@martinloop/mcp 0.3.3 → 0.3.4

package/dist/vendor/contracts/verification.d.ts

@@ -0,0 +1,28 @@
+export type VerifierExitReason = "passed" | "non_zero_exit" | "timed_out" | "spawn_error" | "invalid_command";
+export type VerifierStepType = "lint" | "typecheck" | "test_targeted" | "test_full" | "custom";
+export interface VerifierStepSnapshot {
+    command: string;
+    type: VerifierStepType;
+    fastFail: boolean;
+    passed: boolean;
+    exitCode: number;
+    exitReason: VerifierExitReason;
+    startedAt: string;
+    completedAt: string;
+    durationMs: number;
+    stdout?: string;
+    stderr?: string;
+}
+export interface VerifierSnapshot {
+    passed: boolean;
+    summary: string;
+    startedAt: string;
+    completedAt: string;
+    durationMs: number;
+    stepCount: number;
+    failedStepCount: number;
+    commands: string[];
+    steps: VerifierStepSnapshot[];
+    combinedOutput?: string;
+}
+export declare function cloneVerifierSnapshot(snapshot: VerifierSnapshot): VerifierSnapshot;

package/dist/vendor/contracts/verification.js

@@ -0,0 +1,7 @@
+export function cloneVerifierSnapshot(snapshot) {
+    return {
+        ...snapshot,
+        commands: [...snapshot.commands],
+        steps: snapshot.steps.map((step) => ({ ...step }))
+    };
+}

package/dist/vendor/core/context-graph.d.ts

@@ -0,0 +1,3 @@
+import { type ContextGraphBuildOptions, type ContextGraphHit, type ContextGraphSnapshot, type ContextQuery } from "../contracts/index.js";
+export declare function buildContextGraphSnapshot(repoRoot: string, options?: ContextGraphBuildOptions): Promise<ContextGraphSnapshot>;
+export declare function queryContextGraph(snapshot: ContextGraphSnapshot, query: ContextQuery): ContextGraphHit[];

