@chemx/create-chemx 26.9.17-309 → 26.9.17-606

package/README.md

@@ -34,6 +34,69 @@ starter-kit/
     └── index.js                # Interactive capsule generator
 ```
 
+---
+
+## Model Context Protocol (MCP) Server
+
+Chemical X includes a high-performance, zero-dependency JSON-RPC 2.0 Stdio MCP server that connects directly to AI agent hosts (Cursor, Claude Desktop, Windsurf, Antigravity, VS Code).
+
+### Automatic 1-Step Installation
+
+Run the interactive installer in your workspace root:
+
+```bash
+npx chemx install-mcp
+```
+
+This automatically registers the Chemical X server in:
+- `.cursor/mcp.json` (Cursor IDE)
+- `.vscode/mcp.json` (VS Code)
+- `~/.gemini/config/mcp_config.json` (Antigravity)
+- Adds `"chemx:mcp": "chemx mcp"` to your `package.json` scripts
+
+### Manual MCP Server Configuration
+
+To configure manually in your MCP client settings (e.g. `claude_desktop_config.json` or `.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "chemical-x": {
+      "command": "npx",
+      "args": ["-y", "chemx", "mcp"]
+    }
+  }
+}
+```
+
+### Available MCP Tools (10 Tools)
+
+| Tool Name | Scope | Purpose |
+| :--- | :--- | :--- |
+| `chemx_q` | Discovery | AST search index query machine. Query symbols, capsules, props, and hooks with minimal token burn. |
+| `chemx_query_patterns` | Discovery | Detect duplicated state machines, cloned UI layouts, and parallel hooks before decomposing monoliths. |
+| `chemx_read` | Reading | Token-minified file reader. Extracts AST outlines, stripped comments, or symbol blocks (80%+ token savings). |
+| `chemx_patch` | Editing | Surgically patch files with exact search and replace blocks without whole-file context dumps. |
+| `chemx_check` | Linting | Verify a single file or capsule against molecular boundary rules (< 100L, 2-stage booleans, zero raw DOM). |
+| `chemx_audit` | Quality | Run the full 7-Pillar Chemical X static AST audit. Returns health score, grade (A+ to F), and hazard list. |
+| `chemx_audit_build` | Quality | Wrap build commands with silent execution and catalog compiler diagnostics into structured categories. |
+| `chemx_autofix` | Remediation | Deterministically remediate safe violations (typography hyphens, markdown fences, AI slop comments). |
+| `chemx_generate_capsule` | Scaffolding | Deterministically generate a crystalline capsule directory (component, controller, SCSS, types, index). |
+| `chemx_get_refactor_prompt` | Prompting | Synthesize targeted refactoring prompts for Grade F critical hazards, hotspots, and slop artifacts. |
+
+### Living Resources & Prompts
+
+* **Resources**:
+  * `chemx://directives`: Mandatory Chemical X Molecular Architecture directives (AGENTS.md).
+  * `chemx://scorecard`: Live Molecular Health Index (MHI) grade, score, metrics, and active hazards.
+  * `chemx://blueprints/molecule`: Compliant molecule blueprint adhering to zero raw DOM standards.
+  * `chemx://blueprints/view-template`: Declarative 10-20 line Table-of-Contents view blueprint.
+* **Prompts**:
+  * `chemx_remediate_hotspot`: Dynamically inspects candidate file AST metrics and generates targeted decomposition instructions.
+  * `chemx_harmonize_patterns`: Generates Pre-Split Pattern Discovery instructions to extract shared capsules.
