@vibecodetown/mcp-server 1.3.1 → 1.5.0

package/build/domains/bee/scout_heuristics.js

@@ -0,0 +1,446 @@
+/**
+ * Scout Heuristics
+ * ================
+ * Static analysis fallback for Scout triggers when BitNet is unavailable.
+ * Provides rule-based risk assessment using file patterns and git context.
+ *
+ * Design principle:
+ *   Heuristic analysis runs in < 10ms (pure computation, no I/O).
+ *   Results include confidence, risk_level, and actionable suggestions.
+ *
+ * @since v1.7.0
+ */
+// ============================================================================
+// Auth Touch Keywords & Patterns
+// ============================================================================
+const AUTH_KEYWORDS = [
+    'auth',
+    'login',
+    'logout',
+    'signup',
+    'register',
+    'password',
+    'credential',
+    'token',
+    'jwt',
+    'session',
+    'oauth',
+    'sso',
+    'cookie',
+    'guard',
+    'strategy',
+    'totp',
+    'mfa',
+    '2fa',
+    'passkey',
+    'webauthn',
+];
+const CRITICAL_CONFIG_PATTERNS = [
+    '.env',
+    'config/security',
+    'config/auth',
+    'cors.',
+    'helmet.',
+    'csrf.',
+    'permissions.',
+    'rbac.',
+    'acl.',
+];
+const SECRET_PATTERNS = [
+    'secret',
+    'private_key',
+    'api_key',
+    'apikey',
+    'signing_key',
+    'encryption_key',
+    'master_key',
+];
+export function analyzeAuthTouch(ctx) {
+    const { changedPaths, diffSummary } = ctx;
+    if (changedPaths.length === 0) {
+        return {
+            triggered: false,
+            scenario: 'AUTH_TOUCH',
+            skipped_reason: 'No changed paths provided for auth analysis',
+        };
+    }
+    // --- Classify changed files ---
+    const authFiles = [];
+    const criticalConfigs = [];
+    const secretFiles = [];
+    const testFiles = [];
+    const otherFiles = [];
+    for (const path of changedPaths) {
+        const lower = path.toLowerCase();
+        if (isTestFile(lower)) {
+            testFiles.push(path);
+        }
+        else if (matchesAny(lower, SECRET_PATTERNS)) {
+            secretFiles.push(path);
+        }
+        else if (matchesAny(lower, CRITICAL_CONFIG_PATTERNS)) {
+            criticalConfigs.push(path);
+        }
+        else if (matchesAny(lower, AUTH_KEYWORDS)) {
+            authFiles.push(path);
+        }
+        else {
+            otherFiles.push(path);
+        }
+    }
+    const totalAuthRelated = authFiles.length + criticalConfigs.length + secretFiles.length;
+    // --- Not triggered: no auth-related files ---
+    if (totalAuthRelated === 0) {
+        return {
+            triggered: false,
+            scenario: 'AUTH_TOUCH',
+            confidence: 0.9,
+            risk_level: 'low',
+            analysis: 'No authentication-related files detected in the change set.',
+        };
+    }
+    // --- Triggered: assess risk ---
+    let riskLevel = 'medium';
+    const reasons = [];
+    const suggestions = [];
+    // Secret/key files → immediate high risk
+    if (secretFiles.length > 0) {
+        riskLevel = 'high';
+        reasons.push(`Secret/key files modified: ${formatFileList(secretFiles)}.`);
+        suggestions.push('Verify no secrets are committed to version control.');
+        suggestions.push('Rotate any exposed credentials immediately.');
+    }
+    // Critical config files → high risk
+    if (criticalConfigs.length > 0) {
+        riskLevel = 'high';
+        reasons.push(`Critical security config changed: ${formatFileList(criticalConfigs)}.`);
+        suggestions.push('Review CORS, CSP, and security header configuration.');
+        suggestions.push('Verify environment variables and secret management.');
+    }
+    // Auth logic files → medium risk (escalated if no tests)
+    if (authFiles.length > 0) {
+        reasons.push(`Authentication logic modified: ${formatFileList(authFiles)}.`);
+        if (authFiles.some(f => f.includes('jwt') || f.includes('token'))) {
+            suggestions.push('Review JWT expiration, refresh token rotation, and token revocation logic.');
+        }
+        if (authFiles.some(f => f.includes('cookie') || f.includes('session'))) {
+            suggestions.push('Ensure cookie attributes (Secure, HttpOnly, SameSite) are correctly set.');
+        }
+        if (authFiles.some(f => f.includes('password') || f.includes('credential'))) {
+            suggestions.push('Verify password hashing algorithm (bcrypt/argon2) and salt configuration.');
+        }
