@martinloop/mcp 0.8.5 → 0.8.7

package/dist/vendor/core/index.js

@@ -2,7 +2,8 @@ import { DEFAULT_AGENT_EXECUTION_INTENT, normalizeProviderExecutionTimeoutMs, ap
 import { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe } from "./policy.js";
 import { evaluateChangeApprovalLeash, evaluateFilesystemLeash, evaluateSecretLeash, redactSecretsFromText, resolveExecutionProfile, evaluateVerificationLeash } from "./leash.js";
 import { buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations } from "./grounding.js";
-import { captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, restoreRollbackBoundary } from "./rollback.js";
+import { captureRollbackBoundary, findEscapingLinks, listAttemptChangedFilesSinceBoundary, listIgnoredFileChangesSinceBoundary, restoreRollbackBoundary } from "./rollback.js";
+import { findWeakenedTestFiles } from "./test-integrity.js";
 import { compilePromptPacket } from "./compiler.js";
 import { makeLedgerEvent, resolveRunsRoot, runDir } from "./persistence/index.js";
 import { createDefaultExitPolicy, evaluateExitPolicy, hashProgressState, toLegacyExitDecision } from "./exits.js";
@@ -14,7 +15,8 @@ import { decideCircuitBreak } from "./trajectory.js";
 import { verifyContextHandoff, decideContextCircuitBreak } from "./context-handoff.js";
 import { verifierActuallyPassed, } from "./verified-handoff.js";
 export { DEFAULT_AGENT_EXECUTION_INTENT, DEFAULT_PROVIDER_EXECUTION_TIMEOUT_MS, GOVERNED_AUTONOMOUS_BOUNDARY, normalizeProviderExecutionTimeoutMs } from "../contracts/index.js";
-export { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, evaluateVerificationLeash, evaluateFilesystemLeash, evaluateChangeApprovalLeash, evaluateSecretLeash, resolveExecutionProfile, redactSecretsFromText, buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations, captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, restoreRollbackBoundary };
+export { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, evaluateVerificationLeash, evaluateFilesystemLeash, evaluateChangeApprovalLeash, evaluateSecretLeash, resolveExecutionProfile, redactSecretsFromText, buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations, captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, listIgnoredFileChangesSinceBoundary, restoreRollbackBoundary };
+export { describeMalformedVerifier } from "./verifier-input.js";
 export { buildContextGraphSnapshot, queryContextGraph } from "./context-graph.js";
 export { ExternalOutcomeContractError, ExternalOutcomePolicyError, hashExternalOutcomeContract, verifyExternalOutcomes, writeExternalOutcomeEvidence, } from "./external-outcome.js";
 export { createLocalIdentityAuthority, hasIdentityScope, issueIdentityToken, verifyIdentityToken } from "./identity.js";
@@ -24,7 +26,7 @@ export { calculateAvoidedUsd, calculateLoopAvoidedUsd } from "./savings.js";
 // ─── Routing economics ─────────────────────────────────────────────────────
 export { classifyRoute, evaluatePreworkBurnPolicy } from "./routing.js";
 // ─── Test Integrity Validation ──────────────────────────────────────────────
-export { validateTestIntegrity, snapshotTestFiles, identifyNewTests, findTestFiles, isTestFile, extractImports, hasTrivialAssertionsOnly, importsPreExistingCode } from "./test-integrity.js";
+export { validateTestIntegrity, snapshotTestFiles, identifyNewTests, findTestFiles, isTestFile, extractImports, hasTrivialAssertionsOnly, importsPreExistingCode, isTestPath, findWeakenedTestFiles } from "./test-integrity.js";
 // ─── Repo Style Analyzer ────────────────────────────────────────────────────
 export { analyzeRepoStyle, buildPromptDirectives } from "./repo-analyzer.js";
 // ─── Context Integrity Pre-gate ──────────────────────────────────────────────
@@ -32,7 +34,7 @@ export { runContextIntegrityPrecheck } from "./context-integrity.js";
 // ─── Prompt packet compiler ──────────────────────────────────────────────────
 export { compilePromptPacket } from "./compiler.js";
 // ─── Verified Handoff builder ────────────────────────────────────────────────
-export { buildVerifiedHandoff, deriveVerifiedHandoffLifecycleTruth, deriveVerifiedHandoffExecutionBoundary, resolveVerifiedHandoffOutcome, toTestIntegrityVerdict, verifierActuallyPassed, } from "./verified-handoff.js";
