@agentistics/mcp 2.74.2 → 2.76.0

package/dist/agentistics-mcp.js

@@ -171,6 +171,51 @@ var DEFAULT_TEAM = Object.freeze({
   connections: Object.freeze([])
 });
 var SHARE_SOURCE_TYPES = new Set(["repo", "project", "none"]);
+// ../core/src/redact.ts
+var REDACTION = "[REDACTED]";
+var PLACEHOLDER = /^(\*+|x+|\.+|-+|<[^>]*>|\{[^}]*\}|\$\{?[A-Z_][A-Z0-9_]*\}?|your[-_]?\w*|todo|changeme|none|null|nil|empty|redacted|\[redacted\])$/i;
+function looksSecret(value) {
+  const v = value.trim().replace(/^["']|["']$/g, "");
+  if (v.length < 12)
+    return false;
+  if (PLACEHOLDER.test(v))
+    return false;
+  if (/^\d+$/.test(v))
+    return false;
+  if (/\s/.test(v))
+    return false;
+  const classes = [/[a-z]/.test(v), /[A-Z]/.test(v), /\d/.test(v), /[^A-Za-z0-9]/.test(v)].filter(Boolean).length;
+  return classes >= 2;
+}
+function guarded(whole, prefix, value) {
+  return looksSecret(value) ? `${prefix}${REDACTION}` : whole;
+}
+var STRONG = [
+  /-----BEGIN[^-]*PRIVATE KEY-----[\s\S]*?-----END[^-]*PRIVATE KEY-----/g,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+  /\bsk-ant-[A-Za-z0-9\-_]{16,}/g,
+  /\bsk-(?:proj-)?[A-Za-z0-9\-_]{20,}/g,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /\bAIza[A-Za-z0-9\-_]{35}/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /\beyJ[A-Za-z0-9\-_]{8,}\.eyJ[A-Za-z0-9\-_]{8,}\.[A-Za-z0-9\-_]{8,}/g,
+  /\bact1_[A-Za-z0-9\-_]+\.[A-Za-z0-9]{16,}/g
+];
+var URI_CREDENTIAL = /\b([a-z][a-z0-9+.\-]*:\/\/[^\s:/@"']+:)([^\s@"']+)@/gi;
+var ASSIGNMENT = /(^|[^A-Za-z0-9_])((?:[A-Za-z0-9]+[_-])*(?:pass(?:word|wd)?|pwd|secret|token|auth|credentials?|api[_-]?key|access[_-]?key|private[_-]?key)[a-z0-9_-]*\s*[:=]\s*)(["']?[^\s"',;]+["']?)/gi;
+var BEARER = /\b(Bearer\s+)([A-Za-z0-9\-._~+/]{12,}=*)/g;
+function redactSecrets(text) {
+  if (typeof text !== "string" || text === "")
+    return "";
+  let out = text;
+  for (const re of STRONG)
+    out = out.replace(re, REDACTION);
+  out = out.replace(URI_CREDENTIAL, (whole, prefix, pw) => PLACEHOLDER.test(pw) ? whole : `${prefix}${REDACTION}@`);
+  out = out.replace(ASSIGNMENT, (whole, lead, prefix, value) => guarded(whole, `${lead}${prefix}`, value));
+  out = out.replace(BEARER, (whole, prefix, value) => guarded(whole, prefix, value));
+  return out;
+}
 // ../core/src/plan-catalog.ts
 var CLAUDE_PRICING = "https://claude.com/pricing";
 var COPILOT_PRICING = "https://github.com/features/copilot/plans";
@@ -678,6 +723,81 @@ var ANTHROPIC_EDIT_POLICY = Object.freeze({
   status: "declared-unverified",
   source: "CM §7 (docs/superpowers/specs/2026-09-25-runtime-context-manager-design.md), citing " + "Anthropic's documentation that editing earlier turns can invalidate later reasoning blocks " + "(signed signature_delta, R12 §1.3); assistant-text immutability is a product rule (CM §7 line 227)."
