@minionry/minion 0.7.36

package/dist/server/mcp/department-profiles.js

@@ -0,0 +1,133 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { matchesPattern } from './security-patterns.js';
+const KNOWN_PROFILE_IDS = new Set([
+    'marketing',
+    'engineering',
+    'sales',
+    'finance',
+    'operations',
+]);
+const MARKETING_SAFE = [
+    { pattern: /^Bash:\s*(lynx|links|w3m|elinks)\s+(?:-[a-zA-Z_]+\s+|--[a-z-]+(?:=\S+)?\s+)*['"]?https?:\/\/[^|;&`$()]*$/i,
+        reason: 'Terminal browser for scraping public pages (marketing)' },
+    { pattern: /^Bash:\s*(pandoc|html2text|readability|trafilatura)\b/i,
+        reason: 'HTML/document content extraction (marketing)' },
+    { pattern: /^Bash:\s*curl\s+(?:-[a-zA-Z]+\s+|--[a-z-]+(?:=\S+)?\s+)*['"]?https:\/\/(api\.twitter\.com|api\.x\.com|graph\.facebook\.com|api\.linkedin\.com|graph\.instagram\.com|www\.googleapis\.com\/youtube|api\.reddit\.com|api\.bsky\.social|api\.mastodon\.social|api\.threads\.net|api\.tiktokv\.com)\/[^|;&`$()]*$/i,
+        reason: 'Social media API read access (marketing)' },
+    { pattern: /^Bash:\s*curl\s+(?:-[a-zA-Z]+\s+|--[a-z-]+(?:=\S+)?\s+)*['"]?https:\/\/(api\.similarweb\.com|serpapi\.com|api\.semrush\.com|api\.ahrefs\.com|newsapi\.org|api\.rss2json\.com|feeds\.|rss\.)[^|;&`$()]*$/i,
+        reason: 'Content / search API read access (marketing)' },
+    { pattern: /^(Write|Edit):\s*.*\/\.minionry\/(?:specs|pm)\/boards\/[^/]+\/(content|campaigns|creative)\//i,
+        reason: 'Marketing content working directory' },
+];
+const MARKETING_DENIED = [
+    { pattern: /^Bash:\s*(node|python[23]?|pipenv|poetry|ruby|rake|php|go\s+run|cargo\s+run|mvn|gradle|bazel|uv\s+run|pnpm\s+(run|exec)|npm\s+(run|exec)|yarn\s+(run|exec))\b/i,
+        reason: 'Marketing board invoking code-execution runtime — verify intent' },
+    { pattern: /\b(docker|podman|kubectl|helm|flyctl|vercel|netlify|terraform|pulumi|ansible|aws)\b/i,
+        reason: 'Marketing board touching deployment / container tooling — verify intent' },
+    { pattern: /^Bash:\s*git\s+(push|commit|merge|rebase|reset|cherry-pick|tag)\b/i,
+        reason: 'Marketing board mutating a Git repository — verify intent' },
+];
+export const MARKETING_PROFILE = {
+    id: 'marketing',
+    label: 'Marketing',
+    safe: MARKETING_SAFE,
+    denied: MARKETING_DENIED,
+};
+const ENGINEERING_SAFE = [
+    { pattern: /^Bash:\s*(node|python[23]?|ruby|php|go)\s+[\w./-]+$/i,
+        reason: 'Script execution via language runtime (engineering)' },
+    { pattern: /^Bash:\s*(pytest|jest|vitest|mocha|cargo\s+test|go\s+test|mvn\s+test|gradle\s+test|pnpm\s+test|npm\s+test|yarn\s+test)\b/i,
+        reason: 'Test runner (engineering)' },
+    { pattern: /^Bash:\s*(npm|pnpm|yarn)\s+(run|exec|ci|install|prune|dedupe|outdated|ls|list)\b/i,
+        reason: 'Node package manager invocation (engineering)' },
+    { pattern: /^Bash:\s*(pip|pipx|uv|poetry|pipenv|cargo|go)\s+(install|add|build|check|fmt|vet|lint|run|test)\b/i,
+        reason: 'Language package manager invocation (engineering)' },
+    { pattern: /^Bash:\s*git\s+(push|tag|worktree|stash|cherry-pick)\b/i,
+        reason: 'Git repository operations (engineering)' },
+    { pattern: /^Bash:\s*docker\s+(build|compose|ps|images|logs|tag|login|inspect)\b/i,
+        reason: 'Container build / inspect (engineering)' },
+    { pattern: /^Bash:\s*(flyctl|vercel|netlify|cloudflare|wrangler)\s+(deploy|status|logs|releases|list|ls|whoami)\b/i,
+        reason: 'Deployment tooling read / deploy (engineering)' },
