@subseam/mcp 0.3.2 → 0.3.3

package/README.md

@@ -17,7 +17,7 @@ The script runs `npm install @subseam/mcp@<version>` in the host directory and p
 The equivalent by hand:
 
 ```
-npm install @subseam/mcp@0.3.1
+npm install @subseam/mcp@0.3.3
 claude mcp add-json --scope user subseam '{"command":"node","args":["<dir>/node_modules/@subseam/mcp/dist/main.js"],"env":{"SUBSEAM_URL":"https://api.example.subseam.com","SUBSEAM_TENANT":"<your tenant id>"}}'
 ```
 

package/dist/main.js

@@ -20170,6 +20170,9 @@ init_esm_shims();
 init_esm_shims();
 var VERIFY_ANALYSES = ["coverage-residue", "mutation", "witness"];
 
+// ../verify-contract/src/request/scratch-headers.ts
+init_esm_shims();
+
 // ../verify-contract/src/result/verdict.ts
 init_esm_shims();
 
@@ -20630,6 +20633,10 @@ init_esm_shims();
 // ../verify/src/delta/pushed-head.ts
 init_esm_shims();
 
+// ../verify/src/delta/walk-lag.ts
+init_esm_shims();
+var SCRATCH_BODY_LIMIT_BYTES = 64 * 1024 * 1024;
+
 // ../verify/src/service/gateway-verify.ts
 init_esm_shims();
 