+        if (authFiles.some(f => f.includes('oauth') || f.includes('sso'))) {
+            suggestions.push('Check OAuth redirect URI validation and state parameter handling.');
+        }
+    }
+    // Diff summary hints
+    if (diffSummary) {
+        const lowerDiff = diffSummary.toLowerCase();
+        if (lowerDiff.includes('algorithm') || lowerDiff.includes('hash')) {
+            suggestions.push('Cryptographic algorithm change detected — ensure backward compatibility for existing sessions/tokens.');
+        }
+        if (lowerDiff.includes('disable') ||
+            lowerDiff.includes('skip') ||
+            lowerDiff.includes('bypass')) {
+            riskLevel = 'high';
+            reasons.push('Diff suggests security check may have been disabled or bypassed.');
+        }
+    }
+    // Test coverage gap → escalate risk
+    const hasAuthTestChanges = testFiles.some(f => matchesAny(f.toLowerCase(), AUTH_KEYWORDS));
+    if (!hasAuthTestChanges && authFiles.length > 0) {
+        if (riskLevel === 'medium')
+            riskLevel = 'high';
+        reasons.push('Auth logic modified but NO corresponding test files were updated.');
+        suggestions.unshift('Add or update unit tests for the changed auth logic.');
+    }
+    else if (hasAuthTestChanges) {
+        suggestions.push('Run existing auth test suites to verify no regressions.');
+    }
+    // Build analysis text
+    const analysis = reasons.join(' ');
+    const confidence = secretFiles.length > 0 ? 0.95 : criticalConfigs.length > 0 ? 0.9 : 0.85;
+    return {
+        triggered: true,
+        scenario: 'AUTH_TOUCH',
+        analysis,
+        confidence,
+        risk_level: riskLevel,
+        suggestions: dedup(suggestions),
+    };
+}
+const ERROR_PATTERNS = [
+    {
+        type: 'syntax',
+        pattern: /SyntaxError|Unexpected token|Parse error|unexpected end of/gi,
+        label: 'Syntax error',
+    },
+    {
+        type: 'type_mismatch',
+        pattern: /TypeError|Type '.*?' is not assignable|TS\d{4}:|type mismatch|cannot find name/gi,
+        label: 'Type mismatch',
+    },
+    {
+        type: 'import',
+        pattern: /Cannot find module|Module not found|ImportError|No module named|Could not resolve/gi,
+        label: 'Import/module resolution failure',
+    },
+    {
+        type: 'timeout',
+        pattern: /timeout|timed? ?out|ETIMEDOUT|exceeded.*(?:time|limit)|deadline/gi,
+        label: 'Timeout',
+    },
+    {
+        type: 'lint',
+        pattern: /eslint|prettier|lint(?:er|ing)|warning.*rule|no-unused|Unexpected console/gi,
+        label: 'Lint violation',
+    },
+    {
+        type: 'test_fail',
+        pattern: /FAIL|test failed|AssertionError|expect\(.*?\)\.to|assert\.|✗|✕|FAILED/gi,
+        label: 'Test failure',
+    },
+];
+export function analyzeGateViolation(ctx) {
+    const { errorLog, filePath } = ctx;
+    if (!errorLog || errorLog.trim().length === 0) {
+        return {
+            triggered: false,
+            scenario: 'GATE_FIX',
+            skipped_reason: 'No error log provided for gate fix analysis',
+        };
+    }
+    // --- Classify errors by pattern matching ---
+    const categories = [];
+    const lines = errorLog.split('\n');
+    for (const { type, pattern } of ERROR_PATTERNS) {
+        const matches = [];
+        for (const line of lines) {
+            // Reset regex state for global patterns
+            pattern.lastIndex = 0;
+            if (pattern.test(line)) {
+                matches.push(line.trim().slice(0, 120));
+            }
+        }
+        if (matches.length > 0) {
+            categories.push({
+                type,
+                count: matches.length,
+                samples: matches.slice(0, 3),
+            });
+        }
+    }
+    // --- No recognized errors ---
+    if (categories.length === 0) {
+        return {
+            triggered: true,
+            scenario: 'GATE_FIX',
+            analysis: 'Error log present but no recognized error patterns found. Manual review recommended.',
+            confidence: 0.5,
+            risk_level: 'low',
+            suggestions: ['Review the error log manually — the error pattern may be project-specific.'],
+        };
+    }
+    // --- Assess risk based on error categories ---
+    let riskLevel = 'medium';
+    const reasons = [];
+    const suggestions = [];
+    const totalErrors = categories.reduce((sum, c) => sum + c.count, 0);
+    // Sort by severity: syntax > type > import > test > timeout > lint