+export { buildVerifiedHandoff, NO_FILE_CHANGES_WARNING, deriveVerifiedHandoffLifecycleTruth, deriveVerifiedHandoffExecutionBoundary, resolveVerifiedHandoffOutcome, toTestIntegrityVerdict, verifierActuallyPassed, } from "./verified-handoff.js";
 // ─── Persistence (RunStore, LedgerEvent, FileRunStore) ──────────────────────
 export { createFileRunStore, makeLedgerEvent, readAllLoopRecords, readLatestLoopRecord, readLatestLoopRecordFromFile, readLoopRecordsFromFile, resolveRunsRoot, resolveReceiptIntegrityPath, verifyReceiptIntegrityFromFiles, writeReceiptIntegrityMaterial } from "./persistence/index.js";
 export { compileAndPersistContext } from "./persistence/index.js";
@@ -1073,9 +1075,37 @@ export async function runMartin(input) {
                     }
                 }));
             }
-            const changedFiles = tracksWorkspaceMutations
-                ? resolveChangedFiles(result, request.context.repoRoot, rollbackBoundary)
-                : [];
+            let changedFiles = [];
+            try {
+                changedFiles = tracksWorkspaceMutations
+                    ? resolveChangedFiles(result, request.context.repoRoot, rollbackBoundary)
+                    : [];
+            }
+            catch (error) {
+                for (const filePath of normalizeFileEffectPaths(result.execution?.changedFiles ?? [])) {
+                    touchedDuringExecution.add(filePath);
+                }
+                const observationExitDecision = {
+                    shouldExit: true,
+                    lifecycleState: "human_escalation",
+                    status: "exited",
+                    reason: `Workspace change observation became unavailable: ${fileEffectErrorMessage(error)}`,
+                    reasonCode: "workspace_observation_unavailable"
+                };
+                if (input.store) {
+                    await input.store.appendLedger(loop.loopId, makeLedgerEvent({
+                        kind: "run.exited",
+                        runId: loop.loopId,
+                        payload: createRunExitPayload(observationExitDecision)
+                    }));
+                }
+                await stopSignalMonitorAndDrainDiagnostics();
+                const terminationEnvelope = await persistGuardStop(observationExitDecision);
+                const finalizedLoop = await finalizeCurrentLoop(observationExitDecision, now());
+                const finalizedWithEnvelope = { ...finalizedLoop, terminationEnvelope };
+                await persistLoopRecordIfSupported(input.store, finalizedWithEnvelope);
+                return { loop: finalizedWithEnvelope, decision: observationExitDecision };
+            }
             for (const filePath of normalizeFileEffectPaths(changedFiles)) {
                 touchedDuringExecution.add(filePath);
             }
@@ -1097,9 +1127,17 @@ export async function runMartin(input) {
             // returned a non-empty list. A repoRoot alone is insufficient — git may fail (e.g. not
             // a git repo) and silently return [], which would falsely trigger no_code_change.
             const changedFileEvidenceAvailable = result.execution?.changedFiles !== undefined || changedFiles.length > 0;
+            const ignoredChanges = tracksWorkspaceMutations
+                ? listIgnoredFileChangesSinceBoundary({ repoRoot: request.context.repoRoot, boundary: rollbackBoundary })
+                : { created: [], modified: [], deleted: [] };
+            const escapingLinks = tracksWorkspaceMutations && request.context.repoRoot
+                ? findEscapingLinks(request.context.repoRoot, [...changedFiles, ...ignoredChanges.created])
+                : [];
             const filesystemDecision = evaluateFilesystemLeash({
                 repoRoot: request.context.repoRoot,
                 changedFiles,
+                ignoredFiles: [...ignoredChanges.created, ...ignoredChanges.modified, ...ignoredChanges.deleted],
+                escapingLinks,
                 allowedPaths: request.context.allowedPaths,
                 deniedPaths: request.context.deniedPaths,
                 mutationMode: request.context.mutationMode