+
+---
+
 ## Release Versioning: Minute-Precision CalVer
 
 This package adheres to **Minute-Precision Calendar Versioning** (`YY.MM.DD-MMMM`):

package/blueprints/molecule-capsule/m-tab-button/m-tab-button.controller.ts

@@ -1,21 +1,18 @@
 import { computed } from 'vue';
 import type { TabButtonProps, TabTone } from './types';
 
+const TONE_CLASSES: Record<TabTone, string> = {
+  lime: 'm-tab-button--lime',
+  pink: 'm-tab-button--pink',
+  slate: 'm-tab-button--slate',
+  sky: 'm-tab-button--sky'
+};
+
 export function useTabButtonController(props: TabButtonProps, emit: (event: 'click' | 'select') => void) {
   const isSelected = computed((): boolean => Boolean(props.isActive));
 
   const resolveToneClass = (tone: TabTone = 'sky'): string => {
-    switch (tone) {
-      case 'lime':
-        return 'm-tab-button--lime';
-      case 'pink':
-        return 'm-tab-button--pink';
-      case 'slate':
-        return 'm-tab-button--slate';
-      case 'sky':
-      default:
-        return 'm-tab-button--sky';
-    }
+    return TONE_CLASSES[tone] || TONE_CLASSES.sky;
   };
 
   const stateClass = computed((): string => {

package/cli/audit/ast-visitors.js

@@ -89,6 +89,29 @@ export const createAstVisitors = ({ relativePath, violations }) => {
       }
     },
 
+    IfStatement(astPath) {
+      const expr = astPath.node.test;
+      if (t.isLogicalExpression(expr)) {
+        const opCount = countLogicalOperators(expr);
+        const hasBinaryClauses = (t.isBinaryExpression(expr.left) || t.isLogicalExpression(expr.left)) &&
+                                 (t.isBinaryExpression(expr.right) || t.isLogicalExpression(expr.right));
+        if (opCount > 2 || (opCount >= 2 && hasBinaryClauses)) {
+          const line = resolveStartLine(expr, astPath.node, 1);
+          const meta = RULE_REGISTRY.CONTROL_FLOW_INLINE_BOOLEAN;
+          violations.push({
+            filePath: relativePath,
+            line,
+            column: expr.loc?.start.column || 1,
+            hazard: `Inline multi-clause boolean comparison in if statement (${opCount} operators). Decompose into 2-stage booleans per Directive 3.A.`,
+            rule: 'CONTROL_FLOW_INLINE_BOOLEAN',
+            severity: meta.severity,
+            pillar: meta.pillar,
+            directive: meta.directive
+          });
+        }
+      }
+    },
+
     ConditionalExpression(astPath) {
       if (t.isConditionalExpression(astPath.node.consequent) || t.isConditionalExpression(astPath.node.alternate)) {
         const line = astPath.node.loc?.start.line || 1;
@@ -106,6 +129,56 @@ export const createAstVisitors = ({ relativePath, violations }) => {
       }
     },
 
+    SwitchStatement(astPath) {
+      const cases = astPath.node.cases || [];
+      if (cases.length < 3) return;
+
+      const isDispatchConsequent = (statements) => {
+        if (!statements || statements.length === 0) return false;
+        if (statements.length === 1) {
+          const s = statements[0];
+          if (t.isReturnStatement(s)) return true;
+          if (t.isBlockStatement(s)) {
+            return s.body.length === 1 && t.isReturnStatement(s.body[0]);
+          }
+        }
+        if (statements.length === 2) {
+          const [first, second] = statements;
+          if (t.isBreakStatement(second)) {