+    { pattern: /^Bash:\s*kubectl\s+(get|describe|logs|rollout|apply|config|version)\b/i,
+        reason: 'Kubernetes read / rollout (engineering)' },
+    { pattern: /^Bash:\s*(terraform|tofu|pulumi)\s+(plan|apply|show|state\s+list|validate|fmt)\b/i,
+        reason: 'IaC plan / apply (engineering)' },
+];
+const ENGINEERING_DENIED = [
+    { pattern: /\b(api\.hubapi\.com|api\.mailchimp\.com|api\.sendgrid\.com|api\.mailgun\.net|api\.intercom\.io|api\.marketo\.com|api\.salesforce\.com\/services\/data.*\/Lead)/i,
+        reason: 'Engineering board calling marketing-automation API — verify intent' },
+    { pattern: /\b(api\.twitter\.com|api\.x\.com|graph\.facebook\.com|api\.linkedin\.com|graph\.instagram\.com)\b/i,
+        reason: 'Engineering board calling social-platform API — verify intent' },
+];
+export const ENGINEERING_PROFILE = {
+    id: 'engineering',
+    label: 'Engineering',
+    safe: ENGINEERING_SAFE,
+    denied: ENGINEERING_DENIED,
+};
+export const SALES_PROFILE = {
+    id: 'sales',
+    label: 'Sales',
+    safe: [
+        { pattern: /^Bash:\s*curl\s+(?:-[a-zA-Z]+\s+|--[a-z-]+(?:=\S+)?\s+)*['"]?https:\/\/[a-z0-9.-]*\.(my\.salesforce\.com|hubapi\.com|pipedrive\.com|zendesk\.com)\/[^|;&`$()]*$/i,
+            reason: 'CRM API read access (sales)' },
+    ],
+    denied: [
+        { pattern: /^Bash:\s*(node|python[23]?|pipenv|poetry|ruby|rake|php|go\s+run|cargo\s+run|uv\s+run)\b/i,
+            reason: 'Sales board invoking code-execution runtime — verify intent' },
+        { pattern: /\b(docker|podman|kubectl|helm|flyctl|terraform)\b/i,
+            reason: 'Sales board touching deployment / container tooling — verify intent' },
+    ],
+};
+export const FINANCE_PROFILE = {
+    id: 'finance',
+    label: 'Finance',
+    safe: [
+        { pattern: /^Bash:\s*curl\s+(?:-[a-zA-Z]+\s+|--[a-z-]+(?:=\S+)?\s+)*['"]?https:\/\/(?:api\.stripe\.com\/v1\/(?:charges|balance|reports)|api\.plaid\.com|api\.xero\.com|api\.quickbooks\.intuit\.com)\b[^|;&`$()]*$/i,
+            reason: 'Finance read API access (finance)' },
+    ],
+    denied: [
+        { pattern: /\b(docker|podman|kubectl|helm|flyctl|terraform)\b/i,
+            reason: 'Finance board touching deployment tooling — verify intent' },
+        { pattern: /^Bash:\s*curl\s+(?:-[a-zA-Z]+\s+|--[a-z-]+(?:=\S+)?\s+)*['"]?https:\/\/api\.stripe\.com\/v1\/(transfers|payouts|refunds)\b/i,
+            reason: 'Finance board invoking money-moving Stripe endpoint — verify intent' },
+    ],
+};
+export const OPERATIONS_PROFILE = {
+    id: 'operations',
+    label: 'Operations',
+    safe: [],
+    denied: [],
+};
+export const DEPARTMENT_PROFILES = Object.freeze({
+    marketing: MARKETING_PROFILE,
+    engineering: ENGINEERING_PROFILE,
+    sales: SALES_PROFILE,
+    finance: FINANCE_PROFILE,
+    operations: OPERATIONS_PROFILE,
+});
+export function isDepartmentProfileId(value) {
+    return typeof value === 'string' && KNOWN_PROFILE_IDS.has(value);
+}
+export function getActiveDepartmentProfile() {
+    const raw = process.env.BOUNCER_DEPARTMENT_PROFILE;
+    if (!isDepartmentProfileId(raw))
+        return null;
+    return DEPARTMENT_PROFILES[raw];
+}
+export function getDepartmentProfile(id) {
+    if (!isDepartmentProfileId(id))
+        return null;
+    return DEPARTMENT_PROFILES[id];
+}
+export function departmentAllows(operation, profile) {
+    if (!profile)
+        return null;
+    return matchesPattern(operation, profile.safe);
+}
