agent-enderun 1.10.4 → 1.11.1

package/framework-mcp/dist/tools/framework/update_contract_hash.js

@@ -0,0 +1,5 @@
+import { safeExec } from "../../utils/cli.js";
+export function handleUpdateContractHash(projectRoot, args) {
+    const output = safeExec("npx", ["agent-enderun", "update-contract"], projectRoot, args.timeout);
+    return { content: [{ type: "text", text: output }] };
+}

package/framework-mcp/dist/tools/framework/update_memory.js

@@ -0,0 +1,8 @@
+import { safeExec } from "../../utils/cli.js";
+export function handleUpdateProjectMemory(projectRoot, args) {
+    const section = args.section;
+    const content = args.content;
+    // Using execFileSync with array args prevents command injection
+    safeExec("npx", ["agent-enderun", "update_project_memory", section, content], projectRoot);
+    return { content: [{ type: "text", text: `✅ Section ${section} updated.` }] };
+}

package/framework-mcp/dist/tools/index.js

@@ -0,0 +1,62 @@
+import { TOOLS } from "./definitions.js";
+import { handleReadFile } from "./file_system/read_file.js";
+import { handleWriteFile } from "./file_system/write_file.js";
+import { handleReplaceText } from "./file_system/replace_text.js";
+import { handleBatchSurgicalEdit } from "./file_system/batch_surgical_edit.js";
+import { handlePatchFile } from "./file_system/patch_file.js";
+import { handleGrepSearch } from "./search/grep_search.js";
+import { handleListDir } from "./search/list_dir.js";
+import { handleGetProjectGaps } from "./search/get_gaps.js";
+import { handleGetProjectMap } from "./search/get_map.js";
+import { handleGetFrameworkStatus } from "./framework/get_status.js";
+import { handleUpdateProjectMemory } from "./framework/update_memory.js";
+import { handleAuditDependencies } from "./framework/audit_deps.js";
+import { handleRunTests } from "./framework/run_tests.js";
+import { handleGetSystemHealth } from "./observability/get_health.js";
+import { handleCheckPorts } from "./observability/check_ports.js";
+import { handleStartDashboard } from "./dashboard/start_dashboard.js";
+import { handleOrchestrateLoop } from "./framework/orchestrate.js";
+import { handleUpdateContractHash } from "./framework/update_contract_hash.js";
+import { handleReadProjectMemory } from "./memory/read_memory.js";
+import { handleGetMemoryInsights } from "./memory/get_insights.js";
+import { handleSendAgentMessage } from "./messaging/send_message.js";
+import { handleLogAgentAction } from "./messaging/log_action.js";
+import { handleAcquireLock, handleReleaseLock } from "./control_plane/locking.js";
+import { handleRegisterAgent } from "./control_plane/registry.js";
+import { handleRunCommand } from "./shell/run_command.js";
+import { handleCheckLint } from "./quality/check_lint.js";
+// Map of tool names to their handler functions
+const bind = (fn) => {
+    return (root, args) => fn(root, args);
+};
+export const toolHandlers = {
+    read_file: bind(handleReadFile),
+    view_file: bind(handleReadFile), // Alias
+    list_dir: bind(handleListDir),
+    grep_search: bind(handleGrepSearch),
+    get_project_map: bind(handleGetProjectMap),
+    get_project_gaps: bind(handleGetProjectGaps),
+    write_file: bind(handleWriteFile),
+    replace_text: bind(handleReplaceText),
+    batch_surgical_edit: bind(handleBatchSurgicalEdit),
+    patch_file: bind(handlePatchFile),
+    get_framework_status: bind(handleGetFrameworkStatus),
+    read_project_memory: bind(handleReadProjectMemory),
+    get_memory_insights: bind(handleGetMemoryInsights),
+    update_project_memory: bind(handleUpdateProjectMemory),
+    audit_dependencies: bind(handleAuditDependencies),
+    run_tests: bind(handleRunTests),
+    get_system_health: bind(handleGetSystemHealth),
+    check_active_ports: bind(handleCheckPorts),
+    start_dashboard: bind(handleStartDashboard),
+    orchestrate_loop: bind(handleOrchestrateLoop),
+    send_agent_message: bind(handleSendAgentMessage),
+    log_agent_action: bind(handleLogAgentAction),
+    update_contract_hash: bind(handleUpdateContractHash),
+    acquire_lock: bind(handleAcquireLock),
+    release_lock: bind(handleReleaseLock),
+    register_agent: bind(handleRegisterAgent),
+    run_shell_command: bind(handleRunCommand),
+    check_lint: bind(handleCheckLint),
+};
+export { TOOLS };

