@polymorphism-tech/morph-spec 4.22.0 → 5.0.1

package/src/lib/installers/mcp-installer.js

@@ -8,7 +8,8 @@
 
 import { join } from 'path';
 import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs';
-import { execSync } from 'child_process';
+import { execSync, spawn } from 'child_process';
+import { homedir } from 'os';
 import { installMcpServers } from '../../utils/claude-settings-manager.js';
 
 /**
@@ -17,7 +18,7 @@ import { installMcpServers } from '../../utils/claude-settings-manager.js';
  */
 export function loadMcpRegistry() {
   const registryPath = join(
-    import.meta.dirname, '..', '..', '..', 'framework', 'skills', 'level-0-meta', 'mcp-registry.json'
+    import.meta.dirname, '..', '..', '..', 'framework', 'mcp', 'registry.json'
   );
   const raw = readFileSync(registryPath, 'utf-8');
   return JSON.parse(raw);
@@ -175,122 +176,120 @@ export function installCompanionSkills(mcpsInstalled, exec = execSync) {
 
 /**
  * Generate the Stitch OAuth proxy template script.
+ * Cross-platform (Windows gcloud.cmd + Unix gcloud), fetch()-based,
+ * with readline, session tracking, and graceful shutdown.
  * @param {string} gcpProject - GCP project ID for x-goog-user-project header
  * @returns {string} CJS proxy script content
  */
 export function getStitchProxyTemplate(gcpProject) {
-  return `/**
- * Stitch MCP OAuth Proxy
+  return `#!/usr/bin/env node
+/**
+ * Stitch MCP stdio-to-HTTP proxy with Google auth
  * Generated by morph-spec mcp setup stitch
- *
- * Bridges stdio JSON-RPC to https://stitch.googleapis.com/mcp
- * using gcloud application-default credentials (OAuth2 bearer token).
  */
 const { execSync } = require('child_process');
-const https = require('https');
+const { createInterface } = require('readline');
+
+const STITCH_URL = 'https://stitch.googleapis.com/mcp';
+const PROJECT_ID = '${gcpProject}';
 
-const GCP_PROJECT = '${gcpProject}';
-const STITCH_HOST = 'stitch.googleapis.com';
-const STITCH_PATH = '/mcp';
-const TOKEN_TTL_MS = 50 * 60 * 1000; // 50 minutes
+// Cross-platform gcloud path: Windows uses gcloud.cmd from Cloud SDK install
+const GCLOUD = process.platform === 'win32'
+  ? (process.env.LOCALAPPDATA || '') + '/Google/Cloud SDK/google-cloud-sdk/bin/gcloud.cmd'
+  : 'gcloud';
 
 let cachedToken = null;
-let tokenExpiresAt = 0;
+let tokenExpiry = 0;
+let pendingRequests = 0;
+let stdinClosed = false;
+let sessionId = null;
 
-function getAccessToken() {
-  if (cachedToken && Date.now() < tokenExpiresAt) return cachedToken;
+function getToken() {
+  if (cachedToken && Date.now() < tokenExpiry) return cachedToken;
   try {
-    cachedToken = execSync('gcloud auth application-default print-access-token', {
-      encoding: 'utf-8',
-      timeout: 10000,
-      stdio: ['pipe', 'pipe', 'pipe']
+    cachedToken = execSync(\`"\${GCLOUD}" auth application-default print-access-token\`, {
+      encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 10000
     }).trim();
-    tokenExpiresAt = Date.now() + TOKEN_TTL_MS;
+    tokenExpiry = Date.now() + 50 * 60 * 1000; // 50-minute TTL
     return cachedToken;
-  } catch (err) {
-    process.stderr.write('[stitch-proxy] Failed to get access token. Run: gcloud auth application-default login\\n');
-    throw err;
+  } catch {
+    return null;
   }
 }
 
-function clearTokenCache() {
-  cachedToken = null;
-  tokenExpiresAt = 0;
+function maybeExit() {
+  if (stdinClosed && pendingRequests === 0) process.exit(0);
 }
 
-function sendRequest(body) {
-  return new Promise((resolve, reject) => {
-    const token = getAccessToken();
-    const data = JSON.stringify(body);
-    const options = {
-      hostname: STITCH_HOST,
-      path: STITCH_PATH,
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Content-Length': Buffer.byteLength(data),
-        'Authorization': \`Bearer \${token}\`,
-        'x-goog-user-project': GCP_PROJECT,
-      },
-    };
+async function handleMessage(line) {
+  let msg;
+  try { msg = JSON.parse(line); } catch { return; }
 
