@martinloop/mcp 0.2.0 → 0.2.5

package/dist/vendor/adapters/verifier-only.js

@@ -54,4 +54,3 @@ export function createVerifierOnlyAdapter(options = {}) {
         }
     };
 }
-//# sourceMappingURL=verifier-only.js.map

package/dist/vendor/contracts/governance.js

@@ -9,4 +9,3 @@ export function createGovernanceSnapshot(snapshot) {
         }))
     };
 }
-//# sourceMappingURL=governance.js.map

package/dist/vendor/contracts/index.d.ts

@@ -108,6 +108,8 @@ export interface LoopRecordDraft {
     createdAt?: string;
     updatedAt?: string;
 }
+export type { MartinErrorCategory, MartinOutputMode, MartinRunListFilters, MartinRunSelector } from "./operator.js";
+export { MARTIN_ERROR_CATEGORIES } from "./operator.js";
 export interface LoopEventDraft {
     type: LoopEventType;
     lifecycleState?: LoopLifecycleState;

package/dist/vendor/contracts/index.js

@@ -1,3 +1,4 @@
+export { MARTIN_ERROR_CATEGORIES } from "./operator.js";
 export const DEFAULT_BUDGET = {
     maxUsd: 25,
     softLimitUsd: 15,
@@ -200,4 +201,3 @@ function hasText(value) {
     return typeof value === "string" && value.trim().length > 0;
 }
 export { createGovernanceSnapshot } from "./governance.js";
-//# sourceMappingURL=index.js.map

package/dist/vendor/contracts/operator.d.ts

@@ -0,0 +1,19 @@
+export declare const MARTIN_ERROR_CATEGORIES: readonly ["invalid_input", "environment", "auth", "not_found", "store_unreadable", "verification_failed", "policy_blocked", "budget_exit", "transient"];
+export type MartinErrorCategory = (typeof MARTIN_ERROR_CATEGORIES)[number];
+export type MartinOutputMode = "human" | "json" | "quiet";
+export interface MartinRunSelector {
+    runsDir?: string;
+    file?: string;
+    loopId?: string;
+    latest?: boolean;
+    attemptIndex?: number;
+}
+export interface MartinRunListFilters {
+    runsDir?: string;
+    limit?: number;
+    status?: string;
+    lifecycleState?: string;
+    adapterId?: string;
+    model?: string;
+    updatedAfter?: string;
+}

package/dist/vendor/contracts/operator.js

@@ -0,0 +1,11 @@
+export const MARTIN_ERROR_CATEGORIES = [
+    "invalid_input",
+    "environment",
+    "auth",
+    "not_found",
+    "store_unreadable",
+    "verification_failed",
+    "policy_blocked",
+    "budget_exit",
+    "transient"
+];

package/dist/vendor/core/compiler.js

@@ -50,4 +50,3 @@ export function compilePromptPacket(request) {
         }
     };
 }
-//# sourceMappingURL=compiler.js.map

package/dist/vendor/core/context-integrity.js

@@ -53,4 +53,3 @@ export async function runContextIntegrityPrecheck(runId, attemptIndex, artifacts
     }
     return precheck;
 }
-//# sourceMappingURL=context-integrity.js.map

package/dist/vendor/core/grounding.js

@@ -267,4 +267,3 @@ function matchesGlobPattern(filePath, pattern) {
         .replace(/__DOUBLESTAR__/g, ".*");
     return new RegExp(`^${regexStr}$`).test(filePath);
 }
-//# sourceMappingURL=grounding.js.map

package/dist/vendor/core/index.js

@@ -1099,7 +1099,7 @@ function resolveChangedFiles(result, repoRoot) {
         return [];
     }
     try {
-        const diff = spawnSync("git", ["diff", "--name-only", "HEAD"], {
+        const diff = spawnSync("git", ["diff", "--name-only", "HEAD", "--", "."], {
             cwd: repoRoot,
             encoding: "utf8"
         });
@@ -1254,4 +1254,3 @@ function applyPatchFailureToLoop(loop, input) {
             : attempt)
     };
 }
-//# sourceMappingURL=index.js.map