 });
+// ../core/src/agentToolPolicy.ts
+var TASKS = { capability: "localShell", host: true, central: "refuse", allowance: null };
+var GROUPS = TASKS;
+var DATA = { host: false, central: "allow", allowance: null };
+var PREFS = DATA;
+var AGENT_TOOL_POLICY = {
+  agentistics_tasks: { ...TASKS, risk: "R", routes: ["GET /api/tasks"], reason: "lists the board; changes nothing" },
+  agentistics_task: { ...TASKS, risk: "R", routes: ["GET /api/tasks/:ref"], reason: "reads one task (its comments are untrusted text, §4.8)" },
+  agentistics_task_create: { ...TASKS, risk: "W", routes: ["POST /api/tasks"], reason: "adds a card; undone by closing or deleting it" },
+  agentistics_task_status: { ...TASKS, risk: "W", routes: ["POST /api/tasks/:ref"], reason: "moves a card between statuses; moved back by the same call" },
+  agentistics_task_statuses: { ...TASKS, risk: "R", routes: ["GET /api/tasks/statuses"], reason: "reads the status vocabulary" },
+  agentistics_task_status_edit: {
+    ...TASKS,
+    risk: "W",
+    routes: ["DELETE /api/tasks/statuses/:id", "POST /api/tasks/statuses/:id", "POST /api/tasks/statuses"],
+    reason: "status vocabulary is configuration; the server refuses to remove a protected status (§3.5)"
+  },
+  agentistics_task_comment: { ...TASKS, risk: "W", routes: ["POST /api/tasks/:ref/comments"], reason: "appends a note; additive, destroys nothing" },
+  agentistics_task_subtask: { ...TASKS, risk: "W", routes: ["POST /api/tasks/:ref/subtasks"], reason: "adds or edits a subtask; reversible by another edit" },
+  agentistics_task_link: { ...TASKS, risk: "W", routes: ["POST /api/tasks/:ref/links"], reason: "adds or removes a link; reversible by the inverse call" },
+  agentistics_task_blocked_by: { ...TASKS, risk: "W", routes: ["POST /api/tasks/:ref"], reason: "sets a blocker; cleared by the same call" },
+  agentistics_task_next: { ...TASKS, risk: "R", routes: ["GET /api/tasks/next"], reason: "asks what is ready; claims nothing" },
+  agentistics_task_claim: { ...TASKS, risk: "W", routes: ["POST /api/tasks/:ref/claim"], reason: "a lease that expires on its own and can be released" },
+  agentistics_task_activity: { ...TASKS, risk: "R", routes: ["GET /api/tasks/activity"], reason: "reads the board activity log" },
+  agentistics_task_edit: { ...TASKS, risk: "W", routes: ["POST /api/tasks/:ref"], reason: "edits task fields; reversible by another edit" },
+  agentistics_task_session: {
+    ...TASKS,
+    risk: "W",
+    routes: ["POST /api/tasks/x/sessions", "POST /api/tasks/:ref/sessions"],
+    reason: "files or detaches a session under a task; filing is reversible"
+  },
+  agentistics_task_delete: {
+    ...TASKS,
+    risk: "D",
+    routes: ["DELETE /api/tasks/:ref"],
+    reason: "destroys a task with its history; re-classed D by the spec (§3.5), moves behind an intent in P2.6"
+  },
+  agentistics_session_groups: { ...GROUPS, risk: "R", routes: ["GET /api/session-groups"], reason: "lists the session folders" },
+  agentistics_session_group_create: { ...GROUPS, risk: "W", routes: ["POST /api/session-groups"], reason: "creates a folder; removed by delete" },
+  agentistics_session_group_edit: {
+    ...GROUPS,
+    risk: "W",
+    routes: [
+      "POST /api/session-groups/:group/sessions",
+      "POST /api/session-groups/ungroup",
+      "POST /api/session-groups/:group",
+      "DELETE /api/session-groups/:group"
+    ],
+    reason: "folders are labels: deleting one ungroups its sessions and touches no session (§5 defect 3: W, not D)"
+  },
