@shomra/agent 0.3.17 → 0.3.18

package/src/inventory/artifacts/hooks.mjs

@@ -0,0 +1,14 @@
+import { stripJsonComments } from './file-read.mjs';
+
+export function canonicalHooks(text) {
+  let doc;
+  try {
+    doc = JSON.parse(stripJsonComments(text));
+  } catch {
+    return null;
+  }
+  if (!doc || typeof doc !== 'object') return null;
+  const hooks = doc.hooks;
+  if (!hooks || typeof hooks !== 'object' || !Object.keys(hooks).length) return null;
+  return JSON.stringify({ hooks }, null, 2);
+}

package/src/inventory/artifacts/limits.mjs

@@ -0,0 +1,37 @@
+import os from 'node:os';
+import path from 'node:path';
+
+export const HOME = os.homedir();
+
+export const ARTIFACT_KINDS = ['skill', 'command', 'subagent', 'hook'];
+
+export const MAX_DEPTH = 6;
+
+export const MAX_DIRS = 4_000;
+
+export const MAX_ARTIFACTS = 400;
+
+export const MAX_FILE_BYTES = 64_000;
+
+export const MAX_BUNDLED = 20;
+
+export const MAX_TOTAL_BYTES = 4_000_000;
+
+export const IGNORE_DIRS = new Set([
+  'node_modules', '.git', 'dist', 'build', 'out', 'coverage', '__pycache__',
+  '.venv', 'venv', 'site-packages', '.next', '.turbo', 'target',
+
+  'projects', 'todos', 'statsig', 'shell-snapshots', 'history', 'logs', 'cache',
+]);
+
+export const TEXT_EXTS = new Set([
+  'md', 'mdc', 'markdown', 'txt', 'toml', 'json', 'jsonc', 'yaml', 'yml',
+  'sh', 'bash', 'zsh', 'ps1', 'bat', 'cmd', 'py', 'js', 'mjs', 'cjs', 'ts',
+  'rb', 'pl', 'lua', 'sql', 'env', 'cfg', 'ini', 'conf',
+]);
+
+export const extOf = (p) => {
+  const b = path.basename(p);
+  const i = b.lastIndexOf('.');
+  return i > 0 ? b.slice(i + 1).toLowerCase() : '';
+};

package/src/inventory/artifacts/marketplaces.mjs

@@ -0,0 +1,45 @@
+import path from 'node:path';
+import { readJsonAt } from './file-read.mjs';
+
+export const SETTINGS_BASENAMES = new Set([
+  'settings.json', 'settings.local.json', 'hooks.json', 'config.toml',
+]);
+
+export const PLUGIN_PATH_RE = /(^|\/)plugins\/marketplaces\/([^/]+)\//;
+
+export const CATALOGUE_DIR_RE = /(^|\/)(\.tmp|tmp|temp|vendor_imports|bundled-marketplaces|backups?)\//i;
+
+export function installedMarketplaces(root) {
+
+  const out = new Set();
+
+  const manifest = readJsonAt(path.join(root, 'plugins', 'installed_plugins.json'));
+  if (manifest === undefined) return null;
+  if (manifest !== null) {
+    const plugins = manifest?.plugins;
+    if (plugins && typeof plugins === 'object') {
+      for (const [key, value] of Object.entries(plugins)) {
+        addPluginKey(out, key);
+        const named = value && typeof value === 'object' ? (value.marketplace ?? value.source) : null;
+        if (typeof named === 'string') out.add(named);
+      }
+    }
+  }
+
+  for (const f of ['settings.json', 'settings.local.json']) {
+    const doc = readJsonAt(path.join(root, f));
+    if (doc === undefined) return null;
+    if (doc === null) continue;
+    const enabled = doc?.enabledPlugins;
+    if (enabled && typeof enabled === 'object') {
+      for (const key of Object.keys(enabled)) addPluginKey(out, key);
+    }
+  }
+
+  return out;
+}
+
+function addPluginKey(set, key) {
+  const at = String(key).indexOf('@');
+  set.add(at > -1 ? String(key).slice(at + 1) : String(key));
+}

