@optitransfer/proofline 0.0.0-stage → 0.2.0-next.0

package/src/mcp.mjs

@@ -0,0 +1,55 @@
+// Minimal MCP server (JSON-RPC 2.0 over newline-delimited stdio). Zero dependencies.
+import readline from 'node:readline';
+import * as P from './index.mjs';
+
+const BASE = { type: 'string', description: 'The revision the task started from. Needed in a fresh clone unless task_next pinned it or HEAD carries a Proofline-Base: trailer.' };
+const FRESH = { type: 'boolean', description: 'Run every check again, ignoring results reused under defaults.reuse_results.' };
+const OWNER = { type: 'string', description: "Only this owner's tasks and unowned ones; never another owner's." };
+const TOOLS = [
+  { name: 'contract_create', description: 'Add a task contract (id, title, phase, depends_on, scope, criteria with deterministic verifiers). Returns validity problems; a task without verifiers cannot pass.', inputSchema: { type: 'object', properties: { task: { type: 'object' } }, required: ['task'] } },
+  { name: 'task_next', description: 'Return the single next task (phase- and dependency-gated) with its full brief. Call this before starting any work.', inputSchema: { type: 'object', properties: { owner: OWNER } } },
+  { name: 'evidence_record', description: 'Record agent-side evidence (notes, commands you ran). Stored hash-chained, but never used to pass a gate: verify re-runs everything itself.', inputSchema: { type: 'object', properties: { type: { type: 'string' }, data: { type: 'object' } }, required: ['type'] } },
+  { name: 'verify', description: 'Independently run every acceptance check for a task, plus forbidden-action, scope, wiring and claim checks. Returns decision and a corrective prompt.', inputSchema: { type: 'object', properties: { task: { type: 'string' }, claims: { type: 'string', description: 'Your status line(s): TASK-ID | status | commit | tests | measured vs target | missing' }, base: BASE, fresh: FRESH }, required: ['task'] } },
+  { name: 'gate', description: 'Release decision PASS/FAIL/BLOCKED with Markdown+JSON evidence report.', inputSchema: { type: 'object', properties: { task: { type: 'string' }, claims: { type: 'string' }, base: BASE, fresh: FRESH }, required: ['task'] } },
+  { name: 'report', description: 'Latest gate report for a task (Markdown).', inputSchema: { type: 'object', properties: { task: { type: 'string' } }, required: ['task'] } },
+  { name: 'status', description: 'Task and phase status, evidence-chain integrity.', inputSchema: { type: 'object', properties: { owner: OWNER } } },
+];
+
+export function handle(root, msg) {
+  const { id, method, params = {} } = msg;
+  const ok = (result) => ({ jsonrpc: '2.0', id, result });
+  if (method === 'initialize') return ok({ protocolVersion: params.protocolVersion || '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: 'proofline', version: '0.1.0' } });
+  if (method === 'ping') return ok({});
+  if (method === 'tools/list') return ok({ tools: TOOLS });
+  if (method === 'tools/call') {
+    const a = params.arguments || {};
+    try {
+      let r;
+      switch (params.name) {
+        case 'contract_create': r = P.contractCreate(root, a.task); break;
+        case 'task_next': r = P.taskNext(root, { owner: a.owner }); break;
+        case 'evidence_record': r = P.evidenceRecord(root, a.type, a.data || {}); break;
+        case 'verify': { const g = P.E.verifyTask(root, a.task, { claims: a.claims, base: a.base, fresh: a.fresh === true }); r = { ...g, corrective_prompt: P.E.steer(g, P.C.load(root)) }; break; }
+        case 'gate': r = P.E.gate(root, a.task, { claims: a.claims, base: a.base, fresh: a.fresh === true }); break;
+        case 'report': r = P.report(root, a.task); break;
+        case 'status': r = P.status(root, { owner: a.owner }); break;
+        default: return { jsonrpc: '2.0', id, error: { code: -32601, message: `unknown tool ${params.name}` } };
+      }
+      const text = r.brief ? r.brief + '\n\n' + JSON.stringify({ task: r.task, phase: r.phase }) : r.corrective_prompt ? `DECISION: ${r.decision}\n\n${r.corrective_prompt}\n\n${JSON.stringify({ decision: r.decision, failing: r.failing, blocked: r.blocked, measured: r.measured })}` : r.markdown || JSON.stringify(r, null, 2);
+      return ok({ content: [{ type: 'text', text }], isError: false });
+    } catch (e) { return ok({ content: [{ type: 'text', text: `error: ${e.message}` }], isError: true }); }
+  }
+  if (id === undefined) return null; // notification
+  return { jsonrpc: '2.0', id, error: { code: -32601, message: `method not found: ${method}` } };
+}
+
+export function serve(root) {
+  const rl = readline.createInterface({ input: process.stdin });
+  rl.on('line', (line) => {
+    if (!line.trim()) return;
+    let msg; try { msg = JSON.parse(line); } catch { process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'parse error' } }) + '\n'); return; }
+    const r = handle(root, msg);
+    if (r) process.stdout.write(JSON.stringify(r) + '\n');
+  });
+  return new Promise((res) => rl.on('close', res));
+}