package/framework-mcp/dist/tools/memory/get_insights.js

@@ -0,0 +1,34 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../../utils/security.js";
+/**
+ * Extracts key insights from the project memory to minimize token usage.
+ * Returns only the active phase, trace, and the last 5 decisions/tasks.
+ */
+export function handleGetMemoryInsights(projectRoot, _args) {
+    try {
+        const frameworkDir = resolveFrameworkDir(projectRoot);
+        const memoryPath = path.join(projectRoot, frameworkDir, "memory/PROJECT_MEMORY.md");
+        if (!fs.existsSync(memoryPath)) {
+            return { content: [{ type: "text", text: "New project: No history available." }] };
+        }
+        const content = fs.readFileSync(memoryPath, "utf8");
+        const lines = content.split("\n");
+        const activePhase = lines.find(l => l.includes("Active Phase:"))?.split(":")[1]?.trim() || "Unknown";
+        const activeTrace = lines.find(l => l.includes("Active Trace:"))?.split(":")[1]?.trim() || "None";
+        // Find the last 5 history items (heuristic)
+        const historyStartIndex = lines.findIndex(l => l.includes("## History"));
+        let recentHistory = "No history found.";
+        if (historyStartIndex !== -1) {
+            recentHistory = lines.slice(historyStartIndex + 1, historyStartIndex + 15)
+                .filter(l => l.trim().startsWith("-"))
+                .slice(-5)
+                .join("\n");
+        }
+        const insights = `🧠 **Memory Insights**\n- **Phase:** ${activePhase}\n- **Trace:** ${activeTrace}\n\n**Recent Actions:**\n${recentHistory}`;
+        return { content: [{ type: "text", text: insights }] };
+    }
+    catch (e) {
+        return { isError: true, content: [{ type: "text", text: `Failed to extract insights: ${String(e)}` }] };
+    }
+}

package/framework-mcp/dist/tools/memory/read_memory.js

@@ -0,0 +1,28 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../../utils/security.js";
+/**
+ * Reads the project's central memory (PROJECT_MEMORY.md).
+ * This is the "brain" of the project.
+ */
+export function handleReadProjectMemory(projectRoot, _args) {
+    try {
+        const frameworkDir = resolveFrameworkDir(projectRoot);
+        const memoryPath = path.join(projectRoot, frameworkDir, "memory/PROJECT_MEMORY.md");
+        if (!fs.existsSync(memoryPath)) {
+            return {
+                content: [{ type: "text", text: "ℹ️ Project memory file not found. It might be a new project." }]
+            };
+        }
+        const content = fs.readFileSync(memoryPath, "utf8");
+        return {
+            content: [{ type: "text", text: content }]
+        };
+    }
+    catch (e) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: `Failed to read project memory: ${String(e)}` }]
+        };
+    }
+}

