@subseam/mcp 0.3.1 → 0.3.3

package/README.md

@@ -17,7 +17,7 @@ The script runs `npm install @subseam/mcp@<version>` in the host directory and p
 The equivalent by hand:
 
 ```
-npm install @subseam/mcp@0.3.1
+npm install @subseam/mcp@0.3.3
 claude mcp add-json --scope user subseam '{"command":"node","args":["<dir>/node_modules/@subseam/mcp/dist/main.js"],"env":{"SUBSEAM_URL":"https://api.example.subseam.com","SUBSEAM_TENANT":"<your tenant id>"}}'
 ```
 

package/dist/main.js

@@ -20170,6 +20170,9 @@ init_esm_shims();
 init_esm_shims();
 var VERIFY_ANALYSES = ["coverage-residue", "mutation", "witness"];
 
+// ../verify-contract/src/request/scratch-headers.ts
+init_esm_shims();
+
 // ../verify-contract/src/result/verdict.ts
 init_esm_shims();
 
@@ -20238,7 +20241,8 @@ var ROOT_SCRIPTS = [
   "test:extract-prod-compose",
   "test:backend",
   "test:control",
-  "test:oracle"
+  "test:oracle",
+  "test:oracle-exhaustive"
 ];
 
 // ../execution-contract/src/workload/scoping.ts
@@ -20565,7 +20569,8 @@ var VERIFY_ROOT_SCRIPTS = [
   "test:extract-prod-compose",
   "test:backend",
   "test:control",
-  "test:oracle"
+  "test:oracle",
+  "test:oracle-exhaustive"
 ];
 
 // ../verify-contract/src/job/artifact.ts
@@ -20628,6 +20633,10 @@ init_esm_shims();
 // ../verify/src/delta/pushed-head.ts
 init_esm_shims();
 
+// ../verify/src/delta/walk-lag.ts
+init_esm_shims();
+var SCRATCH_BODY_LIMIT_BYTES = 64 * 1024 * 1024;
+
 // ../verify/src/service/gateway-verify.ts
 init_esm_shims();
 
@@ -36306,8 +36315,11 @@ var BuildRequestSchema = external_exports.discriminatedUnion("op", [
     op: external_exports.literal("config"),
     workspaceId: external_exports.string().uuid(),
     set: external_exports.object({
-      landCommand: external_exports.array(external_exports.string()).min(1),
-      landingShape: external_exports.enum(["direct-push", "pr"]).optional()
+      landCommand: external_exports.array(external_exports.string()).min(1).optional(),
+      landingShape: external_exports.enum(["direct-push", "pr"]).optional(),
+      /** Whether Secure is on for this repo. Every `set` field is optional and an absent one is left
+       *  as it stands, so enabling Secure never touches the gate; a `set` naming nothing is refused. */
+      secure: external_exports.object({ enabled: external_exports.boolean() }).optional()
     }).optional()
   })
 ]).readonly();
@@ -36556,6 +36568,9 @@ var BuildResultSchema = external_exports.union([
     /** Which shape this repo's lands take. Null ONLY when the repo has no config row at all — the
      *  same absence `landCommand` reports null for. A repo that has a row always has a shape. */
     landingShape: external_exports.enum(["direct-push", "pr"]).nullable(),
+    /** Whether Secure is on for this repo. Not nullable: no config row means Secure is off, which is
+     *  an answer, not an absence — the repair miner scans nothing either way. */
+    secure: external_exports.object({ enabled: external_exports.boolean() }),
     verification: external_exports.object({
       declaredScopeSupported: external_exports.boolean(),
       scopePatternForms: external_exports.array(external_exports.string())
@@ -43118,6 +43133,20 @@ var coerce = {
 };
 var NEVER2 = INVALID;
 