+  agentistics_summary: { ...DATA, risk: "R", routes: ["GET /api/data"], reason: "reads computed metrics" },
+  agentistics_harnesses: { ...DATA, risk: "R", routes: ["GET /api/data"], reason: "reads computed metrics per harness" },
+  agentistics_projects: { ...DATA, risk: "R", routes: ["GET /api/data"], reason: "reads computed metrics per project" },
+  agentistics_sessions: { ...DATA, risk: "R", routes: ["GET /api/data"], reason: "reads session metadata (first_prompt is untrusted text, §4.8)" },
+  agentistics_costs: { ...DATA, risk: "R", routes: ["GET /api/data"], reason: "reads computed costs" },
+  agentistics_repos: { ...DATA, risk: "R", routes: ["GET /api/data"], reason: "reads computed metrics per repository" },
+  agentistics_component_catalog: { ...DATA, risk: "R", routes: [], reason: "returns a static list; calls nothing" },
+  agentistics_get_layouts: { ...PREFS, risk: "R", routes: ["GET /api/preferences"], reason: "reads the saved layouts" },
+  agentistics_create_layout: { ...PREFS, risk: "W", routes: ["GET /api/preferences", "PUT /api/preferences"], reason: "adds a layout; removed by delete_layout" },
+  agentistics_add_component: { ...PREFS, risk: "W", routes: ["GET /api/preferences", "PUT /api/preferences"], reason: "adds a widget; removed by remove_component" },
+  agentistics_remove_component: { ...PREFS, risk: "W", routes: ["GET /api/preferences", "PUT /api/preferences"], reason: "removes a widget; re-added by add_component" },
+  agentistics_set_active_layout: { ...PREFS, risk: "W", routes: ["GET /api/preferences", "PUT /api/preferences"], reason: "switches the active layout; switched back by the same call" },
+  agentistics_delete_layout: {
+    ...PREFS,
+    risk: "W",
+    routes: ["GET /api/preferences", "PUT /api/preferences"],
+    reason: "a layout is a saved arrangement of widgets, no data goes with it (§5 defect 3: W, not D)"
+  },
+  agentistics_build_layout: { ...PREFS, risk: "W", routes: ["GET /api/preferences", "PUT /api/preferences"], reason: "writes a layout; reversible by another build or delete" },
+  agentistics_export_pdf: { ...DATA, risk: "R", routes: [], reason: "composes a local dashboard URL; calls nothing and exports nothing itself" },
+  agentistics_tags: { ...DATA, risk: "R", routes: ["GET /api/tags"], reason: "reads aggregate-only tag cards" },
+  agentistics_tag_detail: { ...DATA, risk: "R", routes: ["GET /api/tags", "GET /api/tags/:id"], reason: "reads one tag aggregate (counts and sums only)" },
+  agentistics_team_status: { ...PREFS, risk: "R", routes: ["GET /api/preferences"], reason: "reads mode and connection endpoints; returns no token" },
+  agentistics_team_members: { ...DATA, central: "only", risk: "R", routes: ["GET /api/team/members"], reason: "reads the member list; central only" }
+};
 // session-tokens.ts
 function sessionHarness(s) {
   return s.harness ?? "claude";
@@ -740,6 +860,224 @@ function harnessParam() {
   };
 }
 
+// agent-audit.ts
+import { createHash } from "node:crypto";
+import * as nodeFs from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var AUDIT_ROTATE_BYTES = 10 * 1024 * 1024;
+var AUDIT_KEEP_FILES = 3;
+function defaultAuditPath(env = process.env) {
+  return join(env.AGENTISTICS_DIR ?? join(homedir(), ".agentistics"), "agent-audit.jsonl");
+}
+var TARGET_KEYS = [
+  "ref",
+  "id",
+  "taskId",
+  "subtaskId",
+  "sessionId",
+  "session",
+  "sessions",
+  "group",
+  "parentGroupId",
+  "blockedBy",
+  "componentId",
+  "instanceId",
+  "tag",
+  "remove"
+];
+var ID_SHAPE = /^[A-Za-z0-9][A-Za-z0-9_.:@-]{0,79}$/;
+var MAX_TARGETS = 20;
