@zivis/mcp 0.1.0-alpha.26 → 0.1.0-alpha.3

package/dist/lib/next-steps.js

@@ -1,21 +0,0 @@
-export function withNextSteps(result, nextSteps, summary) {
-    const payload = {
-        result,
-        next_steps: nextSteps,
-        ...(summary ? { summary } : {}),
-    };
-    return {
-        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
-    };
-}
-export function withNextStepsError(message, nextSteps, summary) {
-    const payload = {
-        result: { error: message },
-        next_steps: nextSteps,
-        ...(summary ? { summary } : {}),
-    };
-    return {
-        content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
-        isError: true,
-    };
-}

package/dist/matcher/ast-eval.d.ts

@@ -1,8 +0,0 @@
-export type AstLanguage = "typescript" | "javascript" | "python" | "go";
-export interface AstMatch {
-    file: string;
-    start_line: number;
-    end_line: number;
-    matched_text: string;
-}
-export declare function evaluateAstStrategy(expression: unknown, language: AstLanguage, files: string[], rootDir: string): Promise<AstMatch[]>;

package/dist/matcher/ast-eval.js

@@ -1,95 +0,0 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import * as yaml from "js-yaml";
-import * as napi from "@ast-grep/napi";
-let registered = false;
-async function ensureLanguagesRegistered() {
-    if (registered)
-        return;
-    const py = (await import("@ast-grep/lang-python")).default;
-    const go = (await import("@ast-grep/lang-go")).default;
-    napi.registerDynamicLanguage({ python: py, go: go });
-    registered = true;
-}
-export async function evaluateAstStrategy(expression, language, files, rootDir) {
-    await ensureLanguagesRegistered();
-    const rule = normalizeExpressionToRule(expression);
-    if (!rule)
-        return [];
-    const matches = [];
-    const langKey = languageKey(language);
-    for (const file of files) {
-        let raw;
-        try {
-            raw = await fs.readFile(file, "utf8");
-        }
-        catch {
-            continue;
-        }
-        if (!raw)
-            continue;
-        let root;
-        try {
-            root = napi.parse(langKey, raw);
-        }
-        catch {
-            continue;
-        }
-        let foundNodes;
-        try {
-            foundNodes = root.root().findAll(rule);
-        }
-        catch {
-            continue;
-        }
-        for (const node of foundNodes) {
-            const range = node.range();
-            matches.push({
-                file: relPosix(rootDir, file),
-                start_line: (range.start.line ?? 0) + 1,
-                end_line: (range.end.line ?? 0) + 1,
-                matched_text: truncate(node.text(), 240),
-            });
-        }
-    }
-    return matches;
-}
-function normalizeExpressionToRule(expression) {
-    if (typeof expression === "string") {
-        try {
-            return ensureRuleWrapper(yaml.load(expression));
-        }
-        catch {
-            return undefined;
-        }
-    }
-    if (expression && typeof expression === "object") {
-        return ensureRuleWrapper(expression);
-    }
-    return undefined;
-}
-function ensureRuleWrapper(parsed) {
-    if (!parsed || typeof parsed !== "object")
-        return parsed;
-    const obj = parsed;
-    if ("rule" in obj)
-        return obj;
-    return { rule: obj };
-}
-function languageKey(lang) {
-    switch (lang) {
-        case "typescript": return "ts";
-        case "javascript": return "js";
-        case "python": return "python";
-        case "go": return "go";
-    }
-}
-function relPosix(rootDir, abs) {
-    const rel = path.relative(rootDir, abs);
-    return rel.split(path.sep).join("/");
-}
-function truncate(s, max) {
-    if (s.length <= max)
-        return s;
-    return s.slice(0, max) + "…";
-}

