@martinloop/mcp 0.8.8 → 0.8.10

package/dist/vendor/core/policy.js

@@ -385,7 +385,10 @@ function roundUsd(value) {
     return Math.round(value * 100) / 100;
 }
 export function evaluateBudgetPreflight(input) {
-    const pricePerMToken = input.pricePerMTokenUsd ?? 3.0;
+    const declaredPrice = input.pricePerMTokenUsd;
+    const validDeclaredPrice = declaredPrice === undefined
+        || (Number.isFinite(declaredPrice) && declaredPrice >= 0);
+    const pricePerMToken = validDeclaredPrice ? (declaredPrice ?? 3.0) : 3.0;
     const rawPromptTokens = Math.ceil(input.promptCharCount / 4);
     const estimatedPromptTokens = Math.ceil(rawPromptTokens * 1.2);
     const estimatedToolOverheadTokens = 800 + input.attemptCount * 200;
@@ -407,6 +410,13 @@ export function evaluateBudgetPreflight(input) {
         estimatedAttemptCostUsd,
         provenance
     };
+    if (!validDeclaredPrice) {
+        return {
+            allowed: false,
+            reason: "Preflight: invalid adapter price; pricePerMTokenUsd must be finite and non-negative.",
+            estimate
+        };
+    }
     if (input.remainingTokens !== undefined
         && estimatedMinimumViableTokens > 0
         && estimatedTotalTokens > input.remainingTokens) {

package/dist/vendor/core/resume.d.ts

@@ -0,0 +1,39 @@
+import type { LoopRecord, RollbackBoundaryArtifact } from "../contracts/index.js";
+export interface RunExecutionLease {
+    schemaVersion: "martin.execution-lease.v1";
+    runId: string;
+    token: string;
+    owner: string;
+    pid: number;
+    hostname: string;
+    acquiredAt: string;
+}
+export interface AcquiredRunExecutionLease {
+    lease: RunExecutionLease;
+    path: string;
+    release(): Promise<void>;
+}
+export interface ResumeVerifierFailure {
+    command: string;
+    exitCode?: number;
+    crashed?: boolean;
+    timedOut?: boolean;
+    failureExcerpt: string;
+    attemptId: string;
+    attemptIndex: number;
+}
+export interface ResumabilityDecision {
+    allowed: boolean;
+    reason: string;
+}
+export declare function evaluateRunResumability(loop: LoopRecord): ResumabilityDecision;
+export declare function loadResumeCandidateBoundary(runsRoot: string, loop: LoopRecord): Promise<RollbackBoundaryArtifact | undefined>;
+export declare function loadResumeVerifierFailure(runsRoot: string, loop: LoopRecord): Promise<ResumeVerifierFailure | undefined>;
+export declare function acquireRunExecutionLease(input: {
+    runsRoot: string;
+    runId: string;
+    owner: string;
+    now?: () => string;
+    host?: string;
+    pid?: number;
+}): Promise<AcquiredRunExecutionLease>;