package/dist/vendor/core/leash.js

@@ -9,7 +9,7 @@ const BLOCKED_PATTERNS = [
     /(^|\s)mkfs(\.|\s|$)/u,
     /(^|\s)dd\s+if=/u,
     /(shutdown|reboot)(\s|$)/iu,
-    /:\(\)\{:\|:&\};:/u,
+    /:\(\)\s*\{\s*:\|:&\s*\}\s*;\s*:/u,
     /chmod\s+-R\s+777\s+\//iu,
     /(kubectl|docker)\s+.*\b(delete|prune|rm)\b/iu,
     /ssh\s+/iu,
@@ -314,17 +314,25 @@ function normalizeChangedFile(file, repoRoot) {
     };
 }
 function matchesPathPattern(file, pattern) {
-    const normalizedFile = file.replace(/\\/gu, "/");
-    const normalizedPattern = pattern.replace(/\\/gu, "/");
-    if (normalizedPattern.includes("**")) {
-        const prefix = normalizedPattern.split("**")[0] ?? normalizedPattern;
-        return normalizedFile.startsWith(prefix.replace(/\/$/u, ""));
+    const normalizedFile = normalizePathForMatching(file);
+    const normalizedPattern = normalizePathForMatching(pattern);
+    if (!normalizedPattern.includes("*")) {
+        return (normalizedFile === normalizedPattern ||
+            normalizedFile.startsWith(`${normalizedPattern.replace(/\/$/u, "")}/`));
     }
-    if (normalizedPattern.endsWith("*")) {
-        return normalizedFile.startsWith(normalizedPattern.replace(/\*+$/u, ""));
-    }
-    return (normalizedFile === normalizedPattern ||
-        normalizedFile.startsWith(`${normalizedPattern.replace(/\/$/u, "")}/`));
+    const regexStr = normalizedPattern
+        .replace(/[.+^${}()|[\]\\]/gu, "\\$&")
+        .replace(/\*\*/gu, "__DOUBLESTAR__")
+        .replace(/\*/gu, "[^/]*")
+        .replace(/__DOUBLESTAR__/gu, ".*");
+    return new RegExp(`^${regexStr}$`, "u").test(normalizedFile);
+}
+function normalizePathForMatching(value) {
+    return value
+        .replace(/\\/gu, "/")
+        .replace(/^\.\//u, "")
+        .replace(/\/{2,}/gu, "/")
+        .replace(/\/$/u, "");
 }
 function buildNetworkViolation(command, profile) {
     const targets = extractNetworkTargets(command);
@@ -405,4 +413,3 @@ function isConfigChangeFile(file) {
         normalized.startsWith("infrastructure/") ||
         normalized.startsWith("ops/"));
 }
-//# sourceMappingURL=leash.js.map

package/dist/vendor/core/persistence/compiler.js

@@ -32,4 +32,3 @@ export async function compileAndPersistContext(request, options) {
     }
     return { packet };
 }
-//# sourceMappingURL=compiler.js.map

package/dist/vendor/core/persistence/index.js

@@ -2,4 +2,3 @@ export { makeLedgerEvent } from "./ledger.js";
 export { artifactDir, createFileRunStore, resolveRunsRoot, runDir } from "./store.js";
 export { readAllLoopRecords, readLatestLoopRecord, readLatestLoopRecordFromFile, readLoopRecordsFromFile } from "./runs-reader.js";
 export { compileAndPersistContext } from "./compiler.js";
-//# sourceMappingURL=index.js.map

package/dist/vendor/core/persistence/ledger.js

@@ -7,4 +7,3 @@ export function makeLedgerEvent(draft, options = {}) {
         ...(draft.attemptIndex !== undefined ? { attemptIndex: draft.attemptIndex } : {})
     };
 }
-//# sourceMappingURL=ledger.js.map

