altimate-receipts 0.18.0 → 0.19.0

package/dist/{chunk-IDAIDLZT.js → chunk-44V3DNK5.js}

@@ -27,6 +27,7 @@ var PRIVILEGED_PREFIXES = [
   "sensitive-access",
   "guard-blocked",
   "mcp-write",
+  "mcp-config-change",
   "metadata-egress",
   "tls-verify-disabled",
   "setuid-create",
@@ -43,7 +44,8 @@ function privileged(id, filePath) {
   return id.startsWith("file-shrink") && !!filePath && TEST_PATH.test(filePath);
 }
 function findingSurface(id) {
-  if (OPERATOR_KINDS.has(id) || id.startsWith("errcluster-")) {
+  const base = id.replace(/-sa-[0-9a-f]+$/i, "");
+  if (OPERATOR_KINDS.has(base) || base.startsWith("errcluster-")) {
     return "operator";
   }
   return "merge";
@@ -102,4 +104,4 @@ export {
   regenerableReceiptRm,
   regenerableBuildArtifact
 };
-//# sourceMappingURL=chunk-IDAIDLZT.js.map
+//# sourceMappingURL=chunk-44V3DNK5.js.map

package/dist/chunk-44V3DNK5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/findings/surface.ts"],"sourcesContent":["/**\n * Which surface a finding belongs to. The **merge gate** (the PR comment) is about\n * the *merged artifact* — what a reviewer must check before merging. The **operator**\n * view (the `receipts` card and `receipts trends`) is about *how the agent worked* —\n * efficiency, cost, loops, retries. One source of truth, shared by the PR-comment\n * renderer and its standalone Action mirror.\n */\n\n/** Kinds that describe agent behaviour/efficiency, not the merged change. */\nconst OPERATOR_KINDS = new Set([\n  \"loop\",\n  \"bottleneck\",\n  \"cost-concentration\",\n  \"cache-opportunity\",\n  \"model-downgrade\",\n]);\n\nexport type Surface = \"merge\" | \"operator\";\n\n/** Finding-id prefixes that touch a PRIVILEGED surface — CI/CD, lockfiles, hooks,\n * checker config, graders/evals, test integrity, git history (SPEC-0073 R5). These\n * render first in the Agent Work Record, ▲-marked, never collapsed: an edit here runs\n * with repository secrets or moves the ground truth reviewers stand on. */\nexport const PRIVILEGED_PREFIXES = [\n  \"ci-cd-touch\",\n  \"lockfile-edit\",\n  \"hook-bypass\",\n  \"config-weaken\",\n  \"spec-tamper\",\n  \"grader-edit\",\n  \"eval-override\",\n  \"test-focus\",\n  \"test-skipped\",\n  \"test-trivialised\",\n  \"green-by-suppression\",\n  \"untested-test\",\n  \"history-rewrite\",\n  \"force-push\",\n  \"self-permission\",\n  \"sensitive-access\",\n  \"guard-blocked\",\n  \"mcp-write\",\n  \"mcp-config-change\",\n  \"metadata-egress\",\n  \"tls-verify-disabled\",\n  \"setuid-create\",\n  \"obfuscated-exec\",\n  \"untrusted-dep-source\",\n  \"persistence-write\",\n  \"masked-failure\",\n];\n\n/** `file-shrink` is privileged only when the shrunk file is a test (assertion loss). */\nconst TEST_PATH = /(?:^|\\/)(?:tests?|specs?