atabey 0.0.12 → 0.0.13

package/framework-mcp/dist/framework-mcp/src/tools/schemas.js

@@ -151,3 +151,32 @@ export const LogAgentActionSchema = z.object({
 export const AskHumanSchema = z.object({
     question: z.string().min(10, "Question must be clear and detailed."),
 }).strict();
+// ─── LLM Gateway ────────────────────────────────────────────────────
+export const LLMGatewayQuerySchema = z.object({
+    messages: z.array(z.object({
+        role: z.enum(["system", "user", "assistant", "tool"]),
+        content: z.string().min(1),
+    })).min(1, "At least one message is required"),
+    system: z.string().optional(),
+    model: z.string().optional(),
+    provider: z.enum(["openai", "anthropic", "google", "grok", "ollama"]).optional(),
+    strategy: z.enum(["round-robin", "least-latency", "cost-optimized", "failover", "priority-based", "model-based"]).optional(),
+    temperature: z.number().min(0).max(2).optional(),
+    maxTokens: z.number().int().positive().optional(),
+    traceId: z.string().optional(),
+}).strict();
+export const LLMGatewayStatusSchema = z.object({
+    detail: z.enum(["overview", "providers", "stats"]).optional().default("overview"),
+}).strict();
+// ─── Code Quality Analysis ──────────────────────────────────────────
+export const AnalyzeCodeQualitySchema = z.object({
+    path: z.string().min(1, "Path to analyze is required"),
+    checkTypes: z.boolean().optional().default(true),
+    checkLint: z.boolean().optional().default(true),
+    checkComplexity: z.boolean().optional().default(true),
+}).strict();
+// ─── Architecture Compliance ────────────────────────────────────────
+export const CheckArchitectureComplianceSchema = z.object({
+    path: z.string().min(1, "Path to check is required"),
+    rules: z.array(z.string()).optional(),
+}).strict();

package/framework-mcp/dist/framework-mcp/src/tools/shell/run_command.js

@@ -60,8 +60,8 @@ const COMMAND_ALLOW_LIST = [
     "cargo build",
     "cargo check",
     "cargo fmt",
-    // File operations (safe) — NOTA: "rm -rf" ve "rm -r" KASITLI olarak yok.
-    // "rm -rf /" gibi tehlikeli komutları engellemek için sadece "rmdir" izinli.
+    // File operations (safe) — NOTE: "rm -rf" and "rm -r" intentionally excluded.
+    // Only "rmdir" is allowed to prevent dangerous commands like "rm -rf /".
     "mkdir",
     "cp",
     "mv",

package/framework-mcp/dist/src/modules/memory/core.js

@@ -1,9 +1,10 @@
 import crypto from "crypto";
+import { generateEmbedding } from "./embedding.js";
 import { VectorStore } from "./vector-store.js";
 /**
  * [MEMORY] Core Memory Service
  * High-level API for managing project knowledge and embeddings.
- * Uses TF-IDF style keyword frequency for vector generation (no external dependencies).
+ * Uses OpenAI Embedding API when available, falls back to TF-IDF.
  */
 export class CoreMemory {
     static VECTOR_DIM = 384;
@@ -18,14 +19,16 @@ export class CoreMemory {
     }
     /**
      * Records a new piece of knowledge into the core memory.
-     * Automatically generates a TF-IDF style vector embedding.
+     * Uses OpenAI Embedding API when available, falls back to TF-IDF.
      */
     static async remember(params) {
         const id = crypto.createHash("sha256").update(params.content + (params.filePath || "")).digest("hex");
+        // Use provided vector or generate via embedding service
+        const vector = params.vector || await generateEmbedding(params.content);
         const entry = {
             id,
             content: params.content,
-            vector: params.vector || this.generateEmbedding(params.content),
+            vector,
             metadata: {
                 category: params.category,
                 traceId: params.traceId,
@@ -39,23 +42,15 @@ export class CoreMemory {
     }
     /**
      * Searches the memory for relevant knowledge using cosine similarity.
+     * Uses OpenAI Embedding API when available for the query vector.
      */
     static async recall(query, options) {
-        const vector = options.queryVector || this.generateEmbedding(query);
+        const vector = options.queryVector || await generateEmbedding(query);
         return VectorStore.search(vector, options.limit || 5, options.category);
     }
     /**
      * Generates a TF-IDF style embedding vector from text.
-     *
-     * How it works:
-     * 1. Tokenizes the text into words
-     * 2. Removes stop words and short tokens
-     * 3. Calculates term frequency for each word
-     * 4. Maps each word to a deterministic position in the vector using hash
-     * 5. Normalizes the final vector
-     *
-     * This produces a sparse vector where semantically similar texts
-     * (sharing similar keywords) will have higher cosine similarity.
+     * Kept for backward compatibility and as fallback.
      */
     static generateEmbedding(text) {
         const vector = new Array(this.VECTOR_DIM).fill(0);
@@ -74,8 +69,6 @@ export class CoreMemory {
             tf.set(token, (tf.get(token) || 0) + 1);
         }
         // Map each unique token to vector positions using hash
-        // A single token contributes to multiple positions (3-gram hash)
-        // to capture partial token similarity
         for (const [token, freq] of tf) {
             for (let i = 0; i < token.length - 1; i++) {
                 const ngram = token.substring(i, i + 2);
@@ -99,7 +92,7 @@ export class CoreMemory {
         let hash = 0;
         for (let i = 0; i < value.length; i++) {
             hash = ((hash << 5) - hash) + value.charCodeAt(i);
-            hash |= 0; // Convert to 32-bit integer
+            hash |= 0;
         }
         return Math.abs(hash) % this.VECTOR_DIM;
     }

