@massu/core 1.5.8 → 1.6.1

package/docs/AUTHORING-ADAPTERS.md

@@ -200,6 +200,47 @@ adapter authors to opt-in to the new shape.
 Additive changes (new optional fields on result types, new
 TreeSitterLanguage enum entries) are minor-version compatible.
 
+## Manifest sha256 round-trip — what to do when CI fails
+
+> Plan 3c Phase 9b P-D-004 runbook excerpt.
+
+The `tarball-e2e` CI job runs `adapter-manifest-roundtrip.test.ts` against the
+live registry manifest at `https://registry.massu.ai/adapters/manifest.json`.
+The test rebuilds every workspace adapter's `dist/`, computes the sha256, and
+asserts it matches the manifest's `sha256` entry for that `{package, version}`
+pair.
+
+**If the round-trip fails after a workspace adapter source edit**, the
+manifest must be re-signed BEFORE merge. The flow:
+
+1. **Verify your edit is intentional.** Run `npm run build` from the repo
+   root and inspect `git diff packages/adapter-<f>/dist/`. If the diff is
+   non-trivial, the source change is real and needs a manifest re-sign.
+2. **Bump the adapter version** in `packages/adapter-<f>/package.json` (e.g.
+   `1.0.0` → `1.0.1` for a bugfix; `1.1.0` for an additive feature). Manifest
+   entries are versioned, so re-signing without a version bump would break
+   reproducibility for users on the prior version.
+3. **Compute the new sha256** via `node packages/core/scripts/compute-adapter-shasums.mjs`
+   (or equivalent) — this writes to `~/.massu/build-shasums.json`.
+4. **Re-sign the manifest.** Run `bash scripts/provision/registry-publish.sh
+   path/to/manifest-body.json` — reads the Ed25519 private key from macOS
+   Keychain (`massu/registry/signing/private`), produces an envelope, deploys
+   to Vercel.
+5. **Re-run the round-trip test locally**: `MASSU_MANIFEST_ROUNDTRIP=1 npm test
+   -- adapter-manifest-roundtrip` — should now PASS.
+6. **Commit + open PR**. The CI gate will re-verify against the freshly-deployed
+   manifest.
+
+If CI fails on a transient registry outage (5xx, DNS, CDN cache miss), the
+test SKIPs cleanly with a console.warn — does NOT fail the job. Re-run the
+job to recover.
+
+**Non-monorepo adapter authors** (third-party packages NOT under `packages/adapter-*`):
+the round-trip test SKIPs your package automatically (workspace dir absent in
+the monorepo). Your install-time verification chain runs against the registry
+sha256 directly via `discover.ts:295-360` — that path catches the same drift
+class without requiring the test.
+
 ## See also
 
 - [`SECURITY.md`](./SECURITY.md) — signing model, key rotation, supply-chain risks

package/docs/SECURITY.md

@@ -240,6 +240,45 @@ per the canonical plan). The maintainer will:
 5. Add the affected adapter to the manifest's `unpublished: true` list
    if applicable, so all consumers refuse to load on next refresh.
 