+export function departmentDenies(operation, profile) {
+    if (!profile)
+        return null;
+    return matchesPattern(operation, profile.denied);
+}

package/dist/server/mcp/quality-bridge.js

@@ -0,0 +1,153 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, statSync } from 'node:fs';
+import { extname, relative, resolve } from 'node:path';
+import { getPersistence } from '../services/websocket/quality-handlers.js';
+import { QualityPersistence } from '../services/websocket/quality-persistence.js';
+import { applyListCap, indexDismissals, isActiveFinding, runQualityScan } from '../services/websocket/quality-service.js';
+import { attributeToTrackedDirectories, detectEcosystem } from '../services/websocket/quality-tools.js';
+import { SOURCE_EXTENSIONS } from '../services/websocket/quality-types.js';
+export const QUALITY_MCP_SERVER_NAME = 'minionry-quality';
+export const QUALITY_CHECK_TOOL_NAME = 'quality_check_files';
+export const QUALITY_CHECK_MAX_FINDINGS = 50;
+function failure(code, message) {
+    return { ok: false, code, message };
+}
+export function parseQualityCheckPaths(input) {
+    const raw = input && typeof input === 'object' && !Array.isArray(input) ? input.paths : undefined;
+    if (!Array.isArray(raw) || raw.length === 0) {
+        return failure('BAD_REQUEST', `'paths' must be a non-empty array of file paths relative to the working directory`);
+    }
+    const paths = [];
+    for (const entry of raw) {
+        if (typeof entry !== 'string' || entry.trim() === '') {
+            return failure('BAD_REQUEST', `'paths' must contain only non-empty strings`);
+        }
+        if (!paths.includes(entry))
+            paths.push(entry);
+    }
+    return { ok: true, paths };
+}
+function isInside(dir, path) {
+    return path === dir || path.startsWith(`${dir}/`);
+}
+function uncheckableReason(absolute) {
+    if (!existsSync(absolute))
+        return 'no such file';
+    try {
+        if (!statSync(absolute).isFile())
+            return 'not a file';
+    }
+    catch {
+        return 'not readable';
+    }
+    const ext = extname(absolute).toLowerCase();
+    if (!SOURCE_EXTENSIONS.has(ext)) {
+        return `not a source file the analyzers read (${ext || 'no extension'})`;
+    }
+    return null;
+}
+function noEcosystemReason(dirPath) {
+    const where = dirPath === '.' ? 'the working directory' : `'${dirPath}'`;
+    return `no ecosystem detected in ${where} — no package.json, pyproject.toml, setup.py, requirements.txt, Cargo.toml, go.mod, Package.swift or build.gradle there, so no analyzer can run on it`;
+}
+function trackedDirectories(root) {
+    return QualityPersistence.isSetUp(root) ? getPersistence(root).loadConfig() : [];
+}
+const inFlight = new Set();
+export function _resetQualityChecksForTests() {
+    inFlight.clear();
+}
+export async function runQualityCheck(args) {
+    const root = resolve(args.spaceRoot);
+    const absoluteOf = new Map();
+    for (const path of args.paths) {
+        const absolute = resolve(root, path);
+        if (!isInside(root, absolute)) {
+            return failure('PATH_OUTSIDE_SPACE', `'${path}' is outside the working directory — only files inside it can be checked`);
+        }
+        absoluteOf.set(path, absolute);
+    }
+    if (inFlight.has(args.sessionKey)) {
+        return failure('CHECK_IN_PROGRESS', 'a quality check is already running for this session — wait for it to finish, then retry');
+    }
+    inFlight.add(args.sessionKey);
+    try {