package/framework-mcp/dist/src/modules/memory/embedding.js

@@ -0,0 +1,130 @@
+/**
+ * [MEMORY] Embedding Service
+ *
+ * Real embedding generation with OpenAI API integration.
+ * Falls back to TF-IDF if no API key is available.
+ *
+ * Supported methods:
+ * 1. OpenAI Embedding API (text-embedding-3-small) — 1536 dimensions
+ * 2. TF-IDF fallback (local method) — 384 dimensions
+ */
+import fs from "fs";
+import path from "path";
+import { logger } from "../../shared/logger.js";
+import { CoreMemory } from "./core.js";
+const EMBEDDING_API = "https://api.openai.com/v1/embeddings";
+const EMBEDDING_MODEL = "text-embedding-3-small";
+const EMBEDDING_DIM = 1536;
+/**
+ * Reads the API key from environment variable or .env file.
+ */
+function getApiKey() {
+    if (process.env.OPENAI_API_KEY)
+        return process.env.OPENAI_API_KEY;
+    try {
+        const envPath = path.join(process.cwd(), ".env");
+        if (fs.existsSync(envPath)) {
+            const content = fs.readFileSync(envPath, "utf8");
+            const match = content.match(/^OPENAI_API_KEY=(.+)$/m);
+            if (match)
+                return match[1].trim();
+        }
+    }
+    catch {
+        // Silently ignore .env read errors
+    }
+    return null;
+}
+/**
+ * Generates an embedding vector for the given text.
+ *
+ * Priority:
+ * 1. OpenAI API (if API key is available)
+ * 2. TF-IDF fallback (local)
+ */
+export async function generateEmbedding(text) {
+    const apiKey = getApiKey();
+    // Use OpenAI API if available
+    if (apiKey) {
+        try {
+            const response = await fetch(EMBEDDING_API, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "Authorization": `Bearer ${apiKey}`,
+                },
+                body: JSON.stringify({
+                    input: text,
+                    model: EMBEDDING_MODEL,
+                }),
+            });
+            if (!response.ok) {
+                logger.warn(`OpenAI API error: ${response.status}. Falling back to TF-IDF.`);
+                return fallbackEmbedding(text);
+            }
+            const data = await response.json();
+            if (data?.data?.[0]?.embedding) {
+                return data.data[0].embedding;
+            }
+        }
+        catch (err) {
+            logger.warn(`OpenAI API call failed: ${err.message}. Falling back to TF-IDF.`);
+        }
+    }
+    // Fallback: TF-IDF
+    return fallbackEmbedding(text);
+}
+/**
+ * TF-IDF fallback embedding using CoreMemory.generateEmbedding.
+ * OpenAI embedding is 1536 dimensions, TF-IDF is 384 dimensions.
+ * Pads TF-IDF output to 1536 for compatibility.
+ */
+function fallbackEmbedding(text) {
+    const tfidfVector = CoreMemory.generateEmbedding(text); // 384 dimensions
+    // Pad 384 → 1536
+    const padded = new Array(EMBEDDING_DIM).fill(0);
+    for (let i = 0; i < tfidfVector.length; i++) {
+        padded[i] = tfidfVector[i];
+    }
+    return padded;
+}
+/**
+ * Batch embedding generation. Single API call for multiple texts.
+ * OpenAI supports batch requests natively.
+ */
+export async function generateEmbeddings(texts) {
+    const apiKey = getApiKey();
+    if (apiKey) {
+        try {
+            const response = await fetch(EMBEDDING_API, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "Authorization": `Bearer ${apiKey}`,
+                },
+                body: JSON.stringify({
+                    input: texts,
+                    model: EMBEDDING_MODEL,
+                }),
+            });
+            if (response.ok) {
+                const data = await response.json();
+                if (data?.data) {
+                    return data.data.map(d => d.embedding);
+                }
+            }
+        }
+        catch {
+            // fallback
+        }
+    }
+    // Fallback for each text
+    return Promise.all(texts.map(t => fallbackEmbedding(t)));
+}
+/**
+ * Checks if a vector is an OpenAI embedding (1536 dimensions)
+ * as opposed to TF-IDF (384 dimensions).
+ */
+export function isOpenAIEmbedding(vector) {
+    return vector.length === EMBEDDING_DIM;
+}

