@vibecodetown/mcp-server 1.3.1 → 1.5.0

package/build/mcp/policy/unified.js

@@ -0,0 +1,148 @@
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+import { validateToolInput } from '../security/input-validator.js';
+import { isPathForbidden, normalizePath } from '../security/path-policy.js';
+import { getSandboxConfigFromEnv } from '../security/sandbox.js';
+import { cacheRoot } from '../bootstrap/installer.js';
+import { getRequirementsForTool, checkFeatureRequirement, checkAuthRequirement, } from './requirements.js';
+function isRecord(v) {
+    return typeof v === 'object' && v !== null;
+}
+function extractCandidatePaths(input) {
+    const out = [];
+    const pushIfString = (key, v) => {
+        if (typeof v === 'string' && v.trim())
+            out.push({ key, value: v.trim() });
+    };
+    const pushIfStringArray = (key, v) => {
+        if (!Array.isArray(v))
+            return;
+        for (const it of v)
+            pushIfString(key, it);
+    };
+    pushIfStringArray('target_paths', input['target_paths']);
+    pushIfString('bridge_path', input['bridge_path']);
+    pushIfString('path', input['path']);
+    pushIfStringArray('paths', input['paths']);
+    return out;
+}
+function toWorkspaceRelativePath(p, workspaceRoot) {
+    // If absolute, normalize to a safe absolute path, then convert back to relative for zone checks.
+    if (path.isAbsolute(p) || /^[A-Za-z]:[\\/]/.test(p)) {
+        const abs = normalizePath(p, workspaceRoot);
+        const rel = path.relative(workspaceRoot, abs).replace(/\\/g, '/');
+        return rel;
+    }
+    return p.replace(/\\/g, '/');
+}
+export async function preflightToolExecution(params) {
+    const { rawInput, workspaceRoot } = params;
+    // 1) Best-effort input shape validation (size, common fields).
+    if (isRecord(rawInput)) {
+        validateToolInput(rawInput);
+    }
+    // 2) Path zone checks (fail-closed for BLACK/RED).
+    const zones = [];
+    if (isRecord(rawInput)) {
+        const candidates = extractCandidatePaths(rawInput);
+        for (const candidate of candidates) {
+            // IMPORTANT: Some tool inputs legitimately reference control-plane files under `.vibe/`
+            // (e.g. bridge files). Path zones are intended for user workspace modification scope,
+            // so we only enforce them for "target_paths"/"paths" style inputs.
+            if (candidate.key === 'bridge_path')
+                continue;
+            const rel = toWorkspaceRelativePath(candidate.value, workspaceRoot);
+            const check = isPathForbidden(rel);
+            zones.push({ path: rel, zone: check.zone, forbidden: check.forbidden });
+            if (check.forbidden && check.reason && check.zone) {
+                throw new McpError(ErrorCode.InvalidParams, `[PATH_POLICY] ${check.reason}`, {
+                    vibeCode: -32_070,
+                    category: 'SECURITY',
+                    context: { path: rel, zone: check.zone, tool: params.toolName },
+                });
+            }
+        }
+    }
+    // 3) Sandbox policy (opt-in via env; default stays "none" for compatibility).
+    const sandbox = deriveSandboxConfigForTool({
+        toolName: params.toolName,
+        workspaceRoot,
+        base: getSandboxConfigFromEnv(),
+    });
+    // 4) Feature/auth requirements (fail-closed).
+    const reqs = getRequirementsForTool(params.toolName);
+    for (const req of reqs) {
+        if (req.kind === 'feature') {
+            const r = checkFeatureRequirement(req.feature);
+            if (!r.allowed) {
+                throw new McpError(ErrorCode.InvalidRequest, `[FEATURE_GATE] Feature not allowed: ${String(req.feature)}`, {
+                    vibeCode: -32_090,
+                    category: 'ENTITLEMENT',
+                    context: { tool: params.toolName, feature: req.feature, reason: r.reason },
+                });
+            }
+        }
+        else if (req.kind === 'auth') {
+            const r = await checkAuthRequirement(req.entitlement);
+            if (!r.allowed) {
+                throw new McpError(ErrorCode.InvalidRequest, `[AUTH_GATE] Entitlement not allowed: ${String(req.entitlement)}`, {
+                    vibeCode: -32_091,
+                    category: 'ENTITLEMENT',
+                    context: { tool: params.toolName, entitlement: req.entitlement, reason: r.reason },
+                });
+            }
+        }
+    }
+    return { sandbox, zones };
+}
+function uniqPaths(paths) {
+    const out = [];
+    const seen = new Set();
+    for (const p of paths) {
+        const t = p.trim();
+        if (!t)
+            continue;
+        if (seen.has(t))
+            continue;
+        seen.add(t);
+        out.push(t);
+    }
+    return out;
+}
+function getPackageRoot() {
+    // src/mcp/policy/unified.ts -> package root
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, '../../..');
+}
+function isSandboxActive(config) {
+    return config.mode !== 'none';
+}
+function shouldApplySandbox(toolName, applyMode) {
+    if (applyMode === 'all')
+        return true;
+    // Conservative: only apply to a small set until proven stable.
+    return (toolName === 'vibe_pm.inspect_code' ||
+        toolName === 'vibe_pm.scout' ||
+        toolName === 'bitnet.check' ||
+        toolName === 'bitnet.trace');
+}
+function deriveSandboxConfigForTool(params) {
+    const base = params.base;
+    if (!isSandboxActive(base))
+        return base;
+    const applyEnv = (process.env.VIBECODE_SANDBOX_APPLY ?? 'risky').trim().toLowerCase();
+    const applyMode = applyEnv === 'all' ? 'all' : 'risky';
+    if (!shouldApplySandbox(params.toolName, applyMode)) {
+        // Keep sandbox off for this tool to avoid unexpected behavior changes.
+        return { ...base, mode: 'none' };
+    }
+    const pkgRoot = getPackageRoot();
+    const cache = cacheRoot();
+    const vibeDir = path.join(params.workspaceRoot, '.vibe');
+    return {
+        ...base,
+        allowedPaths: uniqPaths([...(base.allowedPaths ?? []), params.workspaceRoot, pkgRoot, cache]),
+        writablePaths: uniqPaths([...(base.writablePaths ?? []), vibeDir, cache]),
+    };
+}

