execution"
+        }
+      }
+    },
+    "data-ml": {
+      "servers": {
+        "python-repl": {
+          "command": "npx",
+          "args": ["-y", "@anthropic-ai/mcp-server-python"],
+          "description": "Python REPL and execution"
+        }
+      }
+    },
+    "go-service": {
+      "servers": {}
+    },
+    "flutter": {
+      "servers": {}
+    },
+    "fullstack-monorepo": {
+      "servers": {}
+    },
+    "django": {
+      "servers": {
+        "python-repl": {
+          "command": "npx",
+          "args": ["-y", "@anthropic-ai/mcp-server-python"],
+          "description": "Python REPL and execution"
+        }
+      }
+    },
+    "terraform": {
+      "servers": {}
+    },
+    "kubernetes": {
+      "servers": {}
+    }
+  }
+}

package/lib/commands/auth.js

@@ -471,8 +471,9 @@ async function cmdAuthStatus() {
   log(`${email} (${status.plan || auth.plan || "free"} plan)`);
   if (status.usage_today) {
     console.log("  Usage today:");
+    const limits = status.limits || {};
     for (const [k, v] of Object.entries(status.usage_today))
-      console.log(`    ${k}: ${v} / ${status.limits[k]}`);
+      console.log(`    ${k}: ${v} / ${limits[k] ?? "?"}`);
   }
   const license = status.license || auth.license || { status: "inactive" };
   console.log(`  Activation: ${license.status || "inactive"}${license.activation_id ? ` (${license.activation_id})` : ""}`);
@@ -481,6 +482,54 @@ async function cmdAuthStatus() {
   }
 }
 
+// Disclosure text for the remote activation event.
+// Exported so tests can assert the notice references the real payload fields.
+const ACTIVATION_TELEMETRY_NOTICE =
+  "Telemetry: on activation, 0dai sends an event (free_tier_activated, timestamp, "
+  + "path=cli://activate-free, source=cli) to api.0dai.dev/v1/events via your "
+  + "authenticated session with a device identifier (X-Device-ID header). "
+  + "To opt out: set DO_NOT_TRACK=1 or ODAI_NO_TELEMETRY=1.";
+
+/**
+ * Post a best-effort activation event to the remote analytics endpoint.
+ *
+ * Opt-out: set DO_NOT_TRACK=1 or ODAI_NO_TELEMETRY=1 in the environment.
+ * When opted out, the local activation log (ai/meta/telemetry/activation.jsonl)
+ * is NOT affected — only the remote HTTP POST is skipped.
+ *
+ * @param {object} [deps]
+ * @param {Function} [deps.apiCallFn] - injectable stand-in for apiCall (tests)
+ * @param {object}  [deps.env]        - injectable env (defaults to process.env)
+ * @param {Function} [deps.print]     - injectable print fn (defaults to console.log)
+ */
+async function trackFreeTierActivated(deps = {}) {
+  const env = deps.env || process.env;
+  const print = deps.print || console.log;
+  const callFn = deps.apiCallFn || apiCall;
+
+  // Honour standard cross-ecosystem opt-out AND 0dai-specific form.
+  if (env.DO_NOT_TRACK === "1" || env.ODAI_NO_TELEMETRY === "1") {
+    return; // remote POST skipped; local log is unaffected
+  }
+
+  // One-time honest disclosure: what is sent, where, and how to opt out.
+  print(ACTIVATION_TELEMETRY_NOTICE);
+
+  try {
+    await callFn("/v1/events", {
+      events: [{
+        event: "free_tier_activated",
+        timestamp: new Date().toISOString(),
+        path: "cli://activate-free",
+        page: "0dai activate free",
+        props: { source: "cli" },
+      }],
+    });
+  } catch {
+    // best-effort telemetry — network failure is non-fatal
+  }
+}
+
 async function cmdActivateFree() {
   const ensureAuthenticated = makeEnsureAuthenticated(cmdAuthLogin);
   await ensureAuthenticated("activation");
@@ -488,6 +537,9 @@ async function cmdActivateFree() {
   log(`license ${license.status}`);
   console.log(`  activation id: ${license.activation_id}`);
   console.log(`  plan: ${license.plan || "free"}`);
+  if (license.status === "active") {
+    await trackFreeTierActivated();
+  }
 }
 
 async function cmdActivateStatus() {
@@ -523,4 +575,6 @@ module.exports = {
   parseActivationArgs,
   parseAuthLoginFlags,
   printDeviceLoginInstructions,
+  trackFreeTierActivated,
+  ACTIVATION_TELEMETRY_NOTICE,
 };

package/lib/commands/compliance.js

@@ -4,7 +4,7 @@ const shared = require("../shared");
 const { D, R, findRepoScript, log, spawnSync } = shared;
 
 function cmdCompliance(target, args) {
-  const complianceScript = findRepoScript(target, "compliance_report.py");
+  const complianceScript = shared.resolvePythonScript(target, "compliance_report.py");
   if (!complianceScript) {
     log("compliance helper unavailable in this environment");
     console.log(`  ${D}Expected scripts/compliance_report.py in repo checkout${R}`);

package/lib/commands/detect.js

@@ -1,15 +1,21 @@
 "use strict";
 const shared = require("../shared");
-const { D, R, log, apiCall, collectMetadata } = shared;
+const { D, R, log, apiCall, collectMetadata, buildProjectIdentity, hashManifestFiles } = shared;
 
 async function cmdDetect(target) {
   const OPTIONAL_CLIS = ["gemini", "aider", "opencode"];
-  const { projectFiles, manifestContents, clis: localClis } = collectMetadata(target);
-  // Send file contents AND local CLI inventory so server can do content-based detection
+  const metadata = collectMetadata(target);
+  const { projectFiles, manifestContents, clis: localClis } = metadata;
+  const identity = buildProjectIdentity(target, metadata);
+  // Privacy: send only filenames + SHA-256 hashes, never raw content (closes #4016).
+  // Local stack detection is pre-computed and passed as `stack`; server works from
+  // project_files + client-derived stack, not file content.
   const result = await apiCall("/v1/detect", {
     project_files: projectFiles,
-    manifest_contents: manifestContents,
+    manifest_files: hashManifestFiles(manifestContents),
     available_clis: localClis,
+    project_name: identity.project_name,
+    stack: identity.stack,
   });
   if (result.error) { log(`error: ${result.error}`); return; }
   console.log(`stack: ${result.stack || "?"}`);