@aquex/cmos-mcp 1.0.0

package/dist/import-export/types.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Types for the secure template import/export system
+ * Implements the 6-layer security architecture from R3.2
+ */
+/**
+ * Template metadata structure
+ */
+export interface TemplateMetadata {
+    name: string;
+    version: string;
+    author: string;
+    signature: TemplateSignature;
+    tags?: string[];
+}
+/**
+ * Digital signature for template verification (Layer 4)
+ */
+export interface TemplateSignature {
+    keyId: string;
+    algorithm: string;
+    value: string;
+}
+/**
+ * Template dependency specification (Layer 6)
+ */
+export interface TemplateDependency {
+    name: string;
+    sourceUrl: string;
+    version: string;
+    checksum: string;
+}
+export interface StructuredPromptingBlock {
+    enabled: boolean;
+    role: string;
+    context: string;
+    task: string;
+    format: string;
+    constraints: string;
+}
+export interface TemplateSpec {
+    structured_prompting?: StructuredPromptingBlock;
+    [key: string]: unknown;
+}
+/**
+ * Complete mission template structure
+ */
+export interface MissionTemplate {
+    apiVersion: string;
+    kind: string;
+    metadata: TemplateMetadata;
+    spec: TemplateSpec;
+    dependencies?: TemplateDependency[];
+}
+/**
+ * Validation result for each security layer
+ */
+export interface ValidationResult {
+    layer: string;
+    passed: boolean;
+    message?: string;
+    details?: Record<string, unknown>;
+}
+/**
+ * Complete validation report
+ */
+export interface SecurityValidationReport {
+    valid: boolean;
+    layers: ValidationResult[];
+    template?: MissionTemplate;
+    errors: string[];
+    warnings: string[];
+    performanceMs: number;
+}
+/**
+ * Configuration for semantic validation rules (Layer 5)
+ */
+export interface SemanticValidationRules {
+    maxResourceMemory?: number;
+    maxResourceCpu?: number;
+    allowedActions?: string[];
+    deniedKeywords?: string[];
+    maxDependencies?: number;
+    urlAllowlist?: string[];
+}
+/**
+ * Options for template import
+ */
+export interface ImportOptions {
+    skipSignatureVerification?: boolean;
+    semanticRules?: SemanticValidationRules;
+    trustLevel?: 'verified-internal' | 'signed-known' | 'untrusted';
+}
+/**
+ * Export options
+ */
+export interface ExportOptions {
+    format?: 'yaml' | 'json';
+    includeComments?: boolean;
+    pretty?: boolean;
+}
+/**
+ * Error types for import/export operations
+ */
+export declare class ImportExportError extends Error {
+    layer?: string | undefined;
+    details?: Record<string, unknown> | undefined;
+    constructor(message: string, layer?: string | undefined, details?: Record<string, unknown> | undefined);
+}
+export declare class SignatureVerificationError extends ImportExportError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+export declare class SemanticValidationError extends ImportExportError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+export declare class DependencyResolutionError extends ImportExportError {
+    constructor(message: string, details?: Record<string, unknown>);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/import-export/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/import-export/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,UAAU,CAAC,EAAE,mBAAmB,GAAG,cAAc,GAAG,WAAW,CAAC;CACjE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGjC,KAAK,CAAC,EAAE,MAAM;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFxC,OAAO,EAAE,MAAM,EACR,KAAK,CAAC,EAAE,MAAM,YAAA,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK3C;AAED,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED,qBAAa,uBAAwB,SAAQ,iBAAiB;gBAChD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED,qBAAa,yBAA0B,SAAQ,iBAAiB;gBAClD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D"}

package/dist/import-export/types.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Types for the secure template import/export system
+ * Implements the 6-layer security architecture from R3.2
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DependencyResolutionError = exports.SemanticValidationError = exports.SignatureVerificationError = exports.ImportExportError = void 0;
+/**
+ * Error types for import/export operations
+ */
+class ImportExportError extends Error {
+    constructor(message, layer, details) {
+        super(message);
+        this.layer = layer;
+        this.details = details;
+        this.name = 'ImportExportError';
+    }
+}
+exports.ImportExportError = ImportExportError;
+class SignatureVerificationError extends ImportExportError {
+    constructor(message, details) {
+        super(message, 'Layer 4: Signature Verification', details);
+        this.name = 'SignatureVerificationError';
+    }
+}
+exports.SignatureVerificationError = SignatureVerificationError;
+class SemanticValidationError extends ImportExportError {
+    constructor(message, details) {
+        super(message, 'Layer 5: Semantic Validation', details);
+        this.name = 'SemanticValidationError';
+    }
+}
+exports.SemanticValidationError = SemanticValidationError;
+class DependencyResolutionError extends ImportExportError {
+    constructor(message, details) {
+        super(message, 'Layer 6: Dependency Resolution', details);
+        this.name = 'DependencyResolutionError';
+    }
+}
+exports.DependencyResolutionError = DependencyResolutionError;
+//# sourceMappingURL=types.js.map