@@ -1127,7 +1165,14 @@ export async function runMartin(input) {
                     repoRoot: request.context.repoRoot,
                     boundary: rollbackBoundary,
                     restoredAt: attemptCompletedAt,
-                    decision: patchDecision.decision
+                    decision: patchDecision.decision,
+                    // Attempt-created ignored violations are removed. Modified or deleted
+                    // baseline ignored violations are restored from the bounded in-memory snapshot.
+                    removePaths: violatingIgnoredPaths(filesystemDecision.violations, ignoredChanges.created),
+                    restoreIgnoredPaths: violatingIgnoredPaths(filesystemDecision.violations, [
+                        ...ignoredChanges.modified,
+                        ...ignoredChanges.deleted
+                    ])
                 });
                 if (input.store) {
                     await input.store.writeAttemptArtifacts(loop.loopId, currentAttemptIndex, {
@@ -1176,8 +1221,16 @@ export async function runMartin(input) {
                     decision: filesystemExitDecision
                 };
             }
+            const weakenedTestFiles = tracksWorkspaceMutations && request.context.repoRoot && rollbackBoundary?.headRef
+                ? findWeakenedTestFiles({
+                    repoRoot: request.context.repoRoot,
+                    baseRef: rollbackBoundary.headRef,
+                    changedFiles
+                })
+                : [];
             const changeApprovalDecision = evaluateChangeApprovalLeash({
                 changedFiles,
+                weakenedTestFiles,
                 executionProfile: request.context.executionProfile,
                 approvalPolicy: request.context.approvalPolicy
             });
@@ -1550,6 +1603,8 @@ function safetyLeashReasonCode(decision, safetySurface) {
             return "migration_approval_required";
         case "config_change_approval_required":
             return "config_change_approval_required";
+        case "test_change_approval_required":
+            return "test_change_approval_required";
         default:
             return `${safetySurface}_safety_block`;
     }
@@ -1595,7 +1650,8 @@ function observeRunFileEffects(input) {
     try {
         const netChangedAtCompletion = normalizeFileEffectPaths(listAttemptChangedFilesSinceBoundary({
             repoRoot: input.repoRoot,
-            boundary: input.boundary
+            boundary: input.boundary,
+            includeBaselineSnapshotChanges: true
         }));
         const netChanged = new Set(netChangedAtCompletion);
         return {
@@ -1714,18 +1770,23 @@ function mergeCostProvenance(previous, current) {
     }
     return COST_PROVENANCE_RANK[current] < COST_PROVENANCE_RANK[previous] ? current : previous;
 }
+/**
+ * Git-backed observation that degrades the same way `resolveChangedFiles` does:
+ * when Git becomes unavailable after the attempt, fall back only if the adapter
+ * reported its own changed files; otherwise fail closed.
+ */
+function violatingIgnoredPaths(violations, ignoredPaths) {
+    const violating = new Set(violations.map((violation) => violation.file?.replace(/\/$/u, "")).filter(Boolean));
+    return ignoredPaths.filter((filePath) => violating.has(filePath.replace(/\/$/u, "")));
+}
 function resolveChangedFiles(result, repoRoot, rollbackBoundary) {
     const adapterReported = normalizeFileEffectPaths(result.execution?.changedFiles ?? []);
-    try {
-        const gitObserved = listAttemptChangedFilesSinceBoundary({ repoRoot, boundary: rollbackBoundary });
-        return normalizeFileEffectPaths([...adapterReported, ...gitObserved]);
-    }
-    catch (error) {
-        if (result.execution?.changedFiles !== undefined) {
-            return adapterReported;
-        }
-        throw error;
-    }
+    const gitObserved = listAttemptChangedFilesSinceBoundary({
+        repoRoot,
+        boundary: rollbackBoundary,
+        includeBaselineSnapshotChanges: true
+    });
+    return normalizeFileEffectPaths([...adapterReported, ...gitObserved]);
 }
 function buildPatchDiff(result, changedFiles) {
     if (result.execution?.patch) {