+    const severityOrder = {
+        syntax: 0,
+        type_mismatch: 1,
+        import: 2,
+        test_fail: 3,
+        timeout: 4,
+        lint: 5,
+        unknown: 6,
+    };
+    categories.sort((a, b) => severityOrder[a.type] - severityOrder[b.type]);
+    for (const cat of categories) {
+        switch (cat.type) {
+            case 'syntax':
+                riskLevel = 'high';
+                reasons.push(`Syntax error(s) detected (${cat.count} occurrence${cat.count > 1 ? 's' : ''}).`);
+                suggestions.push('Fix syntax errors before proceeding — these block compilation entirely.');
+                break;
+            case 'type_mismatch':
+                riskLevel = 'high';
+                reasons.push(`Type error(s) detected (${cat.count} occurrence${cat.count > 1 ? 's' : ''}).`);
+                suggestions.push('Resolve type mismatches — check function signatures and interface contracts.');
+                break;
+            case 'import':
+                if (riskLevel !== 'high')
+                    riskLevel = 'high';
+                reasons.push(`Import/module resolution failure(s) (${cat.count}).`);
+                suggestions.push('Check dependency installation (npm install) and import paths.');
+                break;
+            case 'test_fail':
+                if (riskLevel !== 'high')
+                    riskLevel = 'medium';
+                reasons.push(`Test failure(s) detected (${cat.count}).`);
+                suggestions.push('Run failing tests locally and fix assertions or implementation.');
+                break;
+            case 'timeout':
+                if (riskLevel !== 'high')
+                    riskLevel = 'medium';
+                reasons.push(`Timeout(s) detected (${cat.count}).`);
+                suggestions.push('Check for infinite loops, missing async/await, or resource bottlenecks.');
+                break;
+            case 'lint':
+                if (riskLevel === 'medium' && categories.length === 1)
+                    riskLevel = 'low';
+                reasons.push(`Lint violation(s) detected (${cat.count}).`);
+                suggestions.push('Run linter auto-fix (e.g., eslint --fix) to resolve formatting issues.');
+                break;
+        }
+    }
+    // File path context
+    if (filePath) {
+        reasons.push(`Primary file: ${filePath}.`);
+    }
+    // Escalate if many errors
+    if (totalErrors >= 10) {
+        riskLevel = 'high';
+        suggestions.unshift(`${totalErrors} total errors detected — consider reverting recent changes and applying incrementally.`);
+    }
+    const confidence = riskLevel === 'high' ? 0.9 : riskLevel === 'medium' ? 0.8 : 0.7;
+    return {
+        triggered: true,
+        scenario: 'GATE_FIX',
+        analysis: reasons.join(' '),
+        confidence,
+        risk_level: riskLevel,
+        suggestions: dedup(suggestions),
+    };
+}
+/**
+ * Parse a SemVer string into [major, minor, patch].
+ * Returns null if the string is not valid SemVer.
+ */
+function parseSemVer(version) {
+    const m = version.match(/v?[~^>=<]*(\d+)\.(\d+)\.(\d+)/);
+    if (!m)
+        return null;
+    return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+export function analyzeDepShift(ctx) {
+    const { packageName, fromVersion, toVersion, diffSummary } = ctx;
+    // --- No version info at all: try diff summary fallback ---
+    if (!fromVersion && !toVersion && !diffSummary) {
+        return {
+            triggered: false,
+            scenario: 'DEP_SHIFT',
+            skipped_reason: 'No version or diff information provided for dependency analysis',
+        };
+    }
+    const reasons = [];
+    const suggestions = [];
+    let riskLevel = 'low';
+    const pkgLabel = packageName ?? 'unknown package';
+    // --- Structured version comparison ---
+    if (fromVersion && toVersion) {
+        const oldVer = parseSemVer(fromVersion);
+        const newVer = parseSemVer(toVersion);
+        if (oldVer && newVer) {
+            const [oldMajor, oldMinor] = oldVer;
+            const [newMajor, newMinor] = newVer;
+            if (newMajor > oldMajor) {
+                riskLevel = 'high';
+                reasons.push(`Major version upgrade for ${pkgLabel}: ${fromVersion} -> ${toVersion}.`);
+                suggestions.push('Check changelog for breaking changes before upgrading.');
+                suggestions.push('Run full integration tests after the upgrade.');
+            }
