atabey 0.0.12 → 0.0.14

package/framework-mcp/dist/src/shared/pii.js

@@ -0,0 +1,212 @@
+/**
+ * [PII] Personally Identifiable Information Masking Service
+ *
+ * Detects and masks sensitive data in compliance with KVKK/GDPR.
+ * Used in audit log, logger, storage layers, and MCP middleware.
+ *
+ * Supported patterns:
+ * - Email addresses
+ * - Phone numbers (international, Turkish, US, UK)
+ * - TC Identification number (11 digits)
+ * - API keys / tokens (OpenAI, Anthropic, Google, GitHub, generic)
+ * - Bearer tokens / JWTs
+ * - IP addresses (IPv4, IPv6)
+ * - Credit card numbers (AMEX, Visa, Mastercard, etc.)
+ * - Password / secret fields in structured data
+ * - Bank account / IBAN
+ * - Date of birth / full address patterns
+ * - Custom names (configurable)
+ */
+// Sensitive patterns to detect and mask
+// IMPORTANT: More specific patterns MUST come before generic ones
+const SENSITIVE_PATTERNS = [
+    // JWT tokens (complete JWT format) - must be before Bearer
+    { pattern: /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g, replacement: "***-JWT-REDACTED-***" },
+    // Bearer tokens in Authorization headers
+    { pattern: /Bearer\s+[a-zA-Z0-9._-]+/g, replacement: "Bearer ***-REDACTED-***" },
+    // Basic auth in Authorization headers
+    { pattern: /Basic\s+[a-zA-Z0-9=+/]+/g, replacement: "Basic ***-REDACTED-***" },
+    // API keys (common formats) - must be before generic patterns
+    // Note: ghp_ tokens can contain digits that look like phone numbers, so we mask the entire prefix + suffix
+    { pattern: /\b(sk-[a-zA-Z0-9]{20,}|pk-[a-zA-Z0-9]{20,}|xai-[a-zA-Z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|ghp_[a-zA-Z0-9]{36,}|gho_[a-zA-Z0-9]{36,}|ghu_[a-zA-Z0-9]{36,}|ghb_[a-zA-Z0-9]{36,}|github_pat_[a-zA-Z0-9]{36,}|sk-[a-zA-Z0-9_-]{32,}|sk-[a-zA-Z0-9]{48,}|whsec_[a-zA-Z0-9]{16,})\b/g, replacement: "***-REDACTED-***" },
+    // Social Security Number (US SSN: XXX-XX-XXXX) - must be before generic phone
+    { pattern: /\b(?!000|666|9[0-9]{2})\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g, replacement: "***-**-****" },
+    // Date of birth patterns - must be before generic phone
+    { pattern: /\b(0[1-9]|[12][0-9]|3[01])[/.-](0[1-9]|1[0-2])[/.-](19[0-9]{2}|20[0-9]{2})\b/g, replacement: "**/**/****" },
+    // IBAN (international bank account) - must be before generic alphanumeric patterns
+    // Only matches valid IBAN format: 2 letters + 2 digits + 4-30 alphanumeric chars
+    // More specific: requires minimum 8 chars total, starts with country code
+    { pattern: /\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4,30}\b/g, replacement: "****-IBAN-REDACTED-****" },
+    // TC Kimlik (11 digits starting with 1-9, isolated word boundary) - must be before phone
+    { pattern: /\b[1-9][0-9]{10}\b/g, replacement: "***********" },
+    // Email
+    { pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, replacement: "***@***" },
+    // Phone (Turkish: +90 5xx xxx xx xx) - specific before generic
+    { pattern: /(\+90|0)?\s?[0-9]{3}\s?[0-9]{3}\s?[0-9]{2}\s?[0-9]{2}/g, replacement: "***-***-****" },
+    // Phone (international: +90, +1, +44, +49, +33, etc.) - generic, keep last among phones
+    { pattern: /(\+\d{1,2}[\s-]?)?\(?\d{2,4}\)?[\s-]?\d{2,4}[\s-]?\d{2,4}[\s-]?\d{2,4}/g, replacement: "***-***-****" },
+    // IP addresses (IPv4)
+    { pattern: /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/g, replacement: "***.***.***.***" },
+    // IP addresses (IPv6 - simplified)
+    { pattern: /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g, replacement: "****:****:****:****" },
+    // IPv6 compressed
