@yottameta/yotta-dev-mcp-plugin 0.2.0 → 0.2.2

package/.agents/plugins/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Developer Tools",
-      "version": "0.2.0",
+      "version": "0.2.2",
       "description": "YuanKai (yotta-dev-mcp) - deterministic local development tools exposed over stdio MCP: repo_map, system_model, architecture_review, impact_analysis, verify_change, self_test, run_adapter, find_code, compress_output, review_code, review_diff, mcp_doctor, scan_secrets, scan_dependencies, check_publish_readiness, run_checks, scaffold_skill and workflow_state. Reads an optional .yotta/architecture.json contract plus .yotta/verification.json policy for architecture reviews, change impact cones and the L0-L5 evidence ledger. Optional explicit adapters integrate import-linter, dependency-cruiser and Repomix without auto-install or network access. Python 3.8+ standard library, offline by default; writes and command execution require explicit flags.",
       "interface": {
         "displayName": "元开 yotta-dev-mcp",

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Developer Tools",
-      "version": "0.2.0",
+      "version": "0.2.2",
       "description": "YuanKai (yotta-dev-mcp) - deterministic local development tools exposed over stdio MCP: repo_map, system_model, architecture_review, impact_analysis, verify_change, self_test, run_adapter, find_code, compress_output, review_code, review_diff, mcp_doctor, scan_secrets, scan_dependencies, check_publish_readiness, run_checks, scaffold_skill and workflow_state. Reads an optional .yotta/architecture.json contract plus .yotta/verification.json policy for architecture reviews, change impact cones and the L0-L5 evidence ledger. Optional explicit adapters integrate import-linter, dependency-cruiser and Repomix without auto-install or network access. Python 3.8+ standard library, offline by default; writes and command execution require explicit flags.",
       "interface": {
         "displayName": "元开 yotta-dev-mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yottameta/yotta-dev-mcp-plugin",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "YuanKai (yotta-dev-mcp) Agent Plugin: deterministic local development tools over stdio MCP.",
   "license": "MIT",
   "repository": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "yotta-dev-mcp",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "YuanKai (yotta-dev-mcp) - deterministic local development tools exposed over stdio MCP: repo_map, system_model, architecture_review, impact_analysis, verify_change, self_test, run_adapter, find_code, compress_output, review_code, review_diff, mcp_doctor, scan_secrets, scan_dependencies, check_publish_readiness, run_checks, scaffold_skill and workflow_state. Reads an optional .yotta/architecture.json contract plus .yotta/verification.json policy for architecture reviews, change impact cones and the L0-L5 evidence ledger. Optional explicit adapters integrate import-linter, dependency-cruiser and Repomix without auto-install or network access. Python 3.8+ standard library, offline by default; writes and command execution require explicit flags.",
   "author": {
     "name": "YottaMeta",