+## Migration: 1.5.x → 1.6.0 (workspace adapter publish)
+
+> Plan 3c Phase 9b shipped 2026-05-09. See root `CHANGELOG.md` `[1.6.0]`.
+
+`1.6.0` is **additive** — end-users on `1.5.x` are unaffected. No
+breaking changes. No config migration. The 5 first-party AST adapters
+(`rails`, `phoenix`, `aspnet`, `spring`, `go-chi`) continue to ship
+CORE-BUNDLED in `@massu/core` itself; zero-config detection still works
+out of the box.
+
+What's new for users who want REGISTRY-VERIFIED trust:
+
+```bash
+npm install @massu/core@^1.6.0 @massu/adapter-rails@^1.0.0
+```
+
+After install, `npx massu adapters list` will show TWO entries for
+`rails`:
+
+- `rails` — CORE-BUNDLED (from `@massu/core`'s bundled `dist/detect/adapters/rails.js`).
+- `@massu/adapter-rails` — REGISTRY-VERIFIED (from `node_modules/@massu/adapter-rails/dist/`,
+  sha256-cross-checked against the signed manifest at
+  `https://registry.massu.ai/adapters/manifest.json`).
+
+The two co-exist. Discovery prefers REGISTRY-VERIFIED when present
+(the standalone package opts the user into the more-verified path);
+CORE-BUNDLED remains the fallback. There is no "elevation" — they are
+two distinct trust-class entries.
+
+### peerDependency note
+
+`@massu/adapter-*@1.0.0` declares `peerDependencies: { "@massu/core": "^1.6.0" }`.
+Users pinning `@massu/core@1.5.x` who install a standalone adapter will
+see an npm peerDep warning (non-fatal). For cleanest UX, upgrade
+`@massu/core` to `^1.6.0` before installing standalone adapters. The
+adapter source is binary-identical between CORE-BUNDLED and
+REGISTRY-VERIFIED — the warning is informational, not a runtime
+incompatibility.
+
 ## See also
 
 - [`AUTHORING-ADAPTERS.md`](./AUTHORING-ADAPTERS.md) — how to write a

package/package.json

@@ -1,12 +1,16 @@
 {
   "name": "@massu/core",
-  "version": "1.5.8",
+  "version": "1.6.1",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 72 total), 55+ workflow commands, 11 agents, 20+ patterns",
   "main": "src/server.ts",
   "exports": {
     ".": "./src/server.ts",
-    "./adapter": "./src/adapter.ts"
+    "./adapter": {
+      "types": "./dist/adapter.d.ts",
+      "import": "./dist/adapter.js",
+      "default": "./dist/adapter.js"
+    }
   },
   "bin": {
     "massu": "./dist/cli.js"
@@ -14,14 +18,22 @@
   "scripts": {
     "start": "npx tsx src/server.ts",
     "test": "vitest run",
-    "build": "tsc --noEmit && npm run build:cli && npm run build:hooks",
-    "build:cli": "esbuild --bundle --platform=node --format=esm --outfile=dist/cli.js src/cli.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --banner:js='#!/usr/bin/env node\nimport{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
-    "build:hooks": "esbuild --bundle --platform=node --format=esm --outdir=dist/hooks src/hooks/*.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --banner:js='import{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
+    "build": "tsc --noEmit && npm run build:cli && npm run build:hooks && npm run build:adapter-types && npm run build:adapter-subpath && npm run build:bundle-adapters",
+    "build:adapter-types": "tsc -p tsconfig.adapter-types.json",
+    "build:adapter-subpath": "tsx scripts/bundle-adapters.ts --subpath-only",
+    "build:bundle-adapters": "tsx scripts/bundle-adapters.ts",
+    "build:cli": "esbuild --bundle --platform=node --format=esm --outfile=dist/cli.js src/cli.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:@massu/adapter-rails --external:@massu/adapter-phoenix --external:@massu/adapter-aspnet --external:@massu/adapter-spring --external:@massu/adapter-go-chi --banner:js='#!/usr/bin/env node\nimport{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
+    "build:hooks": "esbuild --bundle --platform=node --format=esm --outdir=dist/hooks src/hooks/*.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:@massu/adapter-rails --external:@massu/adapter-phoenix --external:@massu/adapter-aspnet --external:@massu/adapter-spring --external:@massu/adapter-go-chi --banner:js='import{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
     "prepublishOnly": "bash ../../scripts/prepublish-check.sh && node ../../scripts/bundle-pubkey.mjs && npm run build",
     "bench:watch": "tsx test/perf/watch-benchmark.ts"
   },
   "dependencies": {
     "@clack/prompts": "^0.9.1",
+    "@massu/adapter-aspnet": "^1.0.0",
+    "@massu/adapter-go-chi": "^1.0.0",
+    "@massu/adapter-phoenix": "^1.0.0",
+    "@massu/adapter-rails": "^1.0.0",
+    "@massu/adapter-spring": "^1.0.0",
     "better-sqlite3": "^12.6.2",
     "chokidar": "^3.6.0",
     "fast-glob": "^3.3.0",

package/src/adapter.ts

@@ -74,6 +74,37 @@ export {
 
 import type { CodebaseAdapter } from './detect/adapters/types.js';
 