package/framework-mcp/dist/src/shared/fs.js

@@ -1,6 +1,6 @@
+import { execFileSync } from "child_process";
 import fs from "fs";
 import path from "path";
-import { execFileSync } from "child_process";
 import { logger } from "./logger.js";
 export function ensureDir(dirPath, dryRun = false) {
     if (!fs.existsSync(dirPath)) {
@@ -41,7 +41,9 @@ export function appendFile(filePath, content, dryRun = false) {
         return;
     }
     ensureDir(path.dirname(filePath));
-    fs.appendFileSync(filePath, content, "utf8");
+    // Atomic append: oku → ekle → atomic yaz
+    const existing = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : "";
+    writeTextFile(filePath, existing + content);
 }
 export function writeJsonFile(filePath, value, dryRun = false) {
     writeTextFile(filePath, JSON.stringify(value, null, 2), dryRun);

package/framework-mcp/dist/src/shared/logger.js

@@ -1,6 +1,7 @@
 import chalk from "chalk";
 import path from "path";
-import { ensureDir, appendFile } from "./fs.js";
+import { appendFile, ensureDir } from "./fs.js";
+import { containsPII, maskObject, maskText } from "./pii.js";
 export var LogLevel;
 (function (LogLevel) {
     LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
@@ -18,6 +19,8 @@ export class EnterpriseLogger {
             minLevel: isProd ? LogLevel.INFO : LogLevel.DEBUG,
             enableColors: !isProd,
             jsonFormat: isProd,
+            enablePiiMasking: true, // KVKK: PII masking ON by default
+            piiWarning: true,
         };
     }
     static getInstance() {
@@ -41,13 +44,20 @@ export class EnterpriseLogger {
     formatMessage(level, message, meta) {
         const timestamp = new Date().toISOString();
         const pid = process.pid;
+        // [KVKK] PII masking — mask sensitive data before logging
+        const safeMessage = this.config.enablePiiMasking ? maskText(message) : message;
+        const safeMeta = this.config.enablePiiMasking && meta ? maskObject(meta) : meta;
+        // [KVKK] Warn if PII detected in production
+        if (this.config.piiWarning && (containsPII(message) || (meta && containsPII(JSON.stringify(meta))))) {
+            process.stderr.write(`[PII WARNING] Potential PII detected in log at ${timestamp}\n`);
+        }
         if (this.config.jsonFormat) {
             return JSON.stringify({
                 timestamp,
                 level: LogLevel[level],
                 pid,
-                message,
-                meta,
+                message: safeMessage,
+                meta: safeMeta,
             });
         }
         const levelName = LogLevel[level].padEnd(5);
@@ -71,8 +81,8 @@ export class EnterpriseLogger {
                     break;
             }
         }
-        const metaStr = meta ? ` | Meta: ${JSON.stringify(meta)}` : "";
-        return `[${timestamp}] [PID:${pid}] [${coloredLevel}]: ${message}${metaStr}`;
+        const metaStr = safeMeta ? ` | Meta: ${JSON.stringify(safeMeta)}` : "";
+        return `[${timestamp}] [PID:${pid}] [${coloredLevel}]: ${safeMessage}${metaStr}`;
     }
     log(level, message, meta) {
         if (level < this.config.minLevel)

