@i4ctime/q-ring 0.10.1 → 0.11.5

package/dist/mcp.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  PACKAGE_VERSION,
   checkDecay,
   checkExecPolicy,
   checkKeyReadPolicy,
@@ -13,6 +14,7 @@ import {
   exportAudit,
   exportSecrets,
   fireHooks,
+  forget,
   getEnvelope,
   getExecMaxRuntime,
   getPolicySummary,
@@ -20,12 +22,15 @@ import {
   hasSecret,
   httpRequest,
   listHooks,
+  listMemory,
   listSecrets,
   logAudit,
   queryAudit,
   readProjectConfig,
+  recall,
   registerHook,
   registry,
+  remember,
   removeHook,
   setSecret,
   tunnelCreate,
@@ -33,7 +38,7 @@ import {
   tunnelList,
   tunnelRead,
   verifyAuditChain
-} from "./chunk-E46HG5NM.js";
+} from "./chunk-MQM4DLPI.js";
 
 // src/mcp.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -41,23 +46,6 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
-// src/version.ts
-import { readFileSync } from "fs";
-import { dirname, join } from "path";
-import { fileURLToPath } from "url";
-function readPackageVersion() {
-  try {
-    const here = dirname(fileURLToPath(import.meta.url));
-    const pkgPath = join(here, "..", "package.json");
-    const raw = readFileSync(pkgPath, "utf8");
-    const pkg = JSON.parse(raw);
-    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
-var PACKAGE_VERSION = readPackageVersion();
-
 // src/mcp/tools/secrets.ts
 import { z as z2 } from "zod";
 
@@ -163,7 +151,7 @@ function estimateEntropy(secret) {
 }
 
 // src/core/import.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 function parseDotenv(content) {
   const result = /* @__PURE__ */ new Map();
   const lines = content.split(/\r?\n/);
@@ -195,7 +183,7 @@ function parseDotenv(content) {
 function importDotenv(filePathOrContent, options = {}) {
   let content;
   try {
-    content = readFileSync2(filePathOrContent, "utf8");
+    content = readFileSync(filePathOrContent, "utf8");
   } catch {
     content = filePathOrContent;
   }
@@ -350,7 +338,7 @@ function registerSecretTools(server2) {
   );
   server2.tool(
     "set_secret",
-    "[secrets] Store a secret with optional quantum metadata: TTL (decay), environment state (superposition), description, tags.",
+    "[secrets] Create or overwrite a secret value plus optional metadata (TTL/decay, per-env superposition, description, tags). Overwrites existing values for the same key/scope; records access in the audit log. Use import_dotenv for bulk .env ingest. Subject to tool policy; no external rate limits beyond provider calls when validating elsewhere.",
     {
       key: z2.string().describe("The secret key name"),
       value: z2.string().describe("The secret value"),
@@ -413,7 +401,7 @@ function registerSecretTools(server2) {
   );
   server2.tool(
     "delete_secret",
-    "[secrets] Remove a secret from the keyring.",
+    "[secrets] Permanently remove a secret value from the keyring for the given scope/path (not recoverable from q-ring). Does not remove hooks, tunnels, or entanglement metadata alone\u2014use remove_hook, tunnel_destroy, or disentangle_secrets respectively. Returns success or not-found text; subject to tool policy.",
     {
       key: z2.string().describe("The secret key name"),
       scope,
@@ -596,7 +584,7 @@ function registerSecretTools(server2) {
   );
   server2.tool(
     "entangle_secrets",
-    "[secrets] Create a quantum entanglement between two secrets. When the source is rotated/updated, the target automatically receives the same value.",
+    "[secrets] Link two keys so source updates/rotations propagate the same value to the target (mutates metadata; future writes sync). Reverse with disentangle_secrets without deleting values; do not confuse with set_secret (single-key write). Subject to tool policy.",
     {
       sourceKey: z2.string().describe("Source secret key"),
       targetKey: z2.string().describe("Target secret key"),
@@ -630,7 +618,7 @@ function registerSecretTools(server2) {
   );
   server2.tool(
     "disentangle_secrets",
-    "[secrets] Remove a quantum entanglement between two secrets. They will no longer synchronize on rotation.",
+    "[secrets] Remove the sync link between two keys so rotations stop propagating. Does not delete either secret\u2014use delete_secret to erase values. Contrast entangle_secrets (creates link). Safe if the link was already absent; updates metadata; subject to tool policy.",
     {
       sourceKey: z2.string().describe("Source secret key"),
       targetKey: z2.string().describe("Target secret key"),
@@ -1416,7 +1404,7 @@ function registerAuditTools(server2) {
   );
   server2.tool(
     "detect_anomalies",
-    "[audit] Scan for anomalous secret access patterns: burst reads, unusual-hour access. Returns findings and recommendations.",
+    "[audit] Read-only scan of audit history for burst reads and unusual-hour access (text lines per finding). Optional key filter. Use health_check for full decay inventory + anomaly count in scope; use agent_scan for multi-project JSON reports or optional auto-rotation. Does not mutate secrets.",
     {
       key: z6.string().optional().describe("Check anomalies for a specific key")
     },
@@ -1431,7 +1419,7 @@ function registerAuditTools(server2) {
   );
   server2.tool(
     "health_check",
-    "[health] Run a comprehensive health check on all secrets: decay status, staleness, anomalies, entropy assessment.",
+    "[health] Read-only scoped pass: decay/stale/expired counts, per-secret issue lines, plus audit-derived anomalies. No writes. Use check_project for .q-ring.json manifest compliance; use detect_anomalies for audit-pattern-only triage; use agent_scan for multi-project JSON or optional autoRotate credential replacement.",
     {
       scope: scope4,
       projectPath: projectPath4,
@@ -1680,7 +1668,7 @@ function registerHookTools(server2) {
   );
   server2.tool(
     "remove_hook",
-    "[hooks] Remove a registered hook by ID.",
+    "[hooks] Remove a lifecycle hook entry by id from the hook registry only (stops callbacks; does not touch secret values). Call list_hooks first for ids. Contrast delete_secret (credential removal) or tunnel_destroy (ephemeral tunnel). Returns success or not-found; subject to tool policy.",
     {
       id: z8.string().describe("Hook ID to remove")
     },
@@ -1983,8 +1971,8 @@ async function execCommand(opts2) {
 }
 