+    { pattern: /\b(?:[0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}\b/g, replacement: "****:****:****" },
+    // Credit card (16 digits, optional spaces/dashes)
+    { pattern: /\b(?:\d[ -]*?){13,16}\b/g, replacement: "****-****-****-****" },
+    // AMEX (15 digits, starts with 34/37)
+    { pattern: /\b3[47][0-9\s-]{13,14}\b/g, replacement: "****-****-***" },
+    // Password fields in JSON
+    { pattern: /"(password|passwd|secret|api_key|apiKey|apikey|auth_token|refresh_token|access_token)"\s*:\s*"[^"]+"/gi, replacement: "\"$1\": \"***-REDACTED-***\"" },
+    // Turkish address patterns (optional - sokak, cadde, mahalle, no:)
+    { pattern: /(?:no|no:|numara)[:\s]*\d+/gi, replacement: "no: ****" },
+];
+// Fields that are considered sensitive and should always be redacted in structured data
+const SENSITIVE_FIELDS = [
+    "password", "passwd", "secret", "apiKey", "api_key", "apikey",
+    "token", "accessToken", "access_token", "refreshToken", "refresh_token", "authToken", "auth_token",
+    "authorization", "Authorization", "bearer",
+    "email", "e_mail", "eMail",
+    "phone", "phoneNumber", "phone_number", "telephone", "telephoneNumber", "mobile", "mobilePhone", "cellPhone",
+    "creditCard", "credit_card", "ccNumber", "cc_number", "ccn", "cvv", "cvv2", "cvc",
+    "ssn", "socialSecurity", "social_security",
+    "tcKimlik", "tc_kimlik", "identityNumber", "identity_number", "idNumber", "id_number", "nationalId",
+    "ipAddress", "ip_address", "ip",
+    "dob", "dateOfBirth", "date_of_birth", "birthDate", "birth_date",
+    "iban", "IBAN", "bankAccount", "bank_account",
+    "address", "homeAddress", "workAddress", "billingAddress", "shippingAddress",
+    "fullName", "firstName", "lastName", "surname", "middleName",
+];
+/**
+ * Mask sensitive data in a text string.
+ */
+export function maskText(text) {
+    if (!text || typeof text !== "string")
+        return text;
+    let masked = text;
+    for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
+        masked = masked.replace(pattern, replacement);
+    }
+    return masked;
+}
+/**
+ * Recursively mask sensitive fields in an object.
+ * Returns a new object with sensitive values redacted.
+ * Strict mode: when true, also masks values in objects even if the key
+ * is not a known sensitive field name (catches data passed to unknown schemas).
+ */
+export function maskObject(obj, depth = 0, strictMode = false) {
+    if (depth > 10)
+        return obj; // Prevent infinite recursion
+    if (obj === null || obj === undefined)
+        return obj;
+    if (typeof obj === "string")
+        return maskText(obj);
+    if (typeof obj !== "object")
+        return obj;
+    if (Array.isArray(obj)) {
+        return obj.map(item => maskObject(item, depth + 1, strictMode));
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        // Check if the key itself is a sensitive field
+        if (SENSITIVE_FIELDS.includes(key)) {
+            result[key] = typeof value === "string" ? "***-REDACTED-***" : maskObject(value, depth + 1, strictMode);
+        }
+        else if (typeof value === "string") {
+            result[key] = maskText(value);
+        }
+        else if (typeof value === "object") {
+            result[key] = maskObject(value, depth + 1, strictMode);
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Check if a string contains potential PII.
+ * Useful for warning before sending data to external APIs.
+ */
+export function containsPII(text) {
+    for (const { pattern } of SENSITIVE_PATTERNS) {
+        if (pattern.test(text))
+            return true;
+    }
+    return false;
+}
+/**
+ * Check if an object contains PII in any of its string values (recursive).
