@martinloop/mcp 0.3.8 → 0.5.0

package/dist/vendor/core/persistence/mission-store.js

@@ -0,0 +1,281 @@
+/**
+ * Mission Store — C2 durable persistence.
+ *
+ * Layout under <runsRoot>/missions/<missionId>/:
+ *   mission.json      — rebuildable snapshot/cache (NOT the authority)
+ *   ledger.jsonl      — append-only, SHA-256 hash-chained event log (authority)
+ *   ledger-chain.json — chain head hash for tamper detection
+ *   .lock             — cross-process exclusive lock (created with O_EXCL)
+ *
+ * Rules:
+ *   - Ledger is always written before mission.json is updated.
+ *   - mission.json is written atomically (temp file → rename).
+ *   - Cross-process lock is held during every write; stale locks (>8s) are removed.
+ *   - CAS revision must match before any write is accepted.
+ *   - Corrupt or unverifiable ledger data fails closed.
+ *   - Workspace isolation: all paths are under caller-supplied runsRoot.
+ */
+import { createHash } from "node:crypto";
+import { constants, open } from "node:fs/promises";
+import { appendFile, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { MISSION_SCHEMA_VERSION, isMissionTransitionAllowed } from "../../contracts/index.js";
+// ─── Paths ────────────────────────────────────────────────────────────────────
+export function missionDir(runsRoot, missionId) {
+    return join(runsRoot, "missions", missionId);
+}
+function missionJsonPath(runsRoot, missionId) {
+    return join(missionDir(runsRoot, missionId), "mission.json");
+}
+function ledgerPath(runsRoot, missionId) {
+    return join(missionDir(runsRoot, missionId), "ledger.jsonl");
+}
+function chainPath(runsRoot, missionId) {
+    return join(missionDir(runsRoot, missionId), "ledger-chain.json");
+}
+function lockPath(runsRoot, missionId) {
+    return join(missionDir(runsRoot, missionId), ".lock");
+}
+// ─── Hash chain ───────────────────────────────────────────────────────────────
+function sha256(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+async function readChainHead(runsRoot, missionId) {
+    const raw = await readFile(chainPath(runsRoot, missionId), "utf8").catch(() => null);
+    if (raw === null)
+        return { headHash: "root", entryCount: 0 };
+    return JSON.parse(raw);
+}
+async function appendLedgerEntry(runsRoot, missionId, event) {
+    const line = JSON.stringify(event);
+    const head = await readChainHead(runsRoot, missionId);
+    const newHash = sha256(`${head.headHash}\n${line}`);
+    const newHead = { headHash: newHash, entryCount: head.entryCount + 1 };
+    // Append event first, then update chain head
+    await appendFile(ledgerPath(runsRoot, missionId), `${line}\n`, "utf8");
+    await atomicWrite(chainPath(runsRoot, missionId), JSON.stringify(newHead, null, 2));
+}
+// ─── Atomic write ─────────────────────────────────────────────────────────────
+async function atomicWrite(filePath, content) {
+    const tmp = `${filePath}.tmp`;
+    await writeFile(tmp, content, "utf8");
+    await rename(tmp, filePath);
+}
+// ─── Cross-process lock ───────────────────────────────────────────────────────
+const LOCK_STALE_MS = 8_000;
+const LOCK_RETRY_INTERVAL_MS = 50;
+const LOCK_MAX_RETRIES = 60; // 3s total
+async function acquireLock(runsRoot, missionId) {
+    const lp = lockPath(runsRoot, missionId);
+    for (let attempt = 0; attempt < LOCK_MAX_RETRIES; attempt++) {
+        try {
+            // O_EXCL — fails if file exists (atomic on all POSIX and Windows NTFS)
+            const fh = await open(lp, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY);
+            await fh.write(String(Date.now()));
+            await fh.close();
+            return;
+        }
+        catch {
+            // Lock exists — check if stale
+            try {
+                const st = await stat(lp);
+                const ageMs = Date.now() - st.mtimeMs;
+                if (ageMs > LOCK_STALE_MS) {
+                    await rm(lp, { force: true });
+                    continue; // retry immediately after removing stale lock
+                }
+            }
+            catch {