|__tests__)(?:\\/|$)|\\.(?:test|spec)\\.|_test\\./;\n\nexport function privileged(id: string, filePath?: string): boolean {\n  if (PRIVILEGED_PREFIXES.some((p) => id.startsWith(p))) {\n    return true;\n  }\n  return id.startsWith(\"file-shrink\") && !!filePath && TEST_PATH.test(filePath);\n}\n\nexport function findingSurface(id: string): Surface {\n  // Classify on the BASE kind: strip a subagent suffix (`-sa-<agentId>`, M104) so a wrapped operator\n  // id like `bottleneck-sa-1a2b3c4d` is still recognized as operator and can't leak onto the merge\n  // surface. (`errcluster-<tool>` — \"X failed N× before succeeding\" — is also an efficiency signal.)\n  const base = id.replace(/-sa-[0-9a-f]+$/i, \"\");\n  if (OPERATOR_KINDS.has(base) || base.startsWith(\"errcluster-\")) {\n    return \"operator\";\n  }\n  return \"merge\";\n}\n\n/**\n * Shared shape for the destructive-op carve-outs below. Parses the `rm`/`rmdir` clause from a\n * `Destructive op:` finding title and returns true only when EVERY removal operand satisfies\n * `safe`. A non-rm destructive (git/SQL/infra acts on the repo or an external system) or an empty\n * operand list returns false — i.e. the finding keeps flagging. Each carve-out below just supplies\n * the per-operand `safe` predicate.\n */\nfunction everyRemovalOperand(title: string, safe: (operand: string) => boolean): boolean {\n  const clause = title.replace(/^Destructive op:\\s*/i, \"\").replace(/\\s*×\\d+\\s*$/, \"\");\n  const m = clause.match(/^\\s*(rm|rmdir)\\b(.*)$/i);\n  if (!m) {\n    return false;\n  }\n  const operands = m[2].split(/\\s+/).filter((t) => t && !t.startsWith(\"-\"));\n  return operands.length > 0 && operands.every(safe);\n}\n\n/** Strip surrounding quotes from a parsed operand before matching. */\nconst unquote = (operand: string): string => operand.replace(/^[\"']|[\"']$/g, \"\");\n\n/**\n * True when a destructive finding's target is a **scratch path** (a `$VAR`, `/tmp`,\n * `/var/folders`, or `~`), so it can't be a merge risk and shouldn't gate the PR. Conservative:\n * `rm -rf ./src`, `rm -rf build`, `git reset --hard`, `DROP TABLE` are all kept (return false).\n */\nexport function destructiveOutsideRepo(title: string): boolean {\n  return everyRemovalOperand(title, (operand) => {\n    const p = unquote(operand);\n    return (\n      /\\$/.test(p) ||\n      p.startsWith(\"/tmp\") ||\n      p.startsWith(\"/var/folders\") ||\n      p.startsWith(\"/private/var/folders\") ||\n      p.startsWith(\"~\")\n    );\n  });\n}\n\n/**\n * True when a destructive finding deletes only the tool's **own regenerable Receipt artifact**\n * (`rm .receipts/<branch>.json`) — a scope-layer carve-out: a `.receipts/*.json` is inside the repo\n * but is rewritten by `receipts pr`, so it isn't a merge risk. Only a flat `.receipts/<name>.json`\n * file matches; a mixed command or the whole dir (`rm -rf .receipts`) keeps flagging.