@compr/opscontext-mcp 2.3.1 → 2.4.0

package/README.md

@@ -495,10 +495,23 @@ Everything happens locally — search, scoring, learnings, sessions, embeddings.
 |---|---|---|
 | License key (`CE-XXXX-...`) | Activation + daily heartbeat | Validate subscription |
 | Machine ID (SHA-256 hash) | Activation + daily heartbeat | Enforce machine limit |
+| Email | Activation only | Tie the licence to an account |
+| Package version | Activation only | Serve a compatible module bundle |
 | Platform/arch (e.g., `darwin/arm64`) | Activation only | Compatibility check |
+| Delta bundle version | Daily heartbeat | Detect an out-of-date module cache |
+
+That is the complete list. The activation request sends exactly six fields and the heartbeat exactly three — enforced by a lock comment in `src/activation.ts` that forbids adding a seventh field reflecting usage.
 
 **The server never receives:** project names, file contents, learnings, sessions, git history, dependencies, code, .env variables, or anything about your actual work.
 
+**These are the only two network calls the tool makes.** `activate` and `heartbeat`, both in `src/activation.ts`. Nothing else in the codebase opens a connection — verify it yourself with `grep -rn "fetch(" src/`.
+
+### What's obfuscated, and what isn't
+
+One file in the published package is deliberately unreadable: `dist/rubric.js`, which holds the scoring thresholds (what earns which points). Those values are commercial IP under [BSL-1.1](LICENSE), and knowing them exactly makes an AI-readiness score easy to game by padding files to hit a number rather than doing the work.
+
+**What that hides: values. What it does not hide: behaviour.** No code path, network call, file access, or data flow is concealed anywhere in this package. The scoring logic itself, every collector, the search ranker, and both network calls above ship as readable JavaScript — and the full source is public at [FASTPROD/ContextEngine](https://github.com/FASTPROD/ContextEngine). If a privacy claim on this page were false, the code that broke it would be right there to find.
+
 ### Why this matters
 
 Most AI coding tools (Copilot, Cursor, Codeium) send your code to external servers for processing. ContextEngine takes the opposite approach — **embeddings run locally on CPU**, search runs locally, and all persistent state stays in `~/.contextengine/` on your disk. The only network call is a lightweight license check for PRO users.

package/dist/activation.d.ts

@@ -21,9 +21,27 @@ export declare function activate(licenseKey: string, email: string): Promise<{
  * Check if delta modules are installed and valid.
  */
 export declare function isDeltaInstalled(): boolean;
+/**
+ * Version of the delta bundle currently cached on disk, or null if none/unreadable.
+ * Exported so callers can report the mismatch rather than guess at it.
+ */
+export declare function installedDeltaVersion(): string | null;
 /**
  * Dynamically import a delta module.
- * Returns null if not activated or module not found.
+ * Returns null if not activated, module missing, or the cached delta is stale.
+ *
+ * 🔒 LOCKED [DELTA-VERSION-PIN] — 2026-08-14
+ * ⛔ NEVER import a delta module without checking its manifest version against this package.
+ * WHY: the cache at ~/.contextengine/delta/ is written once at activation and never expires. On
+ *      the author's own machine it held version 1.19.1 while the installed package was 2.3.1 —
+ *      two months and three sessions of scorer fixes out of date. Because this function imported
+ *      whatever .mjs happened to be on disk, wiring it up would have silently run the OLD scorer
+ *      inside the NEW package: no error, no symptom, just quietly wrong scores. The canary cannot
+ *      catch this — a stale delta carries its own stale canary and its own stale pins, so it
+ *      passes against itself.
+ * FIX: refuse to load a delta whose version does not match the running package, and say so on
+ *      stderr. A stale module is an unknown, not a usable one — [ABSENCE-IS-NOT-A-VERDICT]
+ *      applied to code delivery rather than to a check result.
  */
 export declare function loadDeltaModule(name: string): Promise<any | null>;
 export declare function heartbeat(): Promise<boolean>;