+            return t.isExpressionStatement(first) || t.isAssignmentExpression(first);
+          }
+        }
+        return false;
+      };
+
+      let dispatchCaseCount = 0;
+      let nonDefaultCount = 0;
+
+      for (const switchCase of cases) {
+        if (!switchCase.test) continue;
+        nonDefaultCount += 1;
+        if (isDispatchConsequent(switchCase.consequent)) {
+          dispatchCaseCount += 1;
+        }
+      }
+
+      const isDispatchSmell = nonDefaultCount >= 3 && (dispatchCaseCount / nonDefaultCount) >= 0.7;
+      if (isDispatchSmell) {
+        const line = astPath.node.loc?.start.line || 1;
+        const meta = RULE_REGISTRY.CONTROL_FLOW_DISPATCH_SWITCH;
+        violations.push({
+          filePath: relativePath,
+          line,
+          column: astPath.node.loc?.start.column || 1,
+          hazard: `Dispatch switch smell detected (${dispatchCaseCount} repetitive case branches)`,
+          rule: 'CONTROL_FLOW_DISPATCH_SWITCH',
+          severity: meta.severity,
+          pillar: meta.pillar,
+          directive: meta.directive
+        });
+      }
+    },
+
     // Pillar 5: Design System & Inline Styles
     JSXAttribute(astPath) {
       const attrName = astPath.node.name?.name;

package/cli/audit/extended-visitors.js

@@ -33,6 +33,55 @@ const FAKE_GREEN_PATTERNS = [
 const IMG_WITHOUT_ALT_PATTERN = new RegExp(['<', 'img\\b', '(?![^>]*\\balt\\s*=)', '[^>]*>'].join(''), 'i');
 const CLICKABLE_CONTAINER_PATTERN = new RegExp(['<', '(div|span)\\b', '(?![^>]*\\brole\\s*=\\s*[\'"](?:button|link|tab)[\'"])', '[^>]*\\b(?:@click|v-on:click)\\s*='].join(''), 'i');
 
+const SENSITIVE_KEYWORDS = new Set([
+  'password', 'passwd', 'secret', 'token', 'apikey', 'api_key',
+  'authtoken', 'auth_token', 'accesstoken', 'access_token',
+  'refreshtoken', 'refresh_token', 'privatekey', 'private_key',
+  'creditcard', 'credit_card', 'ssn'
+]);
+
+const isSensitiveName = (name = '') => {
+  const normalized = String(name).toLowerCase();
+  if (SENSITIVE_KEYWORDS.has(normalized)) return true;
+  return /^(pass(word)?|token|secret|api[_-]?key)$/i.test(normalized);
+};
+
+const JAVASCRIPT_URL_REGEX = /^\s*javascript:/i;
+const TABNABBING_TEMPLATE_PATTERN = /<a\b[^>]*\btarget\s*=\s*["']_blank["'][^>]*>/i;
+const JAVASCRIPT_URL_TEMPLATE_PATTERN = /\b(?:href|src|action|formaction)\s*=\s*["']\s*javascript:/i;
+
+const isSensitiveExpression = (node) => {
+  if (!node) return false;
+  if (t.isIdentifier(node)) {
+    return isSensitiveName(node.name);
+  }
+  if (t.isMemberExpression(node)) {
+    if (t.isIdentifier(node.property)) {
+      return isSensitiveName(node.property.name);
+    }
+    if (t.isStringLiteral(node.property)) {
+      return isSensitiveName(node.property.value);
+    }
+  }
+  if (t.isObjectExpression(node)) {
+    return node.properties.some((prop) => {
+      if (t.isObjectProperty(prop)) {
+        const keyName = t.isIdentifier(prop.key)
+          ? prop.key.name
+          : t.isStringLiteral(prop.key)
+          ? prop.key.value
+          : '';
+        return isSensitiveName(keyName);
+      }
+      return false;
+    });
+  }
+  if (t.isTemplateLiteral(node)) {
+    return node.expressions.some(isSensitiveExpression);
+  }
+  return false;
+};
+
 /**
  * Pillar 10: Check for co-located test files for molecule capsules.