package/build/mcp/profile-config.d.ts

@@ -1,13 +1,16 @@
 export declare const TOOL_GROUPS: {
     readonly mvp: readonly ["vibe_pm.briefing", "vibe_pm.get_decision", "vibe_pm.submit_decision", "vibe_pm.create_work_order", "vibe_pm.inspect_code", "vibe_pm.status", "vibe_pm.doctor", "vibe_pm.ingress"];
-    readonly core: readonly ["vibe_pm.briefing", "vibe_pm.get_decision", "vibe_pm.submit_decision", "vibe_pm.create_work_order", "vibe_pm.inspect_code", "vibe_pm.status", "vibe_pm.doctor", "vibe_pm.ingress"];
-    readonly ops: readonly ["vibe_pm.init_docs", "vibe_pm.ui_manifest", "vibe_pm.ui_resource", "vibe_pm.scaffold", "vibe_pm.setup"];
+    readonly core: readonly ["vibe_pm.briefing", "vibe_pm.get_decision", "vibe_pm.submit_decision", "vibe_pm.create_work_order", "vibe_pm.inspect_code", "vibe_pm.status", "vibe_pm.doctor", "vibe_pm.ingress", "vibe_pm.finalize_work", "vibe_pm.undo_last_task"];
+    readonly ops: readonly ["vibe_pm.init_docs", "vibe_pm.ui_manifest", "vibe_pm.ui_resource", "vibe_pm.scaffold", "vibe_pm.workspace_recipe", "vibe_pm.setup", "vibe_pm.block_search", "vibe_pm.skills", "vibe_pm.suggest_roots", "vibe_pm.check_resources", "vibe_pm.check_dormant", "vibe_pm.repair_plan", "vibe_pm.branch_pivot"];
     readonly bridge: readonly [];
     readonly memory: readonly ["vibe_pm.memory", "vibe_pm.memory_status", "vibe_pm.memory_sync", "vibe_pm.memory_retrieve"];
     readonly research: readonly [];
     readonly perf: readonly [];
     readonly policy: readonly [];
-    readonly bitnet: readonly ["bitnet.check", "bitnet.trace", "bitnet.signal"];
+    readonly bitnet: readonly ["bitnet.check", "bitnet.trace", "bitnet.signal", "bitnet.scout", "vibe_pm.scout"];
+    readonly musu: readonly ["musu.status", "musu.fleet", "musu.gateway", "musu.dispatch", "musu.knowledge", "musu.run"];
+    readonly hive: readonly ["hive.run_command", "hive.file_list", "hive.file_read", "hive.submit_job", "hive.nodes"];
+    readonly human_facing: readonly ["vibe_pm.do", "vibe_pm.ask", "vibe_pm.check", "vibe_pm.status", "vibe_pm.doctor", "vibe_pm.setup"];
 };
 export type ToolGroup = keyof typeof TOOL_GROUPS;
 export declare const PROFILES: {
@@ -18,16 +21,28 @@ export declare const PROFILES: {
     readonly maintenance: ToolGroup[];
     readonly research: ToolGroup[];
     readonly tuning: ToolGroup[];
+    readonly human: ToolGroup[];
     readonly all: ToolGroup[];
 };
 export type ProfileName = keyof typeof PROFILES;
+/**
+ * Tool surface classification for AI vs Human separation.
+ * - user_facing: Shown to human users (VIBE_PROFILE=human)
+ * - ai_internal: Available only to AI agents (VIBE_PROFILE=all)
+ * - system: Always available (metadata/orchestration)
+ */
+export type ToolSurface = 'user_facing' | 'ai_internal' | 'system';
+/**
+ * Check if current profile is the human surface profile
+ */
+export declare function isHumanProfile(profile?: ProfileName): boolean;
 /**
  * Autonomous mode levels:
  * - "off": All decisions require human approval (default)
  * - "assisted": AI suggests, but human approves
  * - "full": AI decides autonomously, human can override
  */
-export type AutonomousMode = "off" | "assisted" | "full";
+export type AutonomousMode = 'off' | 'assisted' | 'full';
 /**
  * Human gate configuration - which checkpoints require human approval
  */