package/dist/vendor/core/leash.d.ts

@@ -1,6 +1,6 @@
 import type { ApprovalPolicy, ExecutionProfile, LoopTask } from "../contracts/index.js";
 export type SafetySurface = "command" | "filesystem" | "secret" | "spend" | "network" | "dependency";
-export type SafetyViolationKind = "command_blocked" | "path_not_allowed" | "path_denied" | "path_outside_repo" | "network_blocked" | "dependency_approval_required" | "migration_approval_required" | "config_change_approval_required" | "secret_value" | "protected_path";
+export type SafetyViolationKind = "command_blocked" | "path_not_allowed" | "path_denied" | "path_outside_repo" | "network_blocked" | "dependency_approval_required" | "migration_approval_required" | "config_change_approval_required" | "test_change_approval_required" | "secret_value" | "protected_path";
 export interface SafetyViolation {
     kind: SafetyViolationKind;
     message: string;
@@ -30,6 +30,14 @@ export declare function evaluateVerificationLeash(task: Pick<LoopTask, "verifica
 export declare function evaluateFilesystemLeash(input: {
     repoRoot?: string;
     changedFiles: string[];
+    /**
+     * Git-ignored files the attempt created or modified. These are checked only
+     * against denied paths and protected secret files, never allowed paths, so
+     * dependency installs and build output stay unaffected.
+     */
+    ignoredFiles?: string[];
+    /** Symlinks or junctions created inside the repo that resolve outside it. */
+    escapingLinks?: string[];
     allowedPaths?: string[];
     deniedPaths?: string[];
     mutationMode?: "edit" | "read_only" | "verify_only";
@@ -43,6 +51,8 @@ export declare function resolveExecutionProfile(input: {
 }): ResolvedExecutionProfile;
 export declare function evaluateChangeApprovalLeash(input: {
     changedFiles: string[];
+    /** Existing test files the attempt deleted or removed lines from. */
+    weakenedTestFiles?: string[];
     executionProfile?: ExecutionProfile;
     approvalPolicy?: ApprovalPolicy;
 }): SafetyLeashDecision;