 // src/core/scan.ts
-import { readFileSync as readFileSync3, readdirSync, statSync } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync2, readdirSync, statSync } from "fs";
+import { join } from "path";
 
 // src/core/secrets-detect.ts
 var SECRET_ASSIGNMENT_PATTERN = /((?:api_?key|secret|token|password|auth|credential|access_?key)[a-z0-9_]*)\s*[:=]\s*(['"])([^'"]+)\2/gi;
@@ -2078,7 +2066,7 @@ function scanCodebase(dir) {
     }
     for (const entry of entries) {
       if (IGNORE_DIRS.has(entry)) continue;
-      const fullPath = join2(currentDir, entry);
+      const fullPath = join(currentDir, entry);
       let stat;
       try {
         stat = statSync(fullPath);
@@ -2092,7 +2080,7 @@ function scanCodebase(dir) {
         if (IGNORE_EXTS.has(ext) || entry.endsWith(".lock")) continue;
         let content;
         try {
-          content = readFileSync3(fullPath, "utf8");
+          content = readFileSync2(fullPath, "utf8");
         } catch {
           continue;
         }
@@ -2122,7 +2110,7 @@ function scanCodebase(dir) {
 }
 
 // src/core/linter.ts
-import { readFileSync as readFileSync4, writeFileSync, existsSync } from "fs";
+import { readFileSync as readFileSync3, writeFileSync, existsSync } from "fs";
 import { basename, extname } from "path";
 var ENV_REF_BY_EXT = {
   ".ts": (k) => `process.env.${k}`,
@@ -2153,7 +2141,7 @@ function lintFiles(files, opts2 = {}) {
     if (!existsSync(file)) continue;
     let content;
     try {
-      content = readFileSync4(file, "utf8");
+      content = readFileSync3(file, "utf8");
     } catch {
       continue;
     }
@@ -2351,7 +2339,7 @@ ${result.stderr}`);
   let dashboardInstance = null;
   server2.tool(
     "status_dashboard",
-    "[dashboard] Launch the quantum status dashboard \u2014 a local web page showing live health, decay timers, superposition states, entanglement graph, tunnels, audit log, and anomaly alerts. Returns the URL to open in a browser.",
+    "[dashboard] Launch the quantum status dashboard \u2014 a local SSE-driven web page showing live KPIs (secrets, env, protected, approvals, hooks, 24h reads, anomalies), health summary, environment, .q-ring.json manifest gaps, governance policy summary, sortable searchable secrets table, decay/superposition/entanglement/tunnel cards, active approvals & hooks, agent memory, anomaly alerts, and a filterable 24h audit feed. Returns the URL to open in a browser. Never exposes secret values.",
     {
       port: z9.number().optional().default(9876).describe("Port to serve on")
     },
@@ -2363,7 +2351,7 @@ ${result.stderr}`);
           `Dashboard already running at http://127.0.0.1:${dashboardInstance.port}`
         );
       }
-      const { startDashboardServer } = await import("./dashboard-73QYM5FU.js");
+      const { startDashboardServer } = await import("./dashboard-FSCJDLJX.js");
       dashboardInstance = startDashboardServer({ port: params.port });
       return text(
         `Dashboard started at http://127.0.0.1:${dashboardInstance.port}
@@ -2373,7 +2361,7 @@ Open this URL in a browser to see live quantum status.`
   );
   server2.tool(
     "agent_scan",
-    "[agent] Run an autonomous agent health scan: checks decay, staleness, anomalies, and optionally auto-rotates expired secrets. Returns a structured report.",
+    "[agent] Multi-project health pass: decay, staleness, audit anomalies, manifest gaps; returns JSON. Prefer health_check for a read-only scoped decay/anomaly text summary (no writes). Prefer detect_anomalies for audit-pattern spikes on one key. With autoRotate=true, overwrites expired secret values in the keyring (credential change\u2014not undoable); leave false unless intentional rotation. Same policy gates as other MCP tools; no separate external auth.",
     {
       autoRotate: z9.boolean().optional().default(false).describe("Auto-rotate expired secrets with generated values"),
       projectPaths: z9.array(z9.string()).optional().describe("Project paths to monitor")
@@ -2392,122 +2380,6 @@ Open this URL in a browser to see live quantum status.`
 