+function asId(v) {
+  if (typeof v !== "string" || !ID_SHAPE.test(v))
+    return null;
+  return redactSecrets(v) === v ? v : null;
+}
+function targetsOf(args) {
+  const out = [];
+  let omitted = 0;
+  if (!args || typeof args !== "object")
+    return { targets: out, omitted };
+  const a = args;
+  for (const key of TARGET_KEYS) {
+    const raw = a[key];
+    if (raw === undefined || raw === null || typeof raw === "boolean")
+      continue;
+    for (const v of Array.isArray(raw) ? raw : [raw]) {
+      const id = asId(v);
+      if (id === null) {
+        omitted++;
+        continue;
+      }
+      if (out.length >= MAX_TARGETS) {
+        omitted++;
+        continue;
+      }
+      if (!out.includes(id))
+        out.push(id);
+    }
+  }
+  return { targets: out, omitted };
+}
+function canonical(v) {
+  if (Array.isArray(v))
+    return `[${v.map(canonical).join(",")}]`;
+  if (v && typeof v === "object") {
+    const o = v;
+    return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${canonical(o[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(v ?? null);
+}
+function argsHash(args) {
+  return createHash("sha256").update(canonical(args ?? {})).digest("hex").slice(0, 16);
+}
+function label(v) {
+  if (typeof v !== "string")
+    return;
+  const t = v.trim().slice(0, 64);
+  if (!/^[\w.:@/ -]{1,64}$/.test(t))
+    return;
+  return redactSecrets(t) === t ? t : undefined;
+}
+function actorOf(client, args, naySession) {
+  const a = args && typeof args === "object" ? args : {};
+  const declared = label(a.actor) ?? label(a.by);
+  const nay = naySession !== undefined ? asId(naySession) ?? undefined : undefined;
+  return {
+    client: label(client?.name) ?? null,
+    clientVersion: label(client?.version) ?? null,
+    ...declared !== undefined ? { declared } : {},
+    ...nay !== undefined ? { naySession: nay } : {}
+  };
+}
+function outcomeOf(result) {
+  if (result === "unknown_tool")
+    return "unknown_tool";
+  if (!result.isError)
+    return "ok";
+  const m = /→ HTTP (\d{3})\b/.exec(result.errorText ?? "");
+  return m ? `http_${Number(m[1])}` : "error";
+}
+function isKnownTool(name) {
+  return Object.prototype.hasOwnProperty.call(AGENT_TOOL_POLICY, name);
+}
+function riskOf(name) {
+  return isKnownTool(name) ? AGENT_TOOL_POLICY[name].risk : null;
+}
+function buildToolAuditRecord(input) {
+  const known = isKnownTool(input.name);
+  const { targets, omitted } = targetsOf(input.args);
+  return {
+    v: 1,
+    kind: "tool",
+    at: input.at.toISOString(),
+    actor: actorOf(input.client, input.args, input.naySession),
+    tool: known ? input.name : null,
+    risk: riskOf(input.name),
+    targets,
+    ...omitted > 0 ? { targetsOmitted: omitted } : {},
+    argsHash: argsHash(input.args),
+    outcome: known ? outcomeOf(input.result) : "unknown_tool"
+  };
+}
+function hourOf(at) {
+  return at.toISOString().slice(0, 13);
+}
+function readCountRecord(hour, counts) {
+  return { v: 1, kind: "reads", hour, counts: { ...counts } };
+}
+function rotatedPath(path, n) {
+  return n === 0 ? path : `${path}.${n}`;
+}
+function createAgentAuditSink(opts = {}) {
+  const path = opts.path ?? defaultAuditPath();
+  const maxBytes = opts.maxBytes ?? AUDIT_ROTATE_BYTES;
+  const keep = Math.max(1, opts.keep ?? AUDIT_KEEP_FILES);
+  const fs = opts.fs ?? nodeFs;
+  const now = opts.now ?? (() => new Date);
+  let written = 0;
+  let writeFailures = 0;
+  let pendingDropped = 0;
+  let modeChecked = false;
+  let readHour = null;
+  let readCounts = {};