package/dist/matcher/finding.d.ts

@@ -1,55 +0,0 @@
-export type Lane = "trusted" | "inferred";
-export interface MatchedEvidence {
-    file: string;
-    start_line: number;
-    end_line?: number;
-    matched_text?: string;
-    strategy_code: string;
-}
-export interface FiredStrategy {
-    code: string;
-    language?: string;
-    trusted: boolean;
-    confidence_weight: number;
-    match_count: number;
-}
-export interface InferenceCandidate {
-    prompt_ref: string;
-    expected_output_schema?: unknown;
-    minimum_context_required?: {
-        lines?: number;
-        symbols?: string[];
-    };
-    reason: string;
-}
-export interface Finding {
-    pattern_id: string;
-    pattern_version: string;
-    lane: Lane;
-    confidence: number;
-    fired_strategies: FiredStrategy[];
-    evidence: MatchedEvidence[];
-    inference_candidate?: InferenceCandidate;
-    safe_summary?: string;
-    threats?: unknown[];
-    repair_contract?: unknown;
-}
-export interface MatcherSummary {
-    trusted_count: number;
-    inferred_count: number;
-    total: number;
-}
-export interface MatcherResult {
-    pack: {
-        id: string;
-        version: string;
-    };
-    artifact_path: string;
-    cwd: string;
-    capsules_relevant: number;
-    capsules_evaluated: number;
-    ast_files_scanned: number;
-    duration_ms: number;
-    summary: MatcherSummary;
-    findings: Finding[];
-}

package/dist/matcher/finding.js

@@ -1 +0,0 @@
-export {};

package/dist/matcher/index.d.ts

@@ -1,8 +0,0 @@
-import type { MatcherResult } from "./finding.js";
-export type { Finding, FiredStrategy, MatchedEvidence, MatcherResult, Lane } from "./finding.js";
-export interface RunMatcherOpts {
-    artifactPath: string;
-    cwd: string;
-    packId?: string;
-}
-export declare function runMatcher(opts: RunMatcherOpts): Promise<MatcherResult>;