package/framework-mcp/dist/tools/messaging/log_action.js

@@ -0,0 +1,22 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../../utils/security.js";
+export function handleLogAgentAction(projectRoot, args) {
+    const { agent, action, traceId, status, summary } = args;
+    const findings = args.findings ? args.findings.split(",").map(f => f.trim()) : [];
+    const frameworkDir = resolveFrameworkDir(projectRoot);
+    const agentName = agent.replace("@", "");
+    const logPath = path.join(projectRoot, frameworkDir, "logs", `${agentName}.json`);
+    const logEntry = {
+        timestamp: new Date().toISOString(),
+        agent,
+        action,
+        requestId: traceId,
+        status,
+        summary,
+        findings
+    };
+    fs.mkdirSync(path.dirname(logPath), { recursive: true });
+    fs.appendFileSync(logPath, JSON.stringify(logEntry) + "\n");
+    return { content: [{ type: "text", text: `✅ Action logged for ${agent} to ${path.join(frameworkDir, "logs", `${agentName}.json`)}` }] };
+}

package/framework-mcp/dist/tools/messaging/send_message.js

@@ -0,0 +1,87 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../../utils/security.js";
+import { Metrics } from "../../utils/metrics.js";
+export async function handleSendAgentMessage(projectRoot, args) {
+    const { to, category, content, traceId } = args;
+    const from = args.from || "@mcp";
+    if (!to || !category || !content || !traceId) {
+        const err = "Missing required messaging arguments (to, category, content, or traceId).";
+        Metrics.logError(projectRoot, from, "send_agent_message", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+    const frameworkDir = resolveFrameworkDir(projectRoot);
+    const messagesDir = path.join(projectRoot, frameworkDir, "messages");
+    const agentName = to.replace("@", "");
+    const messagePath = path.join(messagesDir, `${agentName}.json`);
+    const lockPath = path.join(messagesDir, `${agentName}.lock`);
+    // Hermes Lock Protocol: Retry 3 times with 500ms delay
+    let retries = 3;
+    let acquired = false;
+    while (retries > 0) {
+        try {
+            if (fs.existsSync(lockPath)) {
+                try {
+                    const stats = fs.statSync(lockPath);
+                    if (Date.now() - stats.mtimeMs > 5000) {
+                        fs.unlinkSync(lockPath);
+                    }
+                }
+                catch {
+                    // ignore if concurrently unlinked
+                }
+            }
+            fs.mkdirSync(messagesDir, { recursive: true });
+            fs.writeFileSync(lockPath, `Locked by ${from} at ${new Date().toISOString()}`, { flag: "wx" });
+            acquired = true;
+            break;
+        }
+        catch (err) {
+            const error = err;
+            if (error.code === "EEXIST") {
+                retries--;
+                if (retries > 0) {
+                    await new Promise((resolve) => setTimeout(resolve, 500));
+                }
+            }
+            else {
+                return { content: [{ type: "text", text: `❌ Unexpected lock acquisition error: ${error.message || String(err)}` }], isError: true };
+            }
+        }
+    }
+    if (!acquired) {
+        const err = `Could not send message to ${to}: Hermes lock is busy.`;
+        Metrics.logError(projectRoot, from, "send_agent_message", err);
+        return { content: [{ type: "text", text: `❌ ${err}` }], isError: true };
+    }
+    try {
+        const defaultPriority = (category === "ALERT" || category === "ACTION") ? "HIGH" : "NORMAL";
+        const message = {
+            timestamp: new Date().toISOString(),
+            from,
+            to,
+            category,
+            traceId,
+            content,
+            priority: args.priority || defaultPriority,
+            status: "PENDING"
+        };
+        fs.appendFileSync(messagePath, JSON.stringify(message) + "\n");
+        return { content: [{ type: "text", text: `✅ Message sent to ${to} (from: ${from})` }] };
+    }
+    catch (e) {
+        const err = `Failed to write message: ${String(e)}`;
+        Metrics.logError(projectRoot, from, "send_agent_message", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+    finally {
+        if (acquired && fs.existsSync(lockPath)) {
+            try {
+                fs.unlinkSync(lockPath);
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+}

