@neuroverseos/governance 0.3.1 → 0.3.4

package/dist/chunk-B6OXJLJ5.js

@@ -0,0 +1,622 @@
+import {
+  describeActiveWorld,
+  resolveWorldPath
+} from "./chunk-AKW5YVCE.js";
+import {
+  evaluateGuard
+} from "./chunk-W7LLXRGY.js";
+import {
+  advancePlan,
+  evaluatePlan,
+  getPlanProgress
+} from "./chunk-QLPTHTVB.js";
+import {
+  loadWorld
+} from "./chunk-CTZHONLA.js";
+
+// src/runtime/mcp-server.ts
+import { execSync } from "child_process";
+import { readFileSync, writeFileSync, readdirSync, statSync } from "fs";
+import { join, resolve } from "path";
+var GOVERNED_TOOLS = [
+  {
+    name: "governed_shell",
+    description: "Execute a shell command. This command is evaluated against governance rules before execution.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        command: { type: "string", description: "The shell command to execute" }
+      },
+      required: ["command"]
+    }
+  },
+  {
+    name: "governed_read_file",
+    description: "Read a file. This action is evaluated against governance rules before execution.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "File path to read" }
+      },
+      required: ["path"]
+    }
+  },
+  {
+    name: "governed_write_file",
+    description: "Write content to a file. This action is evaluated against governance rules before execution.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "File path to write" },
+        content: { type: "string", description: "Content to write" }
+      },
+      required: ["path", "content"]
+    }
+  },
+  {
+    name: "governed_list_directory",
+    description: "List files in a directory. This action is evaluated against governance rules.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "Directory path to list" }
+      },
+      required: ["path"]
+    }
+  },
+  {
+    name: "governed_http_request",
+    description: "Make an HTTP request. This action is evaluated against governance rules before execution.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        url: { type: "string", description: "URL to request" },
+        method: { type: "string", description: "HTTP method (GET, POST, PUT, DELETE)", default: "GET" },
+        body: { type: "string", description: "Request body (for POST/PUT)" },
+        headers: { type: "object", description: "Request headers" }
+      },
+      required: ["url"]
+    }
+  },
+  // Governance introspection tools — always available
+  {
+    name: "governance_check",
+    description: "Check if an action would be allowed by governance rules without executing it.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        intent: { type: "string", description: "What the action intends to do" },
+        tool: { type: "string", description: "Tool name (shell, http, file, etc.)" },
+        scope: { type: "string", description: "Scope (file path, URL, etc.)" }
+      },
+      required: ["intent"]
+    }
+  },
+  {
+    name: "governance_plan_status",
+    description: "Show current plan progress and remaining steps.",
+    inputSchema: {
+      type: "object",
+      properties: {}
+    }
+  },
+  {
+    name: "governance_plan_advance",
+    description: "Mark a plan step as completed.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        step_id: { type: "string", description: "ID of the step to mark as completed" }
+      },
+      required: ["step_id"]
+    }
+  }
+];
+function executeShell(command, workingDir) {
+  try {
+    const result = execSync(command, {
+      cwd: workingDir,
+      encoding: "utf-8",
+      timeout: 3e4,
+      maxBuffer: 1024 * 1024
+    });
+    return result;
+  } catch (err) {
+    return `Error: ${err.message}
+${err.stderr ?? ""}`;
+  }
+}
+function executeReadFile(path, workingDir) {
+  const fullPath = resolve(workingDir ?? ".", path);
+  return readFileSync(fullPath, "utf-8");
+}
+function executeWriteFile(path, content, workingDir) {
+  const fullPath = resolve(workingDir ?? ".", path);
+  writeFileSync(fullPath, content);
+  return `File written: ${fullPath}`;
+}
+function executeListDir(path, workingDir) {
+  const fullPath = resolve(workingDir ?? ".", path);
+  const entries = readdirSync(fullPath);
+  return entries.map((e) => {
+    try {
+      const stat = statSync(join(fullPath, e));
+      return `${stat.isDirectory() ? "d" : "-"} ${e}`;
+    } catch {
+      return `? ${e}`;
+    }
+  }).join("\n");
+}
+async function executeHttpRequest(url, method, body, headers) {
+  const response = await fetch(url, {
+    method: method || "GET",
+    body: body || void 0,
+    headers: { "Content-Type": "application/json", ...headers }
+  });
+  const text = await response.text();
+  return `HTTP ${response.status}
+${text}`;
+}
+var McpGovernanceServer = class {
+  world;
+  plan;
+  config;
+  engineOptions;
+  initialized = false;
+  // Stats
+  actionsEvaluated = 0;
+  actionsAllowed = 0;
+  actionsBlocked = 0;
+  constructor(config) {
+    this.config = config;
+    this.plan = config.plan;
+    this.engineOptions = {
+      trace: config.trace ?? false,
+      level: config.level,
+      plan: this.plan
+    };
+  }
+  /**
+   * Start the MCP server — reads JSON-RPC from stdin, writes to stdout.