package/dist/matcher/index.js

@@ -1,202 +0,0 @@
-import * as fs from "node:fs/promises";
-import * as fssync from "node:fs";
-import { loadActivePack, findRelevantCapsules, getControl, } from "../pattern-pack/index.js";
-import { walkLanguageFiles } from "./walker.js";
-import { evaluateAstStrategy } from "./ast-eval.js";
-const SUPPORTED_AST_LANGS = new Set([
-    "typescript",
-    "javascript",
-    "python",
-    "go",
-]);
-export async function runMatcher(opts) {
-    const startedAt = Date.now();
-    const handle = await loadActivePack(opts.packId);
-    const artifact = await readArtifact(opts.artifactPath);
-    const relevant = await findRelevantCapsules(handle, artifact);
-    const langsNeeded = collectAstLanguagesNeeded(relevant);
-    const walked = langsNeeded.length > 0
-        ? await walkLanguageFiles(opts.cwd, langsNeeded)
-        : { filesByLanguage: new Map(), filesScanned: 0, filesSkipped: 0 };
-    const controlPresence = await evaluateAllControls(handle, opts.cwd, walked.filesByLanguage);
-    const findings = [];
-    for (const cap of relevant) {
-        const finding = await evaluateCapsule(cap, opts.cwd, walked.filesByLanguage, controlPresence);
-        if (finding)
-            findings.push(finding);
-    }
-    const summary = {
-        trusted_count: findings.filter((f) => f.lane === "trusted").length,
-        inferred_count: findings.filter((f) => f.lane === "inferred").length,
-        total: findings.length,
-    };
-    return {
-        pack: { id: handle.manifest.pack_id, version: handle.manifest.version },
-        artifact_path: opts.artifactPath,
-        cwd: opts.cwd,
-        capsules_relevant: relevant.length,
-        capsules_evaluated: relevant.length,
-        ast_files_scanned: walked.filesScanned,
-        duration_ms: Date.now() - startedAt,
-        summary,
-        findings,
-    };
-}
-async function evaluateCapsule(cap, cwd, filesByLanguage, controlPresence) {
-    const strategies = (cap.strategies ?? []);
-    const fired = [];
-    const evidence = [];
-    let inferenceCandidate;
-    for (const strategy of strategies) {
-        const code = strategy.code;
-        const trusted = strategy.trusted !== false && code !== "INFER" && code !== "SEM" && code !== "REGEX";
-        if (code === "AST") {
-            const lang = (strategy.language ?? "").toLowerCase();
-            if (!SUPPORTED_AST_LANGS.has(lang)) {
-                fired.push({ code, language: lang, trusted, confidence_weight: strategy.confidence_weight, match_count: 0 });
-                continue;
-            }
-            const files = filesByLanguage.get(lang) ?? [];
-            if (files.length === 0) {
-                fired.push({ code, language: lang, trusted, confidence_weight: strategy.confidence_weight, match_count: 0 });
-                continue;
-            }
-            const matches = await evaluateAstStrategy(strategy.expression, lang, files, cwd);
-            fired.push({
-                code,
-                language: lang,
-                trusted,
-                confidence_weight: strategy.confidence_weight,
-                match_count: matches.length,
-            });
-            for (const m of matches) {
-                evidence.push({
-                    file: m.file,
-                    start_line: m.start_line,
-                    end_line: m.end_line,
-                    matched_text: m.matched_text,
-                    strategy_code: code,
-                });
-            }
-        }
-        else if (code === "META") {
-            const result = evaluateMetaStrategy(strategy.expression, controlPresence);
-            fired.push({
-                code,
-                trusted,
-                confidence_weight: strategy.confidence_weight,
-                match_count: result.fired ? 1 : 0,
-            });
-            if (result.fired) {
-                evidence.push({
-                    file: "(synthetic)",
-                    start_line: 0,
-                    matched_text: `META: none_of_controls satisfied; absent: [${result.absent.join(", ")}]`,
-                    strategy_code: code,
-                });
-            }
-        }
-        else if (code === "INFER") {
-            if (cap.model_task_prompt_ref) {
-                inferenceCandidate = {
-                    prompt_ref: cap.model_task_prompt_ref,
-                    expected_output_schema: cap.expected_output_schema,
-                    minimum_context_required: cap.minimum_context_required,
-                    reason: "Capsule has an INFER strategy. Use zivis_threat_get_inference_prompt to retrieve the prompt bundle, gather the indicated code spans, and run the inference in your model.",
-                };
-            }
-            fired.push({ code, trusted: false, confidence_weight: strategy.confidence_weight, match_count: 1 });
-        }
-        else {
-            fired.push({ code, trusted, confidence_weight: strategy.confidence_weight, match_count: 0 });
-        }
-    }
-    const anyFired = fired.some((f) => f.match_count > 0);
-    if (!anyFired)
-        return undefined;
-    const trustedFired = fired.filter((f) => f.trusted && f.match_count > 0).length;
-    const requiredCount = cap.required_evidence_count ?? 1;
-    const lane = trustedFired >= requiredCount ? "trusted" : "inferred";
-    const confidence = Math.min(1, fired.reduce((acc, f) => (f.match_count > 0 ? acc + f.confidence_weight : acc), 0));
-    return {
-        pattern_id: cap.id,
-        pattern_version: cap.version,
-        lane,
-        confidence,
-        fired_strategies: fired,
-        evidence,
-        inference_candidate: inferenceCandidate,
-        safe_summary: cap.safe_summary,
-        threats: cap.threats,
-        repair_contract: cap.repair_contract,
-    };
-}
-async function readArtifact(p) {
-    if (!fssync.existsSync(p)) {
-        throw new Error(`Artifact not found: ${p}`);
-    }
-    const raw = await fs.readFile(p, "utf8");
-    return JSON.parse(raw);
-}
-function collectAstLanguagesNeeded(capsules) {
-    const set = new Set();
-    for (const cap of capsules) {
-        for (const strategy of cap.strategies) {
-            if (strategy.code !== "AST")
-                continue;
-            const lang = (strategy.language ?? "").toLowerCase();
-            if (SUPPORTED_AST_LANGS.has(lang))
-                set.add(lang);
-        }
-    }
-    set.add("typescript");
-    set.add("python");
-    return [...set];
-}
-function evaluateMetaStrategy(expression, presence) {
-    const expr = expression;
-    if (!expr || typeof expr !== "object")
-        return { fired: false, absent: [] };
-    if (expr.none_of_controls && expr.none_of_controls.length > 0) {
-        const checkable = expr.none_of_controls.filter((id) => presence.get(id)?.checkable);
-        if (checkable.length === 0)
-            return { fired: false, absent: [] };
-        const absent = checkable.filter((id) => !presence.get(id).present);
-        if (absent.length === checkable.length) {
-            return { fired: true, absent };
-        }
-        return { fired: false, absent };
-    }
-    return { fired: false, absent: [] };
-}
-async function evaluateAllControls(handle, cwd, filesByLanguage) {
-    const out = new Map();
-    const controlEntries = handle.manifest.controls ?? [];
-    for (const entry of controlEntries) {
-        let control;
-        try {
-            control = await getControl(handle, entry.id);
-        }
-        catch {
-            continue;
-        }
-        let present = false;
-        let checkable = false;
-        for (const det of control.detection ?? []) {
-            const lang = det.language;
-            if (!SUPPORTED_AST_LANGS.has(lang))
-                continue;
-            const files = filesByLanguage.get(lang) ?? [];
-            if (files.length === 0)
-                continue;
-            checkable = true;
-            const matches = await evaluateAstStrategy(det.rule, lang, files, cwd);
-            if (matches.length > 0) {
-                present = true;
-                break;
-            }
-        }
-        out.set(control.id, { present, checkable });
-    }
-    return out;
-}