+// ============================================================
+// Plan 3c Phase 9b P-A-001a: runtime helper re-exports.
+//
+// The 5 first-party framework adapters (rails/phoenix/aspnet/spring/go-chi)
+// migrated to `packages/adapter-<f>/src/index.ts` workspace packages need
+// these helpers from `@massu/core/adapter` rather than reaching into
+// `@massu/core` internals (which would couple the workspace package to
+// every transitive .ts file).
+//
+// CR-46: a single SemVer-stable authoring surface. Every export from this
+// file is part of the public adapter API; breaking changes require a
+// major version bump per `massu-adapter-api-version`.
+// ============================================================
+
+// Tree-sitter query helpers (compileQuery is intentionally NOT re-exported —
+// only `runQuery` returns the cooked record shape adapters consume).
+export { runQuery, InvalidQueryError, type RunQueryHit } from './detect/adapters/query-helpers.js';
+
+// Grammar acquisition (runtime: downloads + verifies SHA-256 + caches).
+export { loadGrammar } from './detect/adapters/tree-sitter-loader.js';
+
+// Parse-time safety guards (size cap + nested-depth check).
+export {
+  isParsableSource,
+  MAX_AST_FILE_BYTES,
+  MAX_AST_PARSE_DEPTH,
+  MAX_AST_PARSE_MS,
+  type ParseSkip,
+  type ParseSkipReason,
+} from './detect/adapters/parse-guard.js';
+
 /**
  * Identity factory — narrows the input's type to `CodebaseAdapter` so
  * authors get compile-time checking + IDE autocomplete for missing /