package/src/inventory/artifacts/roots.mjs

@@ -0,0 +1,20 @@
+import path from 'node:path';
+import { HOME } from './limits.mjs';
+
+export function artifactRoots(cwd = process.cwd()) {
+  return [
+    { vendor: 'claude-code', scope: 'user', dir: path.join(HOME, '.claude') },
+    { vendor: 'claude-code', scope: 'project', dir: path.join(cwd, '.claude') },
+    { vendor: 'cursor', scope: 'user', dir: path.join(HOME, '.cursor') },
+    { vendor: 'cursor', scope: 'project', dir: path.join(cwd, '.cursor') },
+    { vendor: 'codex', scope: 'user', dir: path.join(HOME, '.codex') },
+    { vendor: 'codex', scope: 'project', dir: path.join(cwd, '.codex') },
+    { vendor: 'gemini', scope: 'user', dir: path.join(HOME, '.gemini') },
+    { vendor: 'gemini', scope: 'project', dir: path.join(cwd, '.gemini') },
+    { vendor: 'windsurf', scope: 'project', dir: path.join(cwd, '.windsurf') },
+    { vendor: 'opencode', scope: 'user', dir: path.join(HOME, '.opencode') },
+    { vendor: 'opencode', scope: 'project', dir: path.join(cwd, '.opencode') },
+
+    { vendor: 'copilot', scope: 'project', dir: path.join(cwd, '.github') },
+  ];
+}

package/src/inventory/artifacts/walk.mjs

@@ -0,0 +1,36 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { IGNORE_DIRS, MAX_DEPTH } from './limits.mjs';
+
+export function walkRoot(dir, budget) {
+  const out = [];
+  const seen = new Set();
+  const queue = [{ d: dir, depth: 0 }];
+  while (queue.length && budget.dirs > 0) {
+    const { d, depth } = queue.shift();
+    let real;
+    try {
+      real = fs.realpathSync(d);
+    } catch {
+      continue;
+    }
+    if (seen.has(real)) continue;
+    seen.add(real);
+    budget.dirs--;
+    let entries;
+    try {
+      entries = fs.readdirSync(d, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      const full = path.join(d, e.name);
+      if (e.isDirectory()) {
+        if (depth < MAX_DEPTH && !IGNORE_DIRS.has(e.name)) queue.push({ d: full, depth: depth + 1 });
+      } else if (e.isFile()) {
+        out.push(full);
+      }
+    }
+  }
+  return out;
+}