+                // Lock disappeared between check and stat — retry
+                continue;
+            }
+            await new Promise((r) => setTimeout(r, LOCK_RETRY_INTERVAL_MS));
+        }
+    }
+    throw new Error(`mission-store: could not acquire lock for ${missionId} after ${LOCK_MAX_RETRIES} retries`);
+}
+async function releaseLock(runsRoot, missionId) {
+    await rm(lockPath(runsRoot, missionId), { force: true });
+}
+async function withLock(runsRoot, missionId, fn) {
+    await acquireLock(runsRoot, missionId);
+    try {
+        return await fn();
+    }
+    finally {
+        await releaseLock(runsRoot, missionId);
+    }
+}
+// ─── Event ID factory ─────────────────────────────────────────────────────────
+let _seq = 0;
+function makeEventId(missionId) {
+    return `evt_${missionId.slice(0, 8)}_${Date.now()}_${(_seq++).toString().padStart(4, "0")}`;
+}
+// ─── Read mission ─────────────────────────────────────────────────────────────
+/**
+ * Read the current mission snapshot.
+ * Returns null when no mission exists at this path.
+ * Fails closed when the snapshot schema version is not recognised.
+ */
+export async function readMission(runsRoot, missionId) {
+    const raw = await readFile(missionJsonPath(runsRoot, missionId), "utf8").catch(() => null);
+    if (raw === null)
+        return null;
+    const record = JSON.parse(raw);
+    if (record.schemaVersion !== MISSION_SCHEMA_VERSION) {
+        throw new Error(`mission-store: unsupported schema "${record.schemaVersion}" for mission ${missionId}`);
+    }
+    return record;
+}
+// ─── Read ledger ──────────────────────────────────────────────────────────────
+export async function readMissionLedger(runsRoot, missionId) {
+    const raw = await readFile(ledgerPath(runsRoot, missionId), "utf8").catch(() => "");
+    return raw
+        .split(/\r?\n/u)
+        .map((l) => l.trim())
+        .filter(Boolean)
+        .map((l) => JSON.parse(l));
+}
+/**
+ * Verify the stored chain head matches a full replay of the ledger.
+ * Returns ok=false when the ledger has been tampered with or entries are missing.
+ */
+export async function verifyMissionLedger(runsRoot, missionId) {
+    const events = await readMissionLedger(runsRoot, missionId);
+    const stored = await readChainHead(runsRoot, missionId);
+    let hash = "root";
+    for (const event of events) {
+        hash = sha256(`${hash}\n${JSON.stringify(event)}`);
+    }
+    if (hash !== stored.headHash) {
+        return {
+            ok: false,
+            reason: `chain_mismatch: expected ${stored.headHash}, replayed ${hash}`,
+            entryCount: events.length
+        };
+    }
+    if (events.length !== stored.entryCount) {
+        return {
+            ok: false,
+            reason: `count_mismatch: stored ${stored.entryCount}, actual ${events.length}`,
+            entryCount: events.length
+        };
+    }
+    return { ok: true, entryCount: events.length };
+}
+// ─── Create mission ───────────────────────────────────────────────────────────
+export async function createMission(runsRoot, mission) {
+    const dir = missionDir(runsRoot, mission.missionId);
+    await mkdir(dir, { recursive: true });
+    await withLock(runsRoot, mission.missionId, async () => {
+        // Fail if already exists
+        const existing = await readMission(runsRoot, mission.missionId);
+        if (existing !== null) {
+            throw new Error(`mission-store: mission ${mission.missionId} already exists`);
+        }
+        const event = {
+            eventId: makeEventId(mission.missionId),
+            kind: "mission.created",
+            missionId: mission.missionId,
+            timestamp: mission.createdAt,
+            payload: { status: mission.status, ownerId: mission.ownerId }
+        };
+        await appendLedgerEntry(runsRoot, mission.missionId, event);
+        await atomicWrite(missionJsonPath(runsRoot, mission.missionId), JSON.stringify(mission, null, 2));
+    });
+}
+export async function attachRun(runsRoot, missionId, options) {
+    return withLock(runsRoot, missionId, async () => {