\n */\nexport function regenerableReceiptRm(title: string): boolean {\n  return everyRemovalOperand(title, (operand) =>\n    /(?:^|\\/)\\.receipts\\/[^/]+\\.json$/.test(unquote(operand)),\n  );\n}\n\n/** Well-known regenerable build/dependency output dirs — deleting them is housekeeping, not\n * data loss. Frozen + conservative: excludes `vendor` (committed in Go/PHP), `.cache`/`bin`\n * (ambiguous), `.terraform` (stateful). */\nconst BUILD_DIRS = new Set([\n  \"target\",\n  \"dist\",\n  \"build\",\n  \"out\",\n  \"node_modules\",\n  \".next\",\n  \".nuxt\",\n  \".turbo\",\n  \".parcel-cache\",\n  \"__pycache__\",\n  \".pytest_cache\",\n  \".mypy_cache\",\n  \".ruff_cache\",\n  \"coverage\",\n  \".gradle\",\n]);\n\n/**\n * True when a destructive op deletes only **regenerable build artifacts** (`rm -rf dist`, `rm -rf\n * node_modules`). Scope-layer carve-out like {@link destructiveOutsideRepo}: build output is inside\n * the repo but regenerable in one command. Conservative: every operand must have a path segment in\n * the frozen build-dir set — a mixed command (`rm -rf dist src`) or a real target keeps flagging.\n */\nexport function regenerableBuildArtifact(title: string): boolean {\n  return everyRemovalOperand(title, (operand) =>\n    unquote(operand)\n      .split(\"/\")\n      .some((seg) => BUILD_DIRS.has(seg)),\n  );\n}\n"],"mappings":";;;AASA,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAM,YAAY;AAEX,SAAS,WAAW,IAAY,UAA4B;AACjE,MAAI,oBAAoB,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,GAAG;AACrD,WAAO;AAAA,EACT;AACA,SAAO,GAAG,WAAW,aAAa,KAAK,CAAC,CAAC,YAAY,UAAU,KAAK,QAAQ;AAC9E;AAEO,SAAS,eAAe,IAAqB;AAIlD,QAAM,OAAO,GAAG,QAAQ,mBAAmB,EAAE;AAC7C,MAAI,eAAe,IAAI,IAAI,KAAK,KAAK,WAAW,aAAa,GAAG;AAC9D,WAAO;AAAA,EACT;AACA,SAAO;AACT;AASA,SAAS,oBAAoB,OAAe,MAA6C;AACvF,QAAM,SAAS,MAAM,QAAQ,wBAAwB,EAAE,EAAE,QAAQ,eAAe,EAAE;AAClF,QAAM,IAAI,OAAO,MAAM,wBAAwB;AAC/C,MAAI,CAAC,GAAG;AACN,WAAO;AAAA,EACT;AACA,QAAM,WAAW,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,WAAW,GAAG,CAAC;AACxE,SAAO,SAAS,SAAS,KAAK,SAAS,MAAM,IAAI;AACnD;AAGA,IAAM,UAAU,CAAC,YAA4B,QAAQ,QAAQ,gBAAgB,EAAE;AAOxE,SAAS,uBAAuB,OAAwB;AAC7D,SAAO,oBAAoB,OAAO,CAAC,YAAY;AAC7C,UAAM,IAAI,QAAQ,OAAO;AACzB,WACE,KAAK,KAAK,CAAC,KACX,EAAE,WAAW,MAAM,KACnB,EAAE,WAAW,cAAc,KAC3B,EAAE,WAAW,sBAAsB,KACnC,EAAE,WAAW,GAAG;AAAA,EAEpB,CAAC;AACH;AAQO,SAAS,qBAAqB,OAAwB;AAC3D,SAAO;AAAA,IAAoB;AAAA,IAAO,CAAC,YACjC,mCAAmC,KAAK,QAAQ,OAAO,CAAC;AAAA,EAC1D;AACF;AAKA,IAAM,aAAa,oBAAI,IAAI;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,SAAS,yBAAyB,OAAwB;AAC/D,SAAO;AAAA,IAAoB;AAAA,IAAO,CAAC,YACjC,QAAQ,OAAO,EACZ,MAAM,GAAG,EACT,KAAK,CAAC,QAAQ,WAAW,IAAI,GAAG,CAAC;AAAA,EACtC;AACF;","names":[]}