package/skills/yotta-dev-mcp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: yotta-dev-mcp
 description: 元开（yotta-dev-mcp）—— 本地、确定性的开发工具 MCP，把只读默认的开发能力暴露为 stdio MCP server：repo_map / system_model / architecture_review / impact_analysis / verify_change / self_test / run_adapter / find_code / compress_output / review_code / review_diff / mcp_doctor / scan_secrets / scan_dependencies / check_publish_readiness / run_checks / scaffold_skill / workflow_state。触发：让 AI 在陌生项目里先做结构盘点、构建系统模型或架构契约（.yotta/architecture.json）、按契约评审架构、分析改动影响锥与回归面、按验证阶梯产出证据账本、对元开自身做完整性 / 反证自测、探测或显式运行 import-linter / dependency-cruiser / Repomix 可选适配器、定位代码、评审改动、扫描密钥/依赖、检查发布就绪、运行白名单检查、生成脚手架或读取 .workflow 状态时；或用户说 元开 / 开发能力 MCP / yotta-dev-mcp / 代码库地图 / 系统模型 / 架构契约 / 架构评审 / 影响分析 / 验证账本 / 反证自测 / 代码评审 MCP / 适配器 等。边界：Python 3.8+ 标准库、离线默认；除 run_checks（显式 allow_execute）、verify_change 的 L2-L4 策略检查（显式 allow_execute）与 self_test 的测试子集（显式 allow_execute）、run_adapter 的 action=run（显式 allow_execute）、scaffold_skill / workflow_state 的显式 apply 外均为只读；不上传源码、不自动修改、不提交、不联网查询包是否存在、不自动安装或下载适配器。
-version: 0.2.0
+version: 0.2.2
 license: MIT
 ---
 
@@ -37,6 +37,18 @@ npx -y @yottameta/yotta-dev-mcp
 python scripts/yotta_dev_mcp.py
 ```
 
+工具分组（`--tools`，与元忆同口径）：
+
+```bash
+python scripts/yotta_dev_mcp.py --tools core   # 5 工具：repo_map / find_code / review_code / review_diff / verify_change
+python scripts/yotta_dev_mcp.py --tools full   # 18 工具（默认）
+```
+
+`core` 给「需要把工具表常驻在上下文里」的宿主用：schema 体积约为 `full` 的 29%
+（5 工具 3,883 字符 vs 18 工具 13,230 字符，紧凑 JSON 口径），适合默认启用；
+`full` 暴露全部工具，适合按需调用、不常驻的场景。`core` 模式下调用 full 专属工具会返回
+明确提示（提示用 `--tools full` 重启）。
+
 自动接入说明：AI 首次协助配置时，必须先展示目标配置文件、完整配置片段和影响，
 并获得用户明确同意后再写入 `mcpServers`。用户拒绝时不要写文件，直接提供上面的启动命令
 让用户手动接入。
@@ -45,7 +57,7 @@ python scripts/yotta_dev_mcp.py
 
 | 工具 | 用途 | 写入 |
 |---|---|---|
-| `repo_map` | 模块、导入、入口点地图 | 否 |
+| `repo_map` | 模块、导入、入口点地图；支持 `from . import X` / 别名 / 包，忽略临时与探针目录 | 否 |
 | `system_model` | 系统模型：模块、依赖、入口、测试映射、配置与数据归属；附带契约分层，输出 PASS / FAIL / UNKNOWN | 否 |
 | `architecture_review` | 按契约评审依赖规则、边界可见性与数据归属；critical / high 判 FAIL，medium / low 只告警 | 否 |
 | `impact_analysis` | 变更影响锥：直接消费者、受影响层 / 边界 / 存储 / 不变量、映射测试、风险分级与回滚探针 | 否 |
@@ -54,10 +66,10 @@ python scripts/yotta_dev_mcp.py
 | `run_adapter` | 探测或显式运行 import-linter / dependency-cruiser / Repomix；固定 argv、项目内 cwd、有界输出与哈希 | 仅 action=run + 显式 allow_execute |
 | `find_code` | 符号 / 文本定位，结果有上限 | 否 |
 | `compress_output` | 保留错误与首尾的长输出压缩 | 否 |
-| `review_code` | 规则化代码评审，带行号与建议 | 否 |
+| `review_code` | 规则化代码评审，带行号与建议；忽略 `.workflow` / `scratch` / `_probe` 等临时目录 | 否 |
 | `review_diff` | 只评审 diff 的新增行 | 否 |
-| `mcp_doctor` | 技能版本与 MCP JSON 配置体检 | 否 |
-| `scan_secrets` | 密钥 / 凭据 / 高熵令牌扫描（强制脱敏） | 否 |
+| `mcp_doctor` | 技能版本与多宿主 MCP 配置体检；返回 coverage，只列 server 名，不含 command / env | 否 |
+| `scan_secrets` | 密钥 / 凭据 / 高熵令牌扫描（强制脱敏；路径 / 哈希 / 文件名噪声过滤） | 否 |
 | `scan_dependencies` | 依赖清单、lockfile、来源与 typosquat 启发式检查 | 否 |
 | `check_publish_readiness` | 版本四件、发布文件、仓库与 publishConfig 检查 | 否 |
 | `run_checks` | 白名单测试 / lint / compile 并返回结构化摘要 | 仅显式 allow_execute |
@@ -77,5 +89,6 @@ python scripts/yotta_dev_mcp.py
 
