atabey 0.0.1

package/framework-mcp/dist/tools/types.js

@@ -0,0 +1 @@
+export {};

package/framework-mcp/dist/utils/cli.js

@@ -0,0 +1,20 @@
+import { execFileSync } from "child_process";
+/**
+ * Executes a CLI command safely using execFileSync (no shell injection risk).
+ * Captures stderr gracefully to prevent stream crashes.
+ */
+export function safeExec(command, args, cwd, timeout) {
+    try {
+        return execFileSync(command, args, {
+            cwd,
+            encoding: "utf8",
+            timeout: timeout || 30000,
+            maxBuffer: 1024 * 1024,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+    }
+    catch (error) {
+        const err = error;
+        throw new Error(err.stderr || err.message || "Command execution failed", { cause: error });
+    }
+}

package/framework-mcp/dist/utils/compliance.js

@@ -0,0 +1,78 @@
+import ts from "typescript";
+/**
+ * Enterprise Compliance Guardrail
+ * Checks content against corporate standards using AST analysis before allowing file mutations.
+ */
+export function verifyCorporateCompliance(content, filePath) {
+    // Skip compliance checks for non-source files or specific ignored files
+    if (filePath.endsWith(".json") || filePath.endsWith(".md") || filePath.endsWith(".env.example")) {
+        return;
+    }
+    const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true);
+    const errors = [];
+    /**
+     * Recursive AST Visitor
+     */
+    function visit(node) {
+        // 1. Zero Console Policy
+        if (ts.isPropertyAccessExpression(node)) {
+            const expression = node.expression;
+            const name = node.name.text;
+            if (ts.isIdentifier(expression) && expression.text === "console") {
+                if (["log", "warn", "error"].includes(name)) {
+                    // Check if file is exempt
+                    if (!filePath.includes("logger.ts") && !filePath.includes("check.ts") && !filePath.includes("cli.ts")) {
+                        errors.push(`❌ Corporate Compliance Breach: 'console.${name}' usage is forbidden at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}.`);
+                    }
+                }
+            }
+        }
+        // 2. No Explicit Any Policy
+        if (ts.isTypeReferenceNode(node)) {
+            if (ts.isIdentifier(node.typeName) && node.typeName.text === "any") {
+                if (!filePath.includes("definitions.ts") && !filePath.includes("types.ts")) {
+                    errors.push(`❌ Corporate Compliance Breach: 'any' type is forbidden at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}.`);
+                }
+            }
+        }
+        // 3. Zero UI Library Policy (No @chakra-ui, mui, @shadcn)
+        if (ts.isImportDeclaration(node)) {
+            const moduleSpecifier = node.moduleSpecifier;
+            if (ts.isStringLiteral(moduleSpecifier)) {
+                const forbiddenLibs = ["@chakra-ui", "mui", "@shadcn", "antd", "bootstrap"];
+                const lib = forbiddenLibs.find(l => moduleSpecifier.text.includes(l));
+                if (lib) {
+                    errors.push(`❌ Corporate Compliance Breach: External UI library '${lib}' usage is FORBIDDEN at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Build atomic components manually instead.`);
+                }
+            }
+        }
+        // Handle 'any' as a keyword type (e.g., parameter: any)
+        if (node.kind === ts.SyntaxKind.AnyKeyword) {
+            if (!filePath.includes("definitions.ts") && !filePath.includes("types.ts")) {
+                errors.push(`❌ Corporate Compliance Breach: 'any' keyword is forbidden at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}.`);
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    // 3. Hardcoded Secrets & PII Guard
+    const piiKeywords = [
+        { regex: /API_KEY\s*=\s*['"][^'"]+['"]/i, msg: "Hardcoded API Key" },
+        { regex: /SECRET\s*=\s*['"][^'"]+['"]/i, msg: "Hardcoded Secret" },
+        { regex: /PASSWORD\s*=\s*['"][^'"]+['"]/i, msg: "Hardcoded Password" },
+        { regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/, msg: "PII Detected: Email Address" },
+        { regex: /\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/, msg: "PII Detected: Credit Card Pattern" }
+    ];
+    for (const { regex, msg } of piiKeywords) {
+        if (regex.test(content)) {
+            // Allow emails in specific files like README or package.json
+            if (msg.includes("Email") && (filePath.endsWith("README.md") || filePath.endsWith("package.json") || filePath.includes("CONTRIBUTING"))) {
+                continue;
+            }
+            errors.push(`❌ Corporate Compliance Breach: ${msg} detected.`);
+        }
+    }
+    if (errors.length > 0) {
+        throw new Error(errors.join("\n"));
+    }
+}

package/framework-mcp/dist/utils/fs.js

@@ -0,0 +1,44 @@
+import fs from "fs";
+import path from "path";
+/**
+ * Ensures directory existence.
+ */
+export function ensureDir(dirPath) {
+    if (!fs.existsSync(dirPath)) {
+        fs.mkdirSync(dirPath, { recursive: true });
+    }
+}
+/**
+ * Atomically writes a text file.
+ */
+export function writeTextFileAtomic(filePath, content) {
+    const dir = path.dirname(filePath);
+    ensureDir(dir);
+    const tempPath = `${filePath}.${Math.random().toString(36).slice(2, 9)}.tmp`;
+    const finalContent = content.endsWith("\n") ? content : `${content}\n`;
+    try {
+        fs.writeFileSync(tempPath, finalContent, "utf8");
+        fs.renameSync(tempPath, filePath);
+    }
+    catch (err) {
+        if (fs.existsSync(tempPath)) {
+            try {
+                fs.unlinkSync(tempPath);
+            }
+            catch { /* ignore */ }
+        }
+        throw err;
+    }
+}
+/**
+ * Atomically appends to a file (if supported by OS) or simulates it.
+ * Note: Real atomic append on POSIX is a single write() call with O_APPEND.
+ * For simplicity and robustness across platforms, we use a simple append here
+ * as the risk of corruption is lower than a full rewrite, but for logs
+ * it's acceptable.
+ */
+export function appendFileSafe(filePath, content) {
+    const dir = path.dirname(filePath);
+    ensureDir(dir);
+    fs.appendFileSync(filePath, content, "utf8");
+}

