@vibekiln/cutline-mcp-cli 0.6.0 → 0.7.0

package/dist/servers/cutline-server.js

@@ -7395,6 +7395,18 @@ function mcpAudit(entry) {
   }));
 }
 var DEFAULT_MODEL = process.env.MODEL_ID || "gemini-2.5-pro";
+var GOVERNANCE_ENFORCEMENT = (process.env.CUTLINE_GOVERNANCE_ENFORCEMENT || "advisory").toLowerCase() === "enforced";
+function buildGovernanceEnvelope(input) {
+  return {
+    decision: input.decision,
+    decisionReasons: input.reasons ?? [],
+    requiredActions: input.requiredActions ?? [],
+    executionPermission: input.executionPermission ?? "conditional",
+    ...input.closePermission ? { closePermission: input.closePermission } : {},
+    ...input.requiredBranches?.length ? { requiredBranches: input.requiredBranches } : {},
+    ...input.mode ? { mode: input.mode } : {}
+  };
+}
 var generateStructuredContent = (options) => withLlmMonitor(options.modelId || DEFAULT_MODEL, () => cfGenerateStructuredContent(options));
 var explorationSessions = /* @__PURE__ */ new Map();
 function generateId(prefix = "id") {
@@ -8003,6 +8015,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             max_constraints: { type: "number", description: "Max constraints to return (default: 5)" },
             use_semantic: { type: "boolean", description: "Use semantic search if embeddings available (default: true)" },
             phase: { type: "string", enum: ["test_spec", "functional", "security", "performance", "economics", "full", "auto"], description: "RGR phase filter. 'auto' uses complexity heuristic. Default: 'full'" },
+            requestedOutcome: {
+              type: "string",
+              enum: ["approve", "revise", "execute", "close"],
+              description: "Governance intent for this transition (default: approve)"
+            },
             auto_scope_expand: { type: "boolean", description: "If true, auto-seed a new graph entity when scope expansion intent is confidently detected and entity fields are provided." },
             scope_entity_name: { type: "string", description: "Optional explicit entity name to seed during scope expansion (for example 'Vibe Check Extension')." },
             scope_entity_type: { type: "string", enum: ["feature", "component", "data_type"], description: "Entity type for auto scope expansion." },
@@ -8223,7 +8240,12 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           properties: {
             product_id: { type: "string", description: "Product ID" },
             file_path: { type: "string", description: "File path to assess (e.g., 'src/api/upload.ts')" },
-            depth: { type: "number", description: "BFS traversal depth for subgraph extraction (default: 2)" }
+            depth: { type: "number", description: "BFS traversal depth for subgraph extraction (default: 2)" },
+            requestedOutcome: {
+              type: "string",
+              enum: ["approve", "revise", "execute", "close"],
+              description: "Governance intent for this transition (default: approve)"
+            }
           },
           required: ["product_id", "file_path"]
         }
@@ -8240,6 +8262,39 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["product_id", "phase"]
         }
       },
+      {
+        name: "request_execution_gate",
+        description: "\u{1F512} PREMIUM - Governance checkpoint before downstream actions (code generation, file edits, migrations, deploy). Uses RGR completion, audit signals, and constraint acknowledgments to return approved/conditional/blocked.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            product_id: { type: "string", description: "Product ID" },
+            target_action: { type: "string", enum: ["generate_code", "modify_files", "run_migration", "deploy"], description: "Planned downstream action" },
+            target_artifacts: { type: "array", items: { type: "string" }, description: "Files/modules the action will touch" },
+            based_on_step_ids: { type: "array", items: { type: "string" }, description: "Optional planning step IDs this execution is based on" },
+            open_critical_findings: { type: "number", description: "Count of unresolved critical/high findings from latest audit context" },
+            touched_sensitive_paths: { type: "array", items: { type: "string" }, description: "Sensitive files touched in this action (auth, billing, security, AI, integrations, user flows)" },
+            constraints_acknowledged: { type: "boolean", description: "Whether relevant constraints have been reviewed and acknowledged for touched sensitive paths" }
+          },
+          required: ["product_id", "target_action", "target_artifacts"]
+        }
+      },
+      {
+        name: "submit_done_claim",