package/dist/vendor/core/context-graph.js

@@ -0,0 +1,371 @@
+import { readdir, readFile } from "node:fs/promises";
+import { extname, join, posix, relative, resolve } from "node:path";
+import { cloneContextGraphSnapshot } from "../contracts/index.js";
+const TEXT_EXTENSIONS = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".json",
+    ".md",
+    ".yaml",
+    ".yml",
+    ".txt",
+    ".py",
+    ".go",
+    ".rs",
+    ".java",
+    ".sh"
+]);
+const IGNORED_DIRS = new Set([
+    ".git",
+    "node_modules",
+    "dist",
+    "build",
+    ".next",
+    ".turbo",
+    "coverage",
+    ".pnpm-store",
+    ".npm-cache"
+]);
+export async function buildContextGraphSnapshot(repoRoot, options = {}) {
+    const normalizedRoot = resolve(repoRoot);
+    const maxFiles = options.maxFiles ?? 600;
+    const maxFileBytes = options.maxFileBytes ?? 96_000;
+    const nodes = [];
+    const state = { count: 0, truncated: false };
+    await walkContextGraph(normalizedRoot, normalizedRoot, nodes, state, { maxFiles, maxFileBytes });
+    const edges = buildContextGraphEdges(nodes);
+    return cloneContextGraphSnapshot({
+        schemaVersion: "martin.context-graph.v1",
+        repoRoot: normalizedRoot,
+        createdAt: new Date().toISOString(),
+        nodeCount: nodes.length,
+        edgeCount: edges.length,
+        truncated: state.truncated,
+        nodes,
+        edges
+    });
+}
+export function queryContextGraph(snapshot, query) {
+    const terms = normalizeQueryTerms(query);
+    const pathPrefix = query.pathPrefix?.replace(/\\/gu, "/").replace(/^\.\/+/u, "");
+    const limit = query.limit ?? 8;
+    return snapshot.nodes
+        .filter((node) => {
+        if (query.kinds && !query.kinds.includes(node.kind)) {
+            return false;
+        }
+        if (pathPrefix && !node.path.startsWith(pathPrefix)) {
+            return false;
+        }
+        return true;
+    })
+        .map((node) => scoreContextNode(node, terms))
+        .filter((hit) => hit !== undefined)
+        .sort((left, right) => right.score - left.score || left.path.localeCompare(right.path))
+        .slice(0, limit);
+}
+async function walkContextGraph(repoRoot, currentDir, nodes, state, options) {
+    if (state.count >= options.maxFiles) {
+        state.truncated = true;
+        return;
+    }
+    const entries = await readdir(currentDir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (state.count >= options.maxFiles) {
+            state.truncated = true;
+            break;
+        }
+        const absPath = join(currentDir, entry.name);
+        if (entry.isDirectory()) {
+            if (!IGNORED_DIRS.has(entry.name)) {
+                await walkContextGraph(repoRoot, absPath, nodes, state, options);
+            }
+            continue;
+        }
+        if (!entry.isFile()) {
+            continue;
+        }
+        const extension = extname(entry.name).toLowerCase();
+        if (!TEXT_EXTENSIONS.has(extension)) {
+            continue;
+        }
+        const content = await readFile(absPath, "utf8").catch(() => undefined);
+        if (!content || content.length > options.maxFileBytes) {
+            continue;
+        }
+        const relPath = relative(repoRoot, absPath).replace(/\\/gu, "/");
+        nodes.push(createContextNode(relPath, content));
+        state.count += 1;
+    }
+}
+function createContextNode(path, content) {
+    const kind = classifyContextNodeKind(path);
+    return {
+        nodeId: path,
+        path,
+        kind,
+        ...(inferLanguage(path) ? { language: inferLanguage(path) } : {}),
+        sizeBytes: Buffer.byteLength(content, "utf8"),
+        headings: extractHeadings(path, content),
+        symbols: extractSymbols(content),
+        keywords: extractKeywords(path, content),
+        imports: extractImports(path, content)
+    };
+}
+function buildContextGraphEdges(nodes) {
+    const paths = new Set(nodes.map((node) => node.path));
+    const edges = [];
+    for (const node of nodes) {
+        for (const importTarget of node.imports) {
+            const resolvedTarget = resolveContextImport(node.path, importTarget, paths);
+            if (resolvedTarget) {
+                edges.push({
+                    fromNodeId: node.nodeId,
+                    toNodeId: resolvedTarget,
+                    kind: "imports"
+                });
+            }
+        }
+        if (node.kind === "document") {
+            const documentTargets = node.keywords
+                .map((keyword) => nodes.find((candidate) => candidate.path !== node.path && candidate.path.includes(keyword)))
+                .filter((candidate) => candidate !== undefined)
+                .slice(0, 3);
+            for (const target of documentTargets) {
+                edges.push({
+                    fromNodeId: node.nodeId,
+                    toNodeId: target.nodeId,
+                    kind: "documents"
+                });
+            }
+        }
+    }
+    return dedupeEdges(edges);
+}
+function scoreContextNode(node, terms) {
+    if (terms.length === 0) {
+        return {
+            nodeId: node.nodeId,
+            path: node.path,
+            kind: node.kind,
+            score: 1,
+            matchedTerms: [],
+            reasons: ["default_match"]
+        };
+    }
+    let score = 0;
+    const matchedTerms = new Set();
+    const reasons = new Set();
+    for (const term of terms) {
+        if (node.path.toLowerCase().includes(term)) {
+            score += 6;
+            matchedTerms.add(term);
+            reasons.add("path");
+        }
+        if (node.keywords.includes(term)) {
+            score += 3;
+            matchedTerms.add(term);
+            reasons.add("keyword");
+        }
+        if (node.symbols.some((symbol) => symbol.toLowerCase().includes(term))) {