package/src/inventory/discovery/ai-dependencies.mjs

@@ -0,0 +1,161 @@
+import path from 'node:path';
+import { AI_USAGE_CATEGORY_LABEL, isAiUsageScannable, rollupAiUsage, scanAiUsage } from '../../detect/ai-usage.mjs';
+import { readJson, readText } from './fs-read.mjs';
+import { walkWorkspace } from './workspace.mjs';
+
+const NPM_AI = new Set([
+  'openai', 'ai', 'langchain', 'llamaindex', 'ollama', 'replicate', 'cohere-ai',
+  'groq-sdk', 'together-ai', 'openrouter', 'mistralai', 'chromadb',
+]);
+
+const NPM_AI_PREFIX = ['@anthropic-ai/', '@google/generative-ai', '@google/genai', '@ai-sdk/', '@langchain/', '@llamaindex/', '@mistralai/', '@huggingface/', '@pinecone-database/', '@qdrant/'];
+
+const PY_AI = [
+  'openai', 'anthropic', 'google-generativeai', 'google-genai', 'langchain',
+  'langchain-openai', 'langchain-anthropic', 'langchain-community', 'llama-index',
+  'llama_index', 'transformers', 'sentence-transformers', 'mistralai', 'cohere',
+  'groq', 'huggingface-hub', 'huggingface_hub', 'ollama', 'litellm', 'guidance',
+  'vllm', 'crewai', 'autogen', 'pyautogen', 'haystack-ai', 'instructor', 'dspy',
+  'dspy-ai', 'semantic-kernel', 'replicate', 'together', 'chromadb', 'qdrant-client',
+  'pinecone-client', 'pinecone', 'faiss-cpu', 'faiss-gpu', 'tiktoken',
+];
+
+const VECTOR_LIBS = {
+  chromadb: { engine: 'chroma', hosted: false },
+  'faiss-cpu': { engine: 'faiss', hosted: false },
+  'faiss-gpu': { engine: 'faiss', hosted: false },
+  lancedb: { engine: 'lancedb', hosted: false },
+  pgvector: { engine: 'pgvector', hosted: false },
+  'qdrant-client': { engine: 'qdrant', hosted: true },
+  'pinecone-client': { engine: 'pinecone', hosted: true },
+  pinecone: { engine: 'pinecone', hosted: true },
+  'weaviate-client': { engine: 'weaviate', hosted: true },
+  'weaviate-ts-client': { engine: 'weaviate', hosted: true },
+  pymilvus: { engine: 'milvus', hosted: true },
+};
+
+export function vectorLibInfo(pkg) {
+  if (VECTOR_LIBS[pkg]) return VECTOR_LIBS[pkg];
+  if (pkg.startsWith('@pinecone-database/')) return { engine: 'pinecone', hosted: true };
+  if (pkg.startsWith('@qdrant/')) return { engine: 'qdrant', hosted: true };
+  return null;
+}
+
+const isVectorLib = (pkg) => !!vectorLibInfo(pkg);
+
+export const PY_VECTOR = [
+  'chromadb', 'faiss-cpu', 'faiss-gpu', 'lancedb', 'pgvector', 'qdrant-client',
+  'pinecone-client', 'pinecone', 'weaviate-client', 'pymilvus',
+];
+
+export const VECTOR_ENV = {
+  PINECONE_API_KEY: { engine: 'pinecone', kind: 'key' },
+  PINECONE_ENVIRONMENT: { engine: 'pinecone', kind: 'endpoint' },
+  PINECONE_HOST: { engine: 'pinecone', kind: 'endpoint' },
+  PINECONE_INDEX: { engine: 'pinecone', kind: 'endpoint' },
+  PINECONE_INDEX_NAME: { engine: 'pinecone', kind: 'endpoint' },
+  WEAVIATE_URL: { engine: 'weaviate', kind: 'endpoint' },
+  WEAVIATE_HOST: { engine: 'weaviate', kind: 'endpoint' },
+  WEAVIATE_API_KEY: { engine: 'weaviate', kind: 'key' },
+  QDRANT_URL: { engine: 'qdrant', kind: 'endpoint' },
+  QDRANT_HOST: { engine: 'qdrant', kind: 'endpoint' },
+  QDRANT_API_KEY: { engine: 'qdrant', kind: 'key' },
+  MILVUS_URI: { engine: 'milvus', kind: 'endpoint' },
+  MILVUS_HOST: { engine: 'milvus', kind: 'endpoint' },
