@praneeth_54/agentdoctor 2.1.0 → 3.0.1

package/dist/languages/index.d.ts

@@ -1,5 +1,5 @@
 import type { LanguageAdapter, ParseResult } from "./types.js";
-/** Languages with real AST backends today (or honest unsupported stubs). */
+/** Languages with real parsers (compiler AST or lightweight line scanners). */
 export declare const languageAdapters: LanguageAdapter[];
 export declare function getAdapterForFile(filePath: string): LanguageAdapter | null;
 export declare function parseSourceFile(filePath: string, source: string): Promise<ParseResult>;
@@ -8,4 +8,8 @@ export { typescriptAdapter, javascriptAdapter } from "./typescript.js";
 export { pythonAdapter, pythonAvailable } from "./python.js";
 export { phpAdapter, phpAvailable } from "./php.js";
 export { goAdapter, goAvailable } from "./go.js";
+export { javaAdapter, parseJavaSource } from "./java.js";
+export { kotlinAdapter, parseKotlinSource } from "./kotlin.js";
+export { rustAdapter, parseRustSource } from "./rust.js";
+export { dartAdapter, parseDartSource } from "./dart.js";
 export type { LanguageAdapter, ParseResult, LanguageId } from "./types.js";

package/dist/languages/index.js

@@ -3,48 +3,21 @@ import { javascriptAdapter, typescriptAdapter } from "./typescript.js";
 import { pythonAdapter } from "./python.js";
 import { phpAdapter } from "./php.js";
 import { goAdapter } from "./go.js";
-function unsupportedAdapter(id, extensions, reason) {
-    return {
-        id,
-        extensions,
-        capabilities: () => ({
-            parse: "unsupported",
-            symbols: "unsupported",
-            definitions: "unsupported",
-            references: "unsupported",
-            imports: "unsupported",
-            calls: "unsupported",
-            diagnostics: "unsupported",
-        }),
-        async parse(filePath, _source) {
-            return {
-                language: id,
-                file: filePath,
-                ok: false,
-                capabilities: this.capabilities(),
-                symbols: [],
-                imports: [],
-                calls: [],
-                diagnostics: [reason],
-                limitations: [
-                    reason,
-                    "No regex fallback is offered under an AST claim — capability remains unsupported until a mature parser is integrated",
-                ],
-            };
-        },
-    };
-}
-/** Languages with real AST backends today (or honest unsupported stubs). */
+import { javaAdapter } from "./java.js";
+import { kotlinAdapter } from "./kotlin.js";
+import { rustAdapter } from "./rust.js";
+import { dartAdapter } from "./dart.js";
+/** Languages with real parsers (compiler AST or lightweight line scanners). */
 export const languageAdapters = [
     typescriptAdapter,
     javascriptAdapter,
     pythonAdapter,
     phpAdapter,
     goAdapter,
-    unsupportedAdapter("java", [".java"], "Java AST requires an external parser (e.g. tree-sitter-java or javaparser); not bundled"),
-    unsupportedAdapter("kotlin", [".kt", ".kts"], "Kotlin AST requires an external parser; not bundled"),
-    unsupportedAdapter("rust", [".rs"], "Rust AST requires syn/rustc or tree-sitter-rust; not bundled"),
-    unsupportedAdapter("dart", [".dart"], "Dart AST requires Dart analyzer APIs; not bundled"),
+    javaAdapter,
+    kotlinAdapter,
+    rustAdapter,
+    dartAdapter,
 ];
 export function getAdapterForFile(filePath) {
     const lang = detectLanguage(filePath);
@@ -74,3 +47,7 @@ export { typescriptAdapter, javascriptAdapter } from "./typescript.js";
 export { pythonAdapter, pythonAvailable } from "./python.js";
 export { phpAdapter, phpAvailable } from "./php.js";
 export { goAdapter, goAvailable } from "./go.js";
+export { javaAdapter, parseJavaSource } from "./java.js";
+export { kotlinAdapter, parseKotlinSource } from "./kotlin.js";
+export { rustAdapter, parseRustSource } from "./rust.js";
+export { dartAdapter, parseDartSource } from "./dart.js";