+            score += 5;
+            matchedTerms.add(term);
+            reasons.add("symbol");
+        }
+        if (node.headings.some((heading) => heading.toLowerCase().includes(term))) {
+            score += 4;
+            matchedTerms.add(term);
+            reasons.add("heading");
+        }
+        if (node.imports.some((importPath) => importPath.toLowerCase().includes(term))) {
+            score += 2;
+            matchedTerms.add(term);
+            reasons.add("import");
+        }
+    }
+    if (score === 0) {
+        return undefined;
+    }
+    return {
+        nodeId: node.nodeId,
+        path: node.path,
+        kind: node.kind,
+        score,
+        matchedTerms: [...matchedTerms],
+        reasons: [...reasons]
+    };
+}
+function normalizeQueryTerms(query) {
+    const rawTerms = [
+        ...(query.text ? tokenize(query.text) : []),
+        ...((query.terms ?? []).flatMap((term) => tokenize(term)))
+    ];
+    return [...new Set(rawTerms)];
+}
+function classifyContextNodeKind(path) {
+    const extension = extname(path).toLowerCase();
+    if (path.endsWith("package.json") || path.endsWith("tsconfig.json")) {
+        return "manifest";
+    }
+    if (extension === ".md" || extension === ".txt") {
+        return "document";
+    }
+    if (extension === ".sh") {
+        return "script";
+    }
+    if (extension === ".json" || extension === ".yaml" || extension === ".yml") {
+        return "config";
+    }
+    return "source_file";
+}
+function inferLanguage(path) {
+    const extension = extname(path).toLowerCase();
+    switch (extension) {
+        case ".ts":
+        case ".tsx":
+            return "typescript";
+        case ".js":
+        case ".jsx":
+        case ".mjs":
+        case ".cjs":
+            return "javascript";
+        case ".md":
+            return "markdown";
+        case ".json":
+            return "json";
+        case ".yaml":
+        case ".yml":
+            return "yaml";
+        case ".py":
+            return "python";
+        case ".sh":
+            return "shell";
+        default:
+            return undefined;
+    }
+}
+function extractHeadings(path, content) {
+    if (extname(path).toLowerCase() !== ".md") {
+        return [];
+    }
+    return content
+        .split(/\r?\n/gu)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith("#"))
+        .map((line) => line.replace(/^#+\s*/u, "").trim())
+        .filter(Boolean)
+        .slice(0, 12);
+}
+function extractSymbols(content) {
+    const out = new Set();
+    const patterns = [
+        /export\s+(?:async\s+)?function\s+([A-Za-z0-9_]+)/gu,
+        /export\s+class\s+([A-Za-z0-9_]+)/gu,
+        /export\s+const\s+([A-Za-z0-9_]+)/gu,
+        /function\s+([A-Za-z0-9_]+)/gu,
+        /class\s+([A-Za-z0-9_]+)/gu,
+        /interface\s+([A-Za-z0-9_]+)/gu,
+        /type\s+([A-Za-z0-9_]+)/gu
+    ];
+    for (const pattern of patterns) {
+        for (const match of content.matchAll(pattern)) {
+            if (match[1]) {
+                out.add(match[1]);
+            }
+        }
+    }
+    return [...out].slice(0, 16);
+}
+function extractKeywords(path, content) {
+    const out = new Set();
+    for (const part of path.split(/[\/._-]+/u)) {
+        if (part.length >= 3) {
+            out.add(part.toLowerCase());
+        }
+    }
+    for (const token of tokenize(content.split(/\r?\n/gu).slice(0, 16).join(" "))) {
+        out.add(token);
+    }
+    return [...out].slice(0, 24);
+}
+function extractImports(path, content) {
+    if (![".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(extname(path).toLowerCase())) {
+        return [];
+    }
+    const imports = new Set();
+    const patterns = [
+        /from\s+["']([^"']+)["']/gu,
+        /require\(\s*["']([^"']+)["']\s*\)/gu,
+        /import\(\s*["']([^"']+)["']\s*\)/gu
+    ];
+    for (const pattern of patterns) {
+        for (const match of content.matchAll(pattern)) {
+            const candidate = match[1]?.trim();
+            if (candidate) {
+                imports.add(candidate);
+            }
+        }
+    }
+    return [...imports].slice(0, 24);
+}
+function resolveContextImport(fromPath, importPath, paths) {
+    if (!importPath.startsWith(".")) {
+        return undefined;
+    }
+    const fromDirectory = fromPath.includes("/") ? fromPath.slice(0, fromPath.lastIndexOf("/")) : "";
+    const base = posix.normalize(posix.join(fromDirectory, importPath)).replace(/^\.\//u, "");
+    const extensionlessBase = extname(base) ? base.slice(0, -extname(base).length) : base;
+    const candidates = [
+        base,
+        extensionlessBase,
+        `${extensionlessBase}.ts`,
+        `${extensionlessBase}.tsx`,
+        `${extensionlessBase}.js`,
+        `${extensionlessBase}.jsx`,
+        `${extensionlessBase}.md`,
+        `${base}.ts`,
+        `${base}.tsx`,
+        `${base}.js`,
+        `${base}.jsx`,
+        `${base}.md`,
+        `${base}/index.ts`,
+        `${base}/index.tsx`,
+        `${base}/index.js`
+    ];
+    return candidates.find((candidate) => paths.has(candidate));
+}
+function dedupeEdges(edges) {
+    const seen = new Set();
+    return edges.filter((edge) => {
+        const key = `${edge.kind}:${edge.fromNodeId}:${edge.toNodeId}`;
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    });
+}
+function tokenize(input) {
+    const normalized = input.replace(/([a-z0-9])([A-Z])/gu, "$1 $2").toLowerCase();
+    const stopWords = new Set([
+        "the",
+        "and",
+        "for",
+        "with",
+        "from",
+        "that",
+        "this",
+        "into",
+        "only",
+        "keep",
+        "make",
+        "loop",
+        "then",
+        "when"
+    ]);
+    return [...new Set(normalized.match(/[a-z0-9_]{3,}/gu) ?? [])].filter((term) => !stopWords.has(term));
+}