+  ZILLIZ_CLOUD_URI: { engine: 'milvus', kind: 'endpoint' },
+  CHROMA_SERVER_HOST: { engine: 'chroma', kind: 'endpoint' },
+  CHROMA_HOST: { engine: 'chroma', kind: 'endpoint' },
+};
+
+function npmAiDeps(pkg) {
+  const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}), ...(pkg.peerDependencies || {}), ...(pkg.optionalDependencies || {}) };
+  const hits = [];
+  for (const name of Object.keys(deps)) {
+    if (NPM_AI.has(name) || NPM_AI_PREFIX.some((p) => name.startsWith(p))) hits.push(name);
+  }
+  return hits;
+}
+
+function pyAiDeps(text) {
+  const hits = [];
+  for (const pkg of PY_AI) {
+    const re = new RegExp(`(^|[^a-z0-9_.-])${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}([^a-z0-9_.-]|$)`, 'im');
+    if (re.test(text)) hits.push(pkg);
+  }
+  return hits;
+}
+
+export function discoverAiDependencies(roots = [process.cwd()], files = null) {
+  const walk = files || walkWorkspace(roots);
+  const byPkg = new Map();
+  const add = (eco, pkg, manifest) => {
+    const key = `${eco}:${pkg}`;
+    if (!byPkg.has(key)) byPkg.set(key, { pkg, eco, manifests: new Set() });
+    byPkg.get(key).manifests.add(manifest);
+  };
+  for (const { file } of walk.manifests) {
+    const base = path.basename(file);
+    if (base === 'package.json') {
+      const json = readJson(file);
+      if (!json) continue;
+
+      for (const pkg of npmAiDeps(json)) if (!isVectorLib(pkg)) add('npm', pkg, file);
+    } else {
+      const text = readText(file, 100_000);
+      if (text == null) continue;
+      for (const pkg of pyAiDeps(text)) if (!isVectorLib(pkg)) add('pip', pkg, file);
+    }
+  }
+  const assets = [];
+  for (const { pkg, eco, manifests } of byPkg.values()) {
+    const list = [...manifests];
+    assets.push({
+      type: 'AI_TOOL',
+      name: `${pkg} (${eco})`,
+      identifier: `dep:${eco}:${pkg}`,
+      vendor: 'ai-sdk',
+      metadata: {
+        category: 'dependency',
+        ecosystem: eco,
+        package: pkg,
+        usedInProjects: list.length,
+        manifests: list.slice(0, 10),
+      },
+    });
+  }
+  return assets;
+}
+
+export function discoverAiUsageInCode(roots = [process.cwd()], files = null) {
+  const walk = files || walkWorkspace(roots);
+  const usages = [];
+  for (const { file } of walk.source || []) {
+    if (!isAiUsageScannable(path.basename(file))) continue;
+    const text = readText(file, 300_000);
+    if (text == null) continue;
+    for (const u of scanAiUsage(text, file)) usages.push(u);
+  }
+  const assets = [];
+  for (const row of rollupAiUsage(usages)) {
+    const site = row.firstSite;
+    assets.push({
+      type: 'AI_TOOL',
+      name: `${row.label} (in code)`,
+      identifier: `ai-usage:${row.provider}`,
+      vendor: 'ai-sdk',
+      metadata: {
+        category: 'code-usage',
+        provider: row.provider,
+        aiCategory: row.category,
+        aiCategoryLabel: AI_USAGE_CATEGORY_LABEL[row.category],
+        fileCount: row.files.length,
+        files: row.files.slice(0, 10),
+        models: row.models.slice(0, 10),
+        callSites: row.sightings,
+        hasCallSite: row.hasCallSite,
+        firstSite: site ? { file: site.file, line: site.line } : null,
+      },
+    });
+  }
+  return assets;
+}