package/framework-mcp/dist/tools/observability/check_ports.js

@@ -0,0 +1,26 @@
+import { execSync } from "child_process";
+/**
+ * Checks for active network ports and their status.
+ */
+export function handleCheckPorts(projectRoot, args) {
+    const filter = args.filter || ""; // Optional filter (e.g., ":3000")
+    try {
+        // Using 'lsof -i -P -n' to list open files and network connections
+        // Note: may require permissions or behave differently on non-Unix systems
+        const command = process.platform === "win32"
+            ? `netstat -ano | findstr LISTENING ${filter ? `| findstr ${filter}` : ""}`
+            : `lsof -i -P -n | grep LISTEN ${filter ? `| grep ${filter}` : ""}`;
+        const output = execSync(command, { encoding: "utf8" });
+        return {
+            content: [{
+                    type: "text",
+                    text: `📡 **Active Listening Ports:**\n\n${output || "No active listening ports found matching filter."}`
+                }]
+        };
+    }
+    catch (_e) {
+        return {
+            content: [{ type: "text", text: "ℹ️ No active ports found or command failed (this is normal if nothing is listening)." }]
+        };
+    }
+}

package/framework-mcp/dist/tools/observability/get_health.js

@@ -0,0 +1,19 @@
+import os from "os";
+/**
+ * Retrieves system health metrics including CPU load and memory usage.
+ */
+export function handleGetSystemHealth(_projectRoot, _args) {
+    const totalMem = os.totalmem();
+    const freeMem = os.freemem();
+    const usedMem = totalMem - freeMem;
+    const memUsagePercent = ((usedMem / totalMem) * 100).toFixed(2);
+    const loadAvg = os.loadavg(); // [1, 5, 15] minute averages
+    const healthReport = `🖥️ **System Health Report**
+- **Memory:** ${memUsagePercent}% used (${(usedMem / 1024 / 1024 / 1024).toFixed(2)} GB / ${(totalMem / 1024 / 1024 / 1024).toFixed(2)} GB)
+- **CPU Load (1m, 5m, 15m):** ${loadAvg.map(l => l.toFixed(2)).join(", ")}
+- **Platform:** ${os.platform()} (${os.release()})
+- **Uptime:** ${(os.uptime() / 3600).toFixed(2)} hours`;
+    return {
+        content: [{ type: "text", text: healthReport }]
+    };
+}

package/framework-mcp/dist/tools/quality/check_lint.js

@@ -0,0 +1,28 @@
+import { exec } from "child_process";
+import { Metrics } from "../../utils/metrics.js";
+const LINT_COMMAND = "npm run lint";
+const TIMEOUT = 60000; // 60 seconds
+/**
+ * Handles running the project's linter.
+ */
+export function handleCheckLint(projectRoot, _args) {
+    return new Promise((resolve) => {
+        exec(LINT_COMMAND, { cwd: projectRoot, timeout: TIMEOUT }, (error, stdout, stderr) => {
+            const output = stdout + stderr;
+            const tokens = Metrics.estimateTokens(output);
+            if (error) {
+                const err = `Linting failed: ${error.message}`;
+                Metrics.logError(projectRoot, "@mcp", "check_lint", err);
+                resolve({
+                    isError: true,
+                    content: [{ type: "text", text: `❌ Lint Errors Found:\n\n${output}` }]
+                });
+                return;
+            }
+            Metrics.logUsage(projectRoot, "@mcp", "check_lint", tokens);
+            resolve({
+                content: [{ type: "text", text: `✅ Lint check passed successfully:\n\n${output}` }]
+            });
+        });
+    });
+}