 // src/mcp/tools/agent.ts
 import { z as z10 } from "zod";
-
-// src/core/memory.ts
-import { existsSync as existsSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync } from "fs";
-import { join as join3 } from "path";
-import { homedir, hostname, userInfo } from "os";
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash, randomBytes as randomBytes3 } from "crypto";
-import { Entry } from "@napi-rs/keyring";
-var MEMORY_FILE = "agent-memory.enc";
-var KEYRING_SERVICE = "qring-memory-key";
-var KEYRING_ACCOUNT = "encryption-key";
-function getMemoryDir() {
-  const dir = join3(homedir(), ".config", "q-ring");
-  if (!existsSync2(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-  return dir;
-}
-function getMemoryPath() {
-  return join3(getMemoryDir(), MEMORY_FILE);
-}
-function deriveLegacyKey() {
-  const fingerprint = `qring-memory:${hostname()}:${userInfo().username}`;
-  return createHash("sha256").update(fingerprint).digest();
-}
-function getOrCreateKey() {
-  try {
-    const entry = new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT);
-    const stored = entry.getPassword();
-    if (stored) return Buffer.from(stored, "base64");
-    const key = randomBytes3(32);
-    entry.setPassword(key.toString("base64"));
-    return key;
-  } catch {
-    console.warn("[q-ring] OS keyring unavailable for memory key \u2014 falling back to machine-derived key");
-    return deriveLegacyKey();
-  }
-}
-function encryptWith(data, key) {
-  const iv = randomBytes3(12);
-  const cipher = createCipheriv2("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${iv.toString("base64")}:${tag.toString("base64")}:${encrypted.toString("base64")}`;
-}
-function decryptWith(blob, key) {
-  const parts = blob.split(":");
-  if (parts.length !== 3) throw new Error("Invalid encrypted format");
-  const iv = Buffer.from(parts[0], "base64");
-  const tag = Buffer.from(parts[1], "base64");
-  const encrypted = Buffer.from(parts[2], "base64");
-  const decipher = createDecipheriv2("aes-256-gcm", key, iv);
-  decipher.setAuthTag(tag);
-  return decipher.update(encrypted) + decipher.final("utf8");
-}
-function encrypt(data) {
-  return encryptWith(data, getOrCreateKey());
-}
-function decrypt(blob) {
-  const key = getOrCreateKey();
-  try {
-    return decryptWith(blob, key);
-  } catch {
-    const legacy = deriveLegacyKey();
-    const plain = decryptWith(blob, legacy);
-    writeFileSync2(getMemoryPath(), encryptWith(plain, key), "utf8");
-    return plain;
-  }
-}
-function loadStore() {
-  const path = getMemoryPath();
-  if (!existsSync2(path)) {
-    return { entries: {} };
-  }
-  try {
-    const raw = readFileSync5(path, "utf8");
-    const decrypted = decrypt(raw);
-    return JSON.parse(decrypted);
-  } catch {
-    return { entries: {} };
-  }
-}
-function saveStore(store) {
-  const json = JSON.stringify(store);
-  const encrypted = encrypt(json);
-  writeFileSync2(getMemoryPath(), encrypted, "utf8");
-}
-function remember(key, value) {
-  const store = loadStore();
-  store.entries[key] = {
-    value,
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  saveStore(store);
-}
-function recall(key) {
-  const store = loadStore();
-  return store.entries[key]?.value ?? null;
-}
-function listMemory() {
-  const store = loadStore();
-  return Object.entries(store.entries).map(([key, entry]) => ({
-    key,
-    updatedAt: entry.updatedAt
-  }));
-}
-function forget(key) {
-  const store = loadStore();
-  if (key in store.entries) {
-    delete store.entries[key];
-    saveStore(store);
-    return true;
-  }
-  return false;
-}
-
-// src/mcp/tools/agent.ts
 function registerAgentTools(server2) {
   server2.tool(
     "agent_remember",