package/dist/matcher/inference-candidates.d.ts

@@ -1,26 +0,0 @@
-import { type Capsule } from "../pattern-pack/index.js";
-import type { Finding } from "./finding.js";
-export interface BundledInferenceCandidate {
-    candidate_id: string;
-    capsule_id: string;
-    capsule_version: string;
-    pattern_title?: string;
-    prompt: string;
-    expected_output_schema: unknown;
-    evidence_focus: Array<{
-        file: string;
-        start_line: number;
-        end_line?: number;
-        note?: string;
-    }>;
-    minimum_context_required?: {
-        lines?: number;
-        symbols?: string[];
-    };
-    instructions_for_host: string;
-}
-export interface InferenceBundle {
-    inference_candidates: BundledInferenceCandidate[];
-    host_required_action: string;
-}
-export declare function buildInferenceBundle(findings: Finding[], capsuleByPatternId?: Map<string, Capsule>): Promise<InferenceBundle>;

package/dist/matcher/inference-candidates.js

@@ -1,81 +0,0 @@
-import { loadActivePack, getInferencePrompt, } from "../pattern-pack/index.js";
-export async function buildInferenceBundle(findings, capsuleByPatternId) {
-    const candidates = [];
-    let handle;
-    for (let i = 0; i < findings.length; i++) {
-        const f = findings[i];
-        if (!f.inference_candidate)
-            continue;
-        if (!handle) {
-            try {
-                handle = await loadActivePack();
-            }
-            catch {
-                candidates.push(toFallbackCandidate(f, i));
-                continue;
-            }
-        }
-        let promptText;
-        try {
-            promptText = await getInferencePrompt(handle, f.inference_candidate.prompt_ref);
-        }
-        catch {
-            candidates.push(toFallbackCandidate(f, i));
-            continue;
-        }
-        const cap = capsuleByPatternId?.get(f.pattern_id);
-        candidates.push({
-            candidate_id: `ic-${i + 1}`,
-            capsule_id: f.pattern_id,
-            capsule_version: f.pattern_version,
-            pattern_title: cap?.title,
-            prompt: promptText,
-            expected_output_schema: f.inference_candidate.expected_output_schema ?? null,
-            evidence_focus: f.evidence
-                .filter((e) => e.file !== "(synthetic)")
-                .map((e) => ({
-                file: e.file,
-                start_line: e.start_line,
-                end_line: e.end_line,
-                note: e.matched_text ? e.matched_text.slice(0, 200) : undefined,
-            })),
-            minimum_context_required: f.inference_candidate.minimum_context_required,
-            instructions_for_host: "Read the source code at each evidence_focus[*].file:start_line — pull at least minimum_context_required.lines around each span. " +
-                "Attach those snippets to the prompt above. Run the prompt against your model. " +
-                "Return JSON matching expected_output_schema. The output enters the inferred lane.",
-        });
-    }
-    const action = buildHostRequiredAction(candidates);
-    return { inference_candidates: candidates, host_required_action: action };
-}
-function toFallbackCandidate(f, i) {
-    return {
-        candidate_id: `ic-${i + 1}`,
-        capsule_id: f.pattern_id,
-        capsule_version: f.pattern_version,
-        prompt: "",
-        expected_output_schema: f.inference_candidate?.expected_output_schema ?? null,
-        evidence_focus: f.evidence
-            .filter((e) => e.file !== "(synthetic)")
-            .map((e) => ({
-            file: e.file,
-            start_line: e.start_line,
-            end_line: e.end_line,
-        })),
-        minimum_context_required: f.inference_candidate?.minimum_context_required,
-        instructions_for_host: "Inline prompt unavailable. Call zivis_threat_get_inference_prompt with capsule_id=" +
-            f.pattern_id +
-            " to retrieve it.",
-    };
-}
-function buildHostRequiredAction(candidates) {
-    if (candidates.length === 0) {
-        return "No inference candidates emitted by this run. Findings are deterministic-only.";
-    }
-    return (`MANDATORY HOST ACTION: For each of the ${candidates.length} inference_candidate${candidates.length === 1 ? "" : "s"} below, ` +
-        `you MUST: (1) read the source code at evidence_focus[*].file:start_line (open each file, grab at least minimum_context_required.lines of surrounding context), ` +
-        `(2) run the candidate's prompt against your model with that source attached, ` +
-        `(3) produce JSON output matching expected_output_schema. ` +
-        `Do this BEFORE summarizing findings to the user — the inferred-lane verdict from your inference is what the user actually wants. ` +
-        `Each candidate is a self-contained inference task; you do not need to call any other ZIVIS tool to execute it.`);
-}