-    const req = https.request(options, (res) => {
-      let responseData = '';
-      res.on('data', (chunk) => { responseData += chunk; });
-      res.on('end', () => {
-        if (res.statusCode === 401) {
-          // Token expired — retry once with fresh token
-          clearTokenCache();
-          const retryToken = getAccessToken();
-          options.headers['Authorization'] = \`Bearer \${retryToken}\`;
-          const retryData = JSON.stringify(body);
-          options.headers['Content-Length'] = Buffer.byteLength(retryData);
-          const retryReq = https.request(options, (retryRes) => {
-            let retryResponse = '';
-            retryRes.on('data', (chunk) => { retryResponse += chunk; });
-            retryRes.on('end', () => resolve(retryResponse));
-          });
-          retryReq.on('error', reject);
-          retryReq.write(retryData);
-          retryReq.end();
-        } else {
-          resolve(responseData);
-        }
-      });
-    });
+  // Notifications (no id) don't need responses
+  if (msg.id === undefined && msg.method === 'notifications/initialized') return;
 
-    req.on('error', reject);
-    req.write(data);
-    req.end();
-  });
-}
+  const token = getToken();
+  if (!token) {
+    if (msg.id !== undefined) {
+      process.stdout.write(JSON.stringify({
+        jsonrpc: '2.0', id: msg.id,
+        error: { code: -32000, message: 'Failed to get gcloud auth token. Run: gcloud auth application-default login' }
+      }) + '\\n');
+    }
+    return;
+  }
 
-// Buffer stdin and split on newlines (JSON-RPC messages)
-let buffer = '';
-process.stdin.setEncoding('utf-8');
-process.stdin.on('data', async (chunk) => {
-  buffer += chunk;
-  const lines = buffer.split('\\n');
-  buffer = lines.pop(); // keep incomplete line in buffer
+  const headers = {
+    'Content-Type': 'application/json',
+    'Authorization': \`Bearer \${token}\`,
+    'x-goog-user-project': PROJECT_ID,
+  };
+  if (sessionId) headers['mcp-session-id'] = sessionId;
 
-  for (const line of lines) {
-    if (!line.trim()) continue;
-    try {
-      const request = JSON.parse(line);
-      const response = await sendRequest(request);
-      process.stdout.write(response + '\\n');
-    } catch (err) {
-      const errorResponse = JSON.stringify({
-        jsonrpc: '2.0',
-        id: null,
-        error: { code: -32603, message: err.message || 'Proxy error' }
-      });
-      process.stdout.write(errorResponse + '\\n');
+  pendingRequests++;
+  try {
+    const res = await fetch(STITCH_URL, { method: 'POST', headers, body: JSON.stringify(msg) });
+
+    // Track sticky session
+    const sid = res.headers.get('mcp-session-id');
+    if (sid) sessionId = sid;
+
+    // Retry once on 401 (expired token)
+    if (res.status === 401) {
+      cachedToken = null;
+      tokenExpiry = 0;
+      const retryToken = getToken();
+      if (retryToken) {
+        headers['Authorization'] = \`Bearer \${retryToken}\`;
+        const retryRes = await fetch(STITCH_URL, { method: 'POST', headers, body: JSON.stringify(msg) });
+        const retryText = await retryRes.text();
+        if (retryText.trim()) {
+          process.stdout.write(retryText.endsWith('\\n') ? retryText : retryText + '\\n');
+        }
+        return;
+      }
     }
+
+    const text = await res.text();
+    if (text.trim()) {
+      process.stdout.write(text.endsWith('\\n') ? text : text + '\\n');
+    }
+  } catch (err) {
+    if (msg.id !== undefined) {
+      process.stdout.write(JSON.stringify({
+        jsonrpc: '2.0', id: msg.id,
+        error: { code: -32000, message: \`Stitch API error: \${err.message}\` }
+      }) + '\\n');
+    }
+  } finally {
+    pendingRequests--;
+    maybeExit();
   }
-});
+}
 
-process.stderr.write(\`[stitch-proxy] Ready — GCP project: \${GCP_PROJECT}\\n\`);
+const rl = createInterface({ input: process.stdin });
+rl.on('line', handleMessage);
+rl.on('close', () => { stdinClosed = true; maybeExit(); });
 `;
 }
 
@@ -312,6 +311,215 @@ export function generateStitchProxy(targetPath, gcpProject) {
   return { proxyPath };
 }
 