package/dist/activation.js

@@ -29,8 +29,9 @@
  *   4. Premium tools become available
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from "fs";
-import { join } from "path";
+import { join, dirname } from "path";
 import { homedir } from "os";
+import { fileURLToPath } from "url";
 import { createHash, createDecipheriv } from "crypto";
 import { safeAppend } from "./audit.js";
 import { verifyLicenseSignature } from "./license-sig.js";
@@ -38,6 +39,20 @@ import { verifyLicenseSignature } from "./license-sig.js";
 // Constants
 // ---------------------------------------------------------------------------
 const DELTA_DIR = join(homedir(), ".contextengine", "delta");
+/**
+ * Version of the running package. Read from package.json at module load, the same way
+ * agents.ts does it, so [DELTA-VERSION-PIN] compares against the real installed version
+ * rather than a constant someone forgets to bump.
+ */
+const PACKAGE_VERSION = (() => {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        return JSON.parse(readFileSync(join(here, "..", "package.json"), "utf-8")).version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+})();
 const LICENSE_FILE = join(homedir(), ".contextengine", "license.json");
 const ACTIVATION_API_BASE = process.env.CONTEXTENGINE_API || "https://api.compr.ch/contextengine";
 const ACTIVATION_API = `${ACTIVATION_API_BASE}/activate`;
@@ -252,13 +267,45 @@ export function isDeltaInstalled() {
         return false;
     }
 }
+/**
+ * Version of the delta bundle currently cached on disk, or null if none/unreadable.
+ * Exported so callers can report the mismatch rather than guess at it.
+ */
+export function installedDeltaVersion() {
+    try {
+        const manifest = JSON.parse(readFileSync(join(DELTA_DIR, "manifest.json"), "utf-8"));
+        return typeof manifest.version === "string" ? manifest.version : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Dynamically import a delta module.
- * Returns null if not activated or module not found.
+ * Returns null if not activated, module missing, or the cached delta is stale.
+ *
+ * 🔒 LOCKED [DELTA-VERSION-PIN] — 2026-08-14
+ * ⛔ NEVER import a delta module without checking its manifest version against this package.
+ * WHY: the cache at ~/.contextengine/delta/ is written once at activation and never expires. On
+ *      the author's own machine it held version 1.19.1 while the installed package was 2.3.1 —
+ *      two months and three sessions of scorer fixes out of date. Because this function imported
+ *      whatever .mjs happened to be on disk, wiring it up would have silently run the OLD scorer
+ *      inside the NEW package: no error, no symptom, just quietly wrong scores. The canary cannot
+ *      catch this — a stale delta carries its own stale canary and its own stale pins, so it
+ *      passes against itself.
+ * FIX: refuse to load a delta whose version does not match the running package, and say so on
+ *      stderr. A stale module is an unknown, not a usable one — [ABSENCE-IS-NOT-A-VERDICT]
+ *      applied to code delivery rather than to a check result.
  */
 export async function loadDeltaModule(name) {
     if (!isDeltaInstalled())
         return null;
+    const cached = installedDeltaVersion();
+    if (cached !== PACKAGE_VERSION) {
+        console.error(`[ContextEngine] ⚠ Delta module "${name}" is version ${cached ?? "unknown"} but this package is ` +
+            `${PACKAGE_VERSION} — refusing to load a stale module. Re-run \`contextengine activate\` to refresh.`);
+        return null;
+    }
     const modulePath = join(DELTA_DIR, `${name}.mjs`);
     if (!existsSync(modulePath))
         return null;