package/src/inventory/discovery/ai-tools.mjs

@@ -0,0 +1,23 @@
+import path from 'node:path';
+import { firstExisting } from './fs-read.mjs';
+import { discoverLocalRuntimes } from './local-runtimes.mjs';
+import { APPDATA, HOME, LOCALAPPDATA, vscodeUserDir } from './platform.mjs';
+
+export function discoverAiTools() {
+  const checks = [
+    { vendor: 'cursor', name: 'Cursor', probe: [path.join(HOME, '.cursor')] },
+    { vendor: 'claude', name: 'Claude Desktop', probe: [path.join(APPDATA, 'Claude'), path.join(HOME, 'Library', 'Application Support', 'Claude'), path.join(HOME, '.config', 'Claude')] },
+    { vendor: 'windsurf', name: 'Windsurf', probe: [path.join(HOME, '.codeium', 'windsurf')] },
+    { vendor: 'continue', name: 'Continue', probe: [path.join(HOME, '.continue')] },
+    { vendor: 'zed', name: 'Zed', probe: [path.join(HOME, '.config', 'zed'), path.join(HOME, 'Library', 'Application Support', 'Zed')] },
+    { vendor: 'cody', name: 'Sourcegraph Cody', probe: [path.join(vscodeUserDir(), 'globalStorage', 'sourcegraph.cody-ai')] },
+    { vendor: 'copilot', name: 'GitHub Copilot (VS Code)', probe: [path.join(vscodeUserDir(), 'globalStorage', 'github.copilot'), path.join(vscodeUserDir(), 'globalStorage', 'github.copilot-chat')] },
+    { vendor: 'tabnine', name: 'Tabnine', probe: [path.join(HOME, '.tabnine'), path.join(LOCALAPPDATA, 'TabNine')] },
+  ];
+  const assets = [];
+  for (const c of checks) {
+    const at = firstExisting(c.probe);
+    if (at) assets.push({ type: 'AI_TOOL', name: c.name, identifier: at, vendor: c.vendor, metadata: { category: 'assistant', detectedAt: at } });
+  }
+  return [...assets, ...discoverLocalRuntimes()];
+}

package/src/inventory/discovery/all.mjs

@@ -0,0 +1,40 @@
+import { clampAsset } from '../../core/wire-limits.mjs';
+import { discoverAiDependencies, discoverAiUsageInCode } from './ai-dependencies.mjs';
+import { discoverAiTools } from './ai-tools.mjs';
+import { discoverCodingAgents } from './coding-agents.mjs';
+import { discoverMcpClients } from './mcp-clients.mjs';
+import { discoverMcpServers } from './mcp-servers.mjs';
+import { discoverDotenvKeys, discoverModelKeys } from './model-keys.mjs';
+import { discoverRulesFiles } from './rules-files.mjs';
+import { discoverVectorStores } from './vector-stores.mjs';
+import { resolveRoots, walkWorkspace } from './workspace.mjs';
+
+export function discoverAll(roots = [process.cwd()], opts = {}) {
+  const { autoExpand = true } = opts;
+  const scanRoots = resolveRoots(roots, autoExpand);
+  const files = walkWorkspace(scanRoots);
+  const all = [
+    ...discoverMcpServers(scanRoots, files),
+    ...discoverRulesFiles(scanRoots, files),
+    ...discoverAiDependencies(scanRoots, files),
+    ...discoverAiUsageInCode(scanRoots, files),
+    ...discoverMcpClients(scanRoots, files),
+    ...discoverVectorStores(scanRoots, files),
+    ...discoverDotenvKeys(scanRoots, files),
+    ...discoverAiTools(),
+    ...discoverCodingAgents(scanRoots),
+    ...discoverModelKeys(),
+  ];
+
+  const clamped = all.map(clampAsset);
+
+  const seen = new Set();
+  const out = [];
+  for (const a of clamped) {
+    const key = `${a.type}::${a.identifier || a.name}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(a);
+  }
+  return out;
+}