+        return await checkFiles(root, absoluteOf);
+    }
+    finally {
+        inFlight.delete(args.sessionKey);
+    }
+}
+async function checkFiles(root, absoluteOf) {
+    const checked = [];
+    const unchecked = [];
+    const given = new Map();
+    for (const [path, absolute] of absoluteOf) {
+        const reason = uncheckableReason(absolute);
+        if (reason)
+            unchecked.push({ path, reason });
+        else
+            given.set(absolute, path);
+    }
+    const attributed = attributeToTrackedDirectories(root, trackedDirectories(root), [...given.keys()]);
+    const active = [];
+    const pathOf = new Map();
+    for (const { path: dirPath, files } of attributed) {
+        const dir = resolve(root, dirPath);
+        const callerPaths = files.map((file) => given.get(resolve(dir, file)) ?? file);
+        const outcome = await checkDirectory(root, dirPath, dir, files);
+        if (!outcome.checked) {
+            for (const path of callerPaths)
+                unchecked.push({ path, reason: outcome.reason });
+            continue;
+        }
+        checked.push(...callerPaths);
+        for (const f of outcome.findings) {
+            pathOf.set(f, relative(root, resolve(dir, f.file)));
+            active.push(f);
+        }
+    }
+    const listed = applyListCap(active, QUALITY_CHECK_MAX_FINDINGS);
+    return {
+        ok: true,
+        findings: listed.map((f) => toCheckFinding(f, pathOf.get(f) ?? f.file)),
+        truncated: active.length > listed.length,
+        checked,
+        unchecked,
+    };
+}
+async function checkDirectory(root, dirPath, dir, files) {
+    if (detectEcosystem(dir).every((eco) => eco === 'unknown')) {
+        return { checked: false, reason: noEcosystemReason(dirPath) };
+    }
+    try {
+        return { checked: true, findings: (await scanDirectory(root, dirPath, dir, files)).filter(isActiveFinding) };
+    }
+    catch (error) {
+        return { checked: false, reason: `scan failed: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+async function scanDirectory(root, dirPath, dir, files) {
+    if (!QualityPersistence.isSetUp(root)) {
+        return (await runQualityScan(dir, { files })).findings;
+    }
+    const persistence = getPersistence(root);
+    const results = await runQualityScan(dir, {
+        files,
+        baseline: persistence.loadBaseline(dirPath),
+        dismissals: indexDismissals(dirPath, persistence.loadSuppressionsFor(dirPath)),
+    });
+    return results.findings;
+}
+function toCheckFinding(f, path) {
+    return {
+        severity: f.severity,
+        category: f.category,
+        path,
+        line: f.line,
+        title: f.title,
+        ...(f.suggestion ? { suggestion: f.suggestion } : {}),
+        ...(f.introduced !== undefined ? { introduced: f.introduced } : {}),
+    };
+}

package/dist/server/mcp/quality-mcp-server.js

@@ -0,0 +1,105 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { Agent } from 'undici';
+export const QUALITY_MCP_SERVER_NAME = 'minionry-quality';
+export const QUALITY_CHECK_TOOL_NAME = 'quality_check_files';
+export const QUALITY_CHECK_TOOL = {
+    name: QUALITY_CHECK_TOOL_NAME,
+    description: "Run Minionry's quality checks (build, lint, format, complexity, length, duplication, secrets) on specific source files and list the active findings — severity, category, path, line, title, suggestion, and whether each is new since the directory's last full scan. " +