package/build/mcp/profile-config.js

@@ -6,43 +6,53 @@
 export const TOOL_GROUPS = {
     // MVP: 최소 판매 단위 (8개) - Code Clinic 판정 중심
     mvp: [
-        "vibe_pm.briefing",
-        "vibe_pm.get_decision",
-        "vibe_pm.submit_decision",
-        "vibe_pm.create_work_order",
-        "vibe_pm.inspect_code",
-        "vibe_pm.status",
-        "vibe_pm.doctor", // 설치 진단용
-        "vibe_pm.ingress" // 컨텍스트 스캔 (v1.1.0)
+        'vibe_pm.briefing',
+        'vibe_pm.get_decision',
+        'vibe_pm.submit_decision',
+        'vibe_pm.create_work_order',
+        'vibe_pm.inspect_code',
+        'vibe_pm.status',
+        'vibe_pm.doctor', // 설치 진단용
+        'vibe_pm.ingress', // 컨텍스트 스캔 (v1.1.0)
     ],
     // Core: "등록된 것만이 진실" (tool-registry.ts 기준)
     // - 현재 AS-BUILT에서 core는 mvp와 동일한 하위집합이다.
     core: [
-        "vibe_pm.briefing",
-        "vibe_pm.get_decision",
-        "vibe_pm.submit_decision",
-        "vibe_pm.create_work_order",
-        "vibe_pm.inspect_code",
-        "vibe_pm.status",
-        "vibe_pm.doctor",
-        "vibe_pm.ingress",
+        'vibe_pm.briefing',
+        'vibe_pm.get_decision',
+        'vibe_pm.submit_decision',
+        'vibe_pm.create_work_order',
+        'vibe_pm.inspect_code',
+        'vibe_pm.status',
+        'vibe_pm.doctor',
+        'vibe_pm.ingress',
+        'vibe_pm.finalize_work', // 작업 마무리 + 커밋
+        'vibe_pm.undo_last_task', // 마지막 작업 되돌리기
     ],
-    // Ops: 설치/운영 + UI 도구 (AS-BUILT: init_docs + ui_manifest/ui_resource + scaffold + setup)
+    // Ops: 설치/운영 + UI 도구 + 블록 검색 + 진단/관리 도구
     ops: [
-        "vibe_pm.init_docs",
-        "vibe_pm.ui_manifest",
-        "vibe_pm.ui_resource",
-        "vibe_pm.scaffold",
-        "vibe_pm.setup",
+        'vibe_pm.init_docs',
+        'vibe_pm.ui_manifest',
+        'vibe_pm.ui_resource',
+        'vibe_pm.scaffold',
+        'vibe_pm.workspace_recipe',
+        'vibe_pm.setup',
+        'vibe_pm.block_search', // P38: DB FTS 블록 검색
+        'vibe_pm.skills', // 스킬팩 조회
+        'vibe_pm.suggest_roots', // 프로젝트 루트 탐색
+        'vibe_pm.check_resources', // 시스템 리소스 점검
+        'vibe_pm.check_dormant', // 프로젝트 비활성 감지
+        'vibe_pm.repair_plan', // 복구 계획 생성
+        'vibe_pm.branch_pivot', // 브랜치 전환 + 스냅샷
     ],
     // Bridge: 예약(AS-BUILT 미등록)
     bridge: [],
     // Memory: 문서 자동 기억 (로컬 인덱스; persist: .vibe/cache/chroma)
     memory: [
-        "vibe_pm.memory", // 통합 메모리 도구 (권장)
-        "vibe_pm.memory_status",
-        "vibe_pm.memory_sync",
-        "vibe_pm.memory_retrieve",
+        'vibe_pm.memory', // 통합 메모리 도구 (권장)
+        'vibe_pm.memory_status',
+        'vibe_pm.memory_sync',
+        'vibe_pm.memory_retrieve',
     ],
     // Research: 예약(AS-BUILT 미등록)
     research: [],
@@ -52,32 +62,80 @@ export const TOOL_GROUPS = {
     policy: [],
     // BitNet: 위험 분석 (v1.1.0)
     bitnet: [
-        "bitnet.check", // 개별 파일 위험 분석
-        "bitnet.trace", // 추적 이력 조회
-        "bitnet.signal" // 상태 추정 + 자율 제안
-    ]
+        'bitnet.check', // 개별 파일 위험 분석
+        'bitnet.trace', // 추적 이력 조회
+        'bitnet.signal', // 상태 추정 + 자율 제안
+        'bitnet.scout', // Rust worker Scout dispatch 브리지
+        'vibe_pm.scout', // 트리거 기반 Scout 분석 (v1.7.0)
+    ],