+   */
+  async start() {
+    if (this.config.worldPath) {
+      this.world = await loadWorld(this.config.worldPath);
+    } else if (this.config.world) {
+      this.world = this.config.world;
+    } else {
+      throw new Error("No world provided");
+    }
+    if (this.config.planPath && !this.plan) {
+      this.plan = JSON.parse(readFileSync(this.config.planPath, "utf-8"));
+      this.engineOptions.plan = this.plan;
+    }
+    process.stderr.write(`[neuroverse-mcp] Server starting
+`);
+    process.stderr.write(`[neuroverse-mcp] World: ${this.world.world.name}
+`);
+    if (this.plan) {
+      process.stderr.write(`[neuroverse-mcp] Plan: ${this.plan.plan_id}
+`);
+    }
+    let buffer = "";
+    const MAX_BUFFER_SIZE = 10 * 1024 * 1024;
+    const MAX_CONTENT_LENGTH = 10 * 1024 * 1024;
+    process.stdin.setEncoding("utf-8");
+    process.stdin.on("data", (chunk) => {
+      buffer += chunk;
+      if (buffer.length > MAX_BUFFER_SIZE) {
+        process.stderr.write(`[neuroverse-mcp] Buffer exceeded ${MAX_BUFFER_SIZE} bytes, dropping.
+`);
+        buffer = "";
+        return;
+      }
+      while (buffer.length > 0) {
+        const headerEnd = buffer.indexOf("\r\n\r\n");
+        if (headerEnd === -1) break;
+        const header = buffer.slice(0, headerEnd);
+        const contentLengthMatch = header.match(/Content-Length:\s*(\d+)/i);
+        if (!contentLengthMatch) {
+          const newlineIdx = buffer.indexOf("\n");
+          if (newlineIdx === -1) break;
+          const line = buffer.slice(0, newlineIdx).trim();
+          buffer = buffer.slice(newlineIdx + 1);
+          if (line) this.handleRawLine(line);
+          continue;
+        }
+        const contentLength = parseInt(contentLengthMatch[1], 10);
+        if (isNaN(contentLength) || contentLength < 0 || contentLength > MAX_CONTENT_LENGTH) {
+          process.stderr.write(`[neuroverse-mcp] Invalid Content-Length: ${contentLengthMatch[1]}, skipping.
