atabey 0.0.12 → 0.0.14

package/framework-mcp/dist/framework-mcp/src/utils/auto-rollback.js

@@ -0,0 +1,265 @@
+/**
+ * ─── AUTO-ROLLBACK + REGENERATE ───────────────────────────────────
+ *
+ * When the AI generates code that violates governance rules (e.g., `any` type,
+ * console.log, copyleft license), this module:
+ *   1. Captures the file content before the write
+ *   2. Validates the new content against governance rules
+ *   3. If violation found: blocks the write, restores original, and sends
+ *      a regenerate instruction back to the AI via MCP notification
+ *
+ * Flow:
+ *   [Pre-Write Snapshot] → [Validate Content] → [Violation?] ─yes→ [Rollback] → [Notify AI]
+ *                                                         └─no─→ [Allow Write]
+ *
+ * Key Innovation: Unlike simple blocking, this tells the AI WHY it was
+ * blocked and gives it specific instructions to self-correct.
+ */
+import fs from "fs";
+import path from "path";
+class SnapshotManager {
+    snapshots = new Map();
+    /**
+     * Capture a pre-write snapshot of a file.
+     */
+    capture(filePath, traceId) {
+        const resolvedPath = path.resolve(filePath);
+        let originalContent = null;
+        try {
+            if (fs.existsSync(resolvedPath)) {
+                originalContent = fs.readFileSync(resolvedPath, "utf8");
+            }
+        }
+        catch { /* file doesn't exist yet (new file) */ }
+        this.snapshots.set(resolvedPath, {
+            filePath: resolvedPath,
+            originalContent,
+            timestamp: Date.now(),
+            traceId,
+            restored: false,
+        });
+    }
+    /**
+     * Get a snapshot for a file.
+     */
+    get(filePath) {
+        return this.snapshots.get(path.resolve(filePath));
+    }
+    /**
+     * Restore a file to its pre-write state.
+     * Returns true if restored, false if no snapshot exists.
+     */
+    restore(filePath) {
+        const resolvedPath = path.resolve(filePath);
+        const snapshot = this.snapshots.get(resolvedPath);
+        if (!snapshot || snapshot.restored)
+            return false;
+        try {
+            if (snapshot.originalContent !== null) {
+                // File existed before – restore original
+                fs.writeFileSync(resolvedPath, snapshot.originalContent, "utf8");
+                process.stderr.write(`[ROLLBACK] Restored: ${path.relative(process.cwd(), resolvedPath)}\n`);
+            }
+            else {
+                // File was new – delete it
+                if (fs.existsSync(resolvedPath)) {
+                    fs.unlinkSync(resolvedPath);
+                    process.stderr.write(`[ROLLBACK] Deleted (new file): ${path.relative(process.cwd(), resolvedPath)}\n`);
+                }
+            }
+            snapshot.restored = true;
+            return true;
+        }
+        catch (error) {
+            process.stderr.write(`[ROLLBACK] Failed to restore ${resolvedPath}: ${error}\n`);
+            return false;
+        }
+    }
+    /**
+     * Clean up old snapshots.
+     */
+    cleanup(maxAgeMs = 300000) {
+        const cutoff = Date.now() - maxAgeMs;
+        for (const [filePath, snapshot] of this.snapshots) {
+            if (snapshot.timestamp < cutoff) {
+                this.snapshots.delete(filePath);
+            }
+        }
+    }
+    /**
+     * Get all active snapshots.
+     */
+    getAll() {
+        return Array.from(this.snapshots.values());
+    }
+}
+// ─── Auto-Rollback Engine ─────────────────────────────────────────
+export class AutoRollback {
+    static snapshots = new SnapshotManager();
+    /**
+     * Initialize the auto-rollback system.
+     * Sets up file watcher cleanup.
+     */
+    static initialize() {
+        // Periodic cleanup of old snapshots (every 5 minutes)
+        setInterval(() => {
+            AutoRollback.snapshots.cleanup();
+        }, 300000);
+    }
+    /**
+     * Prepare for a file write by capturing the current state.