+// src/discovery-failure.ts
+init_esm_shims();
+var DISCOVERY_FAILURE_TOOL = "subseam_unavailable";
+function discoveryFailureText(url2, reason) {
+  return `subseam is unavailable this session: capability discovery failed, so no subseam tools are mounted. Tried GET ${url2.replace(/\/$/, "")}/capabilities \u2014 ${reason}. Check SUBSEAM_URL is your subseam API URL and that it is reachable, then restart the MCP server.`;
+}
+function mountDiscoveryFailure(server, url2, reason) {
+  const text = discoveryFailureText(url2, reason);
+  server.registerTool(DISCOVERY_FAILURE_TOOL, { description: text, inputSchema: {} }, () => ({
+    content: [{ type: "text", text }],
+    isError: true
+  }));
+}
+
 // src/gateway.ts
 init_esm_shims();
 var TENANT_HEADER2 = "x-tenant-id";
@@ -45043,9 +45072,11 @@ Land ${inFlight.landedCommit} is pushed and awaiting the walk. Do NOT push again
     case "config": {
       const gate = r.landCommand === null ? "Land gate: NONE configured for this repo \u2014 a land cannot be authorized until one is set." : `Land gate: ${r.landCommand.join(" ")}`;
       const shape = r.landingShape === null ? "Landing shape: none configured (this repo has no config row)." : r.landingShape === "pr" ? "Landing shape: pr \u2014 a land pushes the verified commit to its own branch and opens a pull request. It lands when that PR is merged." : "Landing shape: direct-push \u2014 a land fast-forwards the verified commit straight onto the default branch.";
+      const secure = r.secure.enabled ? "Secure: on \u2014 this repo's landed commits are scanned, and the taint findings they remove are kept." : "Secure: off \u2014 this repo is not scanned. Turn it on with set: { secure: { enabled: true } }.";
       const scope = r.verification.declaredScopeSupported ? `Declared run scope: supported. Pattern forms: ${r.verification.scopePatternForms.join(", ")}.` : "Declared run scope: not supported by this server.";
       return `${gate}
 ${shape}
+${secure}
 ${scope}`;
     }
     case "run":
@@ -45238,19 +45269,24 @@ var buildLandsTool = {
 };
 var configTool = {
   name: "config",
-  description: "Read \u2014 or set \u2014 the hosted workspace repo's land gate, plus this server's verification affordances. Called bare it is read-only: returns the landCommand your land will be held to (null when the repo has no land config), plus whether `run` accepts a declared `scope` and which pattern forms it takes. Pass `set: { landCommand: [...] }` to configure the gate for this workspace's REPO \u2014 that is what the land refusal means by \"configure the repo's landCommand\", and it is repo-scoped, so a re-set replaces the gate rather than adding one. The gate still lives server-side and a land is still held to whatever this table says; setting it names the command, it does not let a land name its own. Pass `set: { landCommand: [...], landingShape: \"pr\" }` to also choose HOW this repo lands: `direct-push` (the default) fast-forwards the verified commit onto the default branch; `pr` pushes it to a branch of its own and opens a pull request, so the change lands when that PR is merged. landingShape is optional and OMITTING IT LEAVES THE SHAPE UNCHANGED \u2014 setting a gate command never silently reverts a review-configured repo to a direct push. Either form answers with the config that now holds.",
+  description: "Read \u2014 or set \u2014 the hosted workspace repo's land gate, plus this server's verification affordances. Called bare it is read-only: returns the landCommand your land will be held to (null when the repo has no land config), plus whether `run` accepts a declared `scope` and which pattern forms it takes. Pass `set: { landCommand: [...] }` to configure the gate for this workspace's REPO \u2014 that is what the land refusal means by \"configure the repo's landCommand\", and it is repo-scoped, so a re-set replaces the gate rather than adding one. The gate still lives server-side and a land is still held to whatever this table says; setting it names the command, it does not let a land name its own. Pass `set: { landCommand: [...], landingShape: \"pr\" }` to also choose HOW this repo lands: `direct-push` (the default) fast-forwards the verified commit onto the default branch; `pr` pushes it to a branch of its own and opens a pull request, so the change lands when that PR is merged. landingShape is optional and OMITTING IT LEAVES THE SHAPE UNCHANGED \u2014 setting a gate command never silently reverts a review-configured repo to a direct push. Pass `set: { secure: { enabled: true } }` to turn Secure on for this repo \u2014 that is what makes the repair miner scan the commits this repo lands; a repo without it is never scanned. Every `set` field is optional and an absent one is left exactly as it stands, so enabling Secure never touches the gate and setting a gate never turns Secure off. Every form answers with the config that now holds.",
   capability: "build",
   inputSchema: {
     workspaceId: workspaceIdArg,
     set: external_exports2.object({
-      landCommand: external_exports2.array(external_exports2.string()).min(1),
-      landingShape: external_exports2.enum(["direct-push", "pr"]).optional()
+      landCommand: external_exports2.array(external_exports2.string()).min(1).optional(),
+      landingShape: external_exports2.enum(["direct-push", "pr"]).optional(),
+      secure: external_exports2.object({ enabled: external_exports2.boolean() }).optional()
     }).optional()
   },
   handler: async (input8, ctx) => invoke(ctx, {
     op: "config",
     workspaceId: resolveWorkspaceId(input8.workspaceId, ctx),
-    ...input8.set !== void 0 ? { set: { landCommand: input8.set.landCommand, ...input8.set.landingShape !== void 0 ? { landingShape: input8.set.landingShape } : {} } } : {}
+    ...input8.set !== void 0 ? { set: {
+      ...input8.set.landCommand !== void 0 ? { landCommand: input8.set.landCommand } : {},
+      ...input8.set.landingShape !== void 0 ? { landingShape: input8.set.landingShape } : {},
+      ...input8.set.secure !== void 0 ? { secure: input8.set.secure } : {}
+    } } : {}
   })
 };
 var buildTools = [
@@ -45382,6 +45418,11 @@ init_esm_shims();
 // ../secure/src/taint/trust/python.ts
 init_esm_shims();
 
