@martinloop/mcp 0.8.6 → 0.8.8

package/dist/vendor/core/leash.d.ts

@@ -1,6 +1,6 @@
 import type { ApprovalPolicy, ExecutionProfile, LoopTask } from "../contracts/index.js";
 export type SafetySurface = "command" | "filesystem" | "secret" | "spend" | "network" | "dependency";
-export type SafetyViolationKind = "command_blocked" | "path_not_allowed" | "path_denied" | "path_outside_repo" | "network_blocked" | "dependency_approval_required" | "migration_approval_required" | "config_change_approval_required" | "secret_value" | "protected_path";
+export type SafetyViolationKind = "command_blocked" | "path_not_allowed" | "path_denied" | "path_outside_repo" | "network_blocked" | "dependency_approval_required" | "migration_approval_required" | "config_change_approval_required" | "test_change_approval_required" | "secret_value" | "protected_path";
 export interface SafetyViolation {
     kind: SafetyViolationKind;
     message: string;
@@ -30,6 +30,14 @@ export declare function evaluateVerificationLeash(task: Pick<LoopTask, "verifica
 export declare function evaluateFilesystemLeash(input: {
     repoRoot?: string;
     changedFiles: string[];
+    /**
+     * Git-ignored files the attempt created or modified. These are checked only
+     * against denied paths and protected secret files, never allowed paths, so
+     * dependency installs and build output stay unaffected.
+     */
+    ignoredFiles?: string[];
+    /** Symlinks or junctions created inside the repo that resolve outside it. */
+    escapingLinks?: string[];
     allowedPaths?: string[];
     deniedPaths?: string[];
     mutationMode?: "edit" | "read_only" | "verify_only";
@@ -43,6 +51,8 @@ export declare function resolveExecutionProfile(input: {
 }): ResolvedExecutionProfile;
 export declare function evaluateChangeApprovalLeash(input: {
     changedFiles: string[];
+    /** Existing test files the attempt deleted or removed lines from. */
+    weakenedTestFiles?: string[];
     executionProfile?: ExecutionProfile;
     approvalPolicy?: ApprovalPolicy;
 }): SafetyLeashDecision;