+        const mission = await readMission(runsRoot, missionId);
+        if (mission === null)
+            throw new Error(`mission-store: mission ${missionId} not found`);
+        if (mission.revision !== options.expectedRevision) {
+            throw new Error(`mission-store: CAS revision mismatch for ${missionId}: ` +
+                `expected ${options.expectedRevision}, found ${mission.revision}`);
+        }
+        const ts = options.now ? options.now() : new Date().toISOString();
+        const link = {
+            loopId: options.loopId,
+            role: options.role,
+            attachedAt: ts,
+            ...(options.verifiedOutcome !== undefined ? { verifiedOutcome: options.verifiedOutcome } : {}),
+            ...(options.actualUsd !== undefined ? { actualUsd: options.actualUsd } : {})
+        };
+        const newCost = {
+            totalActualUsd: mission.cost.totalActualUsd + (options.actualUsd ?? 0),
+            verifiedOutcomeCount: mission.cost.verifiedOutcomeCount + (options.verifiedOutcome === true ? 1 : 0),
+            totalRunCount: mission.cost.totalRunCount + 1
+        };
+        const updated = {
+            ...mission,
+            revision: mission.revision + 1,
+            runLinks: [...mission.runLinks, link],
+            cost: newCost,
+            updatedAt: ts
+        };
+        const event = {
+            eventId: makeEventId(missionId),
+            kind: "mission.run_attached",
+            missionId,
+            timestamp: ts,
+            payload: {
+                loopId: options.loopId,
+                role: options.role,
+                verifiedOutcome: options.verifiedOutcome,
+                actualUsd: options.actualUsd
+            }
+        };
+        await appendLedgerEntry(runsRoot, missionId, event);
+        await atomicWrite(missionJsonPath(runsRoot, missionId), JSON.stringify(updated, null, 2));
+        return updated;
+    });
+}
+export async function changeMissionStatus(runsRoot, missionId, options) {
+    return withLock(runsRoot, missionId, async () => {
+        const mission = await readMission(runsRoot, missionId);
+        if (mission === null)
+            throw new Error(`mission-store: mission ${missionId} not found`);
+        if (mission.revision !== options.expectedRevision) {
+            throw new Error(`mission-store: CAS revision mismatch for ${missionId}: ` +
+                `expected ${options.expectedRevision}, found ${mission.revision}`);
+        }
+        if (!isMissionTransitionAllowed(mission.status, options.toStatus)) {
+            throw new Error(`mission-store: transition ${mission.status} → ${options.toStatus} is not allowed`);
+        }
+        const ts = options.now ? options.now() : new Date().toISOString();
+        const updated = {
+            ...mission,
+            revision: mission.revision + 1,
+            status: options.toStatus,
+            updatedAt: ts,
+            ...(options.decision && options.decidedBy
+                ? {
+                    outcome: {
+                        decision: options.decision,
+                        decidedAt: ts,
+                        decidedBy: options.decidedBy,
+                        ...(options.note ? { note: options.note } : {})
+                    }
+                }
+                : {})
+        };
+        const eventKind = options.toStatus === "shipped" || options.toStatus === "killed" || options.toStatus === "rolled_back"
+            ? "mission.closed"
+            : "mission.status_changed";
+        const event = {
+            eventId: makeEventId(missionId),
+            kind: eventKind,
+            missionId,
+            timestamp: ts,
+            payload: {
+                from: mission.status,
+                to: options.toStatus,
+                decision: options.decision,
+                decidedBy: options.decidedBy
+            }
+        };
+        await appendLedgerEntry(runsRoot, missionId, event);
+        await atomicWrite(missionJsonPath(runsRoot, missionId), JSON.stringify(updated, null, 2));
+        return updated;
+    });
+}