+/**
+ * Resolve the gcloud CLI binary path.
+ * Checks: system PATH → bundled at ~/.stitch-mcp/ → null.
+ * @param {Function} exec - execSync function (for testing)
+ * @returns {{ gcloudPath: string|null, source: string }}
+ */
+export function findGcloud(exec = execSync) {
+  // Try system PATH first
+  try {
+    exec('gcloud --version', { stdio: ['pipe', 'pipe', 'pipe'], timeout: 10000 });
+    return { gcloudPath: 'gcloud', source: 'system' };
+  } catch { /* not on PATH */ }
+
+  // Windows: try Cloud SDK default install location
+  if (process.platform === 'win32') {
+    const winPath = join(process.env.LOCALAPPDATA || '', 'Google', 'Cloud SDK', 'google-cloud-sdk', 'bin', 'gcloud.cmd');
+    if (existsSync(winPath)) {
+      return { gcloudPath: winPath, source: 'windows-sdk' };
+    }
+  }
+
+  // Try bundled at ~/.stitch-mcp/
+  const bundledDir = join(homedir(), '.stitch-mcp');
+  const bundledBin = process.platform === 'win32'
+    ? join(bundledDir, 'google-cloud-sdk', 'bin', 'gcloud.cmd')
+    : join(bundledDir, 'google-cloud-sdk', 'bin', 'gcloud');
+  if (existsSync(bundledBin)) {
+    return { gcloudPath: bundledBin, source: 'bundled' };
+  }
+
+  return { gcloudPath: null, source: 'not-found' };
+}
+
+/**
+ * Fully automated Stitch MCP setup orchestrator.
+ *
+ * Steps:
+ * 1. Find gcloud CLI
+ * 2. Verify ADC credentials
+ * 3. Detect GCP project
+ * 4. Enable stitch.googleapis.com API
+ * 5. Generate proxy script
+ * 6. Install MCP config in .mcp.json
+ * 7. Health-check the proxy
+ *
+ * @param {string} targetPath - Project root directory
+ * @param {Object} options
+ * @param {string} [options.gcpProject] - GCP project ID (auto-detected if omitted)
+ * @param {Function} [options._exec] - execSync override for testing
+ * @returns {Promise<Object>} Step-by-step results
+ */
+export async function setupStitch(targetPath, options = {}) {
+  const exec = options._exec || execSync;
+  const steps = [];
+
+  // Step 1: Find gcloud
+  const { gcloudPath, source: gcloudSource } = findGcloud(exec);
+  if (!gcloudPath) {
+    steps.push({ step: 'find-gcloud', success: false, error: 'gcloud CLI not found. Install from: https://cloud.google.com/sdk/docs/install' });
+    return { success: false, steps };
+  }
+  steps.push({ step: 'find-gcloud', success: true, gcloudPath, source: gcloudSource });
+
+  const gcloudCmd = gcloudPath.includes(' ') ? `"${gcloudPath}"` : gcloudPath;
+
+  // Step 2: Verify ADC credentials
+  try {
+    exec(`${gcloudCmd} auth application-default print-access-token`, {
+      encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 15000
+    });
+    steps.push({ step: 'verify-adc', success: true });
+  } catch {
+    steps.push({ step: 'verify-adc', success: false, error: 'No ADC credentials. Run: gcloud auth application-default login' });
+    return { success: false, steps };
+  }
+
+  // Step 3: Detect GCP project
+  let gcpProject = options.gcpProject;
+  if (!gcpProject) {
+    // Try config.json
+    const configPath = join(targetPath, '.morph', 'config', 'config.json');
+    if (existsSync(configPath)) {
+      try {
+        const config = JSON.parse(readFileSync(configPath, 'utf-8'));
+        gcpProject = config.gcpProject || config.project?.gcpProject;
+      } catch { /* invalid config */ }
+    }
+  }
+  if (!gcpProject) {
+    // Try gcloud config
+    try {
+      gcpProject = exec(`${gcloudCmd} config get-value project`, {
+        encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 10000
+      }).trim();
+      if (!gcpProject || gcpProject === '(unset)') gcpProject = null;
+    } catch { /* gcloud config failed */ }
+  }
+  if (!gcpProject) {
+    steps.push({ step: 'detect-project', success: false, error: 'Could not detect GCP project. Pass it explicitly or set via: gcloud config set project <id>' });
+    return { success: false, steps };
+  }
+  steps.push({ step: 'detect-project', success: true, gcpProject });
+
+  // Step 4: Enable Stitch API
+  try {
+    exec(`${gcloudCmd} services enable stitch.googleapis.com --project=${gcpProject}`, {
+      encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 30000
+    });
+    steps.push({ step: 'enable-api', success: true });
+  } catch (err) {
+    steps.push({ step: 'enable-api', success: false, error: `Failed to enable stitch API: ${err.message}` });
+    // Non-fatal — API might already be enabled and user may lack permissions to re-enable
+  }
+
+  // Step 5: Generate proxy
+  const { proxyPath } = generateStitchProxy(targetPath, gcpProject);
+  steps.push({ step: 'generate-proxy', success: true, proxyPath });
+
+  // Step 6: Install MCP config in .mcp.json
+  const mcpResult = await installMcpServers(targetPath, {
+    stitch: { type: 'stdio', command: 'node', args: ['.claude/stitch-proxy.cjs'] }
+  });
+  steps.push({ step: 'install-mcp', success: true, added: mcpResult.added, skipped: mcpResult.skipped });
+
+  // Step 7: Health-check
+  const healthResult = await healthCheckStitchProxy(proxyPath);
+  steps.push({ step: 'health-check', ...healthResult });
+
+  const allCriticalPassed = steps.every(s =>
+    s.success || s.step === 'enable-api' || s.step === 'health-check'
+  );
+
+  return { success: allCriticalPassed, steps, gcpProject };
+}
+
+/**
+ * Health-check the Stitch proxy by sending an MCP initialize handshake.
+ * @param {string} proxyPath - Path to stitch-proxy.cjs
+ * @returns {Promise<Object>} { success, protocolVersion?, error? }
+ */
+export function healthCheckStitchProxy(proxyPath) {
+  return new Promise((resolve) => {
+    const initMsg = JSON.stringify({
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'initialize',
+      params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'morph-spec', version: '1.0.0' } }
+    });
+
+    const child = spawn('node', [proxyPath], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 20000,
+    });
+
+    let output = '';
+    let timedOut = false;
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+      resolve({ success: false, error: 'Health-check timed out after 20s' });
+    }, 20000);
+
+    child.stdout.on('data', (data) => {
+      output += data.toString();
+      // Check if we got a response
+      const lines = output.split('\n').filter(l => l.trim());
+      for (const line of lines) {
+        try {
+          const resp = JSON.parse(line);
+          if (resp.result?.protocolVersion) {
+            clearTimeout(timer);
+            child.kill();
+            resolve({ success: true, protocolVersion: resp.result.protocolVersion });
+            return;
+          }
+          if (resp.error) {
+            clearTimeout(timer);
+            child.kill();
+            resolve({ success: false, error: resp.error.message || 'MCP error' });
+            return;
+          }
+        } catch { /* not valid JSON yet */ }
+      }
+    });
+
+    child.on('error', (err) => {
+      if (!timedOut) {
+        clearTimeout(timer);
+        resolve({ success: false, error: err.message });
+      }
+    });
+
+    child.on('close', (code) => {
+      if (!timedOut) {
+        clearTimeout(timer);
+        resolve({ success: false, error: output.trim()
+          ? `Proxy exited with code ${code} — unexpected output`
+          : `Proxy exited with code ${code} and no output`
+        });
+      }
+    });
+
+    // Send the initialize message
+    child.stdin.write(initMsg + '\n');
+    child.stdin.end();
+  });
+}
+
 /**
  * Install a single MCP with provided credentials
  * @param {string} targetPath - Project root directory