package/dist/languages/java.d.ts

@@ -0,0 +1,10 @@
+import type { LanguageAdapter, LanguageImport, LanguageSymbol } from "./types.js";
+export interface JavaParseSummary {
+    packageName: string;
+    imports: LanguageImport[];
+    symbols: LanguageSymbol[];
+    limitations: string[];
+}
+/** Lightweight line-oriented Java scan — not javaparser/tree-sitter. */
+export declare function parseJavaSource(filePath: string, source: string): JavaParseSummary;
+export declare const javaAdapter: LanguageAdapter;

package/dist/languages/java.js

@@ -0,0 +1,80 @@
+/** Lightweight line-oriented Java scan — not javaparser/tree-sitter. */
+export function parseJavaSource(filePath, source) {
+    const lines = source.split(/\r?\n/);
+    const limitations = [
+        "Java parsing uses a lightweight line scanner — not javaparser or tree-sitter-java; calls/types are not fully resolved.",
+        "Full compiler or tree-sitter-java integration remains an EXTERNAL enhancement path (not bundled).",
+    ];
+    let packageName = "";
+    const imports = [];
+    const symbols = [];
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (!packageName && trimmed.startsWith("package ") && trimmed.endsWith(";")) {
+            packageName = trimmed.slice("package ".length, -1).trim();
+        }
+        if (trimmed.startsWith("import ") && trimmed.endsWith(";") && !trimmed.includes(" static ")) {
+            const spec = trimmed.slice("import ".length, -1).trim();
+            if (spec)
+                imports.push({ fromFile: filePath, specifier: spec, evidence: "ast" });
+        }
+        const typeMatch = /^(?:public\s+|private\s+|protected\s+)?(?:abstract\s+)?(?:class|interface|enum|record)\s+(\w+)/.exec(trimmed);
+        if (typeMatch) {
+            const kind = trimmed.includes("interface")
+                ? "interface"
+                : trimmed.includes("enum")
+                    ? "enum"
+                    : "class";
+            symbols.push({
+                id: `java:${kind}:${filePath}:${typeMatch[1]}`,
+                name: typeMatch[1],
+                kind,
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+        const methodMatch = /^(?:public|private|protected|static|\s)+[\w<>,[\].?\s]+\s+(\w+)\s*\([^;]*\)\s*(?:throws\s+[\w\s,]+)?\s*\{?\s*$/.exec(trimmed);
+        if (methodMatch && !trimmed.startsWith("if ") && !trimmed.startsWith("for ")) {
+            symbols.push({
+                id: `java:method:${filePath}:${methodMatch[1]}`,
+                name: methodMatch[1],
+                kind: "method",
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+    }
+    return { packageName, imports, symbols, limitations };
+}
+const JAVA_CAPABILITIES = () => ({
+    parse: "supported",
+    symbols: "supported",
+    definitions: "unsupported",
+    references: "unsupported",
+    imports: "supported",
+    calls: "partial",
+    diagnostics: "unsupported",
+    types: "partial",
+});
+export const javaAdapter = {
+    id: "java",
+    extensions: [".java"],
+    capabilities: JAVA_CAPABILITIES,
+    async parse(filePath, source) {
+        const summary = parseJavaSource(filePath, source);
+        const ok = Boolean(summary.packageName || summary.symbols.length > 0);
+        return {
+            language: "java",
+            file: filePath,
+            ok,
+            capabilities: javaAdapter.capabilities(),
+            symbols: summary.symbols,
+            imports: summary.imports,
+            calls: [],
+            diagnostics: ok ? [] : ["no package or type declarations detected"],
+            limitations: summary.limitations,
+        };
+    },
+};

package/dist/languages/kotlin.d.ts

@@ -0,0 +1,10 @@
+import type { LanguageAdapter, LanguageImport, LanguageSymbol } from "./types.js";
+export interface KotlinParseSummary {
+    packageName: string;
+    imports: LanguageImport[];
+    symbols: LanguageSymbol[];
+    limitations: string[];
+}
+/** Lightweight line-oriented Kotlin scan — not Kotlin compiler AST. */
+export declare function parseKotlinSource(filePath: string, source: string): KotlinParseSummary;
+export declare const kotlinAdapter: LanguageAdapter;