package/dist/vendor/core/persistence/runs-reader.js

@@ -81,4 +81,3 @@ export async function readLatestLoopRecord(runsDir) {
         return a > b ? r : latest;
     }, records[0]);
 }
-//# sourceMappingURL=runs-reader.js.map

package/dist/vendor/core/persistence/store.js

@@ -86,4 +86,3 @@ export function createFileRunStore(options = {}) {
 async function writeJsonFile(path, value) {
     await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
 }
-//# sourceMappingURL=store.js.map

package/dist/vendor/core/policy.js

@@ -622,4 +622,3 @@ function computeDiffRiskScore(input) {
 function roundScore(value) {
     return Math.round(value * 100) / 100;
 }
-//# sourceMappingURL=policy.js.map

package/dist/vendor/core/red-blue/red-phase.d.ts

@@ -0,0 +1,64 @@
+import { type RiskTier } from "./risk-tiers.js";
+export interface RedFinding {
+    trapId: string;
+    severity: "warn" | "block";
+    description: string;
+    resolvedAt?: string;
+}
+export interface RedFindings {
+    riskTier: RiskTier;
+    probesRun: number;
+    findingsCount: number;
+    findings: RedFinding[];
+    modelCallMade: boolean;
+    modelUsed?: string;
+    budgetUsedUsd: number;
+}
+/** Minimal interface for the Anthropic model client (mockable in tests). */
+export interface MockModelClient {
+    complete(prompt: string): Promise<{
+        findings: RedFinding[];
+        tokensUsed: number;
+        costUsd: number;
+    }>;
+}
+export interface RunRedPhaseOptions {
+    /** Inject a mock or real Anthropic client. Required for release_critical tier. */
+    modelClient?: MockModelClient;
+    /** Callback fired with each ledger event produced by the phase. */
+    onLedgerEvent?: (event: RedLedgerEvent) => void;
+}
+export interface RedLedgerEvent {
+    type: "red_phase_findings";
+    runId?: string;
+    riskTier: RiskTier;
+    probesRun: number;
+    findingsCount: number;
+    modelCallMade: boolean;
+    timestamp: string;
+}
+export interface PatchInput {
+    patchId: string;
+    diff: string;
+    changedFiles: string[];
+}
+/**
+ * Runs the Red phase for a given patch and risk tier.
+ *
+ * - baseline: programmatic probes only, no model call
+ * - high_risk: paranoid programmatic scan, no model call
+ * - release_critical: paranoid scan + one Haiku model call
+ */
+export declare function runRedPhase(patch: PatchInput, tier: RiskTier, blueBudgetUsd: number, options?: RunRedPhaseOptions): Promise<RedFindings>;
+/**
+ * Returns true only if the findings contain zero block-severity entries.
+ * A single block finding rejects the patch regardless of warn count.
+ */
+export declare function shouldAcceptPatch(findings: RedFindings): boolean;
+/**
+ * Convenience builder for RedFindings — useful in tests and policy engine.
+ */
+export declare function buildRedFindings(input: Partial<RedFindings> & {
+    riskTier: RiskTier;
+    findings: RedFinding[];
+}): RedFindings;