@@ -36308,8 +36315,11 @@ var BuildRequestSchema = external_exports.discriminatedUnion("op", [
     op: external_exports.literal("config"),
     workspaceId: external_exports.string().uuid(),
     set: external_exports.object({
-      landCommand: external_exports.array(external_exports.string()).min(1),
-      landingShape: external_exports.enum(["direct-push", "pr"]).optional()
+      landCommand: external_exports.array(external_exports.string()).min(1).optional(),
+      landingShape: external_exports.enum(["direct-push", "pr"]).optional(),
+      /** Whether Secure is on for this repo. Every `set` field is optional and an absent one is left
+       *  as it stands, so enabling Secure never touches the gate; a `set` naming nothing is refused. */
+      secure: external_exports.object({ enabled: external_exports.boolean() }).optional()
     }).optional()
   })
 ]).readonly();
@@ -36558,6 +36568,9 @@ var BuildResultSchema = external_exports.union([
     /** Which shape this repo's lands take. Null ONLY when the repo has no config row at all — the
      *  same absence `landCommand` reports null for. A repo that has a row always has a shape. */
     landingShape: external_exports.enum(["direct-push", "pr"]).nullable(),
+    /** Whether Secure is on for this repo. Not nullable: no config row means Secure is off, which is
+     *  an answer, not an absence — the repair miner scans nothing either way. */
+    secure: external_exports.object({ enabled: external_exports.boolean() }),
     verification: external_exports.object({
       declaredScopeSupported: external_exports.boolean(),
       scopePatternForms: external_exports.array(external_exports.string())
@@ -45059,9 +45072,11 @@ Land ${inFlight.landedCommit} is pushed and awaiting the walk. Do NOT push again
     case "config": {
       const gate = r.landCommand === null ? "Land gate: NONE configured for this repo \u2014 a land cannot be authorized until one is set." : `Land gate: ${r.landCommand.join(" ")}`;
       const shape = r.landingShape === null ? "Landing shape: none configured (this repo has no config row)." : r.landingShape === "pr" ? "Landing shape: pr \u2014 a land pushes the verified commit to its own branch and opens a pull request. It lands when that PR is merged." : "Landing shape: direct-push \u2014 a land fast-forwards the verified commit straight onto the default branch.";
+      const secure = r.secure.enabled ? "Secure: on \u2014 this repo's landed commits are scanned, and the taint findings they remove are kept." : "Secure: off \u2014 this repo is not scanned. Turn it on with set: { secure: { enabled: true } }.";
       const scope = r.verification.declaredScopeSupported ? `Declared run scope: supported. Pattern forms: ${r.verification.scopePatternForms.join(", ")}.` : "Declared run scope: not supported by this server.";
       return `${gate}
 ${shape}
+${secure}
 ${scope}`;
     }
     case "run":
@@ -45254,19 +45269,24 @@ var buildLandsTool = {
 };
 var configTool = {
   name: "config",
-  description: "Read \u2014 or set \u2014 the hosted workspace repo's land gate, plus this server's verification affordances. Called bare it is read-only: returns the landCommand your land will be held to (null when the repo has no land config), plus whether `run` accepts a declared `scope` and which pattern forms it takes. Pass `set: { landCommand: [...] }` to configure the gate for this workspace's REPO \u2014 that is what the land refusal means by \"configure the repo's landCommand\", and it is repo-scoped, so a re-set replaces the gate rather than adding one. The gate still lives server-side and a land is still held to whatever this table says; setting it names the command, it does not let a land name its own. Pass `set: { landCommand: [...], landingShape: \"pr\" }` to also choose HOW this repo lands: `direct-push` (the default) fast-forwards the verified commit onto the default branch; `pr` pushes it to a branch of its own and opens a pull request, so the change lands when that PR is merged. landingShape is optional and OMITTING IT LEAVES THE SHAPE UNCHANGED \u2014 setting a gate command never silently reverts a review-configured repo to a direct push. Either form answers with the config that now holds.",
+  description: "Read \u2014 or set \u2014 the hosted workspace repo's land gate, plus this server's verification affordances. Called bare it is read-only: returns the landCommand your land will be held to (null when the repo has no land config), plus whether `run` accepts a declared `scope` and which pattern forms it takes. Pass `set: { landCommand: [...] }` to configure the gate for this workspace's REPO \u2014 that is what the land refusal means by \"configure the repo's landCommand\", and it is repo-scoped, so a re-set replaces the gate rather than adding one. The gate still lives server-side and a land is still held to whatever this table says; setting it names the command, it does not let a land name its own. Pass `set: { landCommand: [...], landingShape: \"pr\" }` to also choose HOW this repo lands: `direct-push` (the default) fast-forwards the verified commit onto the default branch; `pr` pushes it to a branch of its own and opens a pull request, so the change lands when that PR is merged. landingShape is optional and OMITTING IT LEAVES THE SHAPE UNCHANGED \u2014 setting a gate command never silently reverts a review-configured repo to a direct push. Pass `set: { secure: { enabled: true } }` to turn Secure on for this repo \u2014 that is what makes the repair miner scan the commits this repo lands; a repo without it is never scanned. Every `set` field is optional and an absent one is left exactly as it stands, so enabling Secure never touches the gate and setting a gate never turns Secure off. Every form answers with the config that now holds.",
   capability: "build",
   inputSchema: {
     workspaceId: workspaceIdArg,
     set: external_exports2.object({
-      landCommand: external_exports2.array(external_exports2.string()).min(1),
-      landingShape: external_exports2.enum(["direct-push", "pr"]).optional()
+      landCommand: external_exports2.array(external_exports2.string()).min(1).optional(),
+      landingShape: external_exports2.enum(["direct-push", "pr"]).optional(),
+      secure: external_exports2.object({ enabled: external_exports2.boolean() }).optional()
     }).optional()
   },
   handler: async (input8, ctx) => invoke(ctx, {
     op: "config",
     workspaceId: resolveWorkspaceId(input8.workspaceId, ctx),
-    ...input8.set !== void 0 ? { set: { landCommand: input8.set.landCommand, ...input8.set.landingShape !== void 0 ? { landingShape: input8.set.landingShape } : {} } } : {}
+    ...input8.set !== void 0 ? { set: {
+      ...input8.set.landCommand !== void 0 ? { landCommand: input8.set.landCommand } : {},
+      ...input8.set.landingShape !== void 0 ? { landingShape: input8.set.landingShape } : {},
+      ...input8.set.secure !== void 0 ? { secure: input8.set.secure } : {}
+    } } : {}
   })
 };
 var buildTools = [
@@ -45398,6 +45418,11 @@ init_esm_shims();
 // ../secure/src/taint/trust/python.ts
 init_esm_shims();
 
+// ../secure/src/scanner.ts
+init_esm_shims();
+var SECURE_SCANNER_VERSION = 1;
+var SECURE_ORACLE_VERSION = `secure-taint/${SECURE_SCANNER_VERSION}`;
+
 // ../inference/src/index.ts
 init_esm_shims();
 
@@ -45703,7 +45728,7 @@ var workTools = createPullToolProviders({ capability: "work" });
 var bundledProviders = [src_default2, src_default, tension_default, ...defineTools, ...decisionTools, ...captureTools, ...buildTools, secureTool, ...workTools];
 
 // package.json
-var version2 = "0.3.2";
+var version2 = "0.3.3";
 
 // src/server.ts
 var SERVER_VERSION = version2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@subseam/mcp",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "private": false,
   "type": "module",
   "bin": {