  */
@@ -136,6 +185,41 @@ export const checkExtendedTextPatterns = (content, lines, relativePath, filePath
       }
     }
 
+    // Pillar 9: Reverse Tabnabbing in HTML / Vue templates
+    const hasTargetBlank = isTemplateFile && TABNABBING_TEMPLATE_PATTERN.test(lineText);
+    if (hasTargetBlank) {
+      const hasRelProtection = /\brel\s*=\s*["'][^"']*(?:noopener|noreferrer)[^"']*["']/i.test(lineText);
+      if (!hasRelProtection) {
+        const meta = RULE_REGISTRY.SECURITY_REVERSE_TABNABBING;
+        violations.push({
+          filePath: relativePath,
+          line: lineNum,
+          column: 1,
+          hazard: 'External link with target="_blank" missing rel="noopener noreferrer"',
+          rule: 'SECURITY_REVERSE_TABNABBING',
+          severity: meta.severity,
+          pillar: meta.pillar,
+          directive: meta.directive
+        });
+      }
+    }
+
+    // Pillar 9: javascript: pseudo-protocol in HTML / Vue templates
+    const hasJsUrl = isTemplateFile && JAVASCRIPT_URL_TEMPLATE_PATTERN.test(lineText);
+    if (hasJsUrl) {
+      const meta = RULE_REGISTRY.SECURITY_JAVASCRIPT_URL;
+      violations.push({
+        filePath: relativePath,
+        line: lineNum,
+        column: 1,
+        hazard: 'javascript: pseudo-protocol detected in template attribute',
+        rule: 'SECURITY_JAVASCRIPT_URL',
+        severity: meta.severity,
+        pillar: meta.pillar,
+        directive: meta.directive
+      });
+    }
+
     // Pillar 8: Non-semantic clickable containers in templates (@click on div/span)
     const hasClickableContainer = isTemplateFile && CLICKABLE_CONTAINER_PATTERN.test(lineText);
     if (hasClickableContainer) {
@@ -244,6 +328,49 @@ export const createExtendedVisitors = ({ relativePath, violations }) => {
           });
         }
       }
+
+      // Pillar 9: External link target="_blank" without rel="noopener noreferrer"
+      const isAnchorElement = tagName === 'a';
+      if (isAnchorElement) {
+        const targetAttr = astPath.node.attributes.find((attr) => t.isJSXAttribute(attr) && attr.name?.name === 'target');
+        let isTargetBlank = false;
+        if (targetAttr) {
+          if (t.isStringLiteral(targetAttr.value)) {
+            isTargetBlank = targetAttr.value.value.trim().toLowerCase() === '_blank';
+          } else if (t.isJSXExpressionContainer(targetAttr.value) && t.isStringLiteral(targetAttr.value.expression)) {
+            isTargetBlank = targetAttr.value.expression.value.trim().toLowerCase() === '_blank';
+          }
+        }
+
+        if (isTargetBlank) {
+          const relAttr = astPath.node.attributes.find((attr) => t.isJSXAttribute(attr) && attr.name?.name === 'rel');
+          let hasRelProtection = false;
+          if (relAttr) {
+            if (t.isStringLiteral(relAttr.value)) {
+              const val = relAttr.value.value.toLowerCase();
+              hasRelProtection = val.includes('noopener') || val.includes('noreferrer');
+            } else if (t.isJSXExpressionContainer(relAttr.value) && t.isStringLiteral(relAttr.value.expression)) {
+              const val = relAttr.value.expression.value.toLowerCase();
+              hasRelProtection = val.includes('noopener') || val.includes('noreferrer');
+            }
+          }
+
+          if (!hasRelProtection) {
+            const line = astPath.node.loc?.start.line || 1;
+            const meta = RULE_REGISTRY.SECURITY_REVERSE_TABNABBING;
+            violations.push({
+              filePath: relativePath,
+              line,
+              column: astPath.node.loc?.start.column || 1,
+              hazard: 'External link with target="_blank" missing rel="noopener noreferrer"',
+              rule: 'SECURITY_REVERSE_TABNABBING',
+              severity: meta.severity,
+              pillar: meta.pillar,
+              directive: meta.directive