package/dist/vendor/core/leash.js

@@ -1,4 +1,5 @@
 import { isAbsolute, relative, resolve } from "node:path";
+import { isInsideDependencyOrBuildDirectory } from "./output-directories.js";
 const BLOCKED_PATTERNS = [
     /(^|[\s;&|`(])rm\s+-rf(\s|$)/iu,
     /git\s+reset\s+--hard/iu,
@@ -186,8 +187,13 @@ export function evaluateVerificationLeash(task) {
     };
 }
 export function evaluateFilesystemLeash(input) {
-    const violations = [];
-    for (const rawFile of input.changedFiles) {
+    const violations = (input.escapingLinks ?? []).map((link) => ({
+        kind: "path_outside_repo",
+        file: link,
+        message: `Link inside the repo points outside the configured repo root: ${link}`
+    }));
+    const escapingLinks = new Set(input.escapingLinks ?? []);
+    for (const rawFile of input.changedFiles.filter((file) => !escapingLinks.has(file))) {
         const normalized = normalizeChangedFile(rawFile, input.repoRoot);
         if (normalized.outsideRepo) {
             violations.push({
@@ -218,6 +224,10 @@ export function evaluateFilesystemLeash(input) {
             continue;
         }
         const allowedPaths = input.allowedPaths ?? [];
+        if (isProtectedSecretFile(file) && !isExplicitlyAllowed(file, allowedPaths)) {
+            violations.push(protectedSecretViolation(file));
+            continue;
+        }
         if (allowedPaths.length > 0 && !allowedPaths.some((pattern) => matchesPathPattern(file, pattern))) {
             violations.push({
                 kind: "path_not_allowed",
@@ -226,6 +236,25 @@ export function evaluateFilesystemLeash(input) {
             });
         }
     }
+    for (const rawFile of input.ignoredFiles ?? []) {
+        const file = normalizePathForMatching(rawFile);
+        if (!file) {
+            continue;
+        }
+        if ((input.deniedPaths ?? []).some((pattern) => matchesPathPattern(file, pattern))) {
+            violations.push({
+                kind: "path_denied",
+                file,
+                message: `Git-ignored file matches a denylisted path: ${file}`
+            });
+            continue;
+        }
+        if (!isInsideDependencyOrBuildDirectory(file) &&
+            isProtectedSecretFile(file) &&
+            !isExplicitlyAllowed(file, input.allowedPaths ?? [])) {
+            violations.push(protectedSecretViolation(file));
+        }
+    }
     if (violations.length > 0) {
         return {
             allowed: false,
@@ -357,6 +386,15 @@ export function evaluateChangeApprovalLeash(input) {
             });
         }
     }
+    if (!input.approvalPolicy?.testChanges) {
+        for (const file of input.weakenedTestFiles ?? []) {
+            violations.push({
+                kind: "test_change_approval_required",
+                file,
+                message: `Removing or rewriting existing test code requires approval: ${file}`
+            });
+        }
+    }
     if (violations.length > 0) {
         return {
             allowed: false,
@@ -366,7 +404,7 @@ export function evaluateChangeApprovalLeash(input) {
             profile: profile.name,
             blockedCommands: [],
             violations,
-            reason: "Safety leash blocked dependency, migration, or configuration changes that require approval."
+            reason: "Safety leash blocked dependency, migration, configuration, or existing-test changes that require approval."
         };
     }
     return {
@@ -408,6 +446,42 @@ function normalizeChangedFile(file, repoRoot) {
         outsideRepo: false
     };
 }
+const SAFE_ENV_TEMPLATE_SUFFIXES = new Set(["example", "sample", "template", "dist", "defaults"]);
+const PRIVATE_KEY_BASENAMES = new Set(["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519"]);
+const SECRET_MATERIAL_EXTENSIONS = new Set(["pem", "key", "p12", "pfx"]);
+/** Files that conventionally hold credentials or private key material. */
+function isProtectedSecretFile(file) {
+    const leaf = normalizePathForMatching(file).split("/").at(-1) ?? "";
+    if (leaf === ".env") {
+        return true;
+    }
+    if (leaf.startsWith(".env.")) {
+        return !SAFE_ENV_TEMPLATE_SUFFIXES.has(leaf.slice(".env.".length).toLowerCase());
+    }
+    if (PRIVATE_KEY_BASENAMES.has(leaf)) {
+        return true;
+    }
+    const extension = leaf.includes(".") ? leaf.split(".").at(-1)?.toLowerCase() : undefined;
+    return extension !== undefined && SECRET_MATERIAL_EXTENSIONS.has(extension);
+}
+/**
+ * A protected file counts as allowed only when an allowed-path entry targets it
+ * specifically; broad wildcards such as `**` or `src/*` do not approve secrets.
+ */
+function isExplicitlyAllowed(file, allowedPaths) {
+    return allowedPaths.some((pattern) => {
+        const leafPattern = normalizePathForMatching(pattern).split("/").at(-1) ?? "";
+        return !/^\*+$/u.test(leafPattern) && matchesPathPattern(file, pattern);
+    });
+}
+function protectedSecretViolation(file) {
+    return {
+        kind: "protected_path",
+        file,
+        message: `Changed file is a protected secret or key file: ${file}. ` +
+            "Name it explicitly in allowed paths to permit agent writes."
+    };
+}
 function matchesPathPattern(file, pattern) {
     const normalizedFile = normalizePathForMatching(file);
     const normalizedPattern = normalizePathForMatching(pattern);