package/dist/import-export/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/import-export/types.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA6GH;;GAEG;AACH,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,YACE,OAAe,EACR,KAAc,EACd,OAAiC;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,UAAK,GAAL,KAAK,CAAS;QACd,YAAO,GAAP,OAAO,CAA0B;QAGxC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AATD,8CASC;AAED,MAAa,0BAA2B,SAAQ,iBAAiB;IAC/D,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,iCAAiC,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,MAAa,uBAAwB,SAAQ,iBAAiB;IAC5D,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED,MAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,gCAAgC,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC"}

package/dist/index.d.ts

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { type SenderContext } from './intelligence/sender-context';
+import { TokenCounter } from './intelligence/token-counters';
+import { SupportedModel } from './intelligence/types';
+import type { JsonValue } from './errors/types';
+import { runStartupProjectKeyRecovery, runStartupCredentialCheck } from './auth/project-key-capture';
+/**
+ * Mission Protocol server context shared across handlers
+ */
+export interface MissionProtocolContext {
+    baseDir: string;
+    defaultModel: SupportedModel;
+    tokenCounter: TokenCounter;
+    /** Whether CMOS is detected in the project */
+    cmosDetected: boolean;
+    /** Path to CMOS database if detected */
+    cmosDatabasePath?: string;
+    /** Client's project root from MCP roots (set after connection) */
+    clientProjectRoot?: string;
+}
+export interface ToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: object;
+}
+/**
+ * Get tool definitions for the MCP surface.
+ *
+ * @returns Array of CMOS tool definitions
+ */
+export declare function getToolDefinitions(): readonly ToolDefinition[];
+export declare function summarizeValue(value: unknown): JsonValue;
+export declare function sanitizeArgs(args: unknown): Record<string, JsonValue> | undefined;
+export declare function buildMissionProtocolContext(options?: {
+    baseDir?: string;
+    defaultModel?: SupportedModel;
+}): Promise<MissionProtocolContext>;
+interface StartupAttributionSelfTestResult {
+    projectRoot: string | null;
+    source: SenderContext['source'] | null;
+    errorCode: string | null;
+    warning: string | null;
+}
+/**
+ * Register tool handlers
+ */
+export declare function registerToolHandlers(context: MissionProtocolContext, serverInstance?: Server): void;
+export declare function executeMissionProtocolTool(name: string, args: unknown, _context: MissionProtocolContext): Promise<CallToolResult>;
+declare function runWhoamiCli(): Promise<number>;
+/**
+ * Registry prune result emitted by the startup hook.
+ */
+interface StartupRegistryPruneResult {
+    /** Total entries before the prune (null on failure before load). */
+    totalBefore: number | null;
+    /** Entries removed (stale directory or missing CMOS database). */
+    pruned: number;
+    /** Remaining entries after prune. */
+    remaining: number | null;
+    /** Error message when the prune could not run; null on success. */
+    error: string | null;
+}
+/**
+ * Walk the registry, drop entries whose `projectRoot` no longer contains a
+ * CMOS database, and emit a concise log line so the operator can see drift.
+ *
+ * Sprint 56 m01: registry pollution was blowing the fanout response cap on
+ * read surfaces. Auto-prune at boot keeps the registry bounded by live
+ * projects without requiring a manual `cmos_project(action="validate")`.
+ */
+declare function runStartupRegistryPrune(): Promise<StartupRegistryPruneResult>;
+/**
+ * Sprint 62 m02: detect a `.env` file accidentally bundled inside the npm
+ * tarball. Defends against the worst-case "shipped credentials to npm" leak.
+ *
+ * Detection: only fires when the running script lives under a `node_modules`
+ * path (i.e. installed from npm), to avoid false positives on dev tree where
+ * a `.env` file is normal. Logs a [WARN] — never throws — so a misconfig