package/dist/languages/kotlin.js

@@ -0,0 +1,85 @@
+/** Lightweight line-oriented Kotlin scan — not Kotlin compiler AST. */
+export function parseKotlinSource(filePath, source) {
+    const lines = source.split(/\r?\n/);
+    const limitations = [
+        "Kotlin parsing uses a lightweight line scanner — not the Kotlin compiler or tree-sitter-kotlin; calls/types are partial.",
+        "Full compiler or tree-sitter-kotlin integration remains an EXTERNAL enhancement path (not bundled).",
+    ];
+    let packageName = "";
+    const imports = [];
+    const symbols = [];
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (!packageName && trimmed.startsWith("package ")) {
+            packageName = trimmed.slice("package ".length).split(/\s+/)[0] ?? "";
+        }
+        if (trimmed.startsWith("import ") && !trimmed.startsWith("import(")) {
+            const spec = trimmed
+                .slice("import ".length)
+                .replace(/\s+as\s+\w+$/, "")
+                .trim();
+            if (spec)
+                imports.push({ fromFile: filePath, specifier: spec, evidence: "ast" });
+        }
+        const typeMatch = /^(?:data\s+|sealed\s+|open\s+|abstract\s+|inner\s+)?(?:class|interface|object|enum class)\s+(\w+)/.exec(trimmed);
+        if (typeMatch) {
+            let kind = "class";
+            if (trimmed.includes("interface"))
+                kind = "interface";
+            else if (trimmed.includes("object"))
+                kind = "object";
+            else if (trimmed.includes("enum class"))
+                kind = "enum";
+            symbols.push({
+                id: `kotlin:${kind}:${filePath}:${typeMatch[1]}`,
+                name: typeMatch[1],
+                kind,
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+        const funMatch = /^(?:private\s+|public\s+|internal\s+|protected\s+)?fun\s+(?:<[^>]+>\s+)?(\w+)\s*\(/.exec(trimmed);
+        if (funMatch) {
+            symbols.push({
+                id: `kotlin:function:${filePath}:${funMatch[1]}`,
+                name: funMatch[1],
+                kind: "function",
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+    }
+    return { packageName, imports, symbols, limitations };
+}
+const KOTLIN_CAPABILITIES = () => ({
+    parse: "supported",
+    symbols: "supported",
+    definitions: "unsupported",
+    references: "unsupported",
+    imports: "supported",
+    calls: "partial",
+    diagnostics: "unsupported",
+    types: "partial",
+});
+export const kotlinAdapter = {
+    id: "kotlin",
+    extensions: [".kt", ".kts"],
+    capabilities: KOTLIN_CAPABILITIES,
+    async parse(filePath, source) {
+        const summary = parseKotlinSource(filePath, source);
+        const ok = Boolean(summary.packageName || summary.symbols.length > 0);
+        return {
+            language: "kotlin",
+            file: filePath,
+            ok,
+            capabilities: kotlinAdapter.capabilities(),
+            symbols: summary.symbols,
+            imports: summary.imports,
+            calls: [],
+            diagnostics: ok ? [] : ["no package or declarations detected"],
+            limitations: summary.limitations,
+        };
+    },
+};

package/dist/languages/rust.d.ts

@@ -0,0 +1,10 @@
+import type { LanguageAdapter, LanguageImport, LanguageSymbol } from "./types.js";
+export interface RustParseSummary {
+    moduleName: string;
+    imports: LanguageImport[];
+    symbols: LanguageSymbol[];
+    limitations: string[];
+}
+/** Lightweight line-oriented Rust scan — not syn/rustc AST. */
+export declare function parseRustSource(filePath: string, source: string): RustParseSummary;
+export declare const rustAdapter: LanguageAdapter;