package/framework-mcp/dist/utils/metrics.js

@@ -0,0 +1,56 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "./security.js";
+export const Metrics = {
+    /**
+     * Estimates tokens based on character count (rough heuristic: 1 token ~= 4 chars).
+     */
+    estimateTokens: (text) => {
+        return Math.ceil(text.length / 4);
+    },
+    /**
+     * Logs the token usage and action to the observability metrics file.
+     */
+    logUsage: (projectRoot, agent, action, tokens) => {
+        Metrics.saveMetric(projectRoot, {
+            timestamp: new Date().toISOString(),
+            agent,
+            action,
+            estimatedTokens: tokens
+        });
+    },
+    /**
+     * Logs an error occurrence to the observability metrics file.
+     */
+    logError: (projectRoot, agent, action, error) => {
+        Metrics.saveMetric(projectRoot, {
+            timestamp: new Date().toISOString(),
+            agent,
+            action: `ERROR: ${action}`,
+            estimatedTokens: 0,
+            error
+        });
+    },
+    /**
+     * Internal helper to save metric entries.
+     */
+    saveMetric: (projectRoot, entry) => {
+        const frameworkDir = resolveFrameworkDir(projectRoot);
+        const metricsPath = path.join(projectRoot, frameworkDir, "observability/metrics.json");
+        try {
+            const metricsDir = path.dirname(metricsPath);
+            if (!fs.existsSync(metricsDir))
+                fs.mkdirSync(metricsDir, { recursive: true });
+            let currentMetrics = [];
+            if (fs.existsSync(metricsPath)) {
+                currentMetrics = JSON.parse(fs.readFileSync(metricsPath, "utf8"));
+            }
+            currentMetrics.push(entry);
+            // Keep only last 100 entries to save space
+            if (currentMetrics.length > 100)
+                currentMetrics.shift();
+            fs.writeFileSync(metricsPath, JSON.stringify(currentMetrics, null, 2));
+        }
+        catch { /* ignore: metrics should not block the main process */ }
+    }
+};

package/framework-mcp/dist/utils/security.js

@@ -0,0 +1,60 @@
+import path from "path";
+import fs from "fs";
+import { FRAMEWORK, MCP, UNIFIED_HUB_DIR } from "../constants.js"; // New import
+import os from "os"; // Need os.homedir()
+/**
+ * Validates and resolves a user-provided path to prevent path traversal attacks.
+ * Ensures the resolved path stays within the project root boundary.
+ */
+export function safePath(projectRoot, userPath) {
+    const resolved = path.resolve(projectRoot, userPath);
+    const normalizedRoot = path.resolve(projectRoot);
+    if (!resolved.startsWith(normalizedRoot + path.sep) && resolved !== normalizedRoot) {
+        throw new Error(`Access denied: path "${userPath}" escapes project root.`);
+    }
+    return resolved;
+}
+/**
+ * Resolves the active framework directory.
+ * Priority: ATABEY_TEST_DIR (env) -> package.json `atabey.frameworkDir` -> `.atabey` -> other adapter dirs -> global HOME.
+ */
+export function resolveFrameworkDir(projectRoot) {
+    // For test environments, use the explicitly set test directory.
+    const testDir = process.env[MCP.TEST_DIR_ENV];
+    if (testDir)
+        return testDir;
+    // 1. Authoritative source: read from package.json if present
+    try {
+        const pkgPath = path.join(projectRoot, "package.json");
+        if (fs.existsSync(pkgPath)) {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+            const atabeyConfig = pkg["atabey"];
+            if (atabeyConfig && typeof atabeyConfig["frameworkDir"] === "string") {
+                // Ensure the path is relative if it's within the project, otherwise use as-is.
+                const resolvedDir = path.resolve(projectRoot, atabeyConfig["frameworkDir"]);
+                if (resolvedDir.startsWith(path.resolve(projectRoot))) {
+                    return path.relative(projectRoot, resolvedDir);
+                }
+                return atabeyConfig["frameworkDir"];
+            }
+        }
+    }
+    catch {
+        // ignore — fall through to filesystem scan
+    }
+    // 2. Filesystem scan in projectRoot for common framework directories
+    const localCandidates = [
+        FRAMEWORK.CORE_DIR, // .atabey
+        UNIFIED_HUB_DIR, // .agents
+        // Add other adapter specific directories if needed, or remove if unified is strictly enforced
+    ];
+    for (const candidate of localCandidates) {
+        const candidatePath = path.join(projectRoot, candidate);
+        if (fs.existsSync(candidatePath)) {
+            return candidate;
+        }
+    }
+    // 3. Fallback to global home directory.
+    const homeDir = os.homedir();
+    return path.join(homeDir, FRAMEWORK.CORE_DIR);
+}