package/dist/agents.js

@@ -86,6 +86,36 @@ const AGENT_DOC_TOPICS = [
 function matchDocTopics(content, topics) {
     return topics.filter(t => t.patterns.test(content)).map(t => t.label);
 }
+function detectLanguage(p) {
+    if (existsSync(join(p, "package.json")))
+        return "js";
+    const pythonMarkers = ["pyproject.toml", "setup.py", "setup.cfg", "requirements.txt", "Pipfile", "__manifest__.py"];
+    if (pythonMarkers.some(m => existsSync(join(p, m))))
+        return "python";
+    if (existsSync(join(p, "composer.json")))
+        return "php";
+    // Odoo addons and src-layout packages keep their markers one level down.
+    for (const sub of safeSubdirs(p)) {
+        if (pythonMarkers.some(m => existsSync(join(p, sub, m))))
+            return "python";
+        if (existsSync(join(p, sub, "package.json")))
+            return "js";
+    }
+    return "other";
+}
+/** Immediate subdirectories worth searching — skips vendored, hidden and build output. */
+function safeSubdirs(p) {
+    const SKIP = new Set(["node_modules", "vendor", "dist", "build", ".git", "__pycache__", "venv", ".venv", "coverage", "_deprecated"]);
+    try {
+        return readdirSync(p, { withFileTypes: true })
+            .filter(d => d.isDirectory() && !d.name.startsWith(".") && !SKIP.has(d.name))
+            .map(d => d.name)
+            .slice(0, 24); // bounded — this runs for every project on every fleet scan
+    }
+    catch {
+        return [];
+    }
+}
 /** Symlink target for diagnostics, or "?" if unreadable. Never throws. */
 function readlinkSafe(filePath) {
     try {
@@ -1081,6 +1111,8 @@ export function runScoreCanary() {
 export function scoreProject(dir) {
     const checks = [];
     const p = dir.path;
+    // Language decides which tooling checks apply at all — see [SCORE-LANGUAGE-AWARE].
+    const lang = detectLanguage(p);
     // --- Documentation (30 points max) ---
     // copilot-instructions.md (6 pts) — scored on CONTENT, not length.
     // 🔒 LOCKED [SCORE-CONTENT-NOT-LENGTH] — 2026-08-14
@@ -1384,7 +1416,15 @@ export function scoreProject(dir) {
     }
     // --- Code Quality (20 points max) ---
     // Tests directory (8 pts) — checks for real test files, detects symlinks
-    const testDirs = ["tests", "test", "__tests__", "spec", "src/__tests__"];
+    // Search the repo root first, then one level down — Odoo addons, src-layout packages and
+    // single-package monorepos keep tests at `<module>/tests/`. Reporting "No test directory" for
+    // a project with 15 passing tests is [ABSENCE-IS-NOT-A-VERDICT] applied to a path assumption;
+    // it is the same defect as [DOC-PATH-DUAL], one directory deeper.
+    const testDirNames = ["tests", "test", "__tests__", "spec", "src/__tests__"];
+    const testDirs = [
+        ...testDirNames,
+        ...safeSubdirs(p).flatMap(sub => testDirNames.map(td => `${sub}/${td}`)),
+    ];
     const foundTests = testDirs.filter(td => existsSync(join(p, td)));
     if (foundTests.length > 0) {
         const testDirPath = join(p, foundTests[0]);
@@ -1437,6 +1477,21 @@ export function scoreProject(dir) {
     else if (existsSync(join(p, "jsconfig.json"))) {
         checks.push({ name: "Type checking", category: "Code Quality", points: 2, maxPoints: 5, status: "partial", detail: "jsconfig.json only" });
     }
+    else if (lang === "python") {
+        // See [SCORE-LANGUAGE-AWARE]. Python type checking is mypy/pyright, not tsconfig.
+        const pyTypeMarkers = ["mypy.ini", ".mypy.ini", "pyrightconfig.json"];
+        const foundPyType = pyTypeMarkers.filter(m => existsSync(join(p, m)));
+        const pyproject = existsSync(join(p, "pyproject.toml")) ? readFileSync(join(p, "pyproject.toml"), "utf-8") : "";
+        if (foundPyType.length > 0 || /\[tool\.(mypy|pyright)\]/.test(pyproject)) {
+            checks.push({ name: "Type checking", category: "Code Quality", points: 5, maxPoints: 5, status: "pass", detail: `${foundPyType[0] ?? "pyproject.toml"} — static type checking configured` });
+        }
+        else {
+            checks.push({ name: "Type checking", category: "Code Quality", points: 0, maxPoints: 5, status: "fail", detail: "Python project with no mypy/pyright config — add one for static type checking" });
+        }
+    }
+    else if (lang === "php" || lang === "other") {
+        checks.push({ name: "Type checking", category: "Code Quality", points: 0, maxPoints: 5, status: "unknown", detail: `❔ No type-checking convention known for this project type (${lang}) — not assessed` });
+    }
     else {
         checks.push({ name: "Type checking", category: "Code Quality", points: 0, maxPoints: 5, status: "fail", detail: "No tsconfig/jsconfig" });
     }
@@ -1456,8 +1511,22 @@ export function scoreProject(dir) {
             checks.push({ name: "Linting", category: "Code Quality", points: 4, maxPoints: 4, status: "pass", detail: foundLint.join(", ") });
         }
     }
+    else if (lang === "python") {
+        // See [SCORE-LANGUAGE-AWARE]. Python linting is ruff/flake8/pylint, not eslint.
+        const pyLint = ["ruff.toml", ".ruff.toml", ".flake8", ".pylintrc", "tox.ini", "setup.cfg"].filter(l => existsSync(join(p, l)));
+        const pyproject = existsSync(join(p, "pyproject.toml")) ? readFileSync(join(p, "pyproject.toml"), "utf-8") : "";
+        if (pyLint.length > 0 || /\[tool\.(ruff|flake8|pylint|black)\]/.test(pyproject)) {
+            checks.push({ name: "Linting", category: "Code Quality", points: 4, maxPoints: 4, status: "pass", detail: pyLint[0] ?? "pyproject.toml" });
+        }
+        else {
+            checks.push({ name: "Linting", category: "Code Quality", points: 0, maxPoints: 4, status: "fail", detail: "Python project with no ruff/flake8/pylint config — add one" });
+        }
+    }
+    else if (lang === "other") {
+        checks.push({ name: "Linting", category: "Code Quality", points: 0, maxPoints: 4, status: "unknown", detail: "❔ No linting convention known for this project type — not assessed" });
+    }
     else {
-        checks.push({ name: "Linting", category: "Code Quality", points: 0, maxPoints: 4, status: "fail", detail: "No lint config" });
+        checks.push({ name: "Linting", category: "Code Quality", points: 0, maxPoints: 4, status: "fail", detail: "No lint config (looked for eslint/prettier/phpcs at repo root)" });
     }
     // Package scripts / build commands (3 pts)
     const pkgPath = join(p, "package.json");
@@ -1722,7 +1791,7 @@ export function generateProjectScoreMD(score) {
             lines.push(`- ❔ **${u.name}**: ${u.detail}`);
         }
     }
-    lines.push(`\n---\n*Generated by [ContextEngine](https://www.npmjs.com/package/@compr/contextengine-mcp) on ${date}*\n`);
+    lines.push(`\n---\n*Generated by [ContextEngine](https://www.npmjs.com/package/@compr/opscontext-mcp) on ${date}*\n`);
     return lines.join("\n");
 }
 /**
@@ -1917,7 +1986,7 @@ export function generateScoreHTML(scores) {
 ${projectCards}
 