 ## 当前版本
 
+- v0.2.1（2026-09-25）：缺陷修复批次——`mcp_doctor` 改为多宿主 / 多根 / JSON+JSONC+TOML 子集发现并返回 coverage；`self_test(mode="installed")` 按精简分发副本 / npm / plugin / r0 形态判断 banner；`repo_map` 修复 `from . import X` 解析；`scan_secrets` 过滤路径 / 哈希 / 文件名噪声；`review_code` / `repo_map` 忽略 `.workflow` / `scratch` / `_probe` 等临时目录。
 - v0.2.0（2026-09-25）：新增 `system_model`、`architecture_review`、`impact_analysis`、`verify_change`、`self_test`、`run_adapter`，以及 `.yotta/architecture.json` 与可选 `.yotta/verification.json` 契约（版本 1）；工具总数 18，原 12 个工具行为不变。
 - v0.1.1：品牌显示名统一为「元开」；功能与 12 个工具不变。

package/skills/yotta-dev-mcp/references/tools.md

@@ -14,6 +14,12 @@ Input:
 
 Output: `root`, `modules`, `imports`, `entrypoints`, `truncated`.
 
+Python imports include absolute, `from .X import Y`, `from . import X`,
+`as` aliases, packages and multi-name forms. Temporary / agent-state
+directories (`.workflow`, `.codex`, `.cursor`, `.claude`, `.agents`,
+`scratch`, `_probe`, `probe`, `sandbox`, `debug`, `.tmp`) and probe/temp
+file names are ignored by default.
+
 ## system_model
 
 Input:
@@ -201,14 +207,36 @@ Input:
 
 Only added lines are reviewed. Output: `files`, `findings`, `truncated`.
 
+`review_code` uses the same default ignore set as `repo_map`: agent state
+directories, scratch / probe / sandbox / debug directories and probe/temp
+file names do not flood the result. `review_diff` only reviews added lines,
+so it is unaffected by directory traversal.
+
 ## mcp_doctor
 
 Input:
 
 - `skills_dirs` (optional array).
 - `config_paths` (optional array).
-
-Output: `skills`, `mcp_configs`, `issues`, `checked_skills`, `checked_configs`.
+- `include_defaults` (optional boolean): when `config_paths` is supplied, also
+  scan the built-in host registry instead of explicit-only scope.
+
+Output: `skills`, `mcp_configs`, `coverage`, `skills_coverage`, `issues`,
+`coverage_gaps`, `unknown_hosts`, `summary`, `scope`, `checked_skills`,
+`checked_configs`, `checked_hosts`.
+
+Discovery is tiered and environment-aware: verified hosts include Codex
+(`$CODEX_HOME/config.toml`, JSON fallbacks), Cursor, WorkBuddy
+(`~/.workbuddy/mcp.json` plus `connectors/*/mcp.json`), OpenCode
+(`$XDG_CONFIG_HOME/opencode/opencode.jsonc|json`), Claude Code, Windsurf,
+Continue, Gemini, Qwen, Trae, Comate, CodeBuddy, Kimi, Kiro, VS Code and Zed;
+additional hosts are best-effort candidates and are reported as
+`unverified` when absent. JSON, JSONC and a narrow TOML `[mcp_servers.*]`
+subset are parsed; YAML is reported as `unsupported`, never silently skipped.
+Only server names are returned; commands, args and env values are never
+included. `summary.all_clear` is true only for a fully covered, issue-free
+default scan; always read `coverage_confidence` before treating it as
+all-clear.
 
 ## scan_secrets
 
@@ -218,6 +246,11 @@ Input: `path` or `text`, optional `max_findings`, optional `include_git_history`
 Output: `findings` with `path`, `line`, `rule`, `severity`, redacted `evidence`,
 `suggestion`; `truncated`.
 
+High-entropy findings apply a narrow noise filter for absolute paths,
+URL / `file://` percent-encoded paths, common binary/source/document
+suffixes and hash-context hex values (SHA-1/256/512, MD5, checksum, digest,
+integrity). Credential-name, AWS-key and private-key rules are not relaxed.