+ */
+export function containsPIIInObject(obj, depth = 0) {
+    if (depth > 10)
+        return false;
+    if (obj === null || obj === undefined)
+        return false;
+    if (typeof obj === "string")
+        return containsPII(obj);
+    if (typeof obj !== "object")
+        return false;
+    if (Array.isArray(obj)) {
+        return obj.some(item => containsPIIInObject(item, depth + 1));
+    }
+    for (const [_key, value] of Object.entries(obj)) {
+        if (typeof value === "string") {
+            if (containsPII(value))
+                return true;
+        }
+        else if (typeof value === "object") {
+            if (containsPIIInObject(value, depth + 1))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Classify a piece of data based on content analysis.
+ */
+export function classifyData(text) {
+    if (!text)
+        return "public";
+    // Check for highly sensitive / critical data
+    if (/\b(sk-[a-zA-Z0-9]{20,}|Bearer\s+|eyJ[a-zA-Z0-9_-]+\.)/.test(text) ||
+        /\b[1-9][0-9]{10}\b/.test(text) ||
+        /"(password|secret|apiKey)"/i.test(text) ||
+        /\b[A-Z]{2}[0-9]{2}[A-Z0-9]{1,30}\b/.test(text) // IBAN
+    ) {
+        return "restricted";
+    }
+    // Check for personally identifiable / confidential data
+    if (/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/.test(text) ||
+        /(\+90|0)?\s?[0-9]{3}\s?[0-9]{3}\s?[0-9]{2}\s?[0-9]{2}/.test(text) ||
+        /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/.test(text) ||
+        /\b(0[1-9]|[12][0-9]|3[01])[/.-](0[1-9]|1[0-2])[/.-](19[0-9]{2}|20[0-9]{2})\b/.test(text)) {
+        return "confidential";
+    }
+    return "internal";
+}
+/**
+ * Mask the content field of an MCP tool result.
+ * This is used by the MCP middleware layer to automatically
+ * sanitize all tool outputs before they reach the AI.
+ */
+export function maskToolResult(result) {
+    if (!result || !result.content)
+        return result;
+    return {
+        ...result,
+        content: result.content.map(block => ({
+            ...block,
+            text: block.type === "text" ? maskText(block.text) : block.text,
+        })),
+    };
+}
+/**
+ * Mask sensitive arguments in an MCP tool call.
+ * This is applied BEFORE the tool handler executes, ensuring
+ * PII never reaches any processing layer unnecessarily.
+ */
+export function maskToolArgs(args) {
+    const masked = maskObject(args, 0, true);
+    return masked;
+}

package/framework-mcp/dist/src/shared/retention.js

@@ -0,0 +1,170 @@
+/**
+ * [KVKK/GDPR] Data Retention & Privacy Service
+ *
+ * KVKK Art. 4, 5, 7, 11 and GDPR Art. 5, 17 compliant data retention management.
+ *
+ * Features:
+ * - Automatic expired record cleanup
+ * - Data categorization (operational, user_data, api_call, security, compliance)
+ * - "Right to Erasure" support
+ * - Configurable retention policies
+ * - Periodic cleanup cron job
+ */
+import { Audit } from "./audit.js";
+import { logger } from "./logger.js";
+import { Storage } from "./storage.js";
+/**
+ * Data retention categories and default durations (days)
+ */
+export const RETENTION_POLICIES = {
+    OPERATIONAL: 30, // Operational logs: 30 days
+    USER_DATA: 90, // User data: 90 days (KVKK Art. 5)
+    API_CALL: 180, // API call records: 180 days
+    SECURITY: 365, // Security logs: 1 year
+    COMPLIANCE: 730, // Compliance records: 2 years
+};
+/**
+ * [KVKK/GDPR] Data Retention Manager
+ */
+export class DataRetention {
+    static cleanupInterval = null;
+    /**
+   * Initialize data retention with automatic cleanup.
+   * Starts a periodic cleanup job.
+   *
+   * @param intervalMs Cleanup interval in milliseconds (default: 1 hour)
+   */
+    static initialize(intervalMs = 3600000) {
+        // Run initial cleanup
+        this.runCleanup();
+        // Schedule periodic cleanup
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+        }
+        this.cleanupInterval = setInterval(() => this.runCleanup(), intervalMs);
+        logger.info("[RETENTION] Data retention initialized. " +
+            `Cleanup interval: ${intervalMs / 60000}min. ` +
+            `Policies: ${Object.entries(RETENTION_POLICIES).map(([k, v]) => `${k}=${v}d`).join(", ")}`);
+    }
+    /**
+   * Run cleanup for all data stores.