package/src/detect/adapters/aspnet.ts

@@ -1,293 +1,4 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Plan 3c — Phase 7: ASP.NET Core AST adapter.
- *
- * Fifth Phase 7 framework after go-chi + Flask + Rails + Phoenix. First to
- * consume the `csharp` Tree-sitter grammar entry from GRAMMAR_MANIFEST
- * (commit fbb8aa9). All queries verified against actual tree-sitter-c-sharp
- * AST shape via probe (R-011) BEFORE writing the adapter.
- *
- * ASP.NET Core supports two routing styles, both first-class per the
- * official routing guide (https://learn.microsoft.com/aspnet/core/fundamentals/routing):
- *   1. **Minimal API** (recommended for new projects since .NET 6):
- *      `app.MapGet("/path", handler)`, `app.MapPost(...)`, etc. in
- *      Program.cs.
- *   2. **Attribute routing** (MVC controllers): `[HttpGet("{id}")]`,
- *      `[HttpPost]`, `[Route("api/[controller]")]` on controller classes
- *      and methods.
- *
- * The adapter handles BOTH styles uniformly — extracted route_method
- * normalizes `MapGet`/`HttpGet` → `Get`, `MapPost`/`HttpPost` → `Post`,
- * etc. so downstream consumers don't need to know which style produced
- * the signal.
- *
- * Extracts:
- *   - route_method: most-common HTTP verb captured from EITHER `app.Map<Verb>`
- *     invocations (minimal API) OR `[Http<Verb>]` attributes (MVC).
- *   - route_prefix_base: first path segment from EITHER the first `MapGet`
- *     string-literal path arg OR the first class-level `[Route("template")]`
- *     attribute. Mirrors phoenix scope_prefix_base / rails api_namespace.
- *   - controller_class: name of the first class ending in `Controller`
- *     (attribute-routing style only — minimal API has no controllers).
- *     Mirrors python-flask app_factory / phoenix router_module.
- *
- * Confidence rules (mirror phoenix / rails / go-chi):
- *   - 'high'   if exactly ONE distinct route_method seen.
- *   - 'low'    if multiple distinct route_methods seen.
- *   - 'medium' if route_prefix_base or controller_class found but no
- *              route_method.
- *   - 'none'   if no ASP.NET signals at all (regex fallback takes over).
- *
- * Tree-sitter-c-sharp AST shape (verified via probe 2026-05-07):
- *   - Method calls: `(invocation_expression function: (member_access_expression
- *     name: (identifier)) arguments: (argument_list (argument
- *     (string_literal)) ...))`.
- *   - Attributes: `(attribute name: (identifier) (attribute_argument_list
- *     (attribute_argument (string_literal))?))` — argument list is optional
- *     because attributes like `[HttpPost]` have no args.
- *   - Class declarations: `(class_declaration name: (identifier)
- *     bases: (base_list (identifier)?))` — bases optional.
- *
- * Does NOT use regex on file content — only Tree-sitter S-expression queries
- * compiled via query-helpers.ts.
- */
-
-import { Parser } from 'web-tree-sitter';
-import type { CodebaseAdapter, AdapterResult, DetectionSignals, Provenance, SourceFile } from './types.ts';
-import { runQuery, InvalidQueryError } from './query-helpers.ts';
-import { loadGrammar } from './tree-sitter-loader.ts';
-import { isParsableSource, MAX_AST_FILE_BYTES } from './parse-guard.ts';
-
-// ============================================================
-// Tree-sitter S-expression queries (C# grammar)
-// ============================================================
-
-/**
- * Minimal-API verb mapping: `app.MapGet("/path", handler)`,
- * `app.MapPost(...)`, etc. Anchored on the first argument being a
- * string_literal so we capture the route path together with the verb.
- *
- * The captured @method is the full method name like `MapGet` — the
- * adapter strips the `Map` prefix in post-processing.
- *
- * Per ASP.NET Core minimal API docs:
- * https://learn.microsoft.com/aspnet/core/fundamentals/minimal-apis
- */
-const MAP_VERB_QUERY = `
-(invocation_expression
-  function: (member_access_expression
-    name: (identifier) @method (#match? @method "^Map(Get|Post|Put|Patch|Delete|Head|Options)$"))
-  arguments: (argument_list
-    .
-    (argument (string_literal) @route_path)))
-`;
-
-/**
- * Attribute-routing HTTP verb attributes: `[HttpGet]`, `[HttpGet("{id}")]`,
- * `[HttpPost]`, etc. Captures BOTH the parameterless and parameterized
- * forms — the route path may or may not be present.
