@coderifts/agent-hooks 0.3.1 → 0.3.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hooks",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Ask CodeRifts before Claude Code writes a contract artifact (OpenAPI, AsyncAPI, GraphQL, protobuf, MCP manifest).",
   "author": {
     "name": "CodeRifts",

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.3.3 — 2026-10-08
+### Fixed
+- **A plain `mcp.json` is decided by its content (contract-write 1.3.0, P65c).** 0.3.2 skipped every `mcp.json` by
+  name, which also skipped a server's tool manifest of that name. By name only `.mcp.json`, `.cursor/mcp.json`,
+  `.vscode/mcp.json`, `claude_desktop_config.json` and `(cline_)mcp_settings.json` stay skipped (never read). Any
+  other `mcp.json` is read on disk: `mcpServers` / `servers` and no `tools` → a client configuration, nothing sent;
+  `tools`, any other shape, or unparseable → checked as a contract. A manifest rewritten into a client configuration
+  is checked as the manifest removed, without the client side. The same on the OpenClaw tool shapes (`write_file` …).
+
+## 0.3.2 — 2026-10-06
+### Fixed
+- **An MCP client configuration is never treated as a contract (contract-write 1.2.0, P65).** `.mcp.json`, `mcp.json`
+  (also under `.cursor/` and `.vscode/`), `claude_desktop_config.json` and `(cline_)mcp_settings.json`: an edit of one
+  sent its whole text, the servers' `env` credentials included, to CodeRifts preflight. They are decided by name and
+  never read; MCP tool manifests are unchanged.
+
 ## 0.3.1 — 2026-10-04
 
 ### Changed

package/claude-code/marketplace-entry.json

@@ -5,7 +5,7 @@
     "repo": "coderifts/agent-hooks"
   },
   "description": "Host adapters for CodeRifts: Claude Code PreToolUse asks before Write/Edit of OpenAPI, AsyncAPI, GraphQL, protobuf, or MCP manifest files. Not the GitHub Action (coderifts/contract-gate) and not the guard library (@coderifts/agent-guard).",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "author": {
     "name": "CodeRifts",
     "email": "peter@coderifts.com"

package/contract-write.mjs

@@ -27,7 +27,7 @@
 // written by scripts/generate-contract-write-copies.js, byte for byte (the CommonJS twin is a
 // mechanical transform), and its --check fails on any difference. Do not edit a copy.
 
-export const CONTRACT_WRITE_VERSION = '1.1.0';
+export const CONTRACT_WRITE_VERSION = '1.3.0';
 
 /** What a shell write to a named contract file gets, and what an unnamed one gets. */
 export const SHELL_NAMED_DECISION = 'refuse';
@@ -41,9 +41,56 @@ export const LISTING_LIMITS = Object.freeze({ depth: 8, entries: 5000 });
 /** The @coderifts/contract-path list (index.cjs), word for word; test/contract-write.test.js holds them equal. */
 export const CONTRACT_EXT = /\.(ya?ml|json|graphql|gql|proto)$/i;
 