package/dist/vendor/core/resume.js

@@ -0,0 +1,196 @@
+/// <reference types="node" />
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, open, readFile, unlink } from "node:fs/promises";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { artifactDir } from "./persistence/index.js";
+export function evaluateRunResumability(loop) {
+    if (loop.terminationEnvelope) {
+        return { allowed: false, reason: "The run already has authoritative terminal evidence." };
+    }
+    if (!["queued", "running", "verifying"].includes(loop.status)) {
+        return { allowed: false, reason: `Run status ${loop.status} is terminal and cannot be continued.` };
+    }
+    if (!["created", "running", "verifying"].includes(loop.lifecycleState)) {
+        return {
+            allowed: false,
+            reason: `Run lifecycle ${loop.lifecycleState} is terminal and cannot be continued.`
+        };
+    }
+    if (loop.task.taskClass === "irreversible" || loop.task.approvalPolicy?.externalWrites === true) {
+        return {
+            allowed: false,
+            reason: "Automatic execution continuation is disabled for irreversible/external-write tasks."
+        };
+    }
+    if (loop.attempts.length >= loop.budget.maxIterations) {
+        return { allowed: false, reason: "The run has no remaining iteration authority." };
+    }
+    if (loop.cost.actualUsd >= loop.budget.maxUsd) {
+        return { allowed: false, reason: "The run has no remaining USD budget authority." };
+    }
+    if (loop.budget.maxTokens !== undefined &&
+        loop.cost.tokensIn + loop.cost.tokensOut >= loop.budget.maxTokens) {
+        return { allowed: false, reason: "The run has no remaining token budget authority." };
+    }
+    const started = new Set(loop.events
+        .filter((event) => event.type === "attempt.started")
+        .map((event) => String(event.payload["attemptId"] ?? ""))
+        .filter(Boolean));
+    for (const event of loop.events) {
+        if (event.type === "attempt.completed") {
+            const attemptId = String(event.payload["attemptId"] ?? "");
+            if (attemptId)
+                started.delete(attemptId);
+        }
+    }
+    if (started.size > 0) {
+        return {
+            allowed: false,
+            reason: "A persisted attempt is still marked active; provider-process ownership is uncertain."
+        };
+    }
+    return { allowed: true, reason: "Persisted run has remaining safe execution authority." };
+}
+export async function loadResumeCandidateBoundary(runsRoot, loop) {
+    const latestAttempt = loop.attempts.at(-1);
+    if (latestAttempt?.candidateRetained !== true)
+        return undefined;
+    // Recover the first rollback boundary in the current contiguous retained-candidate
+    // suffix. Earlier retained candidates that were later discarded must not become
+    // authority for a new resume.
+    let firstRetainedAttempt = latestAttempt;
+    for (let index = loop.attempts.length - 2; index >= 0; index -= 1) {
+        const candidate = loop.attempts[index];
+        if (candidate?.candidateRetained !== true)
+            break;
+        firstRetainedAttempt = candidate;
+    }
+    const path = join(artifactDir(runsRoot, loop.loopId, firstRetainedAttempt.index), "rollback-boundary.json");
+    const raw = await readFile(path, "utf8").catch((error) => {
+        if (error.code === "ENOENT") {
+            throw new Error(`Cannot continue ${loop.loopId}: retained candidate boundary evidence is missing for attempt ${firstRetainedAttempt.index}.`);
+        }
+        throw error;
+    });
+    return JSON.parse(raw);
+}
+export async function loadResumeVerifierFailure(runsRoot, loop) {
+    const attempt = loop.attempts.at(-1);
+    if (!attempt || attempt.verifierScore === 1)
+        return undefined;
+    const path = join(artifactDir(runsRoot, loop.loopId, attempt.index), "verification.json");
+    const raw = await readFile(path, "utf8").catch((error) => {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    });
+    if (!raw)
+        return undefined;
+    const verification = JSON.parse(raw);
+    const step = verification.steps?.find((candidate) => candidate.launched === true &&
+        (candidate.crashed === true ||
+            candidate.timedOut === true ||
+            (candidate.exitCode !== undefined && candidate.exitCode !== 0)));
+    const excerpt = (step?.detail ??
+        [verification.summary, ...(verification.warnings ?? [])].filter(Boolean).join("\n")).trim();
+    return {
+        command: step?.command ?? loop.task.verificationPlan[0] ?? "unknown",
+        ...(!step?.crashed && !step?.timedOut && step?.exitCode !== undefined
+            ? { exitCode: step.exitCode }
+            : {}),
+        ...(step?.crashed ? { crashed: true } : {}),
+        ...(step?.timedOut ? { timedOut: true } : {}),
+        failureExcerpt: excerpt.slice(-1500),
+        attemptId: attempt.attemptId,
+        attemptIndex: attempt.index
+    };
+}
+export async function acquireRunExecutionLease(input) {
+    const now = input.now ?? (() => new Date().toISOString());
+    const host = input.host ?? hostname();
+    const pid = input.pid ?? process.pid;
+    const directory = join(input.runsRoot, ".execution-leases");
+    const leaseFile = `${createHash("sha256").update(input.runId).digest("hex")}.json`;
+    const path = join(directory, leaseFile);
+    await mkdir(directory, { recursive: true });
+    const token = `${pid}-${randomBytes(16).toString("hex")}`;
+    const lease = {
+        schemaVersion: "martin.execution-lease.v1",
+        runId: input.runId,
+        token,
+        owner: input.owner,
+        pid,
+        hostname: host,
+        acquiredAt: now()
+    };
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const handle = await open(path, "wx", 0o600);
+            try {
+                await handle.writeFile(`${JSON.stringify(lease, null, 2)}\n`, "utf8");
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            return {
+                lease,
+                path,
+                async release() {
+                    try {
+                        const existing = JSON.parse(await readFile(path, "utf8"));
+                        if (existing.token === token)
+                            await unlink(path);
+                    }
+                    catch (error) {
+                        if (error.code !== "ENOENT")
+                            throw error;
+                    }
+                }
+            };
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const existing = await readLease(path);
+            if (!existing)
+                continue;
+            if (existing.hostname !== host) {
+                throw new Error(`Run ${input.runId} is leased by ${existing.owner} on ${existing.hostname}; refusing cross-host takeover.`);
+            }
+            if (isProcessAlive(existing.pid)) {
+                throw new Error(`Run ${input.runId} is already executing under ${existing.owner} (pid ${existing.pid}).`);
+            }
+            await unlink(path).catch((unlinkError) => {
+                if (unlinkError.code !== "ENOENT")
+                    throw unlinkError;
+            });
+        }
+    }
+    throw new Error(`Unable to acquire execution lease for run ${input.runId}.`);
+}
+async function readLease(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new Error(`Existing execution lease is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function isProcessAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ESRCH")
+            return false;
+        return true;
+    }
+}