package/dist/vendor/core/leash.js

@@ -1,4 +1,5 @@
 import { isAbsolute, relative, resolve } from "node:path";
+import { isInsideDependencyOrBuildDirectory } from "./output-directories.js";
 const BLOCKED_PATTERNS = [
     /(^|[\s;&|`(])rm\s+-rf(\s|$)/iu,
     /git\s+reset\s+--hard/iu,
@@ -186,8 +187,13 @@ export function evaluateVerificationLeash(task) {
     };
 }
 export function evaluateFilesystemLeash(input) {
-    const violations = [];
-    for (const rawFile of input.changedFiles) {
+    const violations = (input.escapingLinks ?? []).map((link) => ({
+        kind: "path_outside_repo",
+        file: link,
+        message: `Link inside the repo points outside the configured repo root: ${link}`
+    }));
+    const escapingLinks = new Set(input.escapingLinks ?? []);
+    for (const rawFile of input.changedFiles.filter((file) => !escapingLinks.has(file))) {
         const normalized = normalizeChangedFile(rawFile, input.repoRoot);
         if (normalized.outsideRepo) {
             violations.push({
@@ -218,6 +224,10 @@ export function evaluateFilesystemLeash(input) {
             continue;
         }
         const allowedPaths = input.allowedPaths ?? [];
+        if (isProtectedSecretFile(file) && !isExplicitlyAllowed(file, allowedPaths)) {
+            violations.push(protectedSecretViolation(file));
+            continue;
+        }
         if (allowedPaths.length > 0 && !allowedPaths.some((pattern) => matchesPathPattern(file, pattern))) {
             violations.push({
                 kind: "path_not_allowed",
@@ -226,6 +236,25 @@ export function evaluateFilesystemLeash(input) {
             });
         }
     }
+    for (const rawFile of input.ignoredFiles ?? []) {
+        const file = normalizePathForMatching(rawFile);
+        if (!file) {
+            continue;
+        }
+        if ((input.deniedPaths ?? []).some((pattern) => matchesPathPattern(file, pattern))) {
+            violations.push({
+                kind: "path_denied",
+                file,
+                message: `Git-ignored file matches a denylisted path: ${file}`
+            });
+            continue;
+        }
+        if (!isInsideDependencyOrBuildDirectory(file) &&
+            isProtectedSecretFile(file) &&
+            !isExplicitlyAllowed(file, input.allowedPaths ?? [])) {
+            violations.push(protectedSecretViolation(file));
+        }
+    }
     if (violations.length > 0) {
         return {
             allowed: false,
@@ -357,6 +386,15 @@ export function evaluateChangeApprovalLeash(input) {
             });
         }
     }
+    if (!input.approvalPolicy?.testChanges) {
+        for (const file of input.weakenedTestFiles ?? []) {
+            violations.push({
+                kind: "test_change_approval_required",
+                file,
+                message: `Removing or rewriting existing test code requires approval: ${file}`
+            });
+        }
+    }
     if (violations.length > 0) {
         return {
             allowed: false,
@@ -366,7 +404,7 @@ export function evaluateChangeApprovalLeash(input) {
             profile: profile.name,
             blockedCommands: [],
             violations,
-            reason: "Safety leash blocked dependency, migration, or configuration changes that require approval."
+            reason: "Safety leash blocked dependency, migration, configuration, or existing-test changes that require approval."
         };
     }
     return {
@@ -408,6 +446,42 @@ function normalizeChangedFile(file, repoRoot) {
         outsideRepo: false
     };
 }
+const SAFE_ENV_TEMPLATE_SUFFIXES = new Set(["example", "sample", "template", "dist", "defaults"]);
+const PRIVATE_KEY_BASENAMES = new Set(["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519"]);
+const SECRET_MATERIAL_EXTENSIONS = new Set(["pem", "key", "p12", "pfx"]);
+/** Files that conventionally hold credentials or private key material. */
+function isProtectedSecretFile(file) {
+    const leaf = normalizePathForMatching(file).split("/").at(-1) ?? "";
+    if (leaf === ".env") {
+        return true;
+    }
+    if (leaf.startsWith(".env.")) {
+        return !SAFE_ENV_TEMPLATE_SUFFIXES.has(leaf.slice(".env.".length).toLowerCase());
+    }
+    if (PRIVATE_KEY_BASENAMES.has(leaf)) {
+        return true;
+    }
+    const extension = leaf.includes(".") ? leaf.split(".").at(-1)?.toLowerCase() : undefined;
+    return extension !== undefined && SECRET_MATERIAL_EXTENSIONS.has(extension);
+}
+/**
+ * A protected file counts as allowed only when an allowed-path entry targets it
+ * specifically; broad wildcards such as `**` or `src/*` do not approve secrets.
+ */
+function isExplicitlyAllowed(file, allowedPaths) {
+    return allowedPaths.some((pattern) => {
+        const leafPattern = normalizePathForMatching(pattern).split("/").at(-1) ?? "";
+        return !/^\*+$/u.test(leafPattern) && matchesPathPattern(file, pattern);
+    });
+}
+function protectedSecretViolation(file) {
+    return {
+        kind: "protected_path",
+        file,
+        message: `Changed file is a protected secret or key file: ${file}. ` +
+            "Name it explicitly in allowed paths to permit agent writes."
+    };
+}
 function matchesPathPattern(file, pattern) {
     const normalizedFile = normalizePathForMatching(file);
     const normalizedPattern = normalizePathForMatching(pattern);

package/dist/vendor/core/output-directories.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Directory names that hold dependency installs or build output. Git-ignored
+ * content under them is tracked as a single collapsed entry and is not checked
+ * file by file for protected secrets.
+ */
+export declare const DEPENDENCY_AND_BUILD_DIRECTORIES: ReadonlySet<string>;
+export declare function isInsideDependencyOrBuildDirectory(repoPath: string): boolean;

package/dist/vendor/core/output-directories.js

@@ -0,0 +1,36 @@
+/**
+ * Directory names that hold dependency installs or build output. Git-ignored
+ * content under them is tracked as a single collapsed entry and is not checked
+ * file by file for protected secrets.
+ */
+export const DEPENDENCY_AND_BUILD_DIRECTORIES = new Set([
+    "node_modules",
+    "bower_components",
+    "jspm_packages",
+    ".pnpm-store",
+    ".yarn",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".tox",
+    ".gradle",
+    ".next",
+    ".nuxt",
+    ".turbo",
+    ".cache",
+    ".parcel-cache",
+    "target",
+    "dist",
+    "build",
+    "out",
+    "coverage",
+    "vendor"
+]);
+export function isInsideDependencyOrBuildDirectory(repoPath) {
+    const segments = repoPath.replace(/\\/gu, "/").split("/").filter(Boolean);
+    // A trailing collapsed entry such as `node_modules/` is itself the directory.
+    return segments.some((segment) => DEPENDENCY_AND_BUILD_DIRECTORIES.has(segment));
+}