package/dist/{chunk-FPDXOAYN.js → chunk-C7NAN2LL.js}

@@ -3,7 +3,21 @@ import {
   destructiveOutsideRepo,
   regenerableBuildArtifact,
   regenerableReceiptRm
-} from "./chunk-IDAIDLZT.js";
+} from "./chunk-44V3DNK5.js";
+
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+function getVersion() {
+  try {
+    const pkgUrl = new URL("../package.json", import.meta.url);
+    const raw = readFileSync(fileURLToPath(pkgUrl), "utf8");
+    const pkg = JSON.parse(raw);
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
 
 // src/findings/gitParse.ts
 var WRAPPER = /* @__PURE__ */ new Set(["sudo", "env", "nohup", "command", "stdbuf", "time", "timeout", "xargs"]);
@@ -2814,6 +2828,48 @@ function deriveMcpFindings(sum) {
     }
   ];
 }
+var MCP_CONFIG_FILE = /(?:^|\/)\.mcp\.json$|(?:^|\/)\.(?:cursor|vscode)\/mcp\.json$|(?:^|\/)claude_desktop_config\.json$|(?:^|\/)mcp\.json$/i;
+var SERVER_ENDPOINT = /"(?:command|url)"\s*:\s*"((?:[^"\\]|\\.)*)"/g;
+var endpointValues = (text) => {
+  const out = [];
+  for (const m of text.matchAll(SERVER_ENDPOINT)) {
+    out.push(m[1]);
+  }
+  return out;
+};
+function deriveMcpConfigFindings(sum) {
+  for (const s of sum.spans) {
+    if (s.kind !== "tool" || typeof s.name !== "string" || !isEditTool(s.name)) {
+      continue;
+    }
+    const fp = filePathOf(s.input);
+    if (!fp || !MCP_CONFIG_FILE.test(fp)) {
+      continue;
+    }
+    const { oldStr, newStr } = editBody(s.input);
+    const before = new Set(endpointValues(oldStr));
+    const added = endpointValues(newStr).filter((v) => !before.has(v));
+    if (added.length === 0) {
+      continue;
+    }
+    const base6 = fp.split("/").pop() ?? fp;
+    return [
+      {
+        id: `mcp-config-change-${s.spanId}`,
+        severity: "high",
+        title: `Added or repointed an MCP server in ${base6}`,
+        detail: `An edit to \`${base6}\` introduced or changed an MCP server endpoint (\`${added[0]}\`) \u2014 it grants the agent (and future agents on this branch) a new external tool surface with whatever credentials that server holds, which the source diff doesn't otherwise show. Review the new server's source and scopes before merging.`,
+        impactLabel: "MCP authority change",
+        confidence: 0.85,
+        score: 100 * 0.85,
+        evidenceSpanId: s.spanId,
+        filePath: fp,
+        guardrailRule: "Adding or repointing an MCP server expands the agent's authority \u2014 review the server's source and scopes as part of the change."
+      }
+    ];
+  }
+  return [];
+}
 
 // src/findings/persistenceFindings.ts
 var AUTORUN_PATH = /(?:^|\/)\.(?:bashrc|zshrc|bash_profile|zprofile|profile|bash_login|zshenv)$|(?:^|\/)\.config\/fish\/config\.fish$|^\/etc\/profile(?:\.d\/.+)?$|(?:^|\/)Library\/LaunchAgents\/[^/]+|^\/Library\/Launch(?:Daemons|Agents)\/[^/]+|^\/etc\/systemd\/system\/[^/]+|(?:^|\/)\.config\/systemd\/user\/[^/]+|^\/etc\/cron[^/]*|^\/var\/spool\/cron\//i;
@@ -3093,6 +3149,8 @@ var DETECTORS = [
   { name: "sensitive-access", fn: (s) => deriveSensitiveAccess(s) },
   // MCP external side-effects (M105): mutating MCP tool calls the diff can't show
   { name: "mcp", fn: (s) => deriveMcpFindings(s) },
+  // MCP config change (M113): a new/repointed MCP server in a config edit — authority expansion
+  { name: "mcp-config", fn: (s) => deriveMcpConfigFindings(s) },
   // command-pattern security (M106/108/109/110/111/112): metadata egress, untrusted dep source,
   // TLS-disable, setuid, obfuscated exec, masked verification failure
   { name: "command-security", fn: (s) => deriveCommandSecurityFindings(s) },
@@ -3591,20 +3649,6 @@ function applyDiffScope(derived, findings, files, projectPath) {
   };
 }
 
-// src/version.ts
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-function getVersion() {
-  try {
-    const pkgUrl = new URL("../package.json", import.meta.url);
-    const raw = readFileSync(fileURLToPath(pkgUrl), "utf8");
-    const pkg = JSON.parse(raw);
-    return pkg.version ?? "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
-
 // src/receipt/hash.ts
 import { createHash } from "crypto";
 import { promises as fs } from "fs";
@@ -5634,6 +5678,7 @@ function redactReceipt(receipt) {
 }
 
 export {
+  getVersion,
   deriveSpans,
   cwdAtFirstGit,
   formatTokens,
@@ -5646,7 +5691,6 @@ export {
   narrowEffort,
   windowedEffort,
   applyDiffScope,
-  getVersion,
   hashTranscriptFile,
   sha256Hex,
   PREDICATE_TYPE,
@@ -5675,4 +5719,4 @@ export {
   redact,
   redactReceipt
 };
-//# sourceMappingURL=chunk-FPDXOAYN.js.map
+//# sourceMappingURL=chunk-C7NAN2LL.js.map