+     * Call this BEFORE the tool handler writes to the file.
+     */
+    static prepareWrite(filePath, traceId) {
+        AutoRollback.snapshots.capture(filePath, traceId);
+    }
+    /**
+     * Validate content and rollback if violations are found.
+     * This is called after the tool handler writes the file, but
+     * BEFORE the response is returned to the AI.
+     *
+     * Returns:
+     *   - null if content is clean
+     *   - ViolationRecord[] if violations were found and rolled back
+     */
+    static validateAndRollback(filePath, content, violations) {
+        if (violations.length === 0)
+            return null;
+        // Restore the original file
+        const restored = AutoRollback.snapshots.restore(filePath);
+        if (restored) {
+            process.stderr.write(`[ROLLBACK] Rolled back ${path.relative(process.cwd(), filePath)} due to ${violations.length} violation(s)\n`);
+        }
+        return violations;
+    }
+    /**
+     * Build a regenerate instruction for the AI.
+     * This is what gets sent back to the AI to tell it to fix its output.
+     */
+    static buildRegenerateInstruction(violations, toolName) {
+        const criticalViolations = violations.filter(v => v.severity === "CRITICAL");
+        const lines = [
+            "## ⛔ AI Output Blocked – Governance Violation",
+            "",
+            `The code you generated for tool "${toolName}" has been BLOCKED and ROLLED BACK.`,
+            "The file has been restored to its previous state.",
+            "",
+        ];
+        if (criticalViolations.length > 0) {
+            lines.push(`### 🔴 Critical Violations (${criticalViolations.length})`);
+            lines.push("");
+            for (const v of criticalViolations) {
+                lines.push(`- **${v.rule}** (${v.filePath}:${v.line})`);
+                lines.push(`  - Detail: ${v.detail}`);
+                lines.push(`  - Fix: ${v.regenerateInstruction}`);
+                lines.push("");
+            }
+        }
+        const otherViolations = violations.filter(v => v.severity !== "CRITICAL");
+        if (otherViolations.length > 0) {
+            lines.push(`### 🟠 Other Violations (${otherViolations.length})`);
+            lines.push("");
+            for (const v of otherViolations) {
+                lines.push(`- **${v.rule}** (${v.filePath}:${v.line})`);
+                lines.push(`  - Detail: ${v.detail}`);
+                lines.push(`  - Fix: ${v.regenerateInstruction}`);
+                lines.push("");
+            }
+        }
+        lines.push("---");
+        lines.push("> **Instruction:** Please regenerate the code for this operation.");
+        lines.push("> Address ALL violations listed above.");
+        lines.push("> Do NOT reintroduce the same violations.");
+        return lines.join("\n");
+    }
+    /**
+     * Validate tool response content against governance rules.
+     * Used by the MCP middleware to check file write content before returning.