package/src/inventory/discovery/coding-agents.mjs

@@ -0,0 +1,77 @@
+import path from 'node:path';
+import { canonicalGrant, readVendorPosture } from '../agent-posture.mjs';
+import { exists, readText } from './fs-read.mjs';
+import { HOME, PLAT, vscodeUserDir } from './platform.mjs';
+import { execFileSync } from 'node:child_process';
+
+export function listProcesses() {
+  try {
+    if (PLAT === 'win32') {
+      const out = execFileSync('tasklist', ['/fo', 'csv', '/nh'], { timeout: 4000, encoding: 'utf8', windowsHide: true, maxBuffer: 16 * 1024 * 1024 });
+      return out.split(/\r?\n/).map((l) => (l.match(/^"([^"]+)"/)?.[1] || '').toLowerCase()).filter(Boolean);
+    }
+    const out = execFileSync('ps', ['-eo', 'comm='], { timeout: 4000, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+    return out.split(/\r?\n/).map((s) => s.trim().toLowerCase()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+export function discoverCodingAgents(roots = [process.cwd()]) {
+  const cwd = process.cwd();
+  const agents = [
+    { vendor: 'claude-code', name: 'Claude Code', probes: [path.join(HOME, '.claude.json'), path.join(HOME, '.claude')], hookFiles: [path.join(HOME, '.claude', 'settings.json'), path.join(cwd, '.claude', 'settings.json')] },
+    { vendor: 'cursor', name: 'Cursor', probes: [path.join(HOME, '.cursor')], hookFiles: [path.join(HOME, '.cursor', 'hooks.json'), path.join(cwd, '.cursor', 'hooks.json')] },
+    { vendor: 'windsurf', name: 'Windsurf', probes: [path.join(HOME, '.codeium', 'windsurf')], hookFiles: [path.join(HOME, '.codeium', 'windsurf', 'hooks.json'), path.join(cwd, '.windsurf', 'hooks.json')] },
+    { vendor: 'gemini', name: 'Gemini CLI', probes: [path.join(HOME, '.gemini')], hookFiles: [path.join(HOME, '.gemini', 'settings.json'), path.join(cwd, '.gemini', 'settings.json')] },
+    { vendor: 'codex', name: 'OpenAI Codex CLI', probes: [path.join(HOME, '.codex')], hookFiles: [path.join(HOME, '.codex', 'hooks.json'), path.join(cwd, '.codex', 'hooks.json')] },
+    { vendor: 'copilot', name: 'GitHub Copilot CLI', probes: [path.join(HOME, '.copilot')], hookFiles: [path.join(HOME, '.copilot', 'hooks', 'shomra.json'), path.join(cwd, '.github', 'hooks', 'shomra.json')] },
+    { vendor: 'cline', name: 'Cline', probes: [path.join(vscodeUserDir(), 'globalStorage', 'saoudrizwan.claude-dev')], hookFiles: [path.join(HOME, '.cline', 'hooks.json'), path.join(cwd, '.cline', 'hooks.json')] },
+    { vendor: 'roo', name: 'Roo Code', probes: [path.join(vscodeUserDir(), 'globalStorage', 'rooveterinaryinc.roo-cline')], hookFiles: [path.join(cwd, '.roo', 'hooks.json')] },
+    { vendor: 'aider', name: 'Aider', probes: [path.join(HOME, '.aider.conf.yml'), path.join(cwd, '.aider.conf.yml'), path.join(HOME, '.aider')], hookFiles: [path.join(HOME, '.aider.conf.yml'), path.join(cwd, '.aider.conf.yml')] },
+  ];
+  const assets = [];
+  for (const a of agents) {
+    const installedAt = a.probes.find((p) => exists(p));
+    if (!installedAt) continue;
+    const guardFile = a.hookFiles.find((f) => {
+      const t = readText(f, 20_000);
+      return t != null && /shomra/i.test(t);
+    });
+
+    const posture = readVendorPosture(a.vendor, cwd);
+    const grant = canonicalGrant(posture);
+    assets.push({
+      type: 'AI_AGENT',
+      name: a.name,
+      identifier: `agent:${a.vendor}`,
+      vendor: a.vendor,
+      ...(grant ? { content: grant } : {}),
+      metadata: {
+        detectedAt: installedAt,
+        guarded: !!guardFile,
+        guardFile: guardFile || null,
+        posture: posture
+          ? {
+              tier: posture.tier,
+              readable: posture.readable,
+              claim: posture.claim,
+              mode: posture.mode,
+              allowCount: posture.allow.length,
+              denyCount: posture.deny.length,
+              askCount: posture.ask.length,
+              allow: posture.allow.slice(0, 25),
+              enableAllProjectMcpServers: posture.enableAllProjectMcpServers,
+              switches: posture.switches,
+              mcpServerCount: posture.mcpServers.length,
+              autoApprovedMcp: posture.autoApprovedMcp,
+              unreadableCount: posture.unreadableCount,
+
+              sources: posture.sources.map((s) => ({ path: s.path, scope: s.scope, state: s.state, reason: s.reason })),
+            }
+          : null,
+      },
+    });
+  }
+  return assets;
+}