package/src/util.mjs

@@ -0,0 +1,92 @@
+import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const sha256 = (s) => crypto.createHash('sha256').update(s).digest('hex');
+
+/** Owner marker for these exact bytes. The directory comes from `init --approvals`. A symlink is not a regular file. */
+export function approvalMarker(root, bytes) {
+  let dir = null;
+  try {
+    const c = JSON.parse(fs.readFileSync(path.join(root, '.proofline', 'config.json'), 'utf8'));
+    if (typeof c.approvals === 'string' && c.approvals.trim()) dir = c.approvals;
+  } catch { dir = null; }
+  if (!bytes) return { hex: null, marker: null, approved: false };
+  const hex = sha256(bytes);
+  const marker = dir ? path.join(dir, hex) : null;
+  let approved = false;
+  if (marker) { try { approved = fs.lstatSync(marker).isFile(); } catch { approved = false; } }
+  return { hex, marker, approved };
+}
+
+/** Stable JSON (sorted keys) so hashes are reproducible. */
+export function canon(v) {
+  if (Array.isArray(v)) return '[' + v.map(canon).join(',') + ']';
+  if (v && typeof v === 'object') return '{' + Object.keys(v).sort().filter((k) => v[k] !== undefined).map((k) => JSON.stringify(k) + ':' + canon(v[k])).join(',') + '}';
+  return JSON.stringify(v ?? null);
+}
+
+/** Run a shell command; never throws. */
+export function run(cmd, { cwd, timeoutS = 600, env } = {}) {
+  const t = performance.now();
+  // NODE_TEST_CONTEXT leaks from an enclosing `node --test` and makes a nested `node --test` exit 0 regardless of failures.
+  const e = { ...process.env, ...env }; delete e.NODE_TEST_CONTEXT;
+  // A pre-push hook exports GIT_DIR. A test or command that inits its own repository must not use it.
+  for (const k of ['GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_PREFIX', 'GIT_COMMON_DIR', 'GIT_OBJECT_DIRECTORY', 'GIT_NAMESPACE', 'GIT_QUARANTINE_PATH']) delete e[k];
+  const r = spawnSync('bash', ['-c', cmd], { cwd, encoding: 'utf8', timeout: timeoutS * 1000, env: e, maxBuffer: 64 << 20 });
+  const ms = Math.round(performance.now() - t);
+  const timedOut = r.error?.code === 'ETIMEDOUT';
+  return { cmd, cwd, exit: timedOut ? 124 : (r.status ?? 1), stdout: r.stdout || '', stderr: (r.stderr || '') + (r.error && !timedOut ? String(r.error) : ''), ms, timedOut };
+}
+
+export function git(args, cwd) {
+  const r = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 64 << 20 });
+  return { ok: r.status === 0, out: (r.stdout || '').trim(), err: (r.stderr || '').trim() };
+}
+
+/** Where commit `sha` stands against <remote>/<branch>. { ok: false, err } when the remote cannot be read; otherwise
+ * { ok: true, tip, at, contains, behind, unknown }. A tip this repository lacks is fetched by the branch's name with no ref
+ * written (--refmap= keeps the remote-tracking ref, --no-write-fetch-head keeps FETCH_HEAD), so a commit under the tip is
+ * found without a fetch beforehand. `unknown`: the tip could not be fetched, so whether it holds the commit is not known. */
+export function onRemote(root, sha, remote, branch) {
+  const ls = git(['ls-remote', remote, `refs/heads/${branch}`], root);
+  if (!ls.ok) return { ok: false, err: ls.err || `git ls-remote ${remote} failed` };
+  const tip = ls.out.split(/\s/)[0] || '';
+  if (!tip) return { ok: true, tip: '', at: false, contains: false, behind: null, unknown: false };
+  if (tip === sha) return { ok: true, tip, at: true, contains: true, behind: 0, unknown: false };
+  const have = () => git(['cat-file', '-e', `${tip}^{commit}`], root).ok;
+  if (!have()) git(['fetch', '-q', '--no-tags', '--refmap=', '--no-write-fetch-head', remote, `refs/heads/${branch}`], root);
+  if (!have()) return { ok: true, tip, at: false, contains: false, behind: null, unknown: true };
+  const contains = git(['merge-base', '--is-ancestor', sha, tip], root).ok;
+  return { ok: true, tip, at: false, contains, behind: contains ? Number(git(['rev-list', '--count', `${sha}..${tip}`], root).out) : null, unknown: false };
+}
+
+export const tail = (s, n = 1500) => (s.length > n ? '…' + s.slice(-n) : s);
+
+/** Minimal glob → RegExp: ** , * , ? */
+export function globRe(g) {
+  let re = '';
+  for (let i = 0; i < g.length; i++) {
+    const c = g[i];
+    if (c === '*' && g[i + 1] === '*') { re += '.*'; i++; if (g[i + 1] === '/') i++; }
+    else if (c === '*') re += '[^/]*';
+    else if (c === '?') re += '[^/]';
+    else re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  }
+  return new RegExp('^' + re + '$');
+}
+export const matchAny = (p, globs) => globs.some((g) => globRe(g).test(p));
+
+/** Read a dotted path like "latency.p50" from an object. */
+export const pick = (o, p) => p.split('.').reduce((a, k) => (a == null ? undefined : a[k]), o);
+
+export function readJson(f, d) { try { return JSON.parse(fs.readFileSync(f, 'utf8')); } catch { return d; } }
+export function writeJson(f, v) { fs.mkdirSync(path.dirname(f), { recursive: true }); fs.writeFileSync(f, JSON.stringify(v, null, 2) + '\n'); }
+
+/** Last JSON object found in a text (bench scripts print JSON as the last line). */
+export function lastJson(text) {
+  const lines = text.trim().split('\n').reverse();
+  for (const l of lines) { const s = l.trim(); if (s.startsWith('{')) { try { return JSON.parse(s); } catch {} } }
+  try { return JSON.parse(text); } catch { return undefined; }
+}