+     */
+    static checkWriteContent(filePath, content, traceId) {
+        const ext = path.extname(filePath).toLowerCase();
+        const violations = [];
+        // Only check source files
+        if (![".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".java", ".rs", ".swift", ".kt"].includes(ext)) {
+            return { allowed: true, violations: [], instruction: null };
+        }
+        const lines = content.split("\n");
+        // 1. Check for `any` type (CRITICAL)
+        if ([".ts", ".tsx"].includes(ext)) {
+            for (let i = 0; i < lines.length; i++) {
+                const anyMatch = lines[i].match(/:\s*any\b/);
+                if (anyMatch) {
+                    violations.push({
+                        rule: "No `any` Type",
+                        severity: "CRITICAL",
+                        filePath,
+                        line: i + 1,
+                        detail: `Line ${i + 1}: ${anyMatch[0].substring(0, 60)}`,
+                        regenerateInstruction: "Replace `any` with `unknown` and add proper type guards. Or use a specific interface/type.",
+                    });
+                }
+            }
+        }
+        // 2. Check for console.log (CRITICAL)
+        for (let i = 0; i < lines.length; i++) {
+            const consoleMatch = lines[i].match(/console\.(log|error|warn|debug)\s*\(/);
+            if (consoleMatch) {
+                // Check if file is exempt
+                if (!filePath.includes("logger.ts") && !filePath.includes("cli.ts") && !filePath.includes("compliance.ts")) {
+                    violations.push({
+                        rule: "No Console Log",
+                        severity: "CRITICAL",
+                        filePath,
+                        line: i + 1,
+                        detail: `Line ${i + 1}: ${consoleMatch[0].substring(0, 60)}`,
+                        regenerateInstruction: "Replace with the project's logger (import from the appropriate logger module).",
+                    });
+                }
+            }
+        }
+        // 3. Check for hardcoded secrets (HIGH)
+        const secretPatterns = [
+            { pattern: /(['"])sk-[a-zA-Z0-9]{20,}['"]/, name: "OpenAI API Key" },
+            { pattern: /(['"])ghp_[a-zA-Z0-9]{36,}['"]/, name: "GitHub Token" },
+            { pattern: /(['"])AIza[0-9A-Za-z_-]{35}['"]/, name: "Google API Key" },
+        ];
+        for (let i = 0; i < lines.length; i++) {
+            for (const { pattern, name } of secretPatterns) {
+                if (pattern.test(lines[i])) {
+                    violations.push({
+                        rule: `Hardcoded Secret: ${name}`,
+                        severity: "HIGH",
+                        filePath,
+                        line: i + 1,
+                        detail: `Potential ${name} hardcoded at line ${i + 1}`,
+                        regenerateInstruction: `Use environment variables (process.env.*) instead of hardcoding ${name}.`,
+                    });
+                }
+            }
+        }
+        // If violations found, prepare snapshot and rollback
+        if (violations.length > 0) {
+            AutoRollback.prepareWrite(filePath, traceId);
+            const rolledBack = AutoRollback.validateAndRollback(filePath, content, violations);
+            const instruction = AutoRollback.buildRegenerateInstruction(violations, "write_file");
+            return {
+                allowed: false,
+                violations: rolledBack || violations,
+                instruction,
+            };
+        }
+        return { allowed: true, violations: [], instruction: null };
+    }
+    /**
+     * Get snapshot stats.
+     */
+    static getSnapshotStats() {
+        const all = AutoRollback.snapshots.getAll();
+        return {
+            total: all.length,
+            restored: all.filter(s => s.restored).length,
+            pending: all.filter(s => !s.restored).length,
+        };
+    }
+}
+export { AutoRollback as AutoRollbackEngine };

package/framework-mcp/dist/framework-mcp/src/utils/compliance.js

@@ -53,7 +53,14 @@ export function verifyCorporateCompliance(content, filePath) {
                 }
                 // 5. Secure CLI Policy (No direct child_process)
                 if (moduleSpecifier.text === "child_process") {
-                    errors.push(`[ERROR] Corporate Compliance Breach: Direct 'child_process' usage is forbidden at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Use secure framework APIs.`);
+                    const isExempt = filePath.includes("src/cli/commands/") ||
+                        filePath.includes("shared/fs.ts") ||