+            });
+          }
+        }
+      }
     },
 
     JSXAttribute(astPath) {
@@ -314,6 +441,118 @@ export const createExtendedVisitors = ({ relativePath, violations }) => {
           }
         }
       }
+
+      // Pillar 9: javascript: pseudo-protocol URL in JSX
+      const isUrlAttribute = ['href', 'src', 'action', 'formAction'].includes(attrName);
+      if (isUrlAttribute) {
+        let isJsUrl = false;
+        const val = astPath.node.value;
+        if (t.isStringLiteral(val)) {
+          isJsUrl = JAVASCRIPT_URL_REGEX.test(val.value);
+        } else if (t.isJSXExpressionContainer(val)) {
+          const expr = val.expression;
+          if (t.isStringLiteral(expr)) {
+            isJsUrl = JAVASCRIPT_URL_REGEX.test(expr.value);
+          } else if (t.isTemplateLiteral(expr) && expr.quasis.length > 0) {
+            isJsUrl = JAVASCRIPT_URL_REGEX.test(expr.quasis[0].value.raw);
+          }
+        }
+
+        if (isJsUrl) {
+          const line = astPath.node.loc?.start.line || 1;
+          const meta = RULE_REGISTRY.SECURITY_JAVASCRIPT_URL;
+          violations.push({
+            filePath: relativePath,
+            line,
+            column: astPath.node.loc?.start.column || 1,
+            hazard: `javascript: pseudo-protocol detected in ${attrName} attribute`,
+            rule: 'SECURITY_JAVASCRIPT_URL',
+            severity: meta.severity,
+            pillar: meta.pillar,
+            directive: meta.directive
+          });
+        }
+      }
+    },
+
+    CallExpression(astPath) {
+      const callee = astPath.node.callee;
+
+      // Pillar 9: Dynamic code execution via eval()
+      if (t.isIdentifier(callee) && callee.name === 'eval') {
+        const line = astPath.node.loc?.start.line || 1;
+        const meta = RULE_REGISTRY.SECURITY_DYNAMIC_CODE_EXECUTION;
+        violations.push({
+          filePath: relativePath,
+          line,
+          column: astPath.node.loc?.start.column || 1,
+          hazard: 'Dynamic code execution via eval() detected',
+          rule: 'SECURITY_DYNAMIC_CODE_EXECUTION',
+          severity: meta.severity,
+          pillar: meta.pillar,
+          directive: meta.directive
+        });
+      }
+
+      // Pillar 9: String-based code execution in setTimeout/setInterval
+      if (t.isIdentifier(callee) && (callee.name === 'setTimeout' || callee.name === 'setInterval')) {
+        const firstArg = astPath.node.arguments[0];
+        const isStringExecution = t.isStringLiteral(firstArg) || t.isTemplateLiteral(firstArg);
+        if (isStringExecution) {
+          const line = astPath.node.loc?.start.line || 1;
+          const meta = RULE_REGISTRY.SECURITY_DYNAMIC_CODE_EXECUTION;
+          violations.push({
+            filePath: relativePath,
+            line,
+            column: astPath.node.loc?.start.column || 1,
+            hazard: `String-based dynamic code execution in ${callee.name} detected`,
+            rule: 'SECURITY_DYNAMIC_CODE_EXECUTION',
+            severity: meta.severity,
+            pillar: meta.pillar,
+            directive: meta.directive
+          });
+        }
+      }
+
+      // Pillar 9: Sensitive credential/token logging in console
+      const isConsoleCall = t.isMemberExpression(callee) && t.isIdentifier(callee.object) && callee.object.name === 'console';
+      if (isConsoleCall) {
+        const args = astPath.node.arguments || [];
+        const hasSensitiveArg = args.some(isSensitiveExpression);
+        if (hasSensitiveArg) {
+          const line = astPath.node.loc?.start.line || 1;
+          const meta = RULE_REGISTRY.SECURITY_SENSITIVE_LOGGING;
+          violations.push({
+            filePath: relativePath,
+            line,
+            column: astPath.node.loc?.start.column || 1,
+            hazard: 'Sensitive variable (credential, token, or password) logged to console',