package/dist/vendor/core/policy.d.ts

@@ -138,6 +138,8 @@ export interface PatchDecisionInput {
     safetyViolationCount?: number;
     scopeViolationCount?: number;
     changedFileCount?: number;
+    mutationRequired?: boolean;
+    definitionOfDonePreSatisfied?: boolean;
     diffNovelty?: number;
     diffStats?: {
         filesChanged: number;

package/dist/vendor/core/policy.js

@@ -514,6 +514,9 @@ export function scorePatchDecision(input) {
     const safetyViolationCount = input.safetyViolationCount ?? 0;
     const changedFileEvidenceAvailable = input.changedFileCount !== undefined;
     const changedFileCount = input.changedFileCount ?? 0;
+    const auditablePreSatisfiedNoChange = input.verificationPassed &&
+        input.mutationRequired === true &&
+        input.definitionOfDonePreSatisfied === true;
     const noveltyScore = input.diffNovelty ?? (changedFileCount > 0 ? 1 : 0);
     const diffRiskScore = computeDiffRiskScore(input.diffStats);
     const costUsd = roundUsd(input.costUsd ?? 0);
@@ -527,7 +530,7 @@ export function scorePatchDecision(input) {
     if (scopeViolationCount > 0) {
         reasonCodes.push("scope_violation");
     }
-    if (changedFileEvidenceAvailable && changedFileCount === 0) {
+    if (changedFileEvidenceAvailable && changedFileCount === 0 && !auditablePreSatisfiedNoChange) {
         reasonCodes.push("no_code_change");
     }
     if (input.humanApprovalRequired) {
@@ -560,7 +563,7 @@ export function scorePatchDecision(input) {
     if (input.humanApprovalRequired) {
         score -= 0.25;
     }
-    if (changedFileEvidenceAvailable && changedFileCount === 0) {
+    if (changedFileEvidenceAvailable && changedFileCount === 0 && !auditablePreSatisfiedNoChange) {
         score -= 0.35;
     }
     if (!input.verificationPassed && noveltyScore < 0.2 && verifierDelta <= 0) {

package/dist/vendor/core/rollback.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, relative, resolve } from "node:path";
 export function listAttemptChangedFilesSinceBoundary(input) {
@@ -11,11 +12,24 @@ export function listAttemptChangedFilesSinceBoundary(input) {
     }
     const baselineTracked = new Set(input.boundary.trackedDirtyFiles);
     const baselineUntracked = new Set(input.boundary.untrackedFiles);
+    const baselineContentChanges = input.boundary.snapshots
+        .filter((snapshot) => snapshot.existed && repoFileDiffersFromSnapshot(input.repoRoot, snapshot))
+        .map((snapshot) => snapshot.path);
     return uniqueSorted([
         ...repoState.trackedDirtyFiles.filter((filePath) => !baselineTracked.has(filePath)),
-        ...repoState.untrackedFiles.filter((filePath) => !baselineUntracked.has(filePath))
+        ...repoState.untrackedFiles.filter((filePath) => !baselineUntracked.has(filePath)),
+        ...baselineContentChanges
     ]);
 }
+function repoFileDiffersFromSnapshot(repoRoot, snapshot) {
+    try {
+        const current = readFileSync(resolveRepoPath(repoRoot, snapshot.path));
+        return current.toString("base64") !== snapshot.contentBase64;
+    }
+    catch {
+        return true;
+    }
+}
 export async function captureRollbackBoundary(input) {
     if (!input.repoRoot) {
         return undefined;