+        'Read-only: persists nothing and updates no report. Use it after editing files to see what the next scan would flag. ' +
+        'Paths are relative to the working directory; a path outside it is rejected, and a file no analyzer can run on is returned as unchecked with the reason. At most 50 findings are listed (`truncated` says whether more exist). One check runs at a time per session.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            paths: {
+                type: 'array',
+                items: { type: 'string' },
+                minItems: 1,
+                description: 'Source files to check, relative to the working directory (e.g. "src/app.ts").',
+            },
+        },
+        required: ['paths'],
+        additionalProperties: false,
+    },
+};
+const dispatcher = new Agent({ headersTimeout: 0, bodyTimeout: 0 });
+const server = new Server({ name: QUALITY_MCP_SERVER_NAME, version: '1.0.0' }, { capabilities: { tools: {} } });
+function readEnv() {
+    const port = process.env.MINIONRY_PORT;
+    const secret = process.env.MINIONRY_BOUNCER_SECRET;
+    const capabilityToken = process.env.MINIONRY_CAPABILITY_TOKEN;
+    if (!port || !secret || !capabilityToken)
+        return null;
+    return { port, secret, capabilityToken };
+}
+async function post(env, body) {
+    const options = {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            'x-minionry-bouncer-secret': env.secret,
+            'x-minionry-capability-token': env.capabilityToken,
+        },
+        body: JSON.stringify(body),
+    };
+    options.dispatcher = dispatcher;
+    const res = await fetch(`http://127.0.0.1:${env.port}/internal/quality/check`, options);
+    if (!res.ok) {
+        throw new Error(`/internal/quality/check returned ${res.status}`);
+    }
+    return res.json();
+}
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [QUALITY_CHECK_TOOL] }));
+function toMcpResult(outcome) {
+    if (outcome.ok) {
+        return { content: [{ type: 'text', text: JSON.stringify(outcome) }] };
+    }
+    return {
+        content: [{ type: 'text', text: `${outcome.code}: ${outcome.message}` }],
+        isError: true,
+    };
+}
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const name = request.params.name;
+    if (name !== QUALITY_CHECK_TOOL_NAME) {
+        return toMcpResult({ ok: false, code: 'UNKNOWN_TOOL', message: `'${name}' is not a tool this server provides` });
+    }
+    const env = readEnv();
+    if (!env) {
+        return toMcpResult({
+            ok: false,
+            code: 'QUALITY_UNAVAILABLE',
+            message: `'${name}' cannot be called: this session has no quality routing context`,
+        });
+    }
+    const input = (request.params.arguments ?? {});
+    try {
+        const outcome = (await post(env, { paths: input.paths }));
+        return toMcpResult(outcome);
+    }
+    catch (err) {
+        return toMcpResult({
+            ok: false,
+            code: 'QUALITY_UNAVAILABLE',
+            message: `'${name}' could not be delivered: ${err instanceof Error ? err.message : String(err)}`,
+        });
+    }
+});
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error('[MCP Quality] Server started and ready');
+}
+const isMain = typeof process !== 'undefined' &&
+    Array.isArray(process.argv) &&
+    process.argv[1] &&
+    /quality-mcp-server\.(t|j)s$/.test(process.argv[1]);
+if (isMain) {
+    main().catch((error) => {
+        console.error('[MCP Quality] Fatal error:', error);
+        process.exit(1);
+    });
+}