+                        filePath.includes("shared/lock.ts") ||
+                        filePath.includes("quality-gate.ts") ||
+                        filePath.includes("providers/shared.ts");
+                    if (!isExempt) {
+                        errors.push(`[ERROR] Corporate Compliance Breach: Direct 'child_process' usage is forbidden at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Use secure framework APIs.`);
+                    }
                 }
             }
         }
@@ -75,10 +82,11 @@ export function verifyCorporateCompliance(content, filePath) {
             const prop = node.expression;
             if (ts.isIdentifier(prop.expression) && prop.expression.text === "fs") {
                 if (["writeFileSync", "appendFileSync"].includes(prop.name.text)) {
-                    // Lock files are exempt
+                    // Lock files, core atomic fs wrapper, and mcp configs are exempt
                     const args = node.arguments;
                     const firstArgText = args.length > 0 ? args[0].getText(sourceFile).toLowerCase() : "";
-                    if (!firstArgText.includes("lock")) {
+                    const isExemptFile = filePath.includes("shared/fs.ts") || filePath.includes("src/cli/commands/mcp.ts");
+                    if (!firstArgText.includes("lock") && !isExemptFile) {
                         errors.push(`[ERROR] Corporate Compliance Breach: Raw 'fs.${prop.name.text}' mutation detected at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Use atomic utilities instead.`);
                     }
                 }
@@ -118,7 +126,7 @@ export function scanProjectCompliance(targetDir = "src") {
     const files = getAllFiles(targetDir);
     for (const file of files) {
         // Skip exempt files
-        if (file.includes("compliance") || file.includes("definitions") || file.includes("logger") || file.includes("cli/index.ts"))
+        if (file.includes("compliance") || file.includes("definitions") || file.includes("logger") || file.includes("cli/index.ts") || file.includes("shared/fs.ts") || file.includes("shared/lock.ts"))
             continue;
         const content = fs.readFileSync(file, "utf8");
         try {

package/framework-mcp/dist/framework-mcp/src/utils/context-optimizer.js

@@ -0,0 +1,156 @@
+/**
+ * ─── CONTEXT OPTIMIZER ─────────────────────────────────────────────
+ *
+ * Prevents context poisoning and runaway token consumption by AI CLIs.
+ * Acts as a Circuit Breaker at the MCP middleware layer.
+ *
+ * Features:
+ * - Token Budget Enforcer: Max tokens per tool call response
+ * - File Read Limiter: Auto-truncate large file reads
+ * - Token-Based Rate Limiter: Max token spend per window
+ * - Response Size Governor: Truncates oversized responses
+ *
+ * [KVKK/GDPR] Also prevents PII leakage via oversized responses.
+ */
+// ─── Configuration ────────────────────────────────────────────────
+const CONFIG = {
+    /** Max tokens allowed in a single tool response */
+    MAX_TOKENS_PER_CALL: parseInt(process.env.MCP_MAX_TOKENS_PER_CALL || "4000", 10),
+    /** Max tokens per minute across all calls for an agent */
+    MAX_TOKENS_PER_MINUTE: parseInt(process.env.MCP_MAX_TOKENS_PER_MINUTE || "20000", 10),
+    /** Max tokens per hour across all calls for an agent */
+    MAX_TOKENS_PER_HOUR: parseInt(process.env.MCP_MAX_TOKENS_PER_HOUR || "100000", 10),
+    /** Max file size in bytes before auto-truncation (100KB) */
+    MAX_FILE_READ_SIZE: parseInt(process.env.MCP_MAX_FILE_READ_SIZE || "102400", 10),
+    /** Max lines to return for truncated files */
+    MAX_FILE_LINES: parseInt(process.env.MCP_MAX_FILE_LINES || "200", 10),
+    /** Token estimation ratio (chars per token) */
+    CHARS_PER_TOKEN: 4,
+};
+const agentBudgets = new Map();
+function getOrCreateBudget(agent) {
+    if (!agentBudgets.has(agent)) {
+        agentBudgets.set(agent, {
+            records: [],
+            totalTokens: 0,
+            lastWarning: 0,
+            blockedUntil: null,
+        });
+    }
+    return agentBudgets.get(agent);
+}
+function pruneOldRecords(agent) {
+    const oneHourAgo = Date.now() - 3600000;
+    agent.records = agent.records.filter(r => r.timestamp > oneHourAgo);
+}
+function sumTokensInWindow(agent, windowMs) {
+    const cutoff = Date.now() - windowMs;
+    return agent.records
+        .filter(r => r.timestamp > cutoff)
+        .reduce((sum, r) => sum + r.tokens, 0);
+}
+/**
+ * Estimate token count from text.
+ * Uses 4 chars per token as a conservative estimate.
+ */
+export function estimateTokens(text) {
+    if (!text)
+        return 0;
+    return Math.ceil(text.length / CONFIG.CHARS_PER_TOKEN);
+}
+/**
+ * Check if a tool response is within token budget.