package/dist/vendor/core/verified-handoff.js

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: MartinLoop contributors
 // SPDX-License-Identifier: Apache-2.0
 import { createHash } from "node:crypto";
+import { posix, win32 } from "node:path";
 // ---------------------------------------------------------------------------
 // Mapping: granular TestIntegrityStatus → public TestIntegrityVerdict
 //
@@ -88,6 +89,65 @@ export function deriveVerifiedHandoffLifecycleTruth(loop) {
         evidenceAvailable: true,
     };
 }
+function sameOptionalVerifierFilesystemPath(actual, expected) {
+    if (actual === undefined || expected === undefined) {
+        return actual === expected;
+    }
+    return sameVerifierFilesystemPath(actual, expected);
+}
+function classifyVerifierFilesystemPath(value) {
+    // Persisted Windows bindings are expected to be drive-absolute or UNC.
+    // Do not use win32.isAbsolute() here because it also classifies POSIX-style
+    // root paths such as "/repo" as Windows root-relative paths.
+    if (/^[A-Za-z]:[\\/]/u.test(value) || /^\\\\/u.test(value) || /^\/\//u.test(value)) {
+        return "windows";
+    }
+    if (value.startsWith("/")) {
+        return "posix";
+    }
+    return "relative";
+}
+function stripTrailingVerifierSeparators(value, kind) {
+    if (kind === "windows") {
+        // Preserve drive roots (C:\\) and UNC share roots while removing harmless
+        // trailing separators from ordinary persisted paths.
+        if (/^[a-z]:\\$/iu.test(value) || /^\\\\[^\\]+\\[^\\]+\\?$/u.test(value)) {
+            return value;
+        }
+        return value.replace(/[\\/]+$/u, "");
+    }
+    if (kind === "posix") {
+        return value === "/" ? value : value.replace(/\/+$/u, "");
+    }
+    return value;
+}
+function normalizeVerifierFilesystemPath(value) {
+    const kind = classifyVerifierFilesystemPath(value);
+    if (kind === "windows") {
+        return {
+            kind,
+            value: stripTrailingVerifierSeparators(win32.normalize(value), kind).toLowerCase(),
+        };
+    }
+    if (kind === "posix") {
+        return {
+            kind,
+            value: stripTrailingVerifierSeparators(posix.normalize(value), kind),
+        };
+    }
+    // Relative verifier bindings are legacy/non-canonical. Normalize only their
+    // separators/dot segments and keep comparison case-sensitive/fail-closed.
+    return {
+        kind,
+        value: stripTrailingVerifierSeparators(posix.normalize(value.replace(/\\/gu, "/")), kind),
+    };
+}
+function sameVerifierFilesystemPath(actual, expected) {
+    const normalizedActual = normalizeVerifierFilesystemPath(actual);
+    const normalizedExpected = normalizeVerifierFilesystemPath(expected);
+    return (normalizedActual.kind === normalizedExpected.kind &&
+        normalizedActual.value === normalizedExpected.value);
+}
 export function verifierActuallyPassed(evidence, expected) {
     if (!evidence?.passed || !evidence.binding || !evidence.steps) {
         return false;
@@ -98,8 +158,8 @@ export function verifierActuallyPassed(evidence, expected) {
     if (evidence.binding.runId !== expected.runId ||
         evidence.binding.workspaceId !== expected.workspaceId ||
         (evidence.binding.attemptId ?? undefined) !== (expected.attemptId ?? undefined) ||
-        evidence.binding.cwd !== expected.cwd ||
-        (evidence.binding.runsRoot ?? undefined) !== (expected.runsRoot ?? undefined) ||
+        !sameVerifierFilesystemPath(evidence.binding.cwd, expected.cwd) ||
+        !sameOptionalVerifierFilesystemPath(evidence.binding.runsRoot, expected.runsRoot) ||
         (evidence.binding.executionProfile ?? undefined) !== (expected.executionProfile ?? undefined) ||
         JSON.stringify(evidence.binding.allowedNetworkDomains ?? []) !== JSON.stringify(expected.allowedNetworkDomains ?? []) ||
         JSON.stringify(evidence.binding.commands) !== JSON.stringify(expected.commands)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@martinloop/mcp",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "mcpName": "io.github.Keesan12/martin-loop",
   "private": false,
   "type": "module",
@@ -74,13 +74,9 @@
     "mcpb:smoke": "node ./mcpb/smoke-mcpb.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "@open-policy-agent/opa-wasm": "^1.10.0",
-    "@opentelemetry/api-logs": "^0.214.0",
-    "@opentelemetry/exporter-logs-otlp-http": "^0.214.0",
-    "@opentelemetry/resources": "^2.6.1",
-    "@opentelemetry/sdk-logs": "^0.214.0",
-    "ts-morph": "^21.0.0"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@anthropic-ai/mcpb": "2.1.2",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/Keesan12/martin-loop",
     "source": "github"
   },
-  "version": "0.8.8",
+  "version": "0.8.10",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@martinloop/mcp",
-      "version": "0.8.8",
+      "version": "0.8.10",
       "transport": {
         "type": "stdio"
       }