package/src/inventory/discovery/fs-read.mjs

@@ -0,0 +1,36 @@
+import fs from 'node:fs';
+
+export function readJson(file) {
+  try {
+    return JSON.parse(stripJsonComments(fs.readFileSync(file, 'utf8')));
+  } catch {
+    return null;
+  }
+}
+
+function stripJsonComments(s) {
+  return String(s)
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/(^|[^:])\/\/.*$/gm, '$1');
+}
+
+export function readText(file, cap = 200_000) {
+  try {
+    const b = fs.readFileSync(file, 'utf8');
+    return b.length > cap ? b.slice(0, cap) : b;
+  } catch {
+    return null;
+  }
+}
+
+export function exists(p) {
+  try {
+    return fs.existsSync(p);
+  } catch {
+    return false;
+  }
+}
+
+export function firstExisting(paths) {
+  return paths.find((p) => p && exists(p)) || null;
+}

package/src/inventory/discovery/local-runtimes.mjs

@@ -0,0 +1,53 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { listProcesses } from './coding-agents.mjs';
+import { firstExisting } from './fs-read.mjs';
+import { APPDATA, HOME, LOCALAPPDATA } from './platform.mjs';
+
+export function discoverLocalRuntimes() {
+  const runtimes = [
+    { vendor: 'ollama', name: 'Ollama', dirs: [path.join(HOME, '.ollama'), path.join(LOCALAPPDATA, 'Ollama')], modelsDir: path.join(HOME, '.ollama', 'models', 'manifests'), proc: ['ollama'] },
+    { vendor: 'lmstudio', name: 'LM Studio', dirs: [path.join(HOME, '.lmstudio'), path.join(HOME, '.cache', 'lm-studio'), path.join(LOCALAPPDATA, 'LM Studio')], proc: ['lm studio', 'lmstudio', 'lms'] },
+    { vendor: 'jan', name: 'Jan', dirs: [path.join(HOME, 'jan'), path.join(HOME, '.jan'), path.join(APPDATA, 'Jan')], proc: ['jan'] },
+    { vendor: 'gpt4all', name: 'GPT4All', dirs: [path.join(HOME, '.cache', 'gpt4all'), path.join(HOME, 'Library', 'Application Support', 'nomic.ai', 'GPT4All'), path.join(LOCALAPPDATA, 'nomic.ai', 'GPT4All')], proc: ['gpt4all'] },
+    { vendor: 'huggingface', name: 'Hugging Face cache', dirs: [path.join(HOME, '.cache', 'huggingface'), path.join(process.env.HF_HOME || '', 'hub')], proc: [] },
+    { vendor: 'localai', name: 'LocalAI', dirs: [path.join(HOME, '.localai')], proc: ['local-ai', 'localai'] },
+    { vendor: 'textgen', name: 'Text Generation WebUI', dirs: [], proc: ['text-generation', 'oobabooga'] },
+    { vendor: 'vllm', name: 'vLLM', dirs: [], proc: ['vllm'] },
+  ];
+  const procs = listProcesses();
+  const assets = [];
+  for (const r of runtimes) {
+    const at = firstExisting(r.dirs);
+    const running = r.proc.some((tok) => procs.some((p) => p.includes(tok)));
+    if (!at && !running) continue;
+    const meta = { category: 'local-runtime', detectedAt: at || null, running };
+    if (r.vendor === 'ollama' && r.modelsDir) meta.models = ollamaModels(r.modelsDir);
+    assets.push({ type: 'AI_TOOL', name: r.name, identifier: at || `proc:${r.vendor}`, vendor: r.vendor, metadata: meta });
+  }
+  return assets;
+}
+
+function ollamaModels(manifestsDir) {
+  const out = [];
+  const walk = (dir, depth) => {
+    if (depth > 5 || out.length > 100) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) walk(full, depth + 1);
+      else if (e.isFile()) {
+
+        const rel = path.relative(manifestsDir, full).split(path.sep);
+        if (rel.length >= 2) out.push(`${rel.slice(1, -1).join('/')}:${rel[rel.length - 1]}`);
+      }
+    }
+  };
+  walk(manifestsDir, 0);
+  return out.slice(0, 100);
+}