+ * Returns null if allowed, or an error message if blocked.
+ */
+export function checkTokenBudget(agent, toolName, responseText) {
+    const budget = getOrCreateBudget(agent);
+    // Check if agent is currently blocked
+    if (budget.blockedUntil && Date.now() < budget.blockedUntil) {
+        const remaining = Math.ceil((budget.blockedUntil - Date.now()) / 1000);
+        return `[TOKEN BUDGET] Agent ${agent} is blocked for ${remaining}s. Token limit exceeded.`;
+    }
+    const estimatedTokens = estimateTokens(responseText);
+    // 1. Check per-call limit
+    if (estimatedTokens > CONFIG.MAX_TOKENS_PER_CALL) {
+        return `[TOKEN BUDGET] Response too large: ~${estimatedTokens} tokens (max: ${CONFIG.MAX_TOKENS_PER_CALL}). Truncate your request.`;
+    }
+    // Record the token usage
+    budget.records.push({
+        tokens: estimatedTokens,
+        timestamp: Date.now(),
+        toolName,
+    });
+    budget.totalTokens += estimatedTokens;
+    // Prune old records
+    pruneOldRecords(budget);
+    // 2. Check per-minute limit
+    const minuteTokens = sumTokensInWindow(budget, 60000);
+    if (minuteTokens > CONFIG.MAX_TOKENS_PER_MINUTE) {
+        budget.blockedUntil = Date.now() + 30000; // 30s cooldown
+        return `[TOKEN BUDGET] Agent ${agent} exceeded ${CONFIG.MAX_TOKENS_PER_MINUTE} tokens/min. Cooldown 30s.`;
+    }
+    // 3. Check per-hour limit
+    const hourTokens = sumTokensInWindow(budget, 3600000);
+    if (hourTokens > CONFIG.MAX_TOKENS_PER_HOUR) {
+        budget.blockedUntil = Date.now() + 120000; // 2min cooldown
+        return `[TOKEN BUDGET] Agent ${agent} exceeded ${CONFIG.MAX_TOKENS_PER_HOUR} tokens/hour. Cooldown 2min.`;
+    }
+    // 4. Warning at 80% of per-minute limit
+    if (minuteTokens > CONFIG.MAX_TOKENS_PER_MINUTE * 0.8) {
+        const now = Date.now();
+        if (now - budget.lastWarning > 10000) { // Throttle warnings to once per 10s
+            budget.lastWarning = now;
+            process.stderr.write(`[TOKEN BUDGET WARNING] Agent ${agent} at ${Math.round(minuteTokens / CONFIG.MAX_TOKENS_PER_MINUTE * 100)}% of minute token budget.\n`);
+        }
+    }
+    return null;
+}
+/**
+ * Truncate file content to fit within token budget.
+ * Returns truncated content with a header note.
+ */
+export function truncateFileContent(content, filePath, maxTokens = CONFIG.MAX_TOKENS_PER_CALL) {
+    const estimatedTokens = estimateTokens(content);
+    if (estimatedTokens <= maxTokens)
+        return content;
+    const lines = content.split("\n");
+    const maxLines = Math.min(CONFIG.MAX_FILE_LINES, Math.floor(maxTokens * CONFIG.CHARS_PER_TOKEN / 80));
+    const truncated = lines.slice(0, maxLines).join("\n");
+    const remaining = lines.length - maxLines;
+    return `[TRUNCATED] File "${filePath}" is too large (~${estimatedTokens} tokens). Showing first ${maxLines}/${lines.length} lines.\n\n${truncated}\n\n[... ${remaining} more lines truncated. Use grep_search for targeted queries.]`;
+}
+/**
+ * Get token budget stats for an agent.