package/dist/vendor/core/savings.d.ts

@@ -0,0 +1,13 @@
+import type { LoopRecord } from "../contracts/index.js";
+import type { ExitDecision } from "./policy.js";
+export interface AvoidedUsdInput {
+    lifecycleState: LoopRecord["lifecycleState"];
+    actualUsd: number;
+    uncontrolledBaselineUsd?: number;
+}
+export declare function calculateAvoidedUsd(input: AvoidedUsdInput): number;
+export declare function calculateLoopAvoidedUsd(input: {
+    loop: LoopRecord;
+    decision: ExitDecision;
+    uncontrolledBaselineUsd?: number;
+}): number;

package/dist/vendor/core/savings.js

@@ -0,0 +1,22 @@
+export function calculateAvoidedUsd(input) {
+    if (input.lifecycleState !== "completed")
+        return 0;
+    if (!Number.isFinite(input.actualUsd) || input.actualUsd < 0)
+        return 0;
+    if (input.uncontrolledBaselineUsd === undefined ||
+        !Number.isFinite(input.uncontrolledBaselineUsd) ||
+        input.uncontrolledBaselineUsd <= input.actualUsd) {
+        return 0;
+    }
+    return roundUsd(input.uncontrolledBaselineUsd - input.actualUsd);
+}
+export function calculateLoopAvoidedUsd(input) {
+    return calculateAvoidedUsd({
+        lifecycleState: input.decision.lifecycleState,
+        actualUsd: input.loop.cost.actualUsd,
+        uncontrolledBaselineUsd: input.uncontrolledBaselineUsd
+    });
+}
+function roundUsd(value) {
+    return Math.round(value * 100) / 100;
+}

package/dist/vendor/core/termination-store.d.ts

@@ -0,0 +1,15 @@
+import type { TerminationEnvelopeV1 } from "../contracts/index.js";
+/**
+ * Atomically persist the termination envelope for a governed run.
+ *
+ * Crash-safe write sequence (mirrors exit-signal.ts atomic publication):
+ *   1. Write complete JSON to a unique tmp file (wx, 0o600) in runDirectory
+ *   2. Sync and close the tmp file
+ *   3. Hard-link tmp → termination.json (EEXIST → slot already occupied)
+ *   4. On EEXIST, read and return the existing envelope
+ *   5. Unlink the tmp file in finally (best-effort)
+ *
+ * First terminal exit path wins — competing callers that hit EEXIST get back
+ * the envelope that won the race.  This is the A1 idempotency guarantee.
+ */
+export declare function persistTerminationEnvelope(runDirectory: string, envelope: TerminationEnvelopeV1): Promise<TerminationEnvelopeV1>;

package/dist/vendor/core/termination-store.js

@@ -0,0 +1,44 @@
+import { link, open, readFile, unlink } from "node:fs/promises";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+/**
+ * Atomically persist the termination envelope for a governed run.
+ *
+ * Crash-safe write sequence (mirrors exit-signal.ts atomic publication):
+ *   1. Write complete JSON to a unique tmp file (wx, 0o600) in runDirectory
+ *   2. Sync and close the tmp file
+ *   3. Hard-link tmp → termination.json (EEXIST → slot already occupied)
+ *   4. On EEXIST, read and return the existing envelope
+ *   5. Unlink the tmp file in finally (best-effort)
+ *
+ * First terminal exit path wins — competing callers that hit EEXIST get back
+ * the envelope that won the race.  This is the A1 idempotency guarantee.
+ */
+export async function persistTerminationEnvelope(runDirectory, envelope) {
+    const finalPath = join(runDirectory, "termination.json");
+    const tmpPath = join(runDirectory, `.termination-tmp-${randomUUID()}.json`);
+    const json = `${JSON.stringify(envelope, null, 2)}\n`;
+    let handle;
+    try {
+        handle = await open(tmpPath, "wx", 0o600);
+        await handle.writeFile(json, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
+        try {
+            await link(tmpPath, finalPath);
+            return envelope;
+        }
+        catch (linkErr) {
+            if (linkErr.code !== "EEXIST")
+                throw linkErr;
+            // Another path won the race — read what's on disk and return it
+            const existing = await readFile(finalPath, "utf8");
+            return JSON.parse(existing);
+        }
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+        await unlink(tmpPath).catch(() => undefined);
+    }
+}