+    // Musu: Prime gateway bridge (gated by MUSU_PRIME_URL)
+    musu: [
+        'musu.status',
+        'musu.fleet',
+        'musu.gateway',
+        'musu.dispatch',
+        'musu.knowledge',
+        'musu.run',
+    ],
+    // HiveLink: P2P node bridge (gated by MUSU_PRIME_URL, routes through gateway)
+    hive: [
+        'hive.run_command',
+        'hive.file_list',
+        'hive.file_read',
+        'hive.submit_job',
+        'hive.nodes',
+    ],
+    // Human-facing: meta-tools + direct-access read-only tools for VIBE_PROFILE=human
+    human_facing: [
+        'vibe_pm.do', // 워크플로우 실행 (자연어 인텐트)
+        'vibe_pm.ask', // 정보 조회 (읽기전용)
+        'vibe_pm.check', // 코드 검수 게이트 (quick/full/deep)
+        'vibe_pm.status', // 상태 조회 (직접 노출)
+        'vibe_pm.doctor', // 진단 (직접 노출)
+        'vibe_pm.setup', // 설정 (직접 노출)
+    ],
 };
 // ============================================================
 // Profiles - 프로파일별 그룹 조합
 // ============================================================
 export const PROFILES = {
     // MVP: Code Clinic 판정 중심 (8개) - 최소 판매 단위
-    mvp: ["mvp"],
+    mvp: ['mvp'],
     // 최소: Core만 (AS-BUILT 기준 core는 mvp와 동일)
-    minimal: ["core"],
+    minimal: ['core'],
     // 코딩: Core + Ops + BitNet (AS-BUILT: init_docs + bitnet 포함)
-    coding: ["core", "ops", "bitnet"],
+    coding: ['core', 'ops', 'bitnet'],
     // 기획: Core + Bridge (Bridge는 현재 비어있음)
-    planning: ["core", "bridge"],
+    planning: ['core', 'bridge'],
     // 유지보수: Core + Ops + Memory + BitNet
-    maintenance: ["core", "ops", "memory", "bitnet"],
+    maintenance: ['core', 'ops', 'memory', 'bitnet'],
     // 리서치: Core + Research (Research는 현재 비어있음)
-    research: ["core", "research"],
+    research: ['core', 'research'],
     // 튜닝: Core + Perf (Perf는 현재 비어있음)
-    tuning: ["core", "perf"],
+    tuning: ['core', 'perf'],
+    // 사람 유저: 메타도구 + 직접 노출 도구 (6개)
+    human: ['human_facing'],
     // 전체: 모든 그룹
-    all: ["mvp", "core", "ops", "bridge", "memory", "research", "perf", "policy", "bitnet"]
+    all: [
+        'mvp',
+        'core',
+        'ops',
+        'bridge',
+        'memory',
+        'research',
+        'perf',
+        'policy',
+        'bitnet',
+        'musu',
+        'hive',
+    ],
 };
+/**
+ * Check if current profile is the human surface profile
+ */
+export function isHumanProfile(profile) {
+    return (profile ?? getCurrentProfile()) === 'human';
+}
 /**
  * Default human gates by autonomous mode
  */
@@ -86,31 +144,31 @@ const HUMAN_GATES_BY_MODE = {
         ingress: true,
         decisions: true,
         work_order: true,
-        inspection: true
+        inspection: true,
     },
     assisted: {
         ingress: false, // AI auto-resolves
         decisions: true, // Human approves decisions
         work_order: false, // Auto-generated
-        inspection: true // Human reviews results
+        inspection: true, // Human reviews results
     },
     full: {
         ingress: false,
         decisions: false,
         work_order: false,
-        inspection: false
-    }
+        inspection: false,
+    },
 };
 /**
  * Get autonomous mode from VIBE_AUTONOMOUS_MODE env var
  * Values: "off" (default), "assisted", "full"
  */