+`);
+          buffer = "";
+          break;
+        }
+        const bodyStart = headerEnd + 4;
+        const bodyEnd = bodyStart + contentLength;
+        if (buffer.length < bodyEnd) break;
+        const body = buffer.slice(bodyStart, bodyEnd);
+        buffer = buffer.slice(bodyEnd);
+        this.handleRawLine(body);
+      }
+    });
+    process.stdin.on("end", () => {
+      process.stderr.write(
+        `[neuroverse-mcp] Server stopped. Evaluated: ${this.actionsEvaluated}, Allowed: ${this.actionsAllowed}, Blocked: ${this.actionsBlocked}
+`
+      );
+    });
+    await new Promise(() => {
+    });
+  }
+  handleRawLine(line) {
+    try {
+      const msg = JSON.parse(line);
+      if (msg.method) {
+        if (msg.id !== void 0) {
+          this.handleRequest(msg);
+        } else {
+          this.handleNotification(msg);
+        }
+      }
+    } catch (err) {
+      process.stderr.write(`[neuroverse-mcp] Parse error: ${err}
+`);
+    }
+  }
+  send(msg) {
+    const json = JSON.stringify(msg);
+    const header = `Content-Length: ${Buffer.byteLength(json)}\r
+\r
+`;
+    process.stdout.write(header + json);
+  }
+  sendResult(id, result) {
+    this.send({ jsonrpc: "2.0", id, result });
+  }
+  sendError(id, code, message) {
+    this.send({ jsonrpc: "2.0", id, error: { code, message } });
+  }
+  // ─── Request Handlers ───────────────────────────────────────────────────
+  handleRequest(request) {
+    switch (request.method) {
+      case "initialize":
+        this.handleInitialize(request);
+        break;
+      case "tools/list":
+        this.handleToolsList(request);
+        break;
+      case "tools/call":
+        this.handleToolsCall(request);
+        break;
+      case "ping":
+        this.sendResult(request.id, {});
+        break;
+      default:
+        this.sendError(request.id, -32601, `Method not found: ${request.method}`);
+    }
+  }
+  handleNotification(notification) {
+    switch (notification.method) {
+      case "notifications/initialized":
+        this.initialized = true;
+        process.stderr.write(`[neuroverse-mcp] Client initialized
+`);
+        break;
+      case "notifications/cancelled":
+        break;
+      default:
+        process.stderr.write(`[neuroverse-mcp] Unknown notification: ${notification.method}
+`);
+    }
+  }
+  handleInitialize(request) {
+    this.sendResult(request.id, {
+      protocolVersion: "2024-11-05",
+      capabilities: {
+        tools: {}
+      },
+      serverInfo: {
+        name: "neuroverse-governance",
+        version: "0.2.0"
+      }
+    });
+  }
+  handleToolsList(request) {
+    const tools = [];
+    if (this.config.enableShell !== false) {
+      tools.push(GOVERNED_TOOLS.find((t) => t.name === "governed_shell"));
+    }
+    if (this.config.enableFiles !== false) {
+      tools.push(GOVERNED_TOOLS.find((t) => t.name === "governed_read_file"));
+      tools.push(GOVERNED_TOOLS.find((t) => t.name === "governed_write_file"));
+      tools.push(GOVERNED_TOOLS.find((t) => t.name === "governed_list_directory"));
+    }
+    if (this.config.enableHttp !== false) {
+      tools.push(GOVERNED_TOOLS.find((t) => t.name === "governed_http_request"));
+    }
+    tools.push(GOVERNED_TOOLS.find((t) => t.name === "governance_check"));
+    tools.push(GOVERNED_TOOLS.find((t) => t.name === "governance_plan_status"));
+    if (this.plan) {
+      tools.push(GOVERNED_TOOLS.find((t) => t.name === "governance_plan_advance"));
+    }
+    this.sendResult(request.id, { tools });
+  }
+  async handleToolsCall(request) {
+    const params = request.params;
+    const toolName = params.name;
+    const args = params.arguments ?? {};
+    try {
+      const result = await this.executeTool(toolName, args);
+      this.sendResult(request.id, result);
+    } catch (err) {
+      this.sendResult(request.id, {
+        content: [{ type: "text", text: `Error: ${err.message}` }],
+        isError: true
+      });
+    }
+  }
+  // ─── Tool Execution with Governance ─────────────────────────────────────
+  async executeTool(name, args) {
+    if (name === "governance_check") {
+      return this.toolGovernanceCheck(args);
+    }
+    if (name === "governance_plan_status") {
+      return this.toolPlanStatus();
+    }
+    if (name === "governance_plan_advance") {
+      return this.toolPlanAdvance(args);
+    }
+    const event = this.buildEvent(name, args);