+        description: "\u{1F512} PREMIUM - Governance close gate. Evaluates completion claims against RGR state, unresolved critical findings, and provided evidence references.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            product_id: { type: "string", description: "Product ID" },
+            completion_summary: { type: "string", description: "What was completed" },
+            claimed_criteria_satisfied: { type: "array", items: { type: "string" }, description: "Success criteria the agent claims are satisfied" },
+            known_limitations: { type: "array", items: { type: "string" }, description: "Known limitations or intentional exclusions" },
+            evidence_refs: { type: "array", items: { type: "string" }, description: "Evidence links/refs (tests, reports, docs, PRs)" },
+            open_critical_findings: { type: "number", description: "Count of unresolved critical/high findings from latest audit context" }
+          },
+          required: ["product_id", "completion_summary", "claimed_criteria_satisfied"]
+        }
+      },
       {
         name: "export_readiness_badge",
         description: "\u{1F512} PREMIUM - Export a public readiness badge and verification page for this product. Computes an architecture readiness grade from the constraint graph, stores a public snapshot, and returns embeddable badge snippets (Markdown for GitHub README, HTML for website footer) plus a full CUTLINE-REPORT.md. The verification page at thecutline.ai/verify/{id} provides SEO backlinks.",
@@ -9182,7 +9237,7 @@ Meta: ${JSON.stringify(output.meta)}` }
             return void 0;
           };
           var detectFramework = detectFramework2;
-          const { product_id, file_paths, code_snippet, task_description, mode = "auto", max_constraints = 5, use_semantic = true, phase: autoPhase = "full", auto_scope_expand = false, scope_entity_name, scope_entity_type, scope_entity_description, scope_entity_tags, scope_parent_id, scope_similarity_threshold } = args;
+          const { product_id, file_paths, code_snippet, task_description, mode = "auto", max_constraints = 5, use_semantic = true, phase: autoPhase = "full", requestedOutcome = "approve", auto_scope_expand = false, scope_entity_name, scope_entity_type, scope_entity_description, scope_entity_tags, scope_parent_id, scope_similarity_threshold } = args;
           if (!product_id) {
             throw new McpError(ErrorCode.InvalidParams, "product_id is required");
           }
@@ -9192,6 +9247,19 @@ Meta: ${JSON.stringify(output.meta)}` }
             task_description
           };
           if (!hasEnoughSignal(fileContext)) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "revise",
+              reasons: [{
+                constraintId: "context.signal.missing",
+                severity: "warning",
+                message: "Insufficient context to match constraints deterministically."
+              }],
+              requiredActions: [
+                "Provide file_paths, code_snippet, or task_description.",
+                "Re-run constraints_auto with richer context."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9202,7 +9270,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                   meta: {
                     mode: "silent",
                     signal_strength: 0
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9238,6 +9307,16 @@ Meta: ${JSON.stringify(output.meta)}` }
           }
           const actualMode = mode === "auto" ? analysis.suggested_mode : mode;
           if (actualMode === "silent") {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "approved",
+              reasons: [{
+                constraintId: "constraints.mode.silent",
+                severity: "info",
+                message: "Silent mode selected; constraints were analyzed but not injected into output."
+              }],
+              requiredActions: requestedOutcome === "execute" ? ["If execution is next, run request_execution_gate before downstream write/deploy actions."] : [],
+              executionPermission: requestedOutcome === "execute" ? "conditional" : "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9252,7 +9331,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                     keywords_detected: analysis.signal.keywords?.slice(0, 5),
                     scope_expansion: scopeExpansion,
                     scope_seeded: scopeSeedResult || void 0
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9264,6 +9344,19 @@ Meta: ${JSON.stringify(output.meta)}` }
             lightNodes = await getAllNodesLight(product_id);
           }
           if (lightNodes.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "blocked",
+              reasons: [{
+                constraintId: "constraints.graph.empty",
+                severity: "high",
+                message: "No ingested constraints are available for this product."