+ */
+export function getTokenBudgetStats(agent) {
+    const budget = agentBudgets.get(agent);
+    if (!budget) {
+        return { totalTokens: 0, recentMinute: 0, recentHour: 0, blocked: false, blockedRemaining: 0, callCount: 0 };
+    }
+    pruneOldRecords(budget);
+    return {
+        totalTokens: budget.totalTokens,
+        recentMinute: sumTokensInWindow(budget, 60000),
+        recentHour: sumTokensInWindow(budget, 3600000),
+        blocked: budget.blockedUntil !== null && Date.now() < budget.blockedUntil,
+        blockedRemaining: budget.blockedUntil ? Math.max(0, budget.blockedUntil - Date.now()) : 0,
+        callCount: budget.records.length,
+    };
+}
+/**
+ * Get all agents' token budget stats.
+ */
+export function getAllTokenBudgetStats() {
+    const stats = {};
+    for (const [agent] of agentBudgets) {
+        stats[agent] = getTokenBudgetStats(agent);
+    }
+    return stats;
+}
+/**
+ * Reset all token budgets.
+ */
+export function resetTokenBudgets() {
+    agentBudgets.clear();
+}
+export { CONFIG as TokenBudgetConfig };

package/framework-mcp/dist/framework-mcp/src/utils/discipline.js

@@ -0,0 +1,217 @@
+/**
+ * ─── AI DISCIPLINE ENGINE ─────────────────────────────────────────
+ *
+ * Enforces strict rules on AI behavior at the MCP middleware layer.
+ * Unlike agent instructions (which AI can ignore), these are enforced
+ * at the tool level - AI cannot bypass them.
+ *
+ * Features:
+ * - Tool call rate limiting (prevents abuse)
+ * - File size limits (prevents reading/writing huge files)
+ * - Call frequency tracking (detects loops)
+ * - Tool blacklist per agent
+ * - Agent-based tool whitelist
+ * - Response content validation
+ * - Max concurrent operations
+ */
+import fs from "fs";
+import path from "path";
+// Per-agent discipline tracking
+const agentDiscipline = new Map();
+// ─── Configuration (from env or defaults) ─────────────────────────
+const CONFIG = {
+    MAX_CALLS_PER_MINUTE: parseInt(process.env.MCP_MAX_CALLS_PER_MINUTE || "60", 10),
+    MAX_TOTAL_CALLS: parseInt(process.env.MCP_MAX_TOTAL_CALLS || "500", 10),
+    MAX_FILE_SIZE: parseInt(process.env.MCP_MAX_FILE_SIZE || "1048576", 10),
+    MAX_ARGS_SIZE: parseInt(process.env.MCP_MAX_ARGS_SIZE || "102400", 10),
+    COOLDOWN_MS: parseInt(process.env.MCP_COOLDOWN_MS || "30000", 10),
+    MAX_RESPONSE_SIZE: parseInt(process.env.MCP_MAX_RESPONSE_SIZE || "512000", 10), // 500KB max response
+    MAX_CONSECUTIVE_SAME_TOOL: parseInt(process.env.MCP_MAX_CONSECUTIVE_SAME_TOOL || "10", 10),
+    RESTRICTED_TOOLS: (process.env.MCP_RESTRICTED_TOOLS || "")
+        .split(",").map(t => t.trim()).filter(Boolean),
+    // Agent-based tool whitelist (format: agent1:tool1,tool2;agent2:tool3,tool4)
+    AGENT_TOOL_WHITELIST: parseAgentWhitelist(process.env.MCP_AGENT_TOOL_WHITELIST || ""),
+};
+function parseAgentWhitelist(input) {
+    const map = new Map();
+    if (!input)
+        return map;
+    input.split(";").forEach(pair => {
+        const [agent, tools] = pair.split(":");
+        if (agent && tools) {
+            map.set(agent.trim(), new Set(tools.split(",").map(t => t.trim())));
+        }
+    });
+    return map;
+}
+const cooldowns = new Map();
+function getOrCreateAgent(agent) {
+    if (!agentDiscipline.has(agent)) {
+        const whitelist = CONFIG.AGENT_TOOL_WHITELIST.get(agent) || null;
+        agentDiscipline.set(agent, {
+            totalCalls: 0,
+            calls: [],
+            lastReset: Date.now(),
+            blacklistedTools: new Set(),
+            whitelistedTools: whitelist,
+            violations: 0,
+            lastViolation: null,
+        });
+    }
+    return agentDiscipline.get(agent);
+}
+function pruneOldCalls(agent, windowMs = 60000) {
+    const cutoff = Date.now() - windowMs;
+    agent.calls = agent.calls.filter(c => c.timestamp > cutoff);
+}
+function isInCooldown(agent) {
+    const until = cooldowns.get(agent);
+    if (!until)
+        return false;
+    if (Date.now() > until) {
+        cooldowns.delete(agent);
+        return false;
+    }
+    return true;
+}
+function recordViolation(agent, reason) {
+    const discipline = agentDiscipline.get(agent);
+    if (discipline) {
+        discipline.violations++;
+        discipline.lastViolation = reason;
+    }
+}
+/**
+ * Enforce discipline on a tool call before execution.