+            else if (newMajor < oldMajor) {
+                riskLevel = 'high';
+                reasons.push(`Major version DOWNGRADE for ${pkgLabel}: ${fromVersion} -> ${toVersion}.`);
+                suggestions.push('Version downgrade is unusual — verify this is intentional.');
+            }
+            else if (newMinor > oldMinor) {
+                riskLevel = 'low';
+                reasons.push(`Minor version upgrade for ${pkgLabel}: ${fromVersion} -> ${toVersion}.`);
+                suggestions.push('Review new features and ensure no unintended behavior changes.');
+            }
+            else if (newMinor < oldMinor) {
+                riskLevel = 'medium';
+                reasons.push(`Minor version downgrade for ${pkgLabel}: ${fromVersion} -> ${toVersion}.`);
+                suggestions.push('Verify the downgrade does not remove required features.');
+            }
+            else {
+                reasons.push(`Patch update for ${pkgLabel}: ${fromVersion} -> ${toVersion}.`);
+                suggestions.push('Patch updates are usually safe — verify tests pass.');
+            }
+        }
+        else {
+            // Could not parse SemVer — report raw change
+            riskLevel = 'medium';
+            reasons.push(`Version changed for ${pkgLabel}: ${fromVersion} -> ${toVersion} (non-standard versioning).`);
+            suggestions.push('Manually review the version change — SemVer could not be parsed.');
+        }
+    }
+    else if (toVersion && !fromVersion) {
+        // New dependency added
+        riskLevel = 'medium';
+        reasons.push(`New dependency added: ${pkgLabel}@${toVersion}.`);
+        suggestions.push('Audit the new package for known vulnerabilities (npm audit / cargo audit).');
+        suggestions.push('Verify the package license is compatible with the project.');
+    }
+    else if (fromVersion && !toVersion) {
+        // Dependency removed
+        riskLevel = 'medium';
+        reasons.push(`Dependency removed: ${pkgLabel}@${fromVersion}.`);
+        suggestions.push('Verify no remaining code references the removed package.');
+    }
+    // --- Diff summary augmentation ---
+    if (diffSummary) {
+        const lower = diffSummary.toLowerCase();
+        if (lower.includes('devdependencies') && !/"dependencies"\s*:/.test(diffSummary)) {
+            // Dev-only change is lower risk
+            if (riskLevel === 'high' && reasons.some(r => r.includes('Minor'))) {
+                riskLevel = 'medium';
+            }
+            reasons.push('Change is in devDependencies (development only).');
+        }
+        // Multiple packages changed
+        const pkgMentions = (diffSummary.match(/[+-]\s*"[\w@/.-]+"\s*:/g) ?? []).length;
+        if (pkgMentions > 5) {
+            if (riskLevel !== 'high')
+                riskLevel = 'medium';
+            reasons.push(`${pkgMentions} packages changed — bulk dependency update detected.`);
+            suggestions.push('Consider updating dependencies incrementally rather than in bulk.');
+        }
+    }
+    if (reasons.length === 0) {
+        reasons.push(`Dependency change detected for ${pkgLabel}.`);
+    }
+    const confidence = riskLevel === 'high' ? 0.9 : riskLevel === 'medium' ? 0.8 : 0.75;
+    return {
+        triggered: true,
+        scenario: 'DEP_SHIFT',
+        analysis: reasons.join(' '),
+        confidence,
+        risk_level: riskLevel,
+        suggestions: dedup(suggestions),
+    };
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+function isTestFile(path) {
+    return (path.includes('.test.') ||
+        path.includes('.spec.') ||
+        path.includes('__tests__/') ||
+        path.includes('/tests/') ||
+        path.includes('/test/'));
+}
+function matchesAny(value, patterns) {
+    return patterns.some(p => value.includes(p));
+}
+function formatFileList(files, max = 3) {
+    if (files.length <= max)
+        return files.join(', ');
+    return `${files.slice(0, max).join(', ')} (+${files.length - max} more)`;
+}
+function dedup(arr) {
+    return [...new Set(arr)];
+}

package/build/{tier → domains/bee}/scout_runner.d.ts

@@ -19,6 +19,11 @@ export declare class ScoutRunner {
      * Calculate scan scope based on trigger type
      */
     calculateScope(trigger: TriggerRule, changedPaths: string[]): string[];
+    /**
+     * Map a TriggerRule to a ScoutTriggerInput for native dispatch.
+     * Returns null for trigger types not supported by the Rust Scout module.