+ * doesn't break startup.
+ *
+ * Exported for unit testing.
+ */
+export interface BundledEnvCheckResult {
+    installedFromNpm: boolean;
+    envFilePath: string | null;
+    envFileBundled: boolean;
+}
+export declare function runStartupBundledEnvCheck(serverInstallRoot?: string): BundledEnvCheckResult;
+declare function runStartupAttributionSelfTest(): Promise<StartupAttributionSelfTestResult>;
+/**
+ * Initialize server components
+ */
+declare function initializeServer(): Promise<MissionProtocolContext>;
+/**
+ * Main entry point
+ */
+declare function main(): Promise<void>;
+export declare const __test__: {
+    registerToolHandlers: typeof registerToolHandlers;
+    initializeServer: typeof initializeServer;
+    main: typeof main;
+    runWhoamiCli: typeof runWhoamiCli;
+    server: Server<{
+        method: string;
+        params?: {
+            [x: string]: unknown;
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }, {
+        method: string;
+        params?: {
+            [x: string]: unknown;
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }, {
+        [x: string]: unknown;
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+    }>;
+    setContextBuilder: (builder: typeof buildMissionProtocolContext) => void;
+    resetContextBuilder: () => void;
+    setWhoamiCliRunner: (runner: typeof runWhoamiCli) => void;
+    resetWhoamiCliRunner: () => void;
+    setStartupAttributionSelfTestRunner: (runner: typeof runStartupAttributionSelfTest) => void;
+    resetStartupAttributionSelfTestRunner: () => void;
+    runStartupRegistryPrune: typeof runStartupRegistryPrune;
+    setStartupRegistryPruneRunner: (runner: typeof runStartupRegistryPrune) => void;
+    resetStartupRegistryPruneRunner: () => void;
+    setStartupProjectKeyRecoveryRunner: (runner: typeof runStartupProjectKeyRecovery) => void;
+    resetStartupProjectKeyRecoveryRunner: () => void;
+    setStartupCredentialCheckRunner: (runner: typeof runStartupCredentialCheck) => void;
+    resetStartupCredentialCheckRunner: () => void;
+    runStartupBundledEnvCheck: typeof runStartupBundledEnvCheck;
+    setStartupBundledEnvCheckRunner: (runner: typeof runStartupBundledEnvCheck) => void;
+    resetStartupBundledEnvCheckRunner: () => void;
+};
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAuDA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAML,cAAc,EACf,MAAM,oCAAoC,CAAC;AAI5C,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,+BAA+B,CAAC;AAwDvC,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EAC1B,MAAM,4BAA4B,CAAC;AA4BpC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,cAAc,CAAC;IAC7B,YAAY,EAAE,YAAY,CAAC;IAC3B,8CAA8C;IAC9C,YAAY,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,cAAc,EAAE,CAE9D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAcxD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAUjF;AAED,wBAAsB,2BAA2B,CAAC,OAAO,CAAC,EAAE;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,cAAc,CAAC;CAC/B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAoBlC;AAOD,UAAU,gCAAgC;IACxC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AA2ID;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,EAC/B,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI,CA0DN;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAAC,cAAc,CAAC,CA2UzB;AAED,iBAAe,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAI7C;AAED;;GAEG;AACH,UAAU,0BAA0B;IAClC,oEAAoE;IACpE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mEAAmE;IACnE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,iBAAe,uBAAuB,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAW5E;AAWD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,yBAAyB,CACvC,iBAAiB,GAAE,MAA4B,GAC9C,qBAAqB,CAQvB;AAID,iBAAe,6BAA6B,IAAI,OAAO,CAAC,gCAAgC,CAAC,CAyCxF;AAED;;GAEG;AACH,iBAAe,gBAAgB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CA6IjE;AAED;;GAEG;AACH,iBAAe,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAoDnC;AAED,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAMU,OAAO,2BAA2B;;iCAMlC,OAAO,YAAY;;kDAMF,OAAO,6BAA6B;;;4CAO1C,OAAO,uBAAuB;;iDAMzB,OAAO,4BAA4B;;8CAMtC,OAAO,yBAAyB;;;8CAOhC,OAAO,yBAAyB;;CAM3E,CAAC"}