+   * Cleans audit logs, messages, and logs based on retention policies.
+   */
+    static runCleanup() {
+        const result = { audit: 0, messages: 0, logs: 0 };
+        try {
+            // 1. Clean audit logs
+            result.audit = Audit.cleanExpired();
+            // 2. Clean old messages (Hermes message queue)
+            result.messages = this.cleanOldMessages();
+            // 3. Clean old logs
+            result.logs = this.cleanOldLogs();
+            if (result.audit > 0 || result.messages > 0 || result.logs > 0) {
+                logger.info("[RETENTION] Cleanup complete: " +
+                    `${result.audit} audit, ${result.messages} messages, ${result.logs} logs`);
+            }
+        }
+        catch (error) {
+            logger.error(`[RETENTION] Cleanup failed: ${error.message}`);
+        }
+        return result;
+    }
+    /**
+   * [KVKK Art. 7] "Right to Erasure" — Deletes all data for a given trace ID.
+   * Cleans audit records, messages, logs, and tasks.
+   *
+   * @param traceId Trace ID to erase
+   * @returns Total number of deleted records
+   */
+    static eraseTraceData(traceId) {
+        let total = 0;
+        // Audit logs
+        total += Audit.deleteByFilter({ traceId });
+        // Messages
+        const db = Storage.getDB();
+        const msgResult = db.prepare("DELETE FROM messages WHERE trace_id = ?").run(traceId);
+        total += msgResult.changes;
+        // Tasks
+        const taskResult = db.prepare("DELETE FROM tasks WHERE trace_id = ?").run(traceId);
+        total += taskResult.changes;
+        // Logs
+        const logResult = db.prepare("DELETE FROM logs WHERE trace_id = ?").run(traceId);
+        total += logResult.changes;
+        logger.info(`[RETENTION] Trace ${traceId} erased: ${total} records deleted (KVKK Article 7)`);
+        return total;
+    }
+    /**
+   * [KVKK Art. 11] Erases all data.
+   * Only works with the confirmation code.
+   */
+    static eraseAllData(confirmationCode) {
+        if (confirmationCode !== "KVKK-RIGHT-TO-ERASURE") {
+            throw new Error("[RETENTION] Invalid confirmation code. Use 'KVKK-RIGHT-TO-ERASURE'");
+        }
+        let total = 0;
+        const db = Storage.getDB();
+        total += Audit.clearAll(confirmationCode);
+        total += db.prepare("DELETE FROM messages").run().changes;
+        total += db.prepare("DELETE FROM tasks").run().changes;
+        total += db.prepare("DELETE FROM logs").run().changes;
+        total += db.prepare("DELETE FROM agents").run().changes;
+        total += db.prepare("DELETE FROM metadata").run().changes;
+        logger.warn(`[RETENTION] ALL DATA ERASED: ${total} records (KVKK Article 7 - Right to Erasure)`);
+        return total;
+    }
+    /**
+   * Get retention statistics.
+   */
+    static getStats() {
+        const db = Storage.getDB();
+        const auditExpired = db.prepare(`
+        SELECT COUNT(*) as count FROM audit_log
+        WHERE retentionDays IS NOT NULL
+        AND timestamp < datetime('now', '-' || retentionDays || ' days')
+      `).get().count;
+        const messageCount = db.prepare("SELECT COUNT(*) as count FROM messages").get().count;
+        const logCount = db.prepare("SELECT COUNT(*) as count FROM logs").get().count;
+        const taskCount = db.prepare("SELECT COUNT(*) as count FROM tasks").get().count;
+        return {
+            auditExpired,
+            messageCount,
+            logCount,
+            taskCount,
+            policies: { ...RETENTION_POLICIES },
+        };
+    }
+    /**
+   * Stop the periodic cleanup job.
+   */
+    static shutdown() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+            logger.info("[RETENTION] Cleanup job stopped");
+        }
+    }
+    /**
+   * Clean old messages from the Hermes queue.