+
 ## scan_dependencies
 
 Input: `path`.

package/skills/yotta-dev-mcp/scripts/dev_common.py

@@ -10,7 +10,14 @@ from pathlib import Path
 IGNORE_DIRS = {
     ".git", ".hg", ".svn", "node_modules", "__pycache__", ".venv", "venv",
     "dist", "build", ".next", ".nuxt", ".cache", ".tmp", ".tmp2",
+    ".workflow", ".codex", ".cursor", ".claude", ".agents",
+    "scratch", "_scratch", "_probe", "probe", "probes",
+    "sandbox", ".sandbox", "debug", "_debug",
 }
+IGNORE_TEMP_FILE_RE = re.compile(
+    r"(?i)^(?:probe[_-].*|_probe[_-].*|scratch[_-].*|_scratch[_-].*|tmp_.*|temp_.*|.*_tmp)"
+    r"\.(?:py|js|jsx|mjs|cjs|ts|tsx|sh|ps1|go|rs|java|kt|kts|rb|php)$"
+)
 SOURCE_EXTS = {
     ".py", ".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".sh", ".ps1",
     ".go", ".rs", ".java", ".kt", ".kts", ".rb", ".php",
@@ -54,7 +61,9 @@ VERIFY_REQUIRED_SOURCE_FILES = (
     "references/tools.md", "references/adapters.md",
     "references/architecture-contract.md", "assets/banner.png",
 )
-VERIFY_REQUIRED_INSTALLED_FILES = ("SKILL.md", "assets/banner.png")
+VERIFY_REQUIRED_INSTALLED_FILES = ("SKILL.md",)
+VERIFY_REQUIRED_INSTALLED_ASSETS = ("assets/banner.png",)
+LEAN_INSTALL_MARKERS = ("_icon.png",)
 VERIFY_WRITE_GATES = (
     ("run_checks", "allow_execute"),
     ("scaffold_skill", "apply"),
@@ -94,13 +103,15 @@ def _read_text(path):
     return data.decode("utf-8", errors="replace")
 
 
-def _iter_files(root, extensions=None, max_files=5000, all_files=False):
+def _iter_files(root, extensions=None, max_files=5000, all_files=False, ignore_temp=True):
     root = Path(root)
     extensions = set(extensions or TEXT_EXTS)
     count = 0
     for current, dirs, files in os.walk(str(root)):
         dirs[:] = sorted(d for d in dirs if d not in IGNORE_DIRS)
         for name in sorted(files):
+            if ignore_temp and IGNORE_TEMP_FILE_RE.match(name):
+                continue
             path = Path(current) / name
             if path.is_symlink():
                 continue

package/skills/yotta-dev-mcp/scripts/dev_engine.py

@@ -26,12 +26,22 @@ from dev_common import (
     _frontmatter_name, _frontmatter_version, source_exts,
 )
 from dev_impact import impact_analysis as _impact_analysis_impl
+from dev_mcp_doctor import (
+    default_config_paths as _default_config_paths_impl,
+    default_skill_dirs as _default_skill_dirs_impl,
+    mcp_doctor as _mcp_doctor_impl,
+)
 from dev_verify import verify_change as _verify_change_impl
 from dev_selftest import self_test
-from dev_model import _repo_map_js, _repo_map_python, system_model as _system_model_impl
+from dev_model import (
+    _classify_python_import,
+    _repo_map_js,
+    _repo_map_python,
+    system_model as _system_model_impl,
+)
 from dev_rules import REVIEW_RULES
 
-VERSION = "0.2.0"
+VERSION = "0.2.2"
 
 
 
@@ -54,6 +64,7 @@ def repo_map(path, max_files=2000):
     if len(files) > max_files:
         truncated = True
         files = files[:max_files]
+    module_set = {_rel(root, file_path) for file_path in files}
     for file_path in files:
         rel = _rel(root, file_path)
         try:
@@ -63,7 +74,11 @@ def repo_map(path, max_files=2000):
         language = _language(file_path)
         modules.append({"path": rel, "language": language, "lines": len(text.splitlines())})
         if file_path.suffix.lower() == ".py":
-            imports.extend(_repo_map_python(file_path, rel))
+            for raw in _repo_map_python(file_path, rel):
+                _, target = _classify_python_import(
+                    raw["target"], rel, module_set, relative=raw.get("relative", False)