- *
- * The captured @attr_name is `HttpGet` etc. — the adapter strips the
- * `Http` prefix in post-processing.
- *
- * Per ASP.NET Core attribute routing docs:
- * https://learn.microsoft.com/aspnet/core/mvc/controllers/routing
- */
-const HTTP_ATTR_QUERY = `
-(attribute
-  name: (identifier) @attr_name (#match? @attr_name "^Http(Get|Post|Put|Patch|Delete|Head|Options)$"))
-`;
-
-/**
- * Class-level `[Route("api/[controller]")]` attribute. Captures the
- * route template string so we can extract its first path segment.
- * Tokens like `[controller]` inside the template are kept verbatim —
- * the prefix-base extractor splits on `/` so `api/[controller]` → `/api`.
- */
-const ROUTE_ATTR_QUERY = `
-(attribute
-  name: (identifier) @_attr_name (#eq? @_attr_name "Route")
-  (attribute_argument_list
-    (attribute_argument (string_literal) @route_template)))
-`;
-
-/**
- * Controller class declaration: `class FooController : ControllerBase`.
- * We restrict to class names ending in `Controller` to avoid every class
- * in the project (canonical ASP.NET MVC naming convention).
- */
-const CONTROLLER_CLASS_QUERY = `
-(class_declaration
-  name: (identifier) @class_name (#match? @class_name "Controller$"))
-`;
-
-// ============================================================
-// Adapter
-// ============================================================
-
-export const aspnetAdapter: CodebaseAdapter = {
-  id: 'aspnet',
-  languages: ['csharp'],
-
-  matches(signals: DetectionSignals): boolean {
-    // Cheap signal-only check. No file IO. The canonical ASP.NET Core
-    // declaration is `<Project Sdk="Microsoft.NET.Sdk.Web">` in the .csproj
-    // file (per https://learn.microsoft.com/aspnet/core/fundamentals/target-aspnetcore).
-    // Fallback: presence of `Microsoft.AspNetCore.App` framework reference,
-    // which appears in older .csproj formats.
-    if (!signals.csproj) return false;
-    if (/Sdk\s*=\s*["']Microsoft\.NET\.Sdk\.Web["']/i.test(signals.csproj)) return true;
-    if (/Microsoft\.AspNetCore\.App/i.test(signals.csproj)) return true;
-    return false;
-  },
-
-  async introspect(files: SourceFile[], _rootDir: string): Promise<AdapterResult> {
-    if (files.length === 0) {
-      return { conventions: {}, provenance: [], confidence: 'none' };
-    }
-
-    let language;
-    try {
-      language = await loadGrammar('csharp');
-    } catch (e) {
-      // Grammar unavailable → adapter returns 'none' so regex fallback takes over.
-      return { conventions: {}, provenance: [], confidence: 'none' };
-    }
-
-    const parser = new Parser();
-    parser.setLanguage(language);
-
-    const routeMethods = new Map<string, { line: number; file: string }>();
-    const prefixBases = new Map<string, { line: number; file: string }>();
-    const controllerClasses = new Map<string, { line: number; file: string }>();
-
-    try {
-      for (const file of files) {
-        const skip = isParsableSource(file.content, file.size);
-        if (skip) {
-          process.stderr.write(
-            `[massu/ast] WARN: aspnet skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)\n`,
-          );
-          continue;
-        }
-        try {
-          // Minimal API: app.MapGet("/path", ...)
-          for (const hit of runQuery(parser, file.content, MAP_VERB_QUERY, 'aspnet-map-verb', file.path)) {
-            const methodRaw = hit.captures.method;
-            if (!methodRaw) continue;
-            const verb = methodRaw.replace(/^Map/, ''); // MapGet → Get
-            if (!routeMethods.has(verb)) {
-              routeMethods.set(verb, { line: hit.line, file: file.path });
-            }
-            // Also capture the route path for prefix base
-            const pathRaw = hit.captures.route_path;
-            if (pathRaw) {
-              const literal = pathRaw.replace(/^["']/, '').replace(/["']$/, '');
-              const base = extractPrefixBase(literal);
-              if (base && !prefixBases.has(base)) {
-                prefixBases.set(base, { line: hit.line, file: file.path });
-              }
-            }
-          }
-          // Attribute routing: [HttpGet], [HttpPost], etc.
-          for (const hit of runQuery(parser, file.content, HTTP_ATTR_QUERY, 'aspnet-http-attr', file.path)) {
-            const attrRaw = hit.captures.attr_name;