package/dist/languages/rust.js

@@ -0,0 +1,93 @@
+/** Lightweight line-oriented Rust scan — not syn/rustc AST. */
+export function parseRustSource(filePath, source) {
+    const lines = source.split(/\r?\n/);
+    const limitations = [
+        "Rust parsing uses a lightweight line scanner — not syn or tree-sitter-rust; calls/types are partial.",
+        "Full rustc/syn or tree-sitter-rust integration remains an EXTERNAL enhancement path (not bundled).",
+    ];
+    let moduleName = "";
+    const imports = [];
+    const symbols = [];
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (!moduleName && trimmed.startsWith("mod ") && !trimmed.includes("{")) {
+            moduleName = trimmed.slice("mod ".length).split(/\s+/)[0]?.replace(";", "") ?? "";
+        }
+        if (trimmed.startsWith("use ") && trimmed.endsWith(";")) {
+            const spec = trimmed.slice("use ".length, -1).trim();
+            if (spec)
+                imports.push({ fromFile: filePath, specifier: spec, evidence: "ast" });
+        }
+        const structMatch = /^(?:pub\s+)?(?:struct|enum|trait|type)\s+(\w+)/.exec(trimmed);
+        if (structMatch) {
+            let kind = "struct";
+            if (trimmed.includes("enum"))
+                kind = "enum";
+            else if (trimmed.includes("trait"))
+                kind = "trait";
+            else if (trimmed.includes("type"))
+                kind = "type";
+            symbols.push({
+                id: `rust:${kind}:${filePath}:${structMatch[1]}`,
+                name: structMatch[1],
+                kind,
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+        const fnMatch = /^(?:pub\s+)?(?:async\s+)?fn\s+(\w+)/.exec(trimmed);
+        if (fnMatch) {
+            symbols.push({
+                id: `rust:function:${filePath}:${fnMatch[1]}`,
+                name: fnMatch[1],
+                kind: "function",
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+        const implMatch = /^impl(?:<[^>]+>)?\s+(?:\w+::)*(\w+)/.exec(trimmed);
+        if (implMatch) {
+            symbols.push({
+                id: `rust:impl:${filePath}:${implMatch[1]}`,
+                name: implMatch[1],
+                kind: "impl",
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+    }
+    return { moduleName, imports, symbols, limitations };
+}
+const RUST_CAPABILITIES = () => ({
+    parse: "supported",
+    symbols: "supported",
+    definitions: "unsupported",
+    references: "unsupported",
+    imports: "supported",
+    calls: "partial",
+    diagnostics: "unsupported",
+    types: "partial",
+});
+export const rustAdapter = {
+    id: "rust",
+    extensions: [".rs"],
+    capabilities: RUST_CAPABILITIES,
+    async parse(filePath, source) {
+        const summary = parseRustSource(filePath, source);
+        const ok = Boolean(summary.moduleName || summary.symbols.length > 0 || summary.imports.length > 0);
+        return {
+            language: "rust",
+            file: filePath,
+            ok,
+            capabilities: rustAdapter.capabilities(),
+            symbols: summary.symbols,
+            imports: summary.imports,
+            calls: [],
+            diagnostics: ok ? [] : ["no mod, use, or declarations detected"],
+            limitations: summary.limitations,
+        };
+    },
+};

package/dist/languages/types.d.ts

@@ -3,7 +3,7 @@
  * Unsupported capabilities must be reported as unsupported, never as inferred AST.
  */
 export type LanguageId = "typescript" | "javascript" | "python" | "java" | "kotlin" | "go" | "rust" | "php" | "dart" | "unknown";
-export type AdapterCapability = "parse" | "symbols" | "definitions" | "references" | "imports" | "calls" | "diagnostics";
+export type AdapterCapability = "parse" | "symbols" | "definitions" | "references" | "imports" | "calls" | "diagnostics" | "types";
 export interface LanguageSymbol {
     id: string;
     name: string;
@@ -22,11 +22,12 @@ export interface LanguageCall {
     callee: string;
     evidence: "ast" | "unsupported";
 }
+export type AdapterCapabilityLevel = "supported" | "unsupported" | "partial";
 export interface ParseResult {
     language: LanguageId;
     file: string;
     ok: boolean;
-    capabilities: Partial<Record<AdapterCapability, "supported" | "unsupported">>;
+    capabilities: Partial<Record<AdapterCapability, AdapterCapabilityLevel>>;
     symbols: LanguageSymbol[];
     imports: LanguageImport[];
     calls: LanguageCall[];
@@ -36,7 +37,7 @@ export interface ParseResult {
 export interface LanguageAdapter {
     id: LanguageId;
     extensions: string[];
-    capabilities(): Partial<Record<AdapterCapability, "supported" | "unsupported">>;
+    capabilities(): Partial<Record<AdapterCapability, AdapterCapabilityLevel>>;
     parse(filePath: string, source: string): Promise<ParseResult>;
 }
 export declare function detectLanguage(filePath: string): LanguageId;

package/dist/mcp/agent/registry.d.ts

@@ -1,6 +1,6 @@
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
 import type { ModelProvider } from "../../ai/types.js";
-export declare const AGENT_MCP_TOOL_NAMES: readonly ["project_context", "project_ask", "code_search", "file_read", "file_create", "file_edit", "agent_plan", "change_verify"];
+export declare const AGENT_MCP_TOOL_NAMES: readonly ["project_context", "project_ask", "code_search", "file_read", "file_create", "file_edit", "approval_issue", "agent_plan", "change_verify"];
 export type AgentMcpToolName = (typeof AGENT_MCP_TOOL_NAMES)[number];
 export declare function listAgentMcpTools(): Tool[];
 export declare function invokeAgentMcpTool(root: string, name: string, args: Record<string, unknown>, options?: {