+    this.engineOptions.plan = this.plan;
+    const verdict = evaluateGuard(event, this.world, this.engineOptions);
+    this.actionsEvaluated++;
+    if (verdict.status === "BLOCK") {
+      this.actionsBlocked++;
+      let reason = `[GOVERNANCE BLOCKED] ${verdict.reason ?? "Action blocked by governance rules."}`;
+      if (verdict.ruleId) reason += ` (Rule: ${verdict.ruleId})`;
+      if (verdict.trace?.planCheck && !verdict.trace.planCheck.matched) {
+        const pc = verdict.trace.planCheck;
+        if (pc.closestStepLabel) {
+          reason += `
+Closest plan step: "${pc.closestStepLabel}"`;
+        }
+      }
+      process.stderr.write(`[neuroverse-mcp] BLOCKED: ${event.intent}
+`);
+      return { content: [{ type: "text", text: reason }], isError: true };
+    }
+    if (verdict.status === "PAUSE") {
+      this.actionsBlocked++;
+      const reason = `[GOVERNANCE PAUSED] ${verdict.reason ?? "Action requires human approval."}`;
+      process.stderr.write(`[neuroverse-mcp] PAUSED: ${event.intent}
+`);
+      return { content: [{ type: "text", text: reason }], isError: true };
+    }
+    this.actionsAllowed++;
+    process.stderr.write(`[neuroverse-mcp] ALLOWED: ${event.intent}
+`);
+    const result = await this.executeActualTool(name, args);
+    if (this.plan) {
+      const planVerdict = evaluatePlan(event, this.plan);
+      if (planVerdict.matchedStep) {
+        const advResult = advancePlan(this.plan, planVerdict.matchedStep);
+        if (advResult.success && advResult.plan) {
+          this.plan = advResult.plan;
+          this.engineOptions.plan = this.plan;
+        }
+        const progress = getPlanProgress(this.plan);
+        process.stderr.write(
+          `[neuroverse-mcp] Plan: ${progress.completed}/${progress.total} (${progress.percentage}%)
+`
+        );
+        if (progress.completed === progress.total) {
+          process.stderr.write(`[neuroverse-mcp] Plan complete!
+`);
+        }
+      }
+    }
+    return result;
+  }
+  buildEvent(toolName, args) {
+    switch (toolName) {
+      case "governed_shell":
+        return {
+          intent: `execute shell command: ${args.command}`,
+          tool: "shell",
+          scope: String(args.command ?? ""),
+          actionCategory: "shell",
+          args,
+          direction: "input"
+        };
+      case "governed_read_file":
+        return {
+          intent: `read file: ${args.path}`,
+          tool: "fs",
+          scope: String(args.path ?? ""),
+          actionCategory: "read",
+          args,
+          direction: "input"
+        };
+      case "governed_write_file":
+        return {
+          intent: `write file: ${args.path}`,
+          tool: "fs",
+          scope: String(args.path ?? ""),
+          actionCategory: "write",
+          args,
+          direction: "input"
+        };
+      case "governed_list_directory":
+        return {
+          intent: `list directory: ${args.path}`,
+          tool: "fs",
+          scope: String(args.path ?? ""),
+          actionCategory: "read",
+          args,
+          direction: "input"
+        };
+      case "governed_http_request":
+        return {
+          intent: `http ${args.method ?? "GET"} ${args.url}`,
+          tool: "http",
+          scope: String(args.url ?? ""),
+          actionCategory: "network",
+          args,
+          direction: "input"
+        };
+      default:
+        return {
+          intent: `${toolName}: ${JSON.stringify(args)}`,
+          tool: toolName,
+          args,
+          direction: "input"
+        };
+    }
+  }
+  async executeActualTool(name, args) {
+    const workingDir = this.config.workingDir;
+    switch (name) {
+      case "governed_shell": {
+        const output = executeShell(String(args.command), workingDir);
+        return { content: [{ type: "text", text: output }] };
+      }
+      case "governed_read_file": {
+        const content = executeReadFile(String(args.path), workingDir);
+        return { content: [{ type: "text", text: content }] };
+      }
+      case "governed_write_file": {
+        const result = executeWriteFile(String(args.path), String(args.content), workingDir);
+        return { content: [{ type: "text", text: result }] };
+      }
+      case "governed_list_directory": {
+        const listing = executeListDir(String(args.path), workingDir);
+        return { content: [{ type: "text", text: listing }] };