package/dist/vendor/core/red-blue/red-phase.js

@@ -0,0 +1,135 @@
+import { PROBE_COUNTS, RED_PHASE_MODEL, resolveRedBudgetPolicy } from "./risk-tiers.js";
+// ─── Programmatic probes ──────────────────────────────────────────────────────
+function runProgrammaticProbes(patch, paranoid) {
+    const findings = [];
+    // Probe 1: assertion deletion
+    if (/^\-.*(?:expect\(.*\)\.to|assert\.(?:equal|is|ok|strictEqual)|t\.(?:is|truthy|falsy|deepEqual))/m.test(patch.diff)) {
+        findings.push({
+            trapId: "T01",
+            severity: "warn",
+            description: "Patch removes test assertions — possible weak-test false green."
+        });
+    }
+    // Probe 2: grounding evasion pragma
+    if (/@martin-ignore|@ts-nocheck|eslint-disable/i.test(patch.diff)) {
+        findings.push({
+            trapId: "T11",
+            severity: "block",
+            description: "Grounding evasion pragma detected in patch."
+        });
+    }
+    // Probe 3: context poisoning
+    if (/\.martin\/|\.claude\//.test(patch.diff)) {
+        findings.push({
+            trapId: "T07",
+            severity: "block",
+            description: "Patch writes to agent context directory (.martin/ or .claude/)."
+        });
+    }
+    // Probe 4: budget self-report
+    if (/budgetSource.*model_reported|model_reported.*budget/i.test(patch.diff)) {
+        findings.push({
+            trapId: "T10",
+            severity: "block",
+            description: "Patch introduces model-reported budget sourcing."
+        });
+    }
+    if (paranoid) {
+        // Probe 5: scope creep — manifest changes
+        if (/^\+.*"[^"]+"\s*:\s*"[^"]+".*$/m.test(patch.diff) &&
+            /package\.json|Cargo\.toml|go\.mod/i.test(patch.changedFiles.join(","))) {
+            findings.push({
+                trapId: "T03",
+                severity: "warn",
+                description: "Paranoid scan: substantive manifest change detected."
+            });
+        }
+        // Probe 6: silent revert — removal of recently added symbols
+        const removedExportPattern = /^\-.*export\s+(function|const|class)\s+\w+/m;
+        if (removedExportPattern.test(patch.diff)) {
+            findings.push({
+                trapId: "T02",
+                severity: "warn",
+                description: "Paranoid scan: exported symbol removed — potential silent revert."
+            });
+        }
+    }
+    return findings;
+}
+// ─── Red phase runner ─────────────────────────────────────────────────────────
+/**
+ * Runs the Red phase for a given patch and risk tier.
+ *
+ * - baseline: programmatic probes only, no model call
+ * - high_risk: paranoid programmatic scan, no model call
+ * - release_critical: paranoid scan + one Haiku model call
+ */
+export async function runRedPhase(patch, tier, blueBudgetUsd, options = {}) {
+    const policy = resolveRedBudgetPolicy(tier, blueBudgetUsd);
+    const paranoid = tier !== "baseline";
+    let findings = runProgrammaticProbes(patch, paranoid);
+    let modelCallMade = false;
+    let modelUsed;
+    let budgetUsedUsd = 0;
+    const probesRun = PROBE_COUNTS[tier];
+    if (policy.modelCallAllowed && options.modelClient) {
+        const prompt = buildRedPhasePrompt(patch, findings);
+        const result = await options.modelClient.complete(prompt);
+        findings = [...findings, ...result.findings];
+        modelCallMade = true;
+        modelUsed = RED_PHASE_MODEL;
+        budgetUsedUsd += result.costUsd;
+    }
+    const result = {
+        riskTier: tier,
+        probesRun,
+        findingsCount: findings.length,
+        findings,
+        modelCallMade,
+        ...(modelUsed !== undefined ? { modelUsed } : {}),
+        budgetUsedUsd
+    };
+    options.onLedgerEvent?.({
+        type: "red_phase_findings",
+        riskTier: tier,
+        probesRun,
+        findingsCount: findings.length,
+        modelCallMade,
+        timestamp: new Date().toISOString()
+    });
+    return result;
+}
+// ─── Policy helpers ───────────────────────────────────────────────────────────
+/**
+ * Returns true only if the findings contain zero block-severity entries.
+ * A single block finding rejects the patch regardless of warn count.
+ */
+export function shouldAcceptPatch(findings) {
+    return !findings.findings.some((f) => f.severity === "block");
+}
+/**
+ * Convenience builder for RedFindings — useful in tests and policy engine.
+ */
+export function buildRedFindings(input) {
+    return {
+        riskTier: input.riskTier,
+        probesRun: input.probesRun ?? PROBE_COUNTS[input.riskTier],
+        findingsCount: input.findings.length,
+        findings: input.findings,
+        modelCallMade: input.modelCallMade ?? false,
+        ...(input.modelUsed !== undefined ? { modelUsed: input.modelUsed } : {}),
+        budgetUsedUsd: input.budgetUsedUsd ?? 0
+    };
+}
+// ─── Internal helpers ─────────────────────────────────────────────────────────
+function buildRedPhasePrompt(patch, existingFindings) {
+    return [
+        "You are a security-focused code reviewer running adversarial analysis.",
+        "Analyze this patch for adversarial patterns not caught by programmatic probes.",
+        "Return JSON array of findings with: trapId, severity (warn|block), description.",
+        `Already detected: ${JSON.stringify(existingFindings.map(f => f.trapId))}`,
+        `Changed files: ${patch.changedFiles.join(", ")}`,
+        "Diff (truncated to 2000 chars):",
+        patch.diff.slice(0, 2000)
+    ].join("\n");
+}