-            if (!attrRaw) continue;
-            const verb = attrRaw.replace(/^Http/, ''); // HttpGet → Get
-            if (!routeMethods.has(verb)) {
-              routeMethods.set(verb, { line: hit.line, file: file.path });
-            }
-          }
-          // Class-level [Route("api/[controller]")]
-          for (const hit of runQuery(parser, file.content, ROUTE_ATTR_QUERY, 'aspnet-route-attr', file.path)) {
-            const tplRaw = hit.captures.route_template;
-            if (!tplRaw) continue;
-            const literal = tplRaw.replace(/^["']/, '').replace(/["']$/, '');
-            const base = extractPrefixBase(literal);
-            if (base && !prefixBases.has(base)) {
-              prefixBases.set(base, { line: hit.line, file: file.path });
-            }
-          }
-          // Controller class: class FooController : ControllerBase
-          for (const hit of runQuery(parser, file.content, CONTROLLER_CLASS_QUERY, 'aspnet-controller-class', file.path)) {
-            const name = hit.captures.class_name;
-            if (name && !controllerClasses.has(name)) {
-              controllerClasses.set(name, { line: hit.line, file: file.path });
-            }
-          }
-        } catch (e) {
-          if (e instanceof InvalidQueryError) {
-            throw e;
-          }
-          continue;
-        }
-      }
-    } finally {
-      try { parser.delete(); } catch { /* ignore */ }
-    }
-
-    const conventions: Record<string, unknown> = {};
-    const provenance: Provenance[] = [];
-
-    if (routeMethods.size === 1) {
-      const [name, { line, file }] = routeMethods.entries().next().value as [string, { line: number; file: string }];
-      conventions.route_method = name;
-      provenance.push({ field: 'route_method', sourceFile: file, line, query: 'aspnet-map-verb' });
-    } else if (routeMethods.size >= 2) {
-      const [name, { line, file }] = routeMethods.entries().next().value as [string, { line: number; file: string }];
-      conventions.route_method = name;
-      provenance.push({ field: 'route_method', sourceFile: file, line, query: 'aspnet-map-verb' });
-    }
-
-    if (prefixBases.size >= 1) {
-      const [base, { line, file }] = prefixBases.entries().next().value as [string, { line: number; file: string }];
-      conventions.route_prefix_base = base;
-      provenance.push({ field: 'route_prefix_base', sourceFile: file, line, query: 'aspnet-route-prefix' });
-    }
-
-    if (controllerClasses.size >= 1) {
-      const [name, { line, file }] = controllerClasses.entries().next().value as [string, { line: number; file: string }];
-      conventions.controller_class = name;
-      provenance.push({ field: 'controller_class', sourceFile: file, line, query: 'aspnet-controller-class' });
-    }
-
-    let confidence: AdapterResult['confidence'];
-    if (Object.keys(conventions).length === 0) {
-      confidence = 'none';
-    } else if (routeMethods.size === 1) {
-      confidence = 'high';
-    } else if (routeMethods.size >= 2) {
-      confidence = 'low';
-    } else {
-      confidence = 'medium';
-    }
-
-    return { conventions, provenance, confidence };
-  },
-};
-
-// ============================================================
-// Helpers
-// ============================================================
-
-/**
- * Extract the first path segment of an ASP.NET route template. Mirrors
- * phoenix/rails/python-flask/go-chi prefix-base extractors. Returns null
- * if input is empty or `/`-only.
- *
- * Examples (verified against test fixtures):
- *   "/health"             → "/health"
- *   "api/[controller]"    → "/api"
- *   "/api/v1/users"       → "/api"
- *   "/"                   → null
- *   ""                    → null
- */
-function extractPrefixBase(prefix: string): string | null {
-  // ASP.NET route templates may or may not begin with `/`. Normalize.
-  const stripped = prefix.replace(/^\/+/, '');
-  const firstSeg = stripped.split('/')[0];
-  if (!firstSeg) return null;
-  return '/' + firstSeg;
-}
+// Plan 3c Phase 9b P-A-005: re-export shim. Source-of-truth lives at
+// `packages/adapter-aspnet/src/index.ts` (workspace package). This shim
+// preserves the legacy import path used by codebase-introspector + tests.
+export { aspnetAdapter } from '@massu/adapter-aspnet';