package/dist/vendor/core/verified-handoff.d.ts

@@ -0,0 +1,67 @@
+import type { LoopRecord, ReceiptIntegritySummary, TestIntegrityStatus, TestIntegrityVerdict, VerifiedHandoffOutcome, VerifiedHandoffRecoveryV1, VerifiedHandoffRequirementV1, VerifiedHandoffScopeV1, VerifiedHandoffTestIntegrityV1, VerifiedHandoffV1 } from "../contracts/index.js";
+export declare function toTestIntegrityVerdict(status: TestIntegrityStatus): TestIntegrityVerdict;
+export interface VerifierExecutionBinding {
+    runId: string;
+    workspaceId: string;
+    cwd: string;
+    commands: string[];
+}
+export interface BoundVerifierEvidence {
+    passed: boolean;
+    binding?: VerifierExecutionBinding;
+    steps?: Array<{
+        command: string;
+        launched: boolean;
+        completed?: boolean;
+        crashed?: boolean;
+        exitCode?: number;
+        timedOut?: boolean;
+    }>;
+}
+export declare function verifierActuallyPassed(evidence: BoundVerifierEvidence | null | undefined, expected: VerifierExecutionBinding): boolean;
+export declare function resolveVerifiedHandoffOutcome(input: {
+    lifecycleState: LoopRecord["lifecycleState"];
+    executionStatus?: "completed" | "write_blocked" | "sandbox_blocked" | "policy_rejected" | "failed";
+    verificationStatus: BuildVerifiedHandoffInput["verification"]["status"];
+    receiptIntegrity: ReceiptIntegritySummary["state"];
+    scopeStatus?: VerifiedHandoffScopeV1["status"];
+    testIntegrityStatus?: TestIntegrityStatus;
+    mutationRequired?: boolean;
+    changedFileCount?: number;
+    definitionOfDonePreSatisfied?: boolean;
+    evidenceContradicted?: boolean;
+    unresolvedWorkCount: number;
+}): VerifiedHandoffOutcome;
+export interface BuildVerifiedHandoffInput {
+    loop: LoopRecord;
+    generatedAt?: string;
+    receiptIntegrity: ReceiptIntegritySummary;
+    verification: {
+        status: "passed" | "failed" | "contradicted" | "not_run";
+        summary: string;
+        steps: Array<{
+            command: string;
+            launched: boolean;
+            completed?: boolean;
+            crashed?: boolean;
+            exitCode?: number;
+            timedOut?: boolean;
+            detail?: string;
+        }>;
+        warnings: string[];
+        binding?: VerifierExecutionBinding;
+    };
+    executionStatus?: "completed" | "write_blocked" | "sandbox_blocked" | "policy_rejected" | "failed";
+    mutationRequired?: boolean;
+    definitionOfDonePreSatisfied?: boolean;
+    evidenceContradicted?: boolean;
+    changedFiles?: string[];
+    scope?: Partial<VerifiedHandoffScopeV1>;
+    testIntegrity?: Partial<VerifiedHandoffTestIntegrityV1>;
+    requirements?: VerifiedHandoffRequirementV1[];
+    unresolvedWork?: string[];
+    stopReason?: string;
+    recovery?: Partial<VerifiedHandoffRecoveryV1>;
+    nextAction: string;
+}
+export declare function buildVerifiedHandoff(input: BuildVerifiedHandoffInput): VerifiedHandoffV1;