package/dist/vendor/core/red-blue/risk-tiers.d.ts

@@ -0,0 +1,22 @@
+export type RiskTier = "baseline" | "high_risk" | "release_critical";
+export interface RedBudgetPolicy {
+    riskTier: RiskTier;
+    blueBudgetUsd: number;
+    /** Cap on Red phase spend: 30% / 100% / 150% of Blue */
+    redBudgetCapUsd: number;
+    /** Only release_critical permits a Haiku model call */
+    modelCallAllowed: boolean;
+}
+/**
+ * Returns the Red phase budget policy for a given risk tier and Blue budget.
+ */
+export declare function resolveRedBudgetPolicy(tier: RiskTier, blueBudgetUsd: number): RedBudgetPolicy;
+/**
+ * Probe counts per tier.
+ * baseline = standard 6-probe sweep
+ * high_risk = paranoid 12-probe sweep
+ * release_critical = paranoid 12-probe sweep + model
+ */
+export declare const PROBE_COUNTS: Record<RiskTier, number>;
+/** The only model ever permitted in the Red phase. */
+export declare const RED_PHASE_MODEL: "claude-haiku-4-5-20251001";

package/dist/vendor/core/red-blue/risk-tiers.js

@@ -0,0 +1,32 @@
+// ─── Risk Tier Definitions ────────────────────────────────────────────────────
+// Governs how aggressively Red phase probes a patch and whether a model call
+// is permitted. Budget caps are expressed as fractions of the Blue phase budget.
+const BUDGET_MULTIPLIERS = {
+    baseline: 0.30,
+    high_risk: 1.00,
+    release_critical: 1.50
+};
+/**
+ * Returns the Red phase budget policy for a given risk tier and Blue budget.
+ */
+export function resolveRedBudgetPolicy(tier, blueBudgetUsd) {
+    return {
+        riskTier: tier,
+        blueBudgetUsd,
+        redBudgetCapUsd: blueBudgetUsd * BUDGET_MULTIPLIERS[tier],
+        modelCallAllowed: tier === "release_critical"
+    };
+}
+/**
+ * Probe counts per tier.
+ * baseline = standard 6-probe sweep
+ * high_risk = paranoid 12-probe sweep
+ * release_critical = paranoid 12-probe sweep + model
+ */
+export const PROBE_COUNTS = {
+    baseline: 6,
+    high_risk: 12,
+    release_critical: 12
+};
+/** The only model ever permitted in the Red phase. */
+export const RED_PHASE_MODEL = "claude-haiku-4-5-20251001";