package/dist/vendor/core/policy.d.ts

@@ -1,4 +1,4 @@
-import type { BudgetPreflightEstimate, CostProvenance, EvidenceVector, FailureClass, InterventionType, LoopAttempt, LoopBudget, LoopCost, LoopLifecycleState, LoopStatus, PatchDecisionArtifact, PatchScore, PolicyPhase } from "../contracts/index.js";
+import type { BudgetPreflightEstimate, CostProvenance, EvidenceVector, FailureClass, InterventionType, LoopAttempt, LoopBudget, LoopCost, LoopLifecycleState, LoopStatus, PatchDecisionArtifact, PatchDecisionReasonCode, PatchScore, PolicyPhase } from "../contracts/index.js";
 export interface FailureAssessment {
     failureClass: FailureClass;
     rationale: string;
@@ -106,6 +106,17 @@ export interface BudgetPreflightInput {
     remainingTokens?: number;
     /** Adapter-declared estimated floor required to admit a credible first turn. */
     minimumViableTokens?: number;
+    /**
+     * Remaining iterations allowed. Used to compute a budget-aware per-attempt cap
+     * that reserves capacity for verifier and at least one repair attempt.
+     * When omitted, the preflight uses remaining budget divided by a conservative
+     * factor to prevent over-allocation on the first attempt.
+     */
+    remainingIterations?: number;
+    /**
+     * Explicit per-attempt spending cap. When set, overrides the computed cap.
+     * Only use when the caller has specific rate-limiting requirements.
+     */
     perAttemptCapUsd?: number;
     pricePerMTokenUsd?: number;
 }
@@ -158,5 +169,11 @@ export interface EvaluatedPatchDecision extends PatchDecisionArtifact {
     score: PatchScore;
 }
 export declare function selectRecoveryRecipe(evidence: EvidenceVector): RecoveryDecision;
+/**
+ * Returns true ONLY when every reason code is in the explicit allowlist of
+ * retainable soft failures.  Unknown or future reason codes default to UNSAFE
+ * (fail-closed), preventing silent candidate retention for unrecognized states.
+ */
+export declare function isSafeUnverifiedDiscard(reasonCodes: readonly PatchDecisionReasonCode[]): boolean;
 export declare function evaluatePatchDecision(input: PatchDecisionInput): EvaluatedPatchDecision;
 export declare function scorePatchDecision(input: PatchDecisionInput): PatchScore;