package/framework-mcp/dist/tools/search/get_gaps.js

@@ -0,0 +1,48 @@
+import fs from "fs";
+import path from "path";
+import { safePath } from "../../utils/security.js";
+/**
+ * Scans the codebase for TODOs, FIXMEs, and empty function bodies.
+ * Helps identify what's left and where the agent might have skipped logic.
+ */
+export function handleGetProjectGaps(projectRoot, args) {
+    const srcDir = safePath(projectRoot, args.path || "src");
+    const results = [];
+    const walk = (dir) => {
+        if (!fs.existsSync(dir))
+            return;
+        const files = fs.readdirSync(dir);
+        for (const file of files) {
+            const fullPath = path.join(dir, file);
+            const relativePath = path.relative(projectRoot, fullPath);
+            if (fs.statSync(fullPath).isDirectory()) {
+                if (file !== "node_modules" && file !== "dist" && !file.startsWith(".")) {
+                    walk(fullPath);
+                }
+            }
+            else if (file.endsWith(".ts") || file.endsWith(".tsx")) {
+                const content = fs.readFileSync(fullPath, "utf8");
+                const lines = content.split("\n");
+                lines.forEach((line, index) => {
+                    // 1. Scan for markers
+                    if (line.includes("TODO") || line.includes("FIXME") || line.includes("!!!")) {
+                        results.push(`[${relativePath}:${index + 1}] Marker found: ${line.trim()}`);
+                    }
+                    // 2. Scan for empty function placeholders (heuristic)
+                    if (line.includes("throw new Error(\"Not implemented") || line.includes("// ... rest of code")) {
+                        results.push(`[${relativePath}:${index + 1}] Gap found: ${line.trim()}`);
+                    }
+                });
+            }
+        }
+    };
+    walk(srcDir);
+    return {
+        content: [{
+                type: "text",
+                text: results.length > 0
+                    ? `Found ${results.length} gaps/todos:\n\n${results.join("\n")}`
+                    : "✅ No major gaps or TODOs found in the scanned directory."
+            }]
+    };
+}

package/framework-mcp/dist/tools/search/get_map.js

@@ -0,0 +1,43 @@
+import fs from "fs";
+import path from "path";
+/**
+ * Generates a tree-view map of the project structure.
+ * Helps agents visualize the entire project layout quickly.
+ */
+export function handleGetProjectMap(projectRoot, args) {
+    const maxDepth = args.maxDepth || 3;
+    const includeFiles = args.includeFiles !== false;
+    const buildTree = (dir, depth) => {
+        if (depth > maxDepth)
+            return [];
+        const results = [];
+        const files = fs.readdirSync(dir);
+        files.forEach(file => {
+            if (file === "node_modules" || file === ".git" || file === "dist" || file.startsWith("."))
+                return;
+            const fullPath = path.join(dir, file);
+            const stat = fs.statSync(fullPath);
+            const indent = "  ".repeat(depth);
+            if (stat.isDirectory()) {
+                results.push(`${indent}📁 ${file}/`);
+                results.push(...buildTree(fullPath, depth + 1));
+            }
+            else if (includeFiles) {
+                results.push(`${indent}📄 ${file}`);
+            }
+        });
+        return results;
+    };
+    try {
+        const tree = buildTree(projectRoot, 0);
+        return {
+            content: [{
+                    type: "text",
+                    text: `🗺️ **Project Map (Depth: ${maxDepth})**\n\n${tree.join("\n")}`
+                }]
+        };
+    }
+    catch (e) {
+        return { isError: true, content: [{ type: "text", text: `Failed to map project: ${String(e)}` }] };
+    }
+}