package/dist/vendor/core/rollback.js

@@ -114,8 +114,8 @@ export async function restoreRollbackBoundary(input) {
 }
 function readRepoState(repoRoot) {
     return {
-        trackedDirtyFiles: readGitLines(repoRoot, ["diff", "--name-only", "HEAD"]),
-        untrackedFiles: readGitLines(repoRoot, ["ls-files", "--others", "--exclude-standard"])
+        trackedDirtyFiles: readGitLines(repoRoot, ["diff", "--name-only", "HEAD", "--", "."]),
+        untrackedFiles: readGitLines(repoRoot, ["ls-files", "--others", "--exclude-standard", "--", "."])
     };
 }
 function readGitLines(repoRoot, args) {
@@ -216,4 +216,3 @@ function emptyRepoState() {
 function toErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
-//# sourceMappingURL=rollback.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@martinloop/mcp",
-  "version": "0.2.0",
+  "version": "0.2.5",
   "mcpName": "io.github.Keesan12/martin-loop",
   "private": false,
   "type": "module",
@@ -24,9 +24,10 @@
     "claude",
     "codex",
     "martin_doctor",
-    "martin_preflight",
-    "martin_list_runs",
-    "martin_run_dossier"
+    "martin_triage_runs",
+    "martin_run_dossier",
+    "mcp-resources",
+    "mcp-prompts"
   ],
   "bin": {
     "mcp": "./dist/server.js",
@@ -56,7 +57,8 @@
     "verify:release": "node --test ../../scripts/tests/publish-mcp-workflow.test.mjs ../../scripts/tests/mcp-publish-reliability.test.mjs ../../scripts/tests/mcp-release-docs.test.mjs",
     "test": "vitest run",
     "lint": "tsc -p tsconfig.json --noEmit",
-    "start": "node dist/server.js"
+    "start": "node dist/server.js",
+    "inspect:live": "node ./scripts/inspect-live.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
@@ -66,5 +68,8 @@
     "@opentelemetry/resources": "^2.6.1",
     "@opentelemetry/sdk-logs": "^0.214.0",
     "ts-morph": "^21.0.0"
+  },
+  "devDependencies": {
+    "@martin/contracts": "workspace:*"
   }
 }

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/Keesan12/martin-loop",
     "source": "github"
   },
-  "version": "0.2.0",
+  "version": "0.2.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@martinloop/mcp",
-      "version": "0.2.0",
+      "version": "0.2.5",
       "transport": {
         "type": "stdio"
       }

package/dist/tools/cockpit-support.d.ts

@@ -1,69 +0,0 @@
-import { type LoopRunRecord } from "../vendor/core/index.js";
-export interface RunSelectorInput {
-    loopId?: string;
-    runsDir?: string;
-    latest?: boolean;
-}
-export interface RunSummary {
-    loopId: string;
-    title: string;
-    objective: string;
-    status: string;
-    lifecycleState: string;
-    createdAt: string;
-    updatedAt: string;
-    attempts: number;
-    costUsd: number;
-    avoidedUsd: number;
-    pressure: string;
-    shouldStop: boolean;
-    verificationCount: number;
-}
-export interface VerificationResultSummary {
-    eventId?: string;
-    timestamp?: string;
-    lifecycleState?: string;
-    passed?: boolean;
-    summary?: string;
-}
-export declare function summarizeRun(loop: LoopRunRecord): RunSummary;
-export declare function listRunSummaries(input?: {
-    runsDir?: string;
-    limit?: number;
-}): Promise<RunSummary[]>;
-export declare function loadSelectedRun(input: RunSelectorInput): Promise<LoopRunRecord>;
-export declare function extractVerificationResults(loop: LoopRunRecord): VerificationResultSummary[];
-export declare function getAttempt(loop: LoopRunRecord, attemptIndex: number): import("../vendor/core/index.js").LoopAttemptRecord;
-export declare function buildRunDossier(loop: LoopRunRecord): {
-    loopId: string;
-    generatedAt: string;
-    sections: ({
-        kind: string;
-        content: {
-            title: string;
-            objective: string;
-        };
-    } | {
-        kind: string;
-        content: {
-            budget: {
-                maxUsd: number;
-                softLimitUsd: number;
-                maxIterations: number;
-                maxTokens: number;
-            };
-            cost: {
-                actualUsd: number;
-                tokensIn: number;
-                tokensOut: number;
-                avoidedUsd?: number;
-            };
-        };
-    } | {
-        kind: string;
-        content: import("../vendor/core/index.js").LoopAttemptRecord[];
-    } | {
-        kind: string;
-        content: VerificationResultSummary[];
-    })[];
-};