package/dist/vendor/core/output-directories.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Directory names that hold dependency installs or build output. Git-ignored
+ * content under them is tracked as a single collapsed entry and is not checked
+ * file by file for protected secrets.
+ */
+export declare const DEPENDENCY_AND_BUILD_DIRECTORIES: ReadonlySet<string>;
+export declare function isInsideDependencyOrBuildDirectory(repoPath: string): boolean;

package/dist/vendor/core/output-directories.js

@@ -0,0 +1,36 @@
+/**
+ * Directory names that hold dependency installs or build output. Git-ignored
+ * content under them is tracked as a single collapsed entry and is not checked
+ * file by file for protected secrets.
+ */
+export const DEPENDENCY_AND_BUILD_DIRECTORIES = new Set([
+    "node_modules",
+    "bower_components",
+    "jspm_packages",
+    ".pnpm-store",
+    ".yarn",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".tox",
+    ".gradle",
+    ".next",
+    ".nuxt",
+    ".turbo",
+    ".cache",
+    ".parcel-cache",
+    "target",
+    "dist",
+    "build",
+    "out",
+    "coverage",
+    "vendor"
+]);
+export function isInsideDependencyOrBuildDirectory(repoPath) {
+    const segments = repoPath.replace(/\\/gu, "/").split("/").filter(Boolean);
+    // A trailing collapsed entry such as `node_modules/` is itself the directory.
+    return segments.some((segment) => DEPENDENCY_AND_BUILD_DIRECTORIES.has(segment));
+}

package/dist/vendor/core/rollback.d.ts

@@ -1,18 +1,42 @@
 import type { PatchDecision, RollbackBoundaryArtifact, RollbackOutcomeArtifact } from "../contracts/index.js";
+export interface IgnoredFileChanges {
+    created: string[];
+    modified: string[];
+    deleted: string[];
+}
 export declare class RollbackStateUnavailableError extends Error {
     constructor(message: string);
 }
 export declare function listAttemptChangedFilesSinceBoundary(input: {
     repoRoot?: string;
     boundary?: RollbackBoundaryArtifact;
+    /** Include content changes to dirty/untracked paths that existed at the boundary. */
+    includeBaselineSnapshotChanges?: boolean;
 }): string[];
 export declare function captureRollbackBoundary(input: {
     repoRoot?: string;
     capturedAt: string;
 }): Promise<RollbackBoundaryArtifact | undefined>;
+/**
+ * Git-ignored files the attempt created or modified since the boundary.
+ * Boundaries recorded before the ignored inventory existed report nothing.
+ */
+export declare function listIgnoredFileChangesSinceBoundary(input: {
+    repoRoot?: string;
+    boundary?: RollbackBoundaryArtifact;
+}): IgnoredFileChanges;
 export declare function restoreRollbackBoundary(input: {
     repoRoot?: string;
     boundary?: RollbackBoundaryArtifact;
     restoredAt: string;
     decision: PatchDecision;
+    /** Extra attempt-created paths (for example ignored files) to delete. */
+    removePaths?: string[];
+    /** Pre-existing ignored paths to restore from the in-memory boundary. */
+    restoreIgnoredPaths?: string[];
 }): Promise<RollbackOutcomeArtifact | undefined>;
+/**
+ * Repo-relative links (symlinks or junctions) among `paths` whose target
+ * resolves outside the repository. Paths are first collapsed to the link.
+ */
+export declare function findEscapingLinks(repoRoot: string, paths: string[]): string[];