+  function sizeOf(p) {
+    try {
+      return fs.statSync(p).size;
+    } catch {
+      return 0;
+    }
+  }
+  function rotate() {
+    fs.rmSync(rotatedPath(path, keep - 1), { force: true });
+    for (let n = keep - 2;n >= 0; n--) {
+      const from = rotatedPath(path, n);
+      try {
+        fs.renameSync(from, rotatedPath(path, n + 1));
+      } catch (e) {
+        if (e?.code !== "ENOENT")
+          throw e;
+      }
+    }
+    modeChecked = false;
+  }
+  function write(rec) {
+    try {
+      const line = `${JSON.stringify(pendingDropped > 0 ? { ...rec, dropped: pendingDropped } : rec)}
+`;
+      if (!modeChecked)
+        fs.mkdirSync(dirname(path), { recursive: true, mode: 448 });
+      if (keep > 1 && sizeOf(path) + Buffer.byteLength(line) > maxBytes && sizeOf(path) > 0)
+        rotate();
+      else if (keep === 1 && sizeOf(path) + Buffer.byteLength(line) > maxBytes)
+        fs.rmSync(path, { force: true });
+      fs.appendFileSync(path, line, { mode: 384 });
+      if (!modeChecked) {
+        fs.chmodSync(path, 384);
+        modeChecked = true;
+      }
+      written++;
+      pendingDropped = 0;
+    } catch {
+      writeFailures++;
+      pendingDropped++;
+    }
+  }
+  function flushReads() {
+    if (readHour === null || Object.keys(readCounts).length === 0)
+      return;
+    const rec = readCountRecord(readHour, readCounts);
+    readHour = null;
+    readCounts = {};
+    write(rec);
+  }
+  return {
+    recordCall(input) {
+      try {
+        const at = now();
+        const hour = hourOf(at);
+        if (readHour !== null && readHour !== hour)
+          flushReads();
+        if (riskOf(input.name) === "R") {
+          readHour = hour;
+          readCounts[input.name] = (readCounts[input.name] ?? 0) + 1;
+          return;
+        }
+        write(buildToolAuditRecord({ ...input, at }));
+      } catch {
+        writeFailures++;
+        pendingDropped++;
+      }
+    },
+    flush() {
+      flushReads();
+    },
+    stats() {
+      return { written, writeFailures, pendingDropped };
+    }
+  };
+}
+
 // agentistics-mcp.ts
 var API = process.env.AGENTISTICS_API ?? "http://localhost:47291";
 var HARNESS_PARAM = harnessParam();
@@ -1310,7 +1648,30 @@ var TOOLS = [
   }
 ];
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+var audit = createAgentAuditSink();
+process.on("exit", () => audit.flush());
+for (const sig of ["SIGINT", "SIGTERM"]) {
+  process.on(sig, () => {
+    audit.flush();
+    process.exit(0);
+  });
+}
 server.setRequestHandler(CallToolRequestSchema, async (req) => {
+  const result = await callTool(req);
+  const first = result.content?.[0];
+  audit.recordCall({
+    name: req.params.name,
+    args: req.params.arguments,
+    client: server.getClientVersion(),
+    naySession: process.env.AGENTISTICS_NAY_SESSION,
+    result: {
+      isError: result.isError === true,
+      errorText: first && first.type === "text" ? first.text : undefined
+    }
+  });
+  return result;
+});
+async function callTool(req) {
   const { name, arguments: args } = req.params;
   try {
     switch (name) {
@@ -1989,6 +2350,6 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
       isError: true
     };
   }
-});
+}
 var transport = new StdioServerTransport;
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentistics/mcp",
-  "version": "2.74.2",
+  "version": "2.76.0",
   "description": "Agentistics MCP server — Claude Code analytics for Claude Desktop and Claude Code",
   "type": "module",
   "main": "./dist/agentistics-mcp.js",