package/dist/vendor/core/identity.d.ts

@@ -0,0 +1,20 @@
+import { type IdentityAttestation, type IdentityClaims, type IdentityToken } from "../contracts/index.js";
+export interface LocalIdentityAuthority {
+    keyId: string;
+    algorithm: "ed25519";
+    privateKeyPem: string;
+    publicKeyPem: string;
+}
+export declare function createLocalIdentityAuthority(input?: {
+    keyId?: string;
+}): LocalIdentityAuthority;
+export declare function issueIdentityToken(input: {
+    authority: Pick<LocalIdentityAuthority, "keyId" | "algorithm" | "privateKeyPem">;
+    claims: IdentityClaims;
+}): IdentityToken;
+export declare function verifyIdentityToken(input: {
+    token: IdentityToken;
+    publicKeyPem: string;
+    now?: string;
+}): IdentityAttestation;
+export declare function hasIdentityScope(token: IdentityToken, requiredScope: string): boolean;

package/dist/vendor/core/identity.js

@@ -0,0 +1,86 @@
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "node:crypto";
+import { cloneIdentityAttestation, cloneIdentityClaims, cloneIdentityToken } from "../contracts/index.js";
+export function createLocalIdentityAuthority(input = {}) {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    return {
+        keyId: input.keyId ?? `martin-local-${Date.now().toString(36)}`,
+        algorithm: "ed25519",
+        privateKeyPem: privateKey.export({ format: "pem", type: "pkcs8" }).toString(),
+        publicKeyPem: publicKey.export({ format: "pem", type: "spki" }).toString()
+    };
+}
+export function issueIdentityToken(input) {
+    const claims = cloneIdentityClaims(input.claims);
+    const signer = createPrivateKey(input.authority.privateKeyPem);
+    const payload = serializeIdentityClaims(claims);
+    const signature = sign(null, payload, signer).toString("base64");
+    return cloneIdentityToken({
+        schemaVersion: "martin.identity.v1",
+        algorithm: input.authority.algorithm,
+        keyId: input.authority.keyId,
+        claims,
+        signature
+    });
+}
+export function verifyIdentityToken(input) {
+    const token = cloneIdentityToken(input.token);
+    const verifier = createPublicKey(input.publicKeyPem);
+    const payload = serializeIdentityClaims(token.claims);
+    const verifiedAt = input.now ?? new Date().toISOString();
+    if (token.schemaVersion !== "martin.identity.v1") {
+        return cloneIdentityAttestation({
+            valid: false,
+            verifiedAt,
+            reason: `Unsupported identity schema version '${token.schemaVersion}'.`,
+            token
+        });
+    }
+    const signatureValid = verify(null, payload, verifier, Buffer.from(token.signature, "base64"));
+    if (!signatureValid) {
+        return cloneIdentityAttestation({
+            valid: false,
+            verifiedAt,
+            reason: "Identity signature verification failed.",
+            token
+        });
+    }
+    const expiresAt = token.claims.expiresAt ? Date.parse(token.claims.expiresAt) : undefined;
+    if (expiresAt !== undefined && Number.isFinite(expiresAt) && expiresAt <= Date.parse(verifiedAt)) {
+        return cloneIdentityAttestation({
+            valid: false,
+            verifiedAt,
+            reason: "Identity token is expired.",
+            token
+        });
+    }
+    return cloneIdentityAttestation({
+        valid: true,
+        verifiedAt,
+        reason: `Identity token for role '${token.claims.role}' verified successfully.`,
+        token
+    });
+}
+export function hasIdentityScope(token, requiredScope) {
+    const required = requiredScope.trim().toLowerCase();
+    if (required.length === 0) {
+        return false;
+    }
+    return token.claims.scopes.some((scope) => scope.trim().toLowerCase() === required);
+}
+function serializeIdentityClaims(claims) {
+    return Buffer.from(JSON.stringify(claims, sortKeys), "utf8");
+}
+function sortKeys(_, value) {
+    if (Array.isArray(value)) {
+        return value;
+    }
+    if (value && typeof value === "object") {
+        return Object.keys(value)
+            .sort()
+            .reduce((sorted, key) => {
+            sorted[key] = value[key];
+            return sorted;
+        }, {});
+    }
+    return value;
+}