package/dist/vendor/core/policy.js

@@ -244,17 +244,42 @@ export function inferExit(input) {
             reason: "Oscillating failure pattern detected — loop is cycling without measurable progress."
         };
     }
+    // C2 — progress-aware repetition check.
+    // Two consecutive attempts with the same failureClass are NOT necessarily
+    // the same state. If the verifierScore improved (e.g. fewer failing tests),
+    // that is measurable progress and we must not stop prematurely.
+    // Only stop when the failure class repeated AND there is no measurable improvement:
+    //   - verifierScore did not increase, AND
+    //   - candidate diff did not change (candidateRetained with same failure)
     const lastTwo = input.loop.attempts.slice(-2);
-    const repeatedFailure = lastTwo.length === 2 &&
+    const repeatedFailureClass = lastTwo.length === 2 &&
         lastTwo.every((attempt) => attempt.failureClass &&
             attempt.failureClass === lastTwo[0]?.failureClass &&
             attempt.failureClass === input.lastFailure?.failureClass);
-    if (repeatedFailure && input.lastFailure) {
+    // Measure progress using REAL evidence from actual verifier step results.
+    // Multiple signals are checked; any one constituting real progress allows continuation.
+    const measurableProgressOccurred = (() => {
+        const [prev, curr] = lastTwo;
+        if (!prev || !curr)
+            return false;
+        // Signal 1: verifierScore improved (computed from real passing/total step ratio)
+        const prevScore = prev.verifierScore ?? 0;
+        const currScore = curr.verifierScore ?? 0;
+        if (currScore > prevScore)
+            return true;
+        // Signal 2: fewer failing verifier steps than previous attempt (monotonic improvement)
+        if (prev.failingVerifierStepCount !== undefined &&
+            curr.failingVerifierStepCount !== undefined &&
+            curr.failingVerifierStepCount < prev.failingVerifierStepCount)
+            return true;
+        return false;
+    })();
+    if (repeatedFailureClass && !measurableProgressOccurred && input.lastFailure) {
         return {
             shouldExit: true,
             lifecycleState: "diminishing_returns",
             status: "exited",
-            reason: `Martin exited because ${input.lastFailure.failureClass} repeated across consecutive attempts.`
+            reason: `Martin exited because ${input.lastFailure.failureClass} repeated across consecutive attempts with no measurable progress (score, step count, or failure surface unchanged).`
         };
     }
     if (input.lastFailure?.failureClass === "environment_mismatch" &&
@@ -398,11 +423,34 @@ export function evaluateBudgetPreflight(input) {
             estimate
         };
     }
-    const perAttemptCap = input.perAttemptCapUsd ?? Math.max(input.remainingBudgetUsd * 0.2, 0.05);
+    // D2 — Budget-aware per-attempt cap.
+    //
+    // Old behavior: rigid maxUsd * 0.25 — blocked viable attempts when total budget
+    // was large (e.g. $0.30 cost blocked on $1.00 budget because 0.30 > 0.25).
+    //
+    // New behavior: if an explicit cap is provided, honor it. Otherwise compute a
+    // cap that reserves budget for the verifier and at least one repair attempt beyond
+    // the current one, giving the provider meaningful runway.
+    //
+    // Formula: cap = remainingBudget / (remainingIterations + 1)
+    //   +1 accounts for the current attempt being the "next" attempt.
+    //   Minimum cap of $0.05 prevents degenerate near-zero rejections.
+    const perAttemptCap = (() => {
+        if (input.perAttemptCapUsd !== undefined)
+            return input.perAttemptCapUsd;
+        const iters = input.remainingIterations;
+        if (iters !== undefined && iters > 0) {
+            // Divide remaining budget evenly across remaining iterations.
+            return Math.max(roundUsd(input.remainingBudgetUsd / iters), 0.05);
+        }
+        // No iteration information: allow up to 80% of remaining budget per attempt
+        // (down from the old 25%-of-total which was frequently too low).
+        return Math.max(roundUsd(input.remainingBudgetUsd * 0.8), 0.05);
+    })();
     if (estimatedAttemptCostUsd > perAttemptCap) {
         return {
             allowed: false,
-            reason: `Preflight: estimated attempt cost $${estimatedAttemptCostUsd} exceeds per-attempt cap $${roundUsd(perAttemptCap)}.`,
+            reason: `Preflight: estimated attempt cost $${estimatedAttemptCostUsd} exceeds per-attempt cap $${roundUsd(perAttemptCap)} (remaining budget $${input.remainingBudgetUsd}, ${input.remainingIterations ?? "?"} iterations left).`,
             estimate
         };
     }
@@ -517,6 +565,41 @@ export function selectRecoveryRecipe(evidence) {
         intervention: "escalate_human"
     };
 }
+/**
+ * Explicit allowlist of reason codes that are SAFE to retain as an unverified
+ * candidate for the next repair attempt.
+ *
+ * FAIL-CLOSED: any reason code NOT in this set causes an immediate rollback.
+ * This prevents future or unknown reason codes from silently becoming "safe."
+ *
+ * Retainable only when ALL of these are also true:
+ *  - scope_violation is absent (agent stayed within allowed paths)
+ *  - safety_violation is absent (no secret/tenancy/test-integrity violation)
+ *  - workspace observation was authoritative (changed files were tracked)
+ *  - provider did not crash/fail (status !== "failed")
+ *
+ * no_code_change is explicitly NOT retainable — there is nothing to repair.
+ * Use a different recovery strategy instead.
+ */
+const RETAINABLE_SOFT_REASON_CODES = new Set([
+    "verifier_not_improved",
+    "low_novelty_no_progress",
+    "large_diff_no_improvement",
+    "grounding_failure",
+    "verifier_regressed", // actual test regression — retry with different approach
+]);
+/**
+ * Returns true ONLY when every reason code is in the explicit allowlist of
+ * retainable soft failures.  Unknown or future reason codes default to UNSAFE
+ * (fail-closed), preventing silent candidate retention for unrecognized states.
+ */
+export function isSafeUnverifiedDiscard(reasonCodes) {
+    if (reasonCodes.length === 0) {
+        // No specific signal — we don't know why it's being discarded; fail closed.
+        return false;
+    }
+    return reasonCodes.every((code) => RETAINABLE_SOFT_REASON_CODES.has(code));
+}
 export function evaluatePatchDecision(input) {
     const score = scorePatchDecision(input);
     const reasonCodes = [...score.reasonCodes];
@@ -624,21 +707,41 @@ function tokenizeDiff(diff) {
     return tokens;
 }
 function decidePatchOutcome(input, reasonCodes) {
+    // 1. Explicit human approval required — always escalate regardless of verifier.
+    // 2. Safety violation — always escalate.
     if (input.humanApprovalRequired || reasonCodes.includes("safety_violation")) {
         return "ESCALATE";
     }
+    // 3. Scope violation — hard boundary: out-of-scope writes are never kept,
+    //    even if the verifier passes, because the change violated the task contract.
+    if (reasonCodes.includes("scope_violation")) {
+        return "DISCARD";
+    }
+    // 4. Required mutation is absent — a green generic test suite is not proof
+    //    that the requested work happened.  Discard if:
+    //      - a code change was required (mutation_required = edit mode)
+    //      - no files were actually changed
+    //      - the task was not pre-satisfied by the existing codebase
+    //    Note: the scorer already suppresses no_code_change when
+    //    definitionOfDonePreSatisfied is true, so that legitimate case passes through.
+    if (reasonCodes.includes("no_code_change")) {
+        return "DISCARD";
+    }
+    // 5. Passing verifier is the authoritative signal and overrides lower-confidence
+    //    heuristics such as grounding failure.  A grounding heuristic (symbol
+    //    resolution, repo anatomy check) is weaker evidence than an actual passing
+    //    host-run test exit code.
+    if (input.verificationPassed) {
+        return "KEEP";
+    }
+    // 6. Non-passing verifier: discard on any remaining negative heuristic signal.
     if (reasonCodes.includes("grounding_failure") ||
-        reasonCodes.includes("scope_violation") ||
-        reasonCodes.includes("no_code_change") ||
         reasonCodes.includes("verifier_regressed") ||
         reasonCodes.includes("large_diff_no_improvement") ||
         reasonCodes.includes("low_novelty_no_progress") ||
         reasonCodes.includes("verifier_not_improved")) {
         return "DISCARD";
     }
-    if (input.verificationPassed) {
-        return "KEEP";
-    }
     return "DISCARD";
 }
 function buildPatchDecisionSummary(decision, reasonCodes, summary) {