package/src/lib/phase-chain/phase-validator.js

@@ -13,7 +13,11 @@ import fs from 'fs';
 import path, { join } from 'path';
 import { loadState, derivePhase, getFeature } from '../../core/state/state-manager.js';
 import { getWorkflowConfig } from '../../core/workflows/workflow-detector.js';
-import { shouldAutoApprove } from '../trust/trust-manager.js';
+
+// v5: trust-manager removed. Auto-approval is no longer a CLI feature —
+// approval gates are handled by Claude presenting the gate via skill template
+// and the user responding. Stub to keep legacy callers happy.
+const shouldAutoApprove = () => false;
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Phase definitions (from validate-phase.js)
@@ -34,53 +38,41 @@ export const PHASES = {
     description: 'UI/UX design (conditional - only if frontend)',
     optional: true
   },
-  'design': {
+  'plan': {
     order: 2,
-    name: 'FASE 2: DESIGN',
+    name: 'FASE 2: PLAN',
     requiredOutputs: ['proposal.md'],
-    description: 'Technical specification, contracts, and clarification'
-  },
-  'plan': {
-    order: 3,
-    name: 'FASE 3: PLAN',
-    requiredOutputs: ['proposal.md', 'spec.md'],
-    description: 'Planning phase before task breakdown'
-  },
-  'tasks': {
-    order: 4,
-    name: 'FASE 4: TASKS',
-    requiredOutputs: ['proposal.md', 'spec.md', 'plan.md'],
-    description: 'Break down into executable tasks'
+    description: 'Technical specification, implementation plan, task breakdown, and mandate'
   },
   'implement': {
-    order: 5,
-    name: 'FASE 5: IMPLEMENT',
+    order: 3,
+    name: 'FASE 3: IMPLEMENT',
     requiredOutputs: ['proposal.md', 'spec.md', 'tasks.md'],
     description: 'Execute tasks and implement code'
   },
-  'sync': {
-    order: 6,
-    name: 'FASE 6: SYNC',
-    requiredOutputs: ['proposal.md', 'spec.md', 'decisions.md', 'recap.md'],
-    description: 'Sync decisions to project standards',
-    optional: true
+  'review': {
+    order: 4,
+    name: 'FASE 4: REVIEW',
+    requiredOutputs: ['proposal.md', 'spec.md', 'mandate.md', 'tasks.md', 'recap.md', 'review-report.md'],
+    description: 'Post-implementation quality review against mandate'
   }
 };
 