+ * Returns error message if blocked, null if allowed.
+ */
+export async function enforceDiscipline(agent, toolName, args) {
+    const discipline = getOrCreateAgent(agent);
+    // 1. Check cooldown
+    if (isInCooldown(agent)) {
+        const until = cooldowns.get(agent);
+        const remaining = Math.ceil((until - Date.now()) / 1000);
+        return `[DISCIPLINE] Agent ${agent} is in cooldown for ${remaining}s. Too many requests.`;
+    }
+    // 2. Check restricted tools (global blacklist)
+    if (CONFIG.RESTRICTED_TOOLS.includes(toolName)) {
+        recordViolation(agent, `Attempted to use restricted tool: ${toolName}`);
+        return `[DISCIPLINE] Tool "${toolName}" is restricted. Agent ${agent} cannot use it.`;
+    }
+    // 3. Check agent-specific whitelist
+    if (discipline.whitelistedTools && !discipline.whitelistedTools.has(toolName)) {
+        recordViolation(agent, `Attempted to use non-whitelisted tool: ${toolName}`);
+        const allowed = Array.from(discipline.whitelistedTools).join(", ");
+        return `[DISCIPLINE] Agent ${agent} is not allowed to use "${toolName}". Allowed tools: ${allowed}`;
+    }
+    // 4. Check total call limit
+    if (discipline.totalCalls >= CONFIG.MAX_TOTAL_CALLS) {
+        cooldowns.set(agent, Date.now() + CONFIG.COOLDOWN_MS);
+        recordViolation(agent, `Exceeded max total calls (${CONFIG.MAX_TOTAL_CALLS})`);
+        return `[DISCIPLINE] Agent ${agent} exceeded max total calls (${CONFIG.MAX_TOTAL_CALLS}). Cooldown ${CONFIG.COOLDOWN_MS / 1000}s.`;
+    }
+    // 5. Check rate limit (calls per minute)
+    pruneOldCalls(discipline);
+    if (discipline.calls.length >= CONFIG.MAX_CALLS_PER_MINUTE) {
+        cooldowns.set(agent, Date.now() + CONFIG.COOLDOWN_MS);
+        recordViolation(agent, `Rate limit exceeded (${CONFIG.MAX_CALLS_PER_MINUTE}/min)`);
+        return `[DISCIPLINE] Agent ${agent} exceeded rate limit (${CONFIG.MAX_CALLS_PER_MINUTE}/min). Cooldown ${CONFIG.COOLDOWN_MS / 1000}s.`;
+    }
+    // 6. Check consecutive same tool (prevents loops)
+    if (discipline.calls.length >= CONFIG.MAX_CONSECUTIVE_SAME_TOOL) {
+        const lastCalls = discipline.calls.slice(-CONFIG.MAX_CONSECUTIVE_SAME_TOOL);
+        const allSame = lastCalls.every(c => c.tool === toolName);
+        if (allSame) {
+            cooldowns.set(agent, Date.now() + CONFIG.COOLDOWN_MS);
+            recordViolation(agent, `Consecutive same tool limit: ${toolName} x${CONFIG.MAX_CONSECUTIVE_SAME_TOOL}`);
+            return `[DISCIPLINE] Agent ${agent} called "${toolName}" ${CONFIG.MAX_CONSECUTIVE_SAME_TOOL} times in a row. Possible loop. Cooldown.`;
+        }
+    }
+    // 7. Check args size
+    const argsStr = JSON.stringify(args);
+    if (argsStr.length > CONFIG.MAX_ARGS_SIZE) {
+        recordViolation(agent, `Args too large: ${argsStr.length} bytes`);
+        return `[DISCIPLINE] Tool call args too large (${argsStr.length} bytes, max: ${CONFIG.MAX_ARGS_SIZE}).`;
+    }
+    // 8. Check file size for read/write operations