package/framework-mcp/dist/src/shared/pii.js

@@ -0,0 +1,121 @@
+/**
+ * [PII] Personally Identifiable Information Masking Service
+ *
+ * Detects and masks sensitive data in compliance with KVKK/GDPR.
+ * Used in audit log, logger, and storage layers.
+ *
+ * Supported patterns:
+ * - Email addresses
+ * - Phone numbers
+ * - TC Identification number
+ * - API keys / tokens
+ * - IP addresses
+ * - Credit card numbers
+ * - Custom names (optional)
+ */
+// Sensitive patterns to detect and mask
+const SENSITIVE_PATTERNS = [
+    // Email
+    { pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, replacement: "***@***" },
+    // Phone (international and Turkish)
+    { pattern: /(\+90|0)?\s?[0-9]{3}\s?[0-9]{3}\s?[0-9]{2}\s?[0-9]{2}/g, replacement: "***-***-****" },
+    // TC Kimlik (11 digits starting with 1-9)
+    { pattern: /\b[1-9][0-9]{10}\b/g, replacement: "***********" },
+    // API keys (common formats: sk-..., pk-..., xai-..., etc.)
+    { pattern: /\b(sk-[a-zA-Z0-9]{20,}|pk-[a-zA-Z0-9]{20,}|xai-[a-zA-Z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|ghp_[a-zA-Z0-9]{36,}|gho_[a-zA-Z0-9]{36,})\b/g, replacement: "***-REDACTED-***" },
+    // Bearer tokens in Authorization headers
+    { pattern: /Bearer\s+[a-zA-Z0-9._-]+/g, replacement: "Bearer ***-REDACTED-***" },
+    // IP addresses
+    { pattern: /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/g, replacement: "***.***.***.***" },
+    // Credit card (16 digits, optional spaces/dashes)
+    { pattern: /\b(?:\d[ -]*?){13,16}\b/g, replacement: "****-****-****-****" },
+    // JWT tokens
+    { pattern: /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g, replacement: "***-JWT-REDACTED-***" },
+    // Password fields in JSON
+    { pattern: /"(password|passwd|secret|api_key|apiKey|apikey)"\s*:\s*"[^"]+"/gi, replacement: "\"$1\": \"***-REDACTED-***\"" },
+];
+// Fields that are considered sensitive and should always be redacted in structured data
+const SENSITIVE_FIELDS = [
+    "password", "passwd", "secret", "apiKey", "api_key", "apikey",
+    "token", "accessToken", "refreshToken", "authToken",
+    "authorization", "Authorization",
+    "email", "phone", "phoneNumber", "telephone",
+    "creditCard", "cvv", "ssn", "tcKimlik", "identityNumber",
+    "ipAddress",
+];
+/**
+ * Mask sensitive data in a text string.
+ */
+export function maskText(text) {
+    if (!text || typeof text !== "string")
+        return text;
+    let masked = text;
+    for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
+        masked = masked.replace(pattern, replacement);
+    }
+    return masked;
+}
+/**
+ * Recursively mask sensitive fields in an object.
+ * Returns a new object with sensitive values redacted.
+ */
+export function maskObject(obj, depth = 0) {
+    if (depth > 10)
+        return obj; // Prevent infinite recursion
+    if (obj === null || obj === undefined)
+        return obj;
+    if (typeof obj === "string")
+        return maskText(obj);
+    if (typeof obj !== "object")
+        return obj;
+    if (Array.isArray(obj)) {
+        return obj.map(item => maskObject(item, depth + 1));
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        // Check if the key itself is a sensitive field
+        if (SENSITIVE_FIELDS.includes(key)) {
+            result[key] = typeof value === "string" ? "***-REDACTED-***" : maskObject(value, depth + 1);
+        }
+        else if (typeof value === "string") {
+            result[key] = maskText(value);
+        }
+        else if (typeof value === "object") {
+            result[key] = maskObject(value, depth + 1);
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Check if a string contains potential PII.
+ * Useful for warning before sending data to external APIs.
+ */
+export function containsPII(text) {
+    for (const { pattern } of SENSITIVE_PATTERNS) {
+        if (pattern.test(text))
+            return true;
+    }
+    return false;
+}
+/**
+ * Classify a piece of data based on content analysis.
+ */
+export function classifyData(text) {
+    if (!text)
+        return "public";
+    // Check for highly sensitive data
+    if (/\b(sk-[a-zA-Z0-9]{20,}|Bearer\s+|eyJ[a-zA-Z0-9_-]+\.)/.test(text) ||
+        /\b[1-9][0-9]{10}\b/.test(text) ||
+        /"(password|secret|apiKey)"/i.test(text)) {
+        return "restricted";
+    }
+    // Check for moderately sensitive data
+    if (/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/.test(text) ||
+        /(\+90|0)?\s?[0-9]{3}\s?[0-9]{3}\s?[0-9]{2}\s?[0-9]{2}/.test(text)) {
+        return "confidential";
+    }
+    return "internal";
+}