+            rule: 'SECURITY_SENSITIVE_LOGGING',
+            severity: meta.severity,
+            pillar: meta.pillar,
+            directive: meta.directive
+          });
+        }
+      }
+    },
+
+    NewExpression(astPath) {
+      // Pillar 9: Dynamic code execution via new Function()
+      const callee = astPath.node.callee;
+      if (t.isIdentifier(callee) && callee.name === 'Function') {
+        const line = astPath.node.loc?.start.line || 1;
+        const meta = RULE_REGISTRY.SECURITY_DYNAMIC_CODE_EXECUTION;
+        violations.push({
+          filePath: relativePath,
+          line,
+          column: astPath.node.loc?.start.column || 1,
+          hazard: 'Dynamic code execution via new Function() constructor detected',
+          rule: 'SECURITY_DYNAMIC_CODE_EXECUTION',
+          severity: meta.severity,
+          pillar: meta.pillar,
+          directive: meta.directive
+        });
+      }
     },
 
     VariableDeclarator(astPath) {

package/cli/audit/reporter-utils.js

@@ -36,31 +36,22 @@ export const groupViolationsBySeverity = (violations) => {
 };
 
 export const getSeverityBadge = (severity) => {
-  switch (severity) {
-    case 'CRITICAL':
-      return `${RED}[CRITICAL]${RESET}`;
-    case 'HIGH':
-      return `${ORANGE}[HIGH]${RESET}`;
-    case 'MEDIUM':
-      return `${ORANGE}[MEDIUM]${RESET}`;
-    case 'LOW':
-      return `${YELLOW}[LOW]${RESET}`;
-    default:
-      return `[${severity}]`;
-  }
+  const SEVERITY_BADGES = {
+    CRITICAL: `${RED}[CRITICAL]${RESET}`,
+    HIGH: `${ORANGE}[HIGH]${RESET}`,
+    MEDIUM: `${ORANGE}[MEDIUM]${RESET}`,
+    LOW: `${YELLOW}[LOW]${RESET}`
+  };
+  return SEVERITY_BADGES[severity] || `[${severity}]`;
 };
 
 export const getStatusBadge = (status) => {
-  switch (status) {
-    case 'PASSED':
-      return `${GREEN}✔ PASS${RESET}`;
-    case 'WARN':
-      return `${YELLOW}⚠ WARN${RESET}`;
-    case 'FAILED':
-      return `${RED}✕ FAIL${RESET}`;
-    default:
-      return status;
-  }
+  const STATUS_BADGES = {
+    PASSED: `${GREEN}✔ PASS${RESET}`,
+    WARN: `${YELLOW}⚠ WARN${RESET}`,
+    FAILED: `${RED}✕ FAIL${RESET}`
+  };
+  return STATUS_BADGES[status] || status;
 };
 
 export const resolveIndividualPillarGrade = (pillarData) => {

package/cli/audit/rules-registry.js

@@ -36,6 +36,26 @@ export const RULE_REGISTRY = {
     severity: 'CRITICAL',
     directive: 'Extract hardcoded API keys and secrets into environment variables or secrets manager'
   },
+  SECURITY_REVERSE_TABNABBING: {
+    pillar: PILLARS.PILLAR_9,
+    severity: 'MEDIUM',
+    directive: 'Add rel="noopener noreferrer" to external links with target="_blank" to prevent tab hijacking'
+  },
+  SECURITY_JAVASCRIPT_URL: {
+    pillar: PILLARS.PILLAR_9,
+    severity: 'CRITICAL',
+    directive: 'Do not use javascript: pseudo-protocol in links or action attributes; use event handlers'
+  },
+  SECURITY_DYNAMIC_CODE_EXECUTION: {
+    pillar: PILLARS.PILLAR_9,
+    severity: 'CRITICAL',
+    directive: 'Avoid eval(), new Function(), and string-based setTimeout/setInterval code execution'
+  },
+  SECURITY_SENSITIVE_LOGGING: {
+    pillar: PILLARS.PILLAR_9,
+    severity: 'HIGH',
+    directive: 'Never log sensitive credentials, tokens, or passwords to console diagnostics'
+  },
 
   // Pillar 10: Testing Discipline
   TEST_FAKE_GREEN: {
@@ -86,6 +106,11 @@ export const RULE_REGISTRY = {
     severity: 'CRITICAL',
     directive: 'Extract display states into computed descriptor objects or early returns'
   },
+  CONTROL_FLOW_DISPATCH_SWITCH: {
+    pillar: PILLARS.PILLAR_2,
+    severity: 'MEDIUM',
+    directive: 'Replace repetitive dispatch switch with an O(1) keyed dictionary or method map (Directive 3.E)'
+  },
   HOOK_SATURATION: {
     pillar: PILLARS.PILLAR_3,
     severity: 'HIGH',