 <div class="footer">
-  <p>ContextEngine · <a href="https://www.npmjs.com/package/@compr/contextengine-mcp" style="color:var(--accent)">npm</a></p>
+  <p>ContextEngine · <a href="https://www.npmjs.com/package/@compr/opscontext-mcp" style="color:var(--accent)">npm</a></p>
   <p style="margin-top:4px">Scoring: Documentation (30pts) · Infrastructure (30pts) · Code Quality (20pts) · Security (20pts)</p>
 </div>
 </body>

package/dist/cli.js

@@ -217,7 +217,7 @@ function generateMcpJson() {
             contextengine: {
                 type: "stdio",
                 command: npxPath,
-                args: ["-y", "@compr/contextengine-mcp"],
+                args: ["-y", "@compr/opscontext-mcp"],
             },
         },
     };
@@ -2123,17 +2123,17 @@ Flags:
   --yes, -y   Skip all interactive prompts (auto-accept defaults)
 
 Examples:
-  npx @compr/contextengine-mcp search "docker nginx"
-  npx @compr/contextengine-mcp score ContextEngine
-  npx @compr/contextengine-mcp score --html
-  npx @compr/contextengine-mcp save-session my-project summary "Deployed v2, fixed auth"
-  npx @compr/contextengine-mcp load-session my-project
-  npx @compr/contextengine-mcp end-session
-  npx @compr/contextengine-mcp import-learnings rules.md -c deployment
-  npx @compr/contextengine-mcp init --yes
-  echo "value" | npx @compr/contextengine-mcp save-session my-project notes --stdin
+  npx @compr/opscontext-mcp search "docker nginx"
+  npx @compr/opscontext-mcp score ContextEngine
+  npx @compr/opscontext-mcp score --html
+  npx @compr/opscontext-mcp save-session my-project summary "Deployed v2, fixed auth"
+  npx @compr/opscontext-mcp load-session my-project
+  npx @compr/opscontext-mcp end-session
+  npx @compr/opscontext-mcp import-learnings rules.md -c deployment
+  npx @compr/opscontext-mcp init --yes
+  echo "value" | npx @compr/opscontext-mcp save-session my-project notes --stdin
 
-npm:  https://www.npmjs.com/package/@compr/contextengine-mcp
+npm:  https://www.npmjs.com/package/@compr/opscontext-mcp
 `);
 }
 else if (command === "search") {

package/dist/rubric.js

@@ -1,4 +1,19 @@
 /*__RUBRIC_ENCODED__*/
+/*
+ * Scoring thresholds — encoded deliberately.
+ *
+ * WHAT THIS IS: the point values and cut-offs behind the AI-readiness score. They are commercial
+ * IP under BSL-1.1, and publishing them exactly makes the score trivial to game by padding files
+ * to hit a number instead of doing the work.
+ *
+ * WHAT THIS IS NOT: hidden behaviour. This file contains numbers and nothing else — no network
+ * calls, no file access, no data collection. Every code path in this package ships readable,
+ * including the two (and only two) network calls the tool ever makes: licence activation and the
+ * daily heartbeat, both in activation.js. Full source: https://github.com/FASTPROD/ContextEngine
+ *
+ * Your project data never leaves your machine. See the Privacy section of the README, and verify
+ * it in the source rather than taking our word for it.
+ */
 const _k = "ce-rubric-v1";
 const _d = (b) => {
   const raw = Buffer.from(b, "base64").toString("binary");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compr/opscontext-mcp",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "description": "OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.",
   "type": "module",
   "main": "dist/index.js",