package/dist/vendor/core/rollback.d.ts

@@ -1,18 +1,42 @@
 import type { PatchDecision, RollbackBoundaryArtifact, RollbackOutcomeArtifact } from "../contracts/index.js";
+export interface IgnoredFileChanges {
+    created: string[];
+    modified: string[];
+    deleted: string[];
+}
 export declare class RollbackStateUnavailableError extends Error {
     constructor(message: string);
 }
 export declare function listAttemptChangedFilesSinceBoundary(input: {
     repoRoot?: string;
     boundary?: RollbackBoundaryArtifact;
+    /** Include content changes to dirty/untracked paths that existed at the boundary. */
+    includeBaselineSnapshotChanges?: boolean;
 }): string[];
 export declare function captureRollbackBoundary(input: {
     repoRoot?: string;
     capturedAt: string;
 }): Promise<RollbackBoundaryArtifact | undefined>;
+/**
+ * Git-ignored files the attempt created or modified since the boundary.
+ * Boundaries recorded before the ignored inventory existed report nothing.
+ */
+export declare function listIgnoredFileChangesSinceBoundary(input: {
+    repoRoot?: string;
+    boundary?: RollbackBoundaryArtifact;
+}): IgnoredFileChanges;
 export declare function restoreRollbackBoundary(input: {
     repoRoot?: string;
     boundary?: RollbackBoundaryArtifact;
     restoredAt: string;
     decision: PatchDecision;
+    /** Extra attempt-created paths (for example ignored files) to delete. */
+    removePaths?: string[];
+    /** Pre-existing ignored paths to restore from the in-memory boundary. */
+    restoreIgnoredPaths?: string[];
 }): Promise<RollbackOutcomeArtifact | undefined>;
+/**
+ * Repo-relative links (symlinks or junctions) among `paths` whose target
+ * resolves outside the repository. Paths are first collapsed to the link.
+ */
+export declare function findEscapingLinks(repoRoot: string, paths: string[]): string[];