package/dist/mcp/agent/registry.js

@@ -4,6 +4,8 @@ import { buildAgentPlan } from "../../agent/plan.js";
 import { executeAgentTool, newToolCall } from "../../agent/tools/index.js";
 import { retrieveProjectContext } from "../../agent/context/retrieve.js";
 import { summarizeProjectForChat } from "../../agent/chat/project-summary.js";
+import { consumeApprovalGrant, issueApprovalGrant, hashPlanPayload, hashFileWritePlan, } from "../../product/approval/session.js";
+import { assertForensicReadOnly } from "../../product/forensic/mode.js";
 export const AGENT_MCP_TOOL_NAMES = [
     "project_context",
     "project_ask",
@@ -11,6 +13,7 @@ export const AGENT_MCP_TOOL_NAMES = [
     "file_read",
     "file_create",
     "file_edit",
+    "approval_issue",
     "agent_plan",
     "change_verify",
 ];
@@ -58,30 +61,53 @@ export function listAgentMcpTools() {
         },
         {
             name: "file_create",
-            description: "WRITE: Create file (requires approved=true). Path-safe; never shell. Model cannot self-approve.",
+            description: "WRITE: Create file. Requires approvalToken from issueApprovalGrant / CLI --approve. Bare approved=true is rejected.",
             inputSchema: {
                 type: "object",
                 properties: {
                     path: { type: "string" },
                     content: { type: "string" },
-                    approved: { type: "boolean" },
+                    approvalToken: { type: "string" },
+                    approved: {
+                        type: "boolean",
+                        description: "Legacy flag — insufficient alone; approvalToken required",
+                    },
                 },
-                required: ["path", "content", "approved"],
+                required: ["path", "content", "approvalToken"],
                 additionalProperties: false,
             },
         },
         {
             name: "file_edit",
-            description: "WRITE: Edit file (requires approved=true). Path-safe.",
+            description: "WRITE: Edit file. Requires approvalToken from issueApprovalGrant / CLI --approve.",
             inputSchema: {
                 type: "object",
                 properties: {
                     path: { type: "string" },
                     content: { type: "string" },
                     oldContent: { type: "string" },
-                    approved: { type: "boolean" },
+                    approvalToken: { type: "string" },
+                    approved: {
+                        type: "boolean",
+                        description: "Legacy flag — insufficient alone; approvalToken required",
+                    },
+                },
+                required: ["path", "approvalToken"],
+                additionalProperties: false,
+            },
+        },
+        {
+            name: "approval_issue",
+            description: "TRUSTED: Issue a short-lived approval grant for writes. Requires AGENTDOCTOR_MCP_TRUSTED_APPROVE=1 in the MCP server environment (not model-settable).",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    action: { type: "string" },
+                    resources: { type: "array", items: { type: "string" } },
+                    planHash: { type: "string" },
+                    risk: { type: "string", enum: ["LOW", "MEDIUM", "HIGH", "CRITICAL"] },
                 },
-                required: ["path", "approved"],
+                required: ["action", "resources", "planHash"],
                 additionalProperties: false,
             },
         },
@@ -126,18 +152,6 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                     };
                 }
                 const provider = options?.provider ?? createModelProvider(loadAiConfig());
-                if (provider.id === "none") {
-                    return {
-                        structured: {
-                            ok: false,
-                            error: {
-                                code: "provider_none",
-                                message: "AI chat is not configured. Set AGENTDOCTOR_AI_PROVIDER=mock (or openai-compatible). Silent mock fallback is disabled.",
-                            },
-                        },
-                        isError: true,
-                    };
-                }
                 const chat = new ChatService({
                     root,
                     provider,
@@ -147,7 +161,7 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                     const response = await chat.ask(question);
                     return {
                         structured: { ok: response.status === "ok", response },
-                        isError: response.status !== "ok",
+                        isError: response.status !== "ok" && response.status !== "provider-none",
                     };
                 }
                 finally {
@@ -163,11 +177,23 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                 return { structured: result, isError: !result.ok };
             }
             case "file_create": {
-                if (args.approved !== true) {
+                assertForensicReadOnly(process.env.AGENTDOCTOR_FORENSIC_MODE === "1");
+                const token = typeof args.approvalToken === "string" ? args.approvalToken : undefined;
+                const pathArg = typeof args.path === "string" ? args.path : "";
+                const content = typeof args.content === "string" ? args.content : "";