 export function getAutonomousMode() {
-    const env = (process.env.VIBE_AUTONOMOUS_MODE ?? "").trim().toLowerCase();
-    if (env === "full" || env === "assisted") {
+    const env = (process.env.VIBE_AUTONOMOUS_MODE ?? '').trim().toLowerCase();
+    if (env === 'full' || env === 'assisted') {
         return env;
     }
-    return "off";
+    return 'off';
 }
 /**
  * Get human gate configuration based on autonomous mode
@@ -121,7 +179,7 @@ export function getHumanGates() {
     const mode = getAutonomousMode();
     const defaults = { ...HUMAN_GATES_BY_MODE[mode] };
     // Allow override via env var
-    const override = (process.env.VIBE_HUMAN_GATES ?? "").trim();
+    const override = (process.env.VIBE_HUMAN_GATES ?? '').trim();
     if (override) {
         // Reset all to false first
         defaults.ingress = false;
@@ -129,15 +187,15 @@ export function getHumanGates() {
         defaults.work_order = false;
         defaults.inspection = false;
         // Enable only specified gates
-        const gates = override.split(",").map(g => g.trim().toLowerCase());
+        const gates = override.split(',').map(g => g.trim().toLowerCase());
         for (const gate of gates) {
-            if (gate === "ingress")
+            if (gate === 'ingress')
                 defaults.ingress = true;
-            if (gate === "decisions")
+            if (gate === 'decisions')
                 defaults.decisions = true;
-            if (gate === "work_order")
+            if (gate === 'work_order')
                 defaults.work_order = true;
-            if (gate === "inspection")
+            if (gate === 'inspection')
                 defaults.inspection = true;
         }
     }
@@ -153,7 +211,7 @@ export function isHumanGateEnabled(gate) {
  * Check if autonomous mode is enabled (assisted or full)
  */
 export function isAutonomousModeEnabled() {
-    return getAutonomousMode() !== "off";
+    return getAutonomousMode() !== 'off';
 }
 // ============================================================
 // Helper Functions
@@ -162,11 +220,11 @@ export function isAutonomousModeEnabled() {
  * Get current profile from VIBE_PROFILE env var (default: "all")
  */
 export function getCurrentProfile() {
-    const env = (process.env.VIBE_PROFILE ?? "").trim().toLowerCase();
+    const env = (process.env.VIBE_PROFILE ?? '').trim().toLowerCase();
     if (env && env in PROFILES) {
         return env;
     }
-    return "all";
+    return 'all';
 }
 /**
  * Get all tool names for the current profile
@@ -198,7 +256,7 @@ export function getProfileStats(profile = getCurrentProfile()) {
         profile,
         groups: [...groups],
         toolCount: tools.length,
-        tools
+        tools,
     };
 }
 /**
@@ -206,6 +264,6 @@ export function getProfileStats(profile = getCurrentProfile()) {
  */
 export function logProfileInfo() {
     const stats = getProfileStats();
-    const msg = `[vibe-pm] Profile: ${stats.profile}, Groups: [${stats.groups.join(", ")}], Tools: ${stats.toolCount}`;
-    process.stderr.write(msg + "\n");
+    const msg = `[vibe-pm] Profile: ${stats.profile}, Groups: [${stats.groups.join(', ')}], Tools: ${stats.toolCount}`;
+    process.stderr.write(msg + '\n');
 }