+                )
+                imports.append({"source": rel, "target": target, "line": raw["line"]})
         elif file_path.suffix.lower() in (".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx"):
             imports.extend(_repo_map_js(file_path, rel))
         if (
@@ -274,81 +289,19 @@ def review_diff(diff_text=None, path=None, base=None, max_findings=200):
 
 
 def _default_skill_dirs():
-    home = Path.home()
-    candidates = [
-        home / ".codex" / "skills",
-        home / ".claude" / "skills",
-        home / ".cursor" / "skills",
-        home / ".config" / "opencode" / "skills",
-    ]
-    codex_home = os.environ.get("CODEX_HOME")
-    if codex_home:
-        candidates.insert(0, Path(codex_home) / "skills")
-    claude_home = os.environ.get("CLAUDE_CONFIG_DIR")
-    if claude_home:
-        candidates.insert(0, Path(claude_home) / "skills")
-    xdg_home = os.environ.get("XDG_CONFIG_HOME")
-    if xdg_home:
-        candidates.insert(0, Path(xdg_home) / "opencode" / "skills")
-    return candidates
+    return _default_skill_dirs_impl()
 
 
 def _default_config_paths():
-    home = Path.home()
-    return [
-        home / ".codex" / "config.json",
-        home / ".codex" / "mcp.json",
-        home / ".config" / "opencode" / "opencode.json",
-        home / ".claude" / "settings.json",
-        home / ".cursor" / "mcp.json",
-    ]
-
-
-def mcp_doctor(skills_dirs=None, config_paths=None):
-    skills = []
-    issues = []
-    for directory in (skills_dirs or _default_skill_dirs()):
-        root = Path(directory)
-        if not root.is_dir():
-            continue
-        for child in sorted(root.iterdir(), key=lambda item: item.name):
-            skill_file = child / "SKILL.md"
-            if not child.is_dir() or not skill_file.is_file():
-                continue
-            try:
-                text = _read_text(skill_file)
-            except (OSError, ValueError) as exc:
-                issues.append("%s: %s" % (skill_file, exc))
-                continue
-            skills.append({
-                "name": _frontmatter_name(text) or child.name,
-                "version": _frontmatter_version(text),
-                "path": str(skill_file),
-            })
-    mcp_configs = []
-    for config_path in (config_paths or _default_config_paths()):
-        path = Path(config_path)
-        if not path.is_file():
-            continue
-        try:
-            payload = json.loads(_read_text(path))
-        except Exception as exc:  # noqa: BLE001
-            issues.append("%s: %s" % (path, exc))
-            continue
-        servers = payload.get("mcpServers") if isinstance(payload, dict) else None
-        mcp_configs.append({
-            "path": str(path),
-            "servers": sorted(servers.keys()) if isinstance(servers, dict) else [],
-        })
-    skills.sort(key=lambda item: (item["name"], item["path"]))
-    mcp_configs.sort(key=lambda item: item["path"])
-    return {
-        "skills": skills,
-        "mcp_configs": mcp_configs,
-        "issues": issues,
-        "checked_skills": len(skills),
-        "checked_configs": len(mcp_configs),
-    }
+    return _default_config_paths_impl()
+
+
+def mcp_doctor(skills_dirs=None, config_paths=None, include_defaults=None):
+    return _mcp_doctor_impl(
+        skills_dirs=skills_dirs,
+        config_paths=config_paths,
+        include_defaults=include_defaults,
+    )
 
 
 SECRET_KEY_RE = re.compile(
@@ -357,6 +310,35 @@ SECRET_KEY_RE = re.compile(
 AWS_KEY_RE = re.compile(r"\bAKIA[0-9A-Z]{16}\b")