package/framework-mcp/dist/tools/search/grep_search.js

@@ -0,0 +1,76 @@
+import fs from "fs";
+import path from "path";
+import { Metrics } from "../../utils/metrics.js";
+/**
+ * Searches for a regex pattern within files in the project.
+ */
+export function handleGrepSearch(projectRoot, args) {
+    const pattern = args.pattern;
+    const includePattern = args.includePattern || ""; // e.g., ".ts"
+    const excludePattern = args.excludePattern || "node_modules";
+    if (!pattern) {
+        const err = "Search pattern is required.";
+        Metrics.logError(projectRoot, "@mcp", "grep_search", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+    const results = [];
+    let regex;
+    try {
+        regex = new RegExp(pattern, "g");
+    }
+    catch (e) {
+        const err = `Invalid regex pattern: ${String(e)}`;
+        Metrics.logError(projectRoot, "@mcp", "grep_search", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+    const walk = (dir) => {
+        if (results.length > 100)
+            return;
+        try {
+            const files = fs.readdirSync(dir);
+            for (const file of files) {
+                if (results.length > 100)
+                    return;
+                const filePath = path.join(dir, file);
+                if (excludePattern && filePath.includes(excludePattern)) {
+                    continue;
+                }
+                const stat = fs.statSync(filePath);
+                if (stat.isDirectory()) {
+                    walk(filePath);
+                }
+                else if (stat.isFile()) {
+                    if (includePattern && !filePath.endsWith(includePattern)) {
+                        continue;
+                    }
+                    const content = fs.readFileSync(filePath, "utf8");
+                    // Create a new regex object for each line to avoid state issues with /g
+                    if (new RegExp(pattern).test(content)) {
+                        if (results.length < 100) {
+                            results.push(filePath);
+                        }
+                    }
+                }
+            }
+        }
+        catch (e) {
+            // Ignore directories that cannot be read
+        }
+    };
+    try {
+        walk(projectRoot);
+    }
+    catch (e) {
+        const err = `Search failed: ${String(e)}`;
+        Metrics.logError(projectRoot, "@mcp", "grep_search", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+    return {
+        content: [{
+                type: "text",
+                text: results.length > 0
+                    ? `Found ${results.length} matches:\n\n${results.join("\n")}`
+                    : "No matches found."
+            }]
+    };
+}

package/framework-mcp/dist/tools/search/list_dir.js

@@ -0,0 +1,28 @@
+import fs from "fs";
+import path from "path";
+import { safePath } from "../../utils/security.js";
+/**
+ * Lists the contents of a directory.
+ */
+export function handleListDir(projectRoot, args) {
+    const dirPath = safePath(projectRoot, args.path || ".");
+    if (!fs.existsSync(dirPath)) {
+        throw new Error(`Directory not found: ${args.path}`);
+    }
+    const stats = fs.statSync(dirPath);
+    if (!stats.isDirectory()) {
+        throw new Error(`Path is not a directory: ${args.path}`);
+    }
+    const files = fs.readdirSync(dirPath);
+    const results = files.map(file => {
+        const fullPath = path.join(dirPath, file);
+        const isDir = fs.statSync(fullPath).isDirectory();
+        return `${isDir ? "[DIR] " : "      "}${file}`;
+    });
+    return {
+        content: [{
+                type: "text",
+                text: `Directory listing for ${args.path || "."}:\n\n${results.join("\n")}`
+            }]
+    };
+}