package/dist/matcher/walker.d.ts

@@ -1,7 +0,0 @@
-export type WalkLanguage = "typescript" | "javascript" | "python" | "go";
-export interface WalkResult {
-    filesByLanguage: Map<WalkLanguage, string[]>;
-    filesScanned: number;
-    filesSkipped: number;
-}
-export declare function walkLanguageFiles(rootDir: string, languages: WalkLanguage[]): Promise<WalkResult>;

package/dist/matcher/walker.js

@@ -1,71 +0,0 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-const HARD_SKIP_DIRS = new Set([
-    "node_modules",
-    ".git",
-    ".yarn",
-    ".pnpm",
-    "dist",
-    "build",
-    "out",
-    ".next",
-    ".nuxt",
-    ".turbo",
-    ".cache",
-    "coverage",
-    "vendor",
-    "__pycache__",
-    ".venv",
-    "target",
-]);
-const MAX_FILES = 50_000;
-const LANG_EXTENSIONS = {
-    typescript: [".ts", ".tsx"],
-    javascript: [".js", ".jsx", ".mjs", ".cjs"],
-    python: [".py"],
-    go: [".go"],
-};
-export async function walkLanguageFiles(rootDir, languages) {
-    const extToLang = new Map();
-    for (const lang of languages) {
-        for (const ext of LANG_EXTENSIONS[lang])
-            extToLang.set(ext, lang);
-    }
-    const filesByLanguage = new Map();
-    for (const lang of languages)
-        filesByLanguage.set(lang, []);
-    let filesScanned = 0;
-    let filesSkipped = 0;
-    const total = () => Array.from(filesByLanguage.values()).reduce((n, l) => n + l.length, 0);
-    async function visit(dirAbs) {
-        if (total() >= MAX_FILES)
-            return;
-        let entries;
-        try {
-            entries = await fs.readdir(dirAbs, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const entry of entries) {
-            if (entry.isDirectory()) {
-                if (HARD_SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) {
-                    filesSkipped++;
-                    continue;
-                }
-                await visit(path.join(dirAbs, entry.name));
-                continue;
-            }
-            if (!entry.isFile() && !entry.isSymbolicLink())
-                continue;
-            filesScanned++;
-            const ext = path.extname(entry.name).toLowerCase();
-            const lang = extToLang.get(ext);
-            if (lang) {
-                filesByLanguage.get(lang).push(path.join(dirAbs, entry.name));
-            }
-        }
-    }
-    await visit(rootDir);
-    return { filesByLanguage, filesScanned, filesSkipped };
-}