 PRIVATE_KEY_RE = re.compile(r"-----BEGIN [A-Z ]*PRIVATE KEY-----")
 HIGH_ENTROPY_RE = re.compile(r"[A-Za-z0-9_+/=\-]{32,}")
+HASH_CONTEXT_RE = re.compile(r"(?i)(sha1|sha256|sha512|hash|checksum|digest|integrity)")
+HEX_TOKEN_RE = re.compile(r"^[0-9a-fA-F]+$")
+PATH_HINT_RE = re.compile(r"(?i)(?:[a-z]:[\\/]|\\\\|https?://|file://)")
+URL_HINT_RE = re.compile(r"(?i)(?:file|https?)://")
+PERCENT_ESCAPE_RE = re.compile(r"%[0-9A-Fa-f]{2}")
+HASH_PREFIX_RE = re.compile(r"(?i)^(?:sha1|sha256|sha512|md5)[=:]([0-9a-fA-F]{32,128})$")
+FILE_SUFFIX_RE = re.compile(
+    r"(?i)\.(exe|dll|sys|py|js|ts|tsx|json|md|txt|log|whl|tar|gz|zip|png|jpg|jpeg|svg)"
+)
+
+
+def _high_entropy_noise(line, token, start, end):
+    """Return True for common non-secret high-entropy noise."""
+    if HASH_PREFIX_RE.match(token):
+        return True
+    if PERCENT_ESCAPE_RE.search(token) and URL_HINT_RE.search(line):
+        return True
+    if start > 0 and line[start - 1] == "%":
+        return True
+    if HEX_TOKEN_RE.match(token) and len(token) in (32, 40, 64, 128) and HASH_CONTEXT_RE.search(line):
+        return True
+    window = line[max(0, start - 16):min(len(line), end + 16)]
+    if PATH_HINT_RE.search(window):
+        return True
+    if URL_HINT_RE.search(line) and PERCENT_ESCAPE_RE.search(window):
+        return True
+    if FILE_SUFFIX_RE.match(line[end:end + 8]):
+        return True
+    return False
 
 
 def _entropy(value):
@@ -385,7 +367,9 @@ def scan_secrets(path=None, text=None, max_findings=200, include_git_history=Fal
         root = Path(path)
         if not root.exists():
             raise ValueError("路径不存在: %s" % path)
-        files = [root] if root.is_file() else list(_iter_files(root, all_files=True))
+        files = [root] if root.is_file() else list(
+            _iter_files(root, all_files=True, ignore_temp=False)
+        )
         base = root.parent if root.is_file() else root
         for file_path in files:
             try:
@@ -421,7 +405,11 @@ def scan_secrets(path=None, text=None, max_findings=200, include_git_history=Fal
                 })
             for match in HIGH_ENTROPY_RE.finditer(line):
                 token = match.group(0)
-                if _entropy(token) >= 4.0 and not PRIVATE_KEY_RE.search(line):
+                if (
+                    _entropy(token) >= 4.0
+                    and not PRIVATE_KEY_RE.search(line)
+                    and not _high_entropy_noise(line, token, match.start(), match.end())
+                ):
                     findings.append({
                         "path": rel, "line": line_no, "rule": "high-entropy-token",
                         "severity": "medium", "evidence": _redact(token),
@@ -1083,6 +1071,8 @@ def main():
     doctor = sub.add_parser("mcp-doctor")
     doctor.add_argument("--skills-dir", action="append")
     doctor.add_argument("--config", action="append")
+    doctor.add_argument("--include-defaults", action="store_true",
+                        help="scan built-in host registry in addition to --config paths")
     args = parser.parse_args()
     if args.command == "repo-map":
         result = repo_map(args.path)
@@ -1126,7 +1116,11 @@ def main():
     elif args.command == "review-code":
         result = review_code(args.path)
     elif args.command == "mcp-doctor":
-        result = mcp_doctor(skills_dirs=args.skills_dir, config_paths=args.config)
+        result = mcp_doctor(
+            skills_dirs=args.skills_dir,
+            config_paths=args.config,
+            include_defaults=args.include_defaults,
+        )
     else:
         parser.print_help()
         return 2