+              }],
+              requiredActions: [
+                "Run constraints_ingest_* or graph_ingest_requirements first.",
+                "Re-run constraints_auto after ingestion."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -9275,7 +9368,8 @@ Meta: ${JSON.stringify(output.meta)}` }
                     mode: actualMode,
                     detected_domains: analysis.detected_domains,
                     signal_strength: Math.round(analysis.confidence * 100) / 100
-                  }
+                  },
+                  governance: governance2
                 })
               }]
             };
@@ -9413,6 +9507,36 @@ Meta: ${JSON.stringify(output.meta)}` }
 ${recommendation}`;
             }
           }
+          const criticalCount = topConstraints.filter((c) => c.severity === "critical").length;
+          const warningCount = topConstraints.filter((c) => c.severity === "warning").length;
+          const branchRequired = detectedConflicts.length > 0;
+          const shouldBlock = actualMode === "blocking" && criticalCount > 0;
+          const governanceDecision = shouldBlock ? "blocked" : branchRequired ? "branch" : criticalCount > 0 || warningCount > 0 ? "revise" : "approved";
+          const governance = buildGovernanceEnvelope({
+            decision: governanceDecision,
+            reasons: [
+              ...criticalCount > 0 ? [{
+                constraintId: "constraints.severity.critical",
+                severity: "critical",
+                message: `${criticalCount} critical constraint(s) detected for the proposed transition.`
+              }] : [],
+              ...branchRequired ? [{
+                constraintId: "constraints.conflict.detected",
+                severity: "high",
+                message: `${detectedConflicts.length} constraint conflict(s) detected; compare alternatives before execution.`
+              }] : []
+            ],
+            requiredActions: [
+              ...criticalCount > 0 ? ["Address critical constraints before implementation handoff."] : [],
+              ...branchRequired ? ["Compare at least two implementation alternatives and resolve conflicts explicitly."] : [],
+              ...requestedOutcome === "execute" ? ["Run request_execution_gate before invoking code-write or deploy actions."] : []
+            ],
+            executionPermission: shouldBlock ? "denied" : requestedOutcome === "execute" ? "conditional" : "denied",
+            requiredBranches: branchRequired ? [
+              { branchId: "A", instruction: "Propose the lowest-risk compliant implementation path." },
+              { branchId: "B", instruction: "Propose an alternative path and document trade-offs." }
+            ] : void 0
+          });
           return {
             content: [{
               type: "text",
@@ -9433,9 +9557,12 @@ ${recommendation}`;
                   used_category_prefilter: usePreFilter,
                   phase: autoPhase,
                   rgr_plan: autoRgrPlan || void 0,
+                  requested_outcome: requestedOutcome,
                   scope_expansion: scopeExpansion,
-                  scope_seeded: scopeSeedResult || void 0
-                }
+                  scope_seeded: scopeSeedResult || void 0,
+                  requested_outcome: requestedOutcome
+                },
+                governance
               })
             }]
           };
@@ -10253,7 +10380,7 @@ ${JSON.stringify(metrics, null, 2)}` }
         // RGR_PLAN
         // ─────────────────────────────────────────────────────────────────
         case "rgr_plan": {
-          const { product_id, file_path, depth: rgrDepth = 2 } = args;
+          const { product_id, file_path, depth: rgrDepth = 2, requestedOutcome = "approve" } = args;
           if (!product_id || !file_path) {
             throw new McpError(ErrorCode.InvalidParams, "product_id and file_path are required");
           }
@@ -10264,10 +10391,26 @@ ${JSON.stringify(metrics, null, 2)}` }
             getAllBindings(product_id)
           ]);
           if (rgrEntities.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "blocked",
+              reasons: [{
+                constraintId: "graph.entities.missing",
+                severity: "high",
+                message: `No graph entities found for product "${product_id}".`
+              }],
+              requiredActions: [
+                "Run graph_ingest_requirements or constraints_ingest_* to seed the graph.",
+                "Re-run rgr_plan after ingestion."
+              ],
+              executionPermission: "denied"
+            });
             return {
               content: [{
                 type: "text",
-                text: `No graph entities found for product "${product_id}". Run graph_ingest_requirements first.`
+                text: JSON.stringify({
+                  message: `No graph entities found for product "${product_id}". Run graph_ingest_requirements first.`,
+                  governance: governance2
+                }, null, 2)
               }]
             };
           }
@@ -10286,6 +10429,19 @@ ${JSON.stringify(metrics, null, 2)}` }
             }
           }
           if (rgrMatched.length === 0) {
+            const governance2 = buildGovernanceEnvelope({
+              decision: "revise",
+              reasons: [{
+                constraintId: "graph.binding.missing",
+                severity: "warning",
+                message: `No graph entity is bound to "${file_path}".`
+              }],
+              requiredActions: [
+                "Bind codebase entities using graph_bind_codebase/graph_bind_confirm.",
+                "Proceed with full delivery only if no bound entity is expected."
+              ],
+              executionPermission: requestedOutcome === "execute" ? "conditional" : "denied"
+            });
             return {
               content: [{
                 type: "text",
@@ -10293,7 +10449,8 @@ ${JSON.stringify(metrics, null, 2)}` }
                   strategy: "full",
                   phases: [{ name: "full", label: "Full Delivery", description: "No entity bound to this file. Deliver all constraints.", categories: [], constraint_count: 0 }],
                   total_constraints: 0,
-                  rationale: `No entity bound to "${file_path}". Cannot assess constraint complexity.`
+                  rationale: `No entity bound to "${file_path}". Cannot assess constraint complexity.`,
+                  governance: governance2
                 }, null, 2)
               }]
             };
@@ -10302,13 +10459,36 @@ ${JSON.stringify(metrics, null, 2)}` }
           const fileConstraints = rgrSubgraph?.constraints ?? [];
           const plan = planRgrPhases(fileConstraints);
           const complexity = assessComplexity(fileConstraints);
+          const branchNeeded = plan.strategy === "phased" && (complexity.critical_count > 0 || requestedOutcome === "execute");
+          const governance = buildGovernanceEnvelope({
+            decision: branchNeeded ? "branch" : "approved",
+            reasons: branchNeeded ? [{
+              constraintId: "rgr.phased.required",
+              severity: "high",
+              message: `${complexity.critical_count} critical constraint(s) across ${complexity.category_count} categories require phased comparison.`
+            }] : [{
+              constraintId: "rgr.plan.ready",
+              severity: "info",
+              message: "Plan assessed and ready for implementation sequencing."