+/*
+ * 1.2.0 (2026-10-06, the Claude directory's hold MCP_FORWARDS_CREDENTIAL_ENV): an MCP CLIENT
+ * configuration file — the list of servers a client starts, with their `env` credentials — is not a
+ * contract. `.mcp.json` and `mcp.json` matched the list above (".json" + "mcp") as mcp_manifest, so an
+ * Edit of one sent its whole text, tokens included, to preflight. MCP tool manifests are unchanged.
+ * P65 (2026-10-06): the required check uses this same pattern — index.cjs requires it from here, and its
+ * looksLikeContractPath says no first, word for word as below.
+ *
+ * 1.3.0 (P65c, 2026-10-07): by NAME only the names that are a client configuration and nothing else —
+ * `.mcp.json` anywhere, `.cursor/mcp.json`, `.vscode/mcp.json`, `claude_desktop_config.json`,
+ * `(cline_)mcp_settings.json`. Those are never read, and they win over the project's own `schema:` list.
+ * Any other `mcp.json` (MCP_JSON_BY_CONTENT) is also the name a server's tool manifest carries
+ * (coderifts.com's own), so it is a candidate, read where it already is, and decided by mcpJsonKind:
+ * the hooks read it on disk and never send a client configuration; the required check decides after its
+ * own read (isClientConfigContent), and a client-configuration side counts as no file at all.
+ */
+export const MCP_CLIENT_CONFIG = /(^|\/)(\.mcp\.json|\.cursor\/mcp\.json|\.vscode\/mcp\.json|claude_desktop_config\.json|(cline_)?mcp_settings\.json)$/i;
+
+/** A plain `mcp.json` that MCP_CLIENT_CONFIG does not take by name: decided by its content. */
+export const MCP_JSON_BY_CONTENT = /(^|\/)mcp\.json$/i;
+
+const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/**
+ * 'client_config' when the text is a JSON object with `mcpServers` or `servers` (an object) and no
+ * `tools`; otherwise 'contract' — a `tools` key, any other shape, and text that does not parse
+ * (fail-closed: what cannot be read as a client configuration is checked as a contract).
+ */
+export function mcpJsonKind(text) {
+  let doc;
+  try {
+    doc = JSON.parse(String(text ?? '').replace(/^\uFEFF/, ''));
+  } catch {
+    return 'contract';
+  }
+  if (!isObject(doc) || 'tools' in doc) return 'contract';
+  return isObject(doc.mcpServers) || isObject(doc.servers) ? 'client_config' : 'contract';
+}
+
+/** True when `path` is decided by content and `text` (one side, present) is a client configuration. */
+export function isClientConfigContent(path, text) {
+  if (typeof text !== 'string' || text === '') return false;
+  const rel = normalizePath(path);
+  return MCP_JSON_BY_CONTENT.test(rel) && !MCP_CLIENT_CONFIG.test(rel) && mcpJsonKind(text) === 'client_config';
+}
+
 export function looksLikeContractPath(p) {
   const s = String(p || '').toLowerCase();
   if (s.includes('node_modules/') || s.includes('vendor/')) return false;
+  if (MCP_CLIENT_CONFIG.test(s)) return false;
   return CONTRACT_EXT.test(s) && (s.includes('openapi') || s.includes('swagger') || s.includes('asyncapi')
     || s.endsWith('.graphql') || s.endsWith('.gql') || s.endsWith('.proto') || s.includes('mcp'));
 }
@@ -68,6 +115,7 @@ const HOOK_EXTRAS = Object.freeze([
   [/(^|\/)tools\.(wire\.v1\.)?json$/i, 'mcp_manifest'],
 ]);
 
+
 /** `a/./b/../c` → `a/c`; backslashes become slashes; a leading `./` goes. */
 export function normalizePath(p) {
   const s = String(p || '').replace(/\\/g, '/');
@@ -114,6 +162,7 @@ export function contractType(p, { named = [], excluded = [] } = {}) {
   const rel = normalizePath(p);
   if (!rel) return null;
   if (excluded.some((x) => matchesPattern(rel, x))) return null;
+  if (MCP_CLIENT_CONFIG.test(rel)) return null;
   for (const [re, type] of HOOK_EXTRAS) if (re.test(rel) && !/(^|\/)(node_modules|vendor)\//i.test(rel)) return type;
   if (looksLikeContractPath(rel)) return typeForPath(rel);
   if (named.some((x) => matchesPattern(rel, x))) return typeForPath(rel);
@@ -675,9 +724,30 @@ export async function decideToolCall(call, io = {}) {
   if (after === null) {
     return { action: 'refuse', reason: 'edit_does_not_apply', rel, type, why: `the ${kind} does not apply to ${rel} as it is on disk (${afterFailure(kind, input, before)}), so there is no after text to check` };
   }
+  // 1.3.0 (P65c): a plain mcp.json is decided by content, here, before anything is sent. A side that is
+  // a client configuration counts as no file: both such → pass; one → the manifest added or removed.
+  const clientBefore = isClientConfigContent(rel, before);
+  const clientAfter = isClientConfigContent(rel, after);
+  if (clientBefore || clientAfter) {
+    const b = clientBefore ? '' : before;
+    const a = clientAfter ? '' : after;
+    if (b === '' && a === '') return { action: 'pass', reason: 'mcp_client_config', rel };
+    return { action: 'gate', path: filePath, rel, type, before: b, after: a };
+  }
   return { action: 'gate', path: filePath, rel, type, before, after };
 }
 