package/framework-mcp/dist/src/shared/storage.js

@@ -8,7 +8,7 @@ import { asAgentID, asLogID, asMessageID, asTaskID } from "./types.js";
  * [DB] Atabey Storage Engine
  * Central SQLite database for enterprise-scale agent state management.
  */
-export class Storage {
+export class AtabeyStorage {
     static db = null;
     static getDB() {
         if (!this.db) {
@@ -207,3 +207,5 @@ export class Storage {
         }
     }
 }
+/** @deprecated Use AtabeyStorage instead. Kept for backward compatibility. */
+export const Storage = AtabeyStorage;

package/framework-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atabey-mcp",
-  "version": "0.0.12",
+  "version": "0.0.13",
   "description": "Agent Atabey Model Context Protocol (MCP) Server",
   "author": "Yusuf BEKAR",
   "license": "MIT",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "atabey",
-  "version": "0.0.12",
-  "description": "The Supreme AI Governance & Autonomous Orchestration Framework for Enterprise Development. Supports Polyglot Backends (Go, Java, Python, .NET, Node.js) and Multi-Language Communication (TR/EN).",
+  "version": "0.0.13",
+  "description": "MCP-Powered AI Governance & Autonomous Orchestration Framework. Plugs into Claude Code, Gemini CLI, and Cursor as an MCP server.",
   "author": "Yusuf BEKAR",
   "license": "MIT",
   "readme": "README.md",
@@ -21,7 +21,10 @@
     "agents",
     "mcp",
     "typescript",
-    "framework"
+    "framework",
+    "kvkk",
+    "gdpr",
+    "privacy"
   ],
   "workspaces": [
     "framework-mcp"
@@ -38,6 +41,7 @@
     "LICENSE",
     "mcp.json",
     "ATABEY.md",
+    "PRIVACY.md",
     "framework-mcp/dist",
     "framework-mcp/package.json"
   ],
@@ -48,7 +52,7 @@
     "build": "npm run build:core && npm run build:mcp && npm run build:ui",
     "build:core": "tsc",
     "build:mcp": "npm run build --prefix framework-mcp",
-    "build:ui": "npm run build --prefix src/dashboard",
+    "build:ui": "npm run build --prefix framework-mcp/dashboard",
     "lint": "eslint .",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -65,6 +69,7 @@
     "chalk": "^5.6.2",
     "js-yaml": "^4.2.0",
     "typescript": "^5.9.3",
+    "ws": "^8.21.0",
     "zod": "^3.24.2"
   },
   "devDependencies": {
@@ -72,6 +77,7 @@
     "@pandacss/dev": "^1.11.1",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^25.9.1",
+    "@types/ws": "^8.18.1",
     "@vitest/coverage-v8": "^3.2.6",
     "eslint": "^10.4.0",
     "globals": "^17.6.0",