+// ../secure/src/scanner.ts
+init_esm_shims();
+var SECURE_SCANNER_VERSION = 1;
+var SECURE_ORACLE_VERSION = `secure-taint/${SECURE_SCANNER_VERSION}`;
+
 // ../inference/src/index.ts
 init_esm_shims();
 
@@ -45687,7 +45728,7 @@ var workTools = createPullToolProviders({ capability: "work" });
 var bundledProviders = [src_default2, src_default, tension_default, ...defineTools, ...decisionTools, ...captureTools, ...buildTools, secureTool, ...workTools];
 
 // package.json
-var version2 = "0.3.1";
+var version2 = "0.3.3";
 
 // src/server.ts
 var SERVER_VERSION = version2;
@@ -45700,10 +45741,13 @@ async function createServer(config3, cwd, initialWorkspaceId) {
   try {
     enabled = await fetchEnabledCapabilities(config3);
   } catch (err2) {
+    const reason = err2 instanceof Error ? err2.message : String(err2);
     process.stderr.write(
-      `subseam-mcp: capability discovery failed; mounting no tools this session. ${err2 instanceof Error ? err2.message : String(err2)}
+      `subseam-mcp: capability discovery failed; mounting no product tools this session, only ${DISCOVERY_FAILURE_TOOL} reporting the failure. ${reason}
 `
     );
+    mountDiscoveryFailure(server, config3.url, reason);
+    return server;
   }
   const providers = bundledProviders.map((p, i) => assertToolProvider(p, `bundled provider [${i}]`));
   const ctx = { cwd, tenantId: config3.tenantId, gateway: createGatewayClient(config3), enabledCapabilities: enabled, workspace: createWorkspaceBinding(initialWorkspaceId) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@subseam/mcp",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "private": false,
   "type": "module",
   "bin": {