+/** A shell write to a plain mcp.json that is a client configuration on disk is not a contract write. */
+async function clientConfigOnDisk(rel, io) {
+  if (!MCP_JSON_BY_CONTENT.test(rel) || !io.readFile) return false;
+  const root = normalizePath(io.cwd || '');
+  try {
+    return isClientConfigContent(rel, await io.readFile(root ? `${root}/${rel}` : rel));
+  } catch {
+    return false;
+  }
+}
+
 /** Is there a contract file under `scope`? Unknown (no reader, a limit hit) counts as yes. */
 async function mayHoldContract(scope, io, opts) {
   const glob = /[*?]/.test(scope) ? globToRegExp(normalizePath(scope)) : null;
@@ -705,6 +775,7 @@ async function decideShell(command, io, opts) {
     const inTree = scopeInTree(target, io);
     if (inTree === null) continue;
     const type = inTree !== UNKNOWN && !/[*?]/.test(inTree) ? contractType(inTree, opts) : null;
+    if (type && await clientConfigOnDisk(inTree, io)) continue;
     if (type) named.push({ path: target, type, by });
     else scopes.set(inTree, [...(scopes.get(inTree) || []), by]);
   }

package/gate.js

@@ -11,7 +11,7 @@ import { isAbsolute, resolve } from "node:path";
 // command writes. A byte copy of @coderifts/contract-path's contract-write.mjs, written by the app's
 // scripts/generate-contract-write-copies.js; contract-write.sha256 beside it is checked by
 // test/contract-write-copy.test.js.
-import { contractType, decideToolCall, toolKind } from "./contract-write.mjs";
+import { contractType, decideToolCall, isClientConfigContent, toolKind } from "./contract-write.mjs";
 
 /** Tools whose params carry a path and a new file body. */
 export const DEFAULT_TOOL_SHAPES = Object.freeze({
@@ -324,12 +324,21 @@ export function createGate(config = {}, deps = {}) {
       );
     }
 
+    // 0.3.3 (P65c): a plain mcp.json is decided by its content (contract-write's function), as on the
+    // Claude Code path. A side that is an MCP client configuration counts as no file and is never sent;
+    // both such sides → this gate never claimed the call.
+    const clientBefore = isClientConfigContent(target.path, before);
+    const clientAfter = isClientConfigContent(target.path, after);
+    const sentBefore = clientBefore ? "" : before;
+    const sentAfter = clientAfter ? "" : after;
+    if ((clientBefore || clientAfter) && sentBefore === "" && sentAfter === "") return undefined;
+
     const outcome = await call({
       endpoint,
       apiKey,
       timeoutMs,
       operation,
-      artifact: { id: target.path, type: target.type, before, after },
+      artifact: { id: target.path, type: target.type, before: sentBefore, after: sentAfter },
     });
     return decide(outcome, { operation, path: target.path });
   };

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "coderifts-contract-gate",
   "name": "CodeRifts contract gate",
   "description": "Ask CodeRifts before an agent writes a contract artifact.",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderifts/agent-hooks",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Ask CodeRifts before an agent writes a contract artifact (OpenClaw before_tool_call and Claude Code PreToolUse).",
   "license": "MIT",
   "homepage": "https://github.com/coderifts/agent-hooks#readme",