+                const planHash = hashFileWritePlan("file_create", pathArg, content);
+                const gate = await consumeApprovalGrant({
+                    root,
+                    token,
+                    action: "file_create",
+                    resources: [pathArg],
+                    requirePlanHash: planHash,
+                });
+                if (!gate.ok) {
                     return {
                         structured: {
                             ok: false,
-                            error: { code: "approval_required", message: "approved=true required" },
+                            error: { code: "approval_required", message: gate.reason },
                         },
                         isError: true,
                     };
@@ -176,11 +202,23 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                 return { structured: result, isError: !result.ok };
             }
             case "file_edit": {
-                if (args.approved !== true) {
+                assertForensicReadOnly(process.env.AGENTDOCTOR_FORENSIC_MODE === "1");
+                const token = typeof args.approvalToken === "string" ? args.approvalToken : undefined;
+                const pathArg = typeof args.path === "string" ? args.path : "";
+                const content = typeof args.content === "string" ? args.content : "";
+                const planHash = hashFileWritePlan("file_edit", pathArg, content);
+                const gate = await consumeApprovalGrant({
+                    root,
+                    token,
+                    action: "file_edit",
+                    resources: [pathArg],
+                    requirePlanHash: planHash,
+                });
+                if (!gate.ok) {
                     return {
                         structured: {
                             ok: false,
-                            error: { code: "approval_required", message: "approved=true required" },
+                            error: { code: "approval_required", message: gate.reason },
                         },
                         isError: true,
                     };
@@ -192,6 +230,54 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                 }), { allowWrite: true, approvedByHuman: true });
                 return { structured: result, isError: !result.ok };
             }
+            case "approval_issue": {
+                if (process.env.AGENTDOCTOR_MCP_TRUSTED_APPROVE !== "1") {
+                    return {
+                        structured: {
+                            ok: false,
+                            error: {
+                                code: "trust_required",
+                                message: "approval_issue requires AGENTDOCTOR_MCP_TRUSTED_APPROVE=1 in the MCP host environment",
+                            },
+                        },
+                        isError: true,
+                    };
+                }
+                const resources = Array.isArray(args.resources)
+                    ? args.resources.filter((r) => typeof r === "string")
+                    : [];
+                const action = typeof args.action === "string" ? args.action : "file_edit";
+                const planHash = typeof args.planHash === "string" && args.planHash.length >= 8
+                    ? args.planHash
+                    : hashPlanPayload(action);
+                const risk = (typeof args.risk === "string" ? args.risk : "MEDIUM");
+                try {
+                    const grant = await issueApprovalGrant({
+                        root,
+                        action,
+                        resources,
+                        risk,
+                        planHash,
+                        actor: "mcp-trusted-host",
+                    });
+                    return {
+                        structured: { ok: true, token: grant.token, expiresAt: grant.expiresAt, planHash },
+                        isError: false,
+                    };
+                }
+                catch (error) {
+                    return {
+                        structured: {
+                            ok: false,
+                            error: {
+                                code: "invalid_grant",
+                                message: error instanceof Error ? error.message : String(error),
+                            },
+                        },
+                        isError: true,
+                    };
+                }
+            }
             case "agent_plan": {
                 const goal = typeof args.goal === "string" ? args.goal : "";
                 const plan = await buildAgentPlan({ root, goal });

package/dist/mcp/intelligence/handlers.d.ts

@@ -14,3 +14,6 @@ export declare function handleArchitectureCheckTool(rootInput: string): Promise<
 export declare function handleProofInspectTool(rootInput: string, args: Record<string, unknown>): Promise<unknown>;
 export declare function handleEvidenceInspectTool(rootInput: string, args: Record<string, unknown>): Promise<unknown>;
 export declare function handleGraphQueryTool(rootInput: string, args: Record<string, unknown>): Promise<unknown>;
+export declare function handleProjectDnaTool(rootInput: string): Promise<unknown>;
+export declare function handleSoftwareMapTool(rootInput: string): Promise<unknown>;
+export declare function handleWhatIfTool(rootInput: string, args: Record<string, unknown>): Promise<unknown>;