package/dist/vendor/core/index.d.ts

@@ -2,13 +2,18 @@ import { type ApprovalPolicy, type CostProvenance, type ExecutionProfile, type F
 import { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, type ExitDecision } from "./policy.js";
 import { evaluateChangeApprovalLeash, evaluateFilesystemLeash, evaluateSecretLeash, redactSecretsFromText, resolveExecutionProfile, evaluateVerificationLeash } from "./leash.js";
 import { buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations } from "./grounding.js";
-import { captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, restoreRollbackBoundary } from "./rollback.js";
+import { captureRollbackBoundary, restoreRollbackBoundary } from "./rollback.js";
 import { type RunStore } from "./persistence/index.js";
 export type { ApprovalPolicy, BudgetPreflightEstimate, BudgetSettlement, CostProvenance, EvidenceVector, ExecutionProfile, FailureClass, InterventionType, PatchDecision, PatchDecisionArtifact, PatchDecisionReasonCode, PatchScore, MutationMode, RollbackBoundaryArtifact, RollbackBoundaryStrategy, RollbackFileSnapshot, RollbackOutcomeArtifact, RollbackOutcomeStatus, PolicyPhase } from "../contracts/index.js";
-export { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, evaluateVerificationLeash, evaluateFilesystemLeash, evaluateChangeApprovalLeash, evaluateSecretLeash, resolveExecutionProfile, redactSecretsFromText, buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations, captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, restoreRollbackBoundary };
+export { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, evaluateVerificationLeash, evaluateFilesystemLeash, evaluateChangeApprovalLeash, evaluateSecretLeash, resolveExecutionProfile, redactSecretsFromText, buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations, captureRollbackBoundary, restoreRollbackBoundary };
 export type { BudgetPreflightDecision, BudgetPreflightInput, CostGovernorState, EvidenceVectorInput, EvaluatedPatchDecision, ExitDecision, FailureAssessment, PatchDecisionInput, RecoveryDecision, RecoveryRecipe } from "./policy.js";
 export type { ResolvedExecutionProfile, SafetyLeashDecision, SafetyViolation } from "./leash.js";
 export type { GroundingScanResult, GroundingViolation, GroundingViolationKind, RepoGroundingHit, RepoGroundingIndex } from "./grounding.js";
+export { buildContextGraphSnapshot, queryContextGraph } from "./context-graph.js";
+export { createLocalIdentityAuthority, hasIdentityScope, issueIdentityToken, verifyIdentityToken } from "./identity.js";
+export type { LocalIdentityAuthority } from "./identity.js";
+export { compileExecutionPolicy } from "./policy-compiler.js";
+export { assessTrajectory, decideCircuitBreak } from "./trajectory.js";
 export { runContextIntegrityPrecheck } from "./context-integrity.js";
 export type { ContextIntegrityPrecheck, ContextIntegrityVerdict } from "./context-integrity.js";
 export { compilePromptPacket } from "./compiler.js";
@@ -132,6 +137,8 @@ export interface AttemptPolicyDecision {
     allowed: boolean;
     reason: string;
     recommendedIntervention?: InterventionType;
+    trajectoryAssessment?: import("../contracts/index.js").TrajectoryAssessment;
+    circuitBreakDecision?: import("../contracts/index.js").CircuitBreakDecision;
 }
 /**
  * Admission gate — must pass before any attempt is executed.