package/framework-mcp/dist/tools/shell/run_command.js

@@ -0,0 +1,46 @@
+import { exec } from "child_process";
+import { Metrics } from "../../utils/metrics.js";
+const COMMAND_ALLOW_LIST = [
+    "npm test",
+    "npm run lint",
+    "git status",
+    "git diff",
+    "npx vitest run", // From the audit, this is the test command
+    "npm run build", // From the audit
+];
+const TIMEOUT = 30000; // 30 seconds
+export function handleRunCommand(projectRoot, args) {
+    const command = args.command;
+    const isAllowed = COMMAND_ALLOW_LIST.some(allowedCmd => command.startsWith(allowedCmd));
+    if (!isAllowed) {
+        const errorMsg = `Command not allowed: "${command}". Only commands starting with the following are allowed: ${COMMAND_ALLOW_LIST.join(", ")}`;
+        Metrics.logError(projectRoot, "@mcp", `run_shell_command: ${command} (denied)`, errorMsg);
+        return Promise.resolve({
+            content: [{ type: "text", text: `ERROR: ${errorMsg}` }],
+            isError: true,
+        });
+    }
+    return new Promise((resolve) => {
+        exec(command, { cwd: projectRoot, timeout: TIMEOUT }, (error, stdout, stderr) => {
+            const output = stdout + stderr;
+            const tokens = Metrics.estimateTokens(output);
+            Metrics.logUsage(projectRoot, "@mcp", `run_shell_command: ${command}`, tokens);
+            if (error) {
+                const errorMsg = `Command failed with exit code ${error.code}: ${error.message}.`;
+                Metrics.logError(projectRoot, "@mcp", `run_shell_command: ${command}`, errorMsg);
+                resolve({
+                    content: [{ type: "text", text: `ERROR: ${errorMsg}. Output: ${output}` }],
+                    isError: true,
+                });
+                return;
+            }
+            // Truncate long outputs
+            const MAX_OUTPUT_LENGTH = 5000;
+            let truncatedOutput = output;
+            if (output.length > MAX_OUTPUT_LENGTH) {
+                truncatedOutput = output.substring(0, MAX_OUTPUT_LENGTH) + "... [TRUNCATED] ..."; // Simplified
+            }
+            resolve({ content: [{ type: "text", text: truncatedOutput }] });
+        });
+    });
+}

package/framework-mcp/dist/tools/types.js

@@ -0,0 +1 @@
+export {};

package/framework-mcp/dist/utils/cli.js

@@ -0,0 +1,20 @@
+import { execFileSync } from "child_process";
+/**
+ * Executes a CLI command safely using execFileSync (no shell injection risk).
+ * Captures stderr gracefully to prevent stream crashes.
+ */
+export function safeExec(command, args, cwd, timeout) {
+    try {
+        return execFileSync(command, args, {
+            cwd,
+            encoding: "utf8",
+            timeout: timeout || 30000,
+            maxBuffer: 1024 * 1024,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+    }
+    catch (error) {
+        const err = error;
+        throw new Error(err.stderr || err.message || "Command execution failed", { cause: error });
+    }
+}

package/framework-mcp/dist/utils/compliance.js

@@ -0,0 +1,29 @@
+/**
+ * Enterprise Compliance Guardrail
+ * Checks content against corporate standards before allowing file mutations.
+ */
+export function verifyCorporateCompliance(content, filePath) {
+    // 1. Zero Console Policy
+    if (content.includes("console.log(") || content.includes("console.warn(") || content.includes("console.error(")) {
+        if (!filePath.includes("logger.ts") && !filePath.includes("check.ts") && !filePath.includes("cli.ts")) {
+            throw new Error("❌ Corporate Compliance Breach: 'console.log/warn/error' usage is forbidden. " +
+                "Use the 'logger' system from '@/shared/logger' instead.");
+        }
+    }
+    // 2. No Explicit Any Policy
+    const anyRegex = /[:<]\s*any\b|\bas\s+any\b/g;
+    if (anyRegex.test(content)) {
+        if (!filePath.includes("definitions.ts") && !filePath.includes("types.ts")) {
+            throw new Error("❌ Corporate Compliance Breach: 'any' type is forbidden. " +
+                "Use 'unknown', 'generics', or proper interfaces for type safety.");
+        }
+    }
+    // 3. Hardcoded Secrets Guard (Simple heuristic)
+    const secretKeywords = [/API_KEY\s*=\s*['"][^'"]+['"]/i, /SECRET\s*=\s*['"][^'"]+['"]/i, /PASSWORD\s*=\s*['"][^'"]+['"]/i];
+    for (const regex of secretKeywords) {
+        if (regex.test(content) && !filePath.endsWith(".env.example")) {
+            throw new Error("❌ Corporate Compliance Breach: Hardcoded secrets detected. " +
+                "All sensitive data must be managed via '.env' files.");
+        }
+    }
+}