package/src/inventory/discovery/mcp-clients.mjs

@@ -0,0 +1,67 @@
+import path from 'node:path';
+import { readJson, readText } from './fs-read.mjs';
+import { walkWorkspace } from './workspace.mjs';
+
+const NPM_MCP_CLIENT = new Set(['mcp-use', 'mcp-client']);
+
+const NPM_MCP_CLIENT_PREFIX = ['@modelcontextprotocol/', '@mastra/mcp', '@langchain/mcp'];
+
+const PY_MCP_CLIENT = ['mcp', 'fastmcp', 'mcp-use', 'mcpadapt', 'langchain-mcp-adapters'];
+
+function npmMcpClientDeps(pkg) {
+  const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}), ...(pkg.peerDependencies || {}), ...(pkg.optionalDependencies || {}) };
+  const hits = [];
+  for (const name of Object.keys(deps)) {
+    if (NPM_MCP_CLIENT.has(name) || NPM_MCP_CLIENT_PREFIX.some((p) => name.startsWith(p))) hits.push(name);
+  }
+  return hits;
+}
+
+function pyMcpClientDeps(text) {
+  const hits = [];
+  for (const pkg of PY_MCP_CLIENT) {
+    const re = new RegExp(`(^|[^a-z0-9_.-])${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}([^a-z0-9_.-]|$)`, 'im');
+    if (re.test(text)) hits.push(pkg);
+  }
+  return hits;
+}
+
+export function discoverMcpClients(roots = [process.cwd()], files = null) {
+  const walk = files || walkWorkspace(roots);
+  const byPkg = new Map();
+  const add = (eco, pkg, manifest) => {
+    const key = `${eco}:${pkg}`;
+    if (!byPkg.has(key)) byPkg.set(key, { pkg, eco, manifests: new Set() });
+    byPkg.get(key).manifests.add(manifest);
+  };
+  for (const { file } of walk.manifests) {
+    const base = path.basename(file);
+    if (base === 'package.json') {
+      const json = readJson(file);
+      if (!json) continue;
+      for (const pkg of npmMcpClientDeps(json)) add('npm', pkg, file);
+    } else {
+      const text = readText(file, 100_000);
+      if (text == null) continue;
+      for (const pkg of pyMcpClientDeps(text)) add('pip', pkg, file);
+    }
+  }
+  const assets = [];
+  for (const { pkg, eco, manifests } of byPkg.values()) {
+    const list = [...manifests];
+    assets.push({
+      type: 'AI_TOOL',
+      name: `${pkg} (${eco})`,
+      identifier: `mcp-client:${eco}:${pkg}`,
+      vendor: 'mcp-client',
+      metadata: {
+        category: 'mcp-client',
+        ecosystem: eco,
+        package: pkg,
+        usedInProjects: list.length,
+        manifests: list.slice(0, 10),
+      },
+    });
+  }
+  return assets;
+}