+            }],
+            requiredActions: [
+              ...plan.strategy === "phased" ? ["Follow phased RGR execution order from this plan."] : ["Deliver full constraint set in a single pass."],
+              ...requestedOutcome === "execute" ? ["Request execution permission via request_execution_gate before downstream write/deploy actions."] : []
+            ],
+            executionPermission: requestedOutcome === "execute" ? "conditional" : "denied",
+            requiredBranches: branchNeeded ? [
+              { branchId: "A", instruction: "Prioritize functional progress (test_spec/functional) then apply NFR phases." },
+              { branchId: "B", instruction: "Prioritize security/performance constraints before broad implementation." }
+            ] : void 0
+          });
           return {
             content: [{
               type: "text",
               text: JSON.stringify({
                 ...plan,
                 entity: rgrMatched[0].name,
-                complexity
+                complexity,
+                governance
               }, null, 2)
             }]
           };
@@ -10379,6 +10559,157 @@ ${JSON.stringify(metrics, null, 2)}` }
           };
         }
         // ─────────────────────────────────────────────────────────────────
+        // REQUEST_EXECUTION_GATE
+        // ─────────────────────────────────────────────────────────────────
+        case "request_execution_gate": {
+          const { product_id, target_action, target_artifacts, based_on_step_ids = [], open_critical_findings = 0, touched_sensitive_paths = [], constraints_acknowledged = false } = args;
+          if (!product_id || !target_action || !Array.isArray(target_artifacts) || target_artifacts.length === 0) {
+            throw new McpError(ErrorCode.InvalidParams, "product_id, target_action, and non-empty target_artifacts are required");
+          }
+          const meta = await getGraphMetadata(product_id);
+          const completedPhases = meta?.rgr_completed_phases ?? [];
+          const metrics = meta?.metrics;
+          const unmetCheckpoints = [];
+          const blockingFindings = [];
+          const requiredNextSteps = [];
+          if (!completedPhases.includes("security")) {
+            unmetCheckpoints.push("security_commitment");
+            blockingFindings.push({
+              constraintId: "rgr.phase.security",
+              severity: "high",
+              message: "Security phase is not marked complete."
+            });
+            requiredNextSteps.push('Complete security remediation and call rgr_complete_phase(product_id, phase: "security").');
+          }
+          if (target_action === "deploy" && !completedPhases.includes("performance")) {
+            unmetCheckpoints.push("implementation_readiness");
+            blockingFindings.push({
+              constraintId: "rgr.phase.performance",
+              severity: "warning",
+              message: "Deploy requested before performance phase completion."
+            });
+            requiredNextSteps.push('Complete performance checks and call rgr_complete_phase(product_id, phase: "performance").');
+          }
+          if (open_critical_findings > 0) {
+            unmetCheckpoints.push("verification");
+            blockingFindings.push({
+              constraintId: "audit.findings.open",
+              severity: "critical",
+              message: `${open_critical_findings} unresolved critical/high findings are still open.`
+            });
+            requiredNextSteps.push("Resolve or explicitly accept outstanding critical/high findings before execution.");
+          }
+          if (touched_sensitive_paths.length > 0 && !constraints_acknowledged) {
+            unmetCheckpoints.push("implementation_readiness");
+            blockingFindings.push({
+              constraintId: "constraints.ack.required",
+              severity: "high",
+              message: "Sensitive paths were provided without explicit constraint acknowledgment."