+      }
+      case "governed_http_request": {
+        const result = await executeHttpRequest(
+          String(args.url),
+          String(args.method ?? "GET"),
+          args.body,
+          args.headers
+        );
+        return { content: [{ type: "text", text: result }] };
+      }
+      default:
+        return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
+    }
+  }
+  // ─── Governance Introspection Tools ─────────────────────────────────────
+  toolGovernanceCheck(args) {
+    const event = {
+      intent: String(args.intent ?? ""),
+      tool: args.tool,
+      scope: args.scope,
+      direction: "input"
+    };
+    this.engineOptions.plan = this.plan;
+    const verdict = evaluateGuard(event, this.world, this.engineOptions);
+    const lines = [
+      `Verdict: ${verdict.status}`,
+      verdict.reason ? `Reason: ${verdict.reason}` : null,
+      verdict.ruleId ? `Rule: ${verdict.ruleId}` : null,
+      verdict.warning ? `Warning: ${verdict.warning}` : null
+    ].filter(Boolean).join("\n");
+    return { content: [{ type: "text", text: lines }] };
+  }
+  toolPlanStatus() {
+    if (!this.plan) {
+      return { content: [{ type: "text", text: "No active plan." }] };
+    }
+    const progress = getPlanProgress(this.plan);
+    const lines = [
+      `Plan: ${this.plan.plan_id}`,
+      `Objective: ${this.plan.objective}`,
+      `Progress: ${progress.completed}/${progress.total} (${progress.percentage}%)`,
+      "",
+      "Steps:",
+      ...this.plan.steps.map((s) => {
+        const icon = s.status === "completed" ? "[x]" : s.status === "active" ? "[>]" : "[ ]";
+        return `  ${icon} ${s.label} (${s.id})`;
+      })
+    ];
+    if (this.plan.constraints.length > 0) {
+      lines.push("", "Constraints:");
+      for (const c of this.plan.constraints) {
+        lines.push(`  - ${c.description} [${c.type}]`);
+      }
+    }
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+  }
+  toolPlanAdvance(args) {
+    if (!this.plan) {
+      return { content: [{ type: "text", text: "No active plan." }], isError: true };
+    }
+    const stepId = String(args.step_id ?? "");
+    const step = this.plan.steps.find((s) => s.id === stepId);
+    if (!step) {
+      const ids = this.plan.steps.map((s) => s.id).join(", ");
+      return {
+        content: [{ type: "text", text: `Step "${stepId}" not found. Available: ${ids}` }],
+        isError: true
+      };
+    }
+    if (step.status === "completed") {
+      return { content: [{ type: "text", text: `Step "${stepId}" is already completed.` }] };
+    }
+    const advResult = advancePlan(this.plan, stepId);
+    if (!advResult.success) {
+      return { content: [{ type: "text", text: `Cannot advance: ${advResult.reason}` }] };
+    }
+    this.plan = advResult.plan;
+    this.engineOptions.plan = this.plan;
+    const progress = getPlanProgress(this.plan);
+    let text = `Step completed: ${step.label}
+Progress: ${progress.completed}/${progress.total} (${progress.percentage}%)`;
+    if (progress.completed === progress.total) {
+      text += "\n\nPlan complete!";
+    }
+    if (this.config.planPath) {
+      writeFileSync(this.config.planPath, JSON.stringify(this.plan, null, 2) + "\n");
+    }
+    return { content: [{ type: "text", text }] };
+  }
+};
+async function startMcpServer(args) {
+  function parseArg(flag) {
+    const idx = args.indexOf(flag);
+    return idx >= 0 && idx + 1 < args.length ? args[idx + 1] : void 0;
+  }
+  const worldPath = resolveWorldPath(parseArg("--world"));
+  const planPath = parseArg("--plan");
+  const level = parseArg("--level");
+  const trace = args.includes("--trace");
+  const workingDir = parseArg("--cwd");
+  if (!worldPath) {
+    process.stderr.write(
+      "Error: No world found.\nUse --world <path>, set NEUROVERSE_WORLD, or run `neuroverse world use <name>`\n"
+    );
+    process.exit(1);
+    return;
+  }
+  const worldInfo = describeActiveWorld(parseArg("--world"));
+  if (worldInfo) {
+    process.stderr.write(`Using world: ${worldInfo.name}
+`);
+  }
+  const server = new McpGovernanceServer({
+    worldPath,
+    planPath,
+    level,
+    trace,
+    workingDir,
+    enableShell: !args.includes("--no-shell"),
+    enableFiles: !args.includes("--no-files"),
+    enableHttp: !args.includes("--no-http")
+  });
+  await server.start();
+}
+
+export {
+  McpGovernanceServer,
+  startMcpServer
+};