+    if ((toolName === "read_file" || toolName === "write_file") && args.path) {
+        try {
+            const projectRoot = process.env.ATABEY_PROJECT_ROOT || process.cwd();
+            const filePath = path.resolve(projectRoot, args.path);
+            if (fs.existsSync(filePath)) {
+                const stat = fs.statSync(filePath);
+                if (stat.size > CONFIG.MAX_FILE_SIZE) {
+                    return `[DISCIPLINE] File too large (${(stat.size / 1024 / 1024).toFixed(1)}MB, max: ${(CONFIG.MAX_FILE_SIZE / 1024 / 1024).toFixed(1)}MB). Use grep_search instead.`;
+                }
+            }
+        }
+        catch { /* ignore */ }
+    }
+    // Record the call
+    discipline.totalCalls++;
+    discipline.calls.push({
+        tool: toolName,
+        timestamp: Date.now(),
+        argsSize: argsStr.length,
+    });
+    return null;
+}
+/**
+ * Validate tool response content before returning to AI.
+ * Returns error message if blocked, null if allowed.
+ */
+export function validateResponse(toolName, result) {
+    if (!result || !result.content)
+        return null;
+    for (const block of result.content) {
+        if (block.type !== "text" || !block.text)
+            continue;
+        // Check response size
+        if (block.text.length > CONFIG.MAX_RESPONSE_SIZE) {
+            return `[DISCIPLINE] Response too large (${(block.text.length / 1024).toFixed(1)}KB, max: ${(CONFIG.MAX_RESPONSE_SIZE / 1024).toFixed(1)}KB).`;
+        }
+        // Block binary/gibberish content in text responses
+        const nonPrintable = (block.text.match(/[^\x20-\x7E\n\r\t]/g) || []).length;
+        if (nonPrintable > block.text.length * 0.3) {
+            return `[DISCIPLINE] Response contains too much binary data (${nonPrintable} non-printable chars). Blocked.`;
+        }
+    }
+    return null;
+}
+/**
+ * Get discipline stats for an agent.
+ */
+export function getDisciplineStats(agent) {
+    const discipline = agentDiscipline.get(agent);
+    if (!discipline) {
+        return { totalCalls: 0, recentCalls: 0, inCooldown: false, cooldownRemaining: 0, violations: 0, lastViolation: null };
+    }
+    pruneOldCalls(discipline);
+    const cooldownUntil = cooldowns.get(agent);
+    return {
+        totalCalls: discipline.totalCalls,
+        recentCalls: discipline.calls.length,
+        inCooldown: isInCooldown(agent),
+        cooldownRemaining: cooldownUntil ? Math.max(0, cooldownUntil - Date.now()) : 0,
+        violations: discipline.violations,
+        lastViolation: discipline.lastViolation,
+    };
+}
+/**
+ * Get all agents' discipline stats.
+ */
+export function getAllDisciplineStats() {
+    const stats = {};
+    for (const [agent, _discipline] of agentDiscipline) {
+        stats[agent] = getDisciplineStats(agent);
+    }
+    return stats;
+}
+/**
+ * Reset discipline for all agents.
+ */
+export function resetDiscipline() {
+    agentDiscipline.clear();
+    cooldowns.clear();
+}
+export { CONFIG as DisciplineConfig };