package/build/mcp/progress.d.ts

@@ -0,0 +1,14 @@
+export type McpExtra = {
+    _meta?: {
+        progressToken?: string | number;
+    };
+    sendNotification?: (notification: {
+        method: string;
+        params?: Record<string, unknown>;
+        _meta?: Record<string, unknown>;
+    }) => Promise<unknown> | unknown;
+};
+export interface ProgressReporter {
+    report(progress: number, total: number, message?: string): void;
+}
+export declare function createProgressReporter(extra: unknown): ProgressReporter;

package/build/mcp/progress.js

@@ -0,0 +1,39 @@
+function toNumberOrUndefined(x) {
+    return typeof x === 'number' && Number.isFinite(x) ? x : undefined;
+}
+function getProgressToken(extra) {
+    const token = extra?._meta?.progressToken;
+    return typeof token === 'string' || typeof token === 'number' ? token : undefined;
+}
+export function createProgressReporter(extra) {
+    const token = getProgressToken(extra);
+    const sendNotification = extra?.sendNotification;
+    if (token === undefined || typeof sendNotification !== 'function') {
+        return { report() { } };
+    }
+    let lastProgress;
+    let lastTotal;
+    return {
+        report(progress, total, message) {
+            const totalNum = toNumberOrUndefined(total);
+            const progressNum = toNumberOrUndefined(progress);
+            if (totalNum === undefined || progressNum === undefined)
+                return;
+            // MCP requires monotonic progress (best-effort guard).
+            if (lastTotal === totalNum && lastProgress !== undefined && progressNum < lastProgress) {
+                return;
+            }
+            lastProgress = progressNum;
+            lastTotal = totalNum;
+            void Promise.resolve(sendNotification({
+                method: 'notifications/progress',
+                params: {
+                    progressToken: token,
+                    progress: progressNum,
+                    total: totalNum,
+                    message,
+                },
+            })).catch(() => { });
+        },
+    };
+}

package/build/mcp/prompts/agent_personas.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Agent Persona MCP Prompts
+ *
+ * Registers MCP prompts for each agent in the catalog.
+ * These prompts provide system instructions + behavior rules when
+ * an agent persona is activated (e.g., @code-reviewer in Claude Desktop).
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerAgentPersonaPrompts(server: McpServer): void;