+     */
+    private mapToScoutTrigger;
     private mapScoutModeToJobType;
     private groupByFolder;
     private expandAuthScope;

package/build/{tier → domains/bee}/scout_runner.js

@@ -7,7 +7,8 @@
  */
 import { CooldownStore } from './cooldown_store.js';
 import { recordDailySweep } from './trigger_facts_collector.js';
-import { isMusuAvailable, getMusuAdapter } from '../mcp/runtime/musu_adapter.js';
+import { isMusuAvailable, getMusuAdapter } from '../../kernel/musu_adapter.js';
+import { dispatchScout, isBitNetAvailable } from '../../native/index.js';
 // ============================================================================
 // Scout Runner Class
 // ============================================================================
@@ -25,6 +26,25 @@ export class ScoutRunner {
         const startTime = Date.now();
         const scope = this.calculateScope(trigger, changedPaths);
         try {
+            // 1. Try native dispatch for T3/T6/T8 (Scout trigger types)
+            const scoutTrigger = this.mapToScoutTrigger(trigger, changedPaths);
+            if (scoutTrigger && isBitNetAvailable(this.basePath)) {
+                const report = await dispatchScout(scoutTrigger, this.basePath);
+                if (report) {
+                    this.cooldownStore.recordRun(trigger.id, trigger.cooldown_ms);
+                    if (trigger.id === 'T9_DAILY_SWEEP') {
+                        void recordDailySweep(this.basePath);
+                    }
+                    return {
+                        trigger_id: trigger.id,
+                        success: true,
+                        scan_duration_ms: Date.now() - startTime,
+                        findings_count: 1,
+                        scope,
+                    };
+                }
+            }
+            // 2. Fall back to Musu HTTP adapter
             if (isMusuAvailable()) {
                 const adapter = getMusuAdapter();
                 // Start adapter if needed
@@ -50,7 +70,7 @@ export class ScoutRunner {
                 this.cooldownStore.recordRun(trigger.id, trigger.cooldown_ms);
                 // Record daily sweep if T9
                 if (trigger.id === 'T9_DAILY_SWEEP') {
-                    recordDailySweep(this.basePath);
+                    void recordDailySweep(this.basePath);
                 }
                 return {
                     trigger_id: trigger.id,
@@ -115,6 +135,41 @@ export class ScoutRunner {
     // ============================================================================
     // Private Helpers
     // ============================================================================
+    /**
+     * Map a TriggerRule to a ScoutTriggerInput for native dispatch.
+     * Returns null for trigger types not supported by the Rust Scout module.
+     */
+    mapToScoutTrigger(trigger, changedPaths) {
+        switch (trigger.id) {
+            case 'T3_AUTH_TOUCH':
+                return {
+                    trigger_type: 'auth_touch',
+                    payload: {
+                        file_path: changedPaths[0] || 'unknown',
+                        diff_summary: `${changedPaths.length} auth-related file(s) modified: ${changedPaths.slice(0, 3).join(', ')}`,
+                    },
+                };
+            case 'T6_DEP_SHIFT':
+                return {
+                    trigger_type: 'dep_shift',
+                    payload: {
+                        crate_name: 'package.json',
+                        from_version: 'previous',
+                        to_version: 'current',
+                    },
+                };
+            case 'T8_GATE_FIX':
+                return {
+                    trigger_type: 'gate_fix',
+                    payload: {
+                        issue_id: `trigger-${trigger.id}-${Date.now()}`,
+                        code_diff: changedPaths.slice(0, 10).join('\n'),
+                    },
+                };
+            default:
+                return null;
+        }
+    }
     mapScoutModeToJobType(scoutMode) {
         switch (scoutMode) {
             case 'secrets':

package/build/{tier → domains/bee}/trigger_evaluator.d.ts

@@ -16,13 +16,13 @@
  *
  * @since v1.6.0
  */
-import { TriggerRule, TriggerRuleId, TriggerFacts, TriggerEvaluationResult } from "./trigger_types.js";
-import { CooldownStore } from "./cooldown_store.js";
+import { TriggerRule, TriggerRuleId, TriggerFacts, TriggerEvaluationResult } from './trigger_types.js';
+import { CooldownStore } from './cooldown_store.js';
 export declare const TRIGGER_RULES: TriggerRule[];
 export declare class TriggerEvaluator {
     private cooldownStore;
     private tier;
-    constructor(cooldownStore: CooldownStore, tier?: "FREE" | "PRO");
+    constructor(cooldownStore: CooldownStore, tier?: 'FREE' | 'PRO');
     /**
      * Evaluate all trigger rules against current facts
      */
@@ -39,4 +39,4 @@ export declare class TriggerEvaluator {
     private checkT7;
     private checkDailySweep;
 }
-export declare function createTriggerEvaluator(basePath: string, tier?: "FREE" | "PRO"): TriggerEvaluator;
+export declare function createTriggerEvaluator(basePath: string, tier?: 'FREE' | 'PRO'): TriggerEvaluator;