+            });
+            requiredNextSteps.push("Run constraints_auto for touched sensitive paths and acknowledge applicable constraints.");
+          }
+          const hasBlocks = blockingFindings.some((f) => f.severity === "critical" || f.severity === "high");
+          const denied = hasBlocks && GOVERNANCE_ENFORCEMENT;
+          const decision = denied ? "blocked" : blockingFindings.length > 0 ? "conditional" : "approved";
+          const governance = buildGovernanceEnvelope({
+            decision: denied ? "blocked" : blockingFindings.length > 0 ? "revise" : "approved",
+            reasons: blockingFindings,
+            requiredActions: requiredNextSteps,
+            executionPermission: denied ? "denied" : blockingFindings.length > 0 ? "conditional" : "granted",
+            mode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: JSON.stringify({
+                decision,
+                unmetCheckpoints: [...new Set(unmetCheckpoints)],
+                blockingFindings,
+                requiredNextSteps,
+                based_on_step_ids,
+                product_id,
+                target_action,
+                target_artifacts,
+                governanceMode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory",
+                readiness: {
+                  rgr_completed_phases: completedPhases,
+                  security_readiness_pct: metrics?.security_readiness_pct ?? null,
+                  engineering_readiness_pct: metrics?.engineering_readiness_pct ?? null
+                },
+                governance
+              }, null, 2)
+            }]
+          };
+        }
+        // ─────────────────────────────────────────────────────────────────
+        // SUBMIT_DONE_CLAIM
+        // ─────────────────────────────────────────────────────────────────
+        case "submit_done_claim": {
+          const { product_id, completion_summary, claimed_criteria_satisfied, known_limitations = [], evidence_refs = [], open_critical_findings = 0 } = args;
+          if (!product_id || !completion_summary || !Array.isArray(claimed_criteria_satisfied)) {
+            throw new McpError(ErrorCode.InvalidParams, "product_id, completion_summary, and claimed_criteria_satisfied are required");
+          }
+          const meta = await getGraphMetadata(product_id);
+          const completedPhases = meta?.rgr_completed_phases ?? [];
+          const unsatisfiedCriteria = [];
+          const blockingFindings = [];
+          const requiredNextSteps = [];
+          if (!completedPhases.includes("security")) {
+            unsatisfiedCriteria.push("Security phase completion not recorded.");
+            blockingFindings.push({
+              constraintId: "done.rgr.security_missing",
+              severity: "high",
+              message: "Cannot close work item before security phase completion."
+            });
+            requiredNextSteps.push('Complete and record security phase via rgr_complete_phase(product_id, phase: "security").');
+          }
+          if (evidence_refs.length === 0) {
+            unsatisfiedCriteria.push("No evidence references provided for completion claim.");
+            blockingFindings.push({
+              constraintId: "done.evidence.required",
+              severity: "warning",
+              message: "Done claims require evidence refs (tests, reports, or docs)."
+            });
+            requiredNextSteps.push("Provide evidence_refs for tests, audit reruns, or implementation verification.");
+          }
+          if (open_critical_findings > 0) {
+            unsatisfiedCriteria.push(`${open_critical_findings} unresolved critical/high findings remain.`);
+            blockingFindings.push({
+              constraintId: "done.critical_findings.open",
+              severity: "critical",
+              message: "Outstanding critical/high findings prevent closure."
+            });
+            requiredNextSteps.push("Resolve or explicitly disposition outstanding critical/high findings before closure.");
+          }
+          const hasHardBlock = blockingFindings.some((f) => f.severity === "critical" || f.severity === "high");
+          const decision = hasHardBlock ? "blocked" : unsatisfiedCriteria.length > 0 ? "incomplete" : "complete";
+          const governance = buildGovernanceEnvelope({
+            decision: hasHardBlock ? "blocked" : unsatisfiedCriteria.length > 0 ? "incomplete" : "approved",
+            reasons: blockingFindings,
+            requiredActions: requiredNextSteps,
+            executionPermission: "denied",
+            closePermission: decision === "complete" ? "granted" : "denied",
+            mode: GOVERNANCE_ENFORCEMENT ? "enforced" : "advisory"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: JSON.stringify({
+                decision,
+                closePermission: decision === "complete" ? "granted" : "denied",
+                completionSummary: completion_summary,
+                claimedCriteriaSatisfied: claimed_criteria_satisfied,
+                knownLimitations: known_limitations,
+                evidenceRefs: evidence_refs,
+                unsatisfiedCriteria,
+                blockingFindings,
+                requiredNextSteps,
+                governance
+              }, null, 2)
+            }]
+          };
+        }
+        // ─────────────────────────────────────────────────────────────────
         // GENERATE_CUTLINE_MD
         // ─────────────────────────────────────────────────────────────────
         case "generate_cutline_md": {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vibekiln/cutline-mcp-cli",
-    "version": "0.6.0",
+    "version": "0.7.0",
     "description": "CLI and MCP servers for Cutline — authenticate, then run constraint-aware MCP servers in Cursor or any MCP client.",
     "type": "module",
     "main": "dist/index.js",