+   * Messages older than 30 days are removed.
+   */
+    static cleanOldMessages() {
+        const db = Storage.getDB();
+        const result = db.prepare(`
+      DELETE FROM messages
+      WHERE timestamp < datetime('now', '-30 days')
+    `).run();
+        return result.changes;
+    }
+    /**
+   * Clean old logs.
+   * Logs older than 30 days are removed.
+   */
+    static cleanOldLogs() {
+        const db = Storage.getDB();
+        const result = db.prepare(`
+      DELETE FROM logs
+      WHERE timestamp < datetime('now', '-30 days')
+    `).run();
+        return result.changes;
+    }
+}

package/framework-mcp/dist/src/shared/storage.js

@@ -3,12 +3,13 @@ import fs from "fs";
 import path from "path";
 import { getFrameworkDir } from "../cli/utils/memory.js";
 import { logger } from "./logger.js";
+import { maskText } from "./pii.js";
 import { asAgentID, asLogID, asMessageID, asTaskID } from "./types.js";
 /**
  * [DB] Atabey Storage Engine
  * Central SQLite database for enterprise-scale agent state management.
  */
-export class Storage {
+export class AtabeyStorage {
     static db = null;
     static getDB() {
         if (!this.db) {
@@ -18,6 +19,7 @@ export class Storage {
             }
             const dbPath = path.join(frameworkDir, "atabey.db");
             this.db = new Database(dbPath);
+            this.db.pragma("journal_mode = WAL");
             this.initializeSchema();
         }
         return this.db;
@@ -82,12 +84,47 @@ export class Storage {
                 value TEXT
             )
         `);
+        // Costs Table
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS costs (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                provider TEXT,
+                model TEXT,
+                input_tokens INTEGER,
+                output_tokens INTEGER,
+                cost REAL,
+                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
+                trace_id TEXT
+            )
+        `);
+    }
+    // --- Cost Operations ---
+    static saveCost(cost) {
+        const db = this.getDB();
+        db.prepare(`
+            INSERT INTO costs (provider, model, input_tokens, output_tokens, cost, timestamp, trace_id)
+            VALUES (?, ?, ?, ?, ?, ?, ?)
+        `).run(cost.provider, cost.model, cost.inputTokens, cost.outputTokens, cost.cost, cost.timestamp, cost.traceId || null);
+    }
+    static getAllCosts() {
+        const rows = this.getDB().prepare("SELECT * FROM costs ORDER BY timestamp ASC").all();
+        return rows.map(r => ({
+            provider: r.provider,
+            model: r.model,
+            inputTokens: r.input_tokens,
+            outputTokens: r.output_tokens,
+            cost: r.cost,
+            timestamp: r.timestamp,
+            traceId: r.trace_id || undefined
+        }));
     }
     // --- Agent Operations ---
     static updateAgentStatus(name, state, task, lastUpdated) {
         const db = this.getDB();
         const cleanName = name.replace("@", "");
         const timestamp = lastUpdated || new Date().toISOString();
+        // [KVKK/GDPR] Mask PII in task description before storing
+        const maskedTask = maskText(task);
         db.prepare(`
             INSERT INTO agents (name, state, task, last_updated)
             VALUES (?, ?, ?, ?)
@@ -95,7 +132,7 @@ export class Storage {
                 state = excluded.state,
                 task = excluded.task,
                 last_updated = excluded.last_updated
-        `).run(cleanName, state, task, timestamp);
+        `).run(cleanName, state, maskedTask, timestamp);
     }
     static getAllAgents() {
         return this.getDB().prepare("SELECT * FROM agents").all();
@@ -103,10 +140,12 @@ export class Storage {
     // --- Message Operations ---
     static saveMessage(msg) {
         const db = this.getDB();
+        // [KVKK/GDPR] Mask PII in message content before storing
+        const maskedContent = maskText(msg.content);
         db.prepare(`
             INSERT INTO messages (sender, receiver, category, content, trace_id, parent_id, status, priority, requires_approval)
             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(msg.from, msg.to, msg.category, msg.content, msg.traceId, msg.parentId || null, msg.status || "PENDING", msg.priority || "NORMAL", msg.requiresApproval ? 1 : 0);
+        `