-// Map output filenames to their phase subfolders
+// Map output filenames to their phase subfolders (v5)
 const OUTPUT_PHASE_MAP = {
   'proposal.md': '0-proposal',
-  'schema-analysis.md': '2-design',
-  'spec.md': '2-design',
-  'contracts.cs': '2-design',
-  'decisions.md': '2-design',
+  'stack-scan.md': '0-proposal',
+  'migration-plan.md': '0-proposal',
+  'spec.md': '2-plan',
+  'mandate.md': '2-plan',
+  'decisions.md': '2-plan',
   'design-system.md': '1-ui',
   'mockups.md': '1-ui',
   'components.md': '1-ui',
   'flows.md': '1-ui',
-  'plan.md': '3-plan',
-  'tasks.md': '4-tasks',
-  'recap.md': '5-implement'
+  'tasks.md': '2-plan',
+  'recap.md': '3-implement',
+  'review-report.md': '4-review'
 };
 
 function checkOutput(featurePath, outputFile) {
@@ -147,7 +139,7 @@ export function validatePhase(featureName, targetPhase) {
 
   // Special validation: implement phase requires tasks.md to have actual tasks
   if (targetPhase === 'implement') {
-    const tasksFilePath = path.join(featurePath, '4-tasks', 'tasks.md');
+    const tasksFilePath = path.join(featurePath, '2-plan', 'tasks.md');
     if (fs.existsSync(tasksFilePath)) {
       const content = fs.readFileSync(tasksFilePath, 'utf-8');
       const taskCount = (content.match(/^###\s+T\d+/gm) || []).length;
@@ -186,7 +178,7 @@ export function validatePhase(featureName, targetPhase) {
 // Phase eligibility
 // ─────────────────────────────────────────────────────────────────────────────
 
-const PHASE_ORDER = ['proposal', 'uiux', 'design', 'plan', 'tasks', 'implement', 'sync'];
+const PHASE_ORDER = ['proposal', 'uiux', 'plan', 'implement', 'review'];
 
 function getNextPhase(currentPhase, featureName) {
   const idx = PHASE_ORDER.indexOf(currentPhase);
@@ -224,13 +216,17 @@ export function computePassRate(validationHistory) {
   return entries.length > 0 ? passed / entries.length : null;
 }
 
-// Map output type names to file paths for eligibility checks
+// Map output type names to file paths for eligibility checks (v5)
 const OUTPUT_PATH_MAP = {
   'proposal': '0-proposal/proposal.md',
-  'spec': '2-design/spec.md',
-  'contracts': '2-design/contracts.cs',
-  'tasks': '4-tasks/tasks.md',
-  'schemaAnalysis': '2-design/schema-analysis.md',
+  'stackScan': '0-proposal/stack-scan.md',
+  'migrationPlan': '0-proposal/migration-plan.md',
+  'spec': '2-plan/spec.md',
+  'mandate': '2-plan/mandate.md',
+  'tasks': '2-plan/tasks.md',
+  'decisions': '2-plan/decisions.md',
+  'recap': '3-implement/recap.md',
+  'reviewReport': '4-review/review-report.md',
 };
 
 function getMissingRequiredOutputs(featureName, phase, projectPath) {
@@ -335,7 +331,7 @@ export function checkPhaseEligibility(featureName, opts = {}) {
   }
 
   try {
-    const requiredGateMap = { design: 'design', tasks: 'tasks', uiux: 'uiux' };
+    const requiredGateMap = { plan: 'plan', uiux: 'uiux', review: 'review' };
     const gate = requiredGateMap[currentPhase];
     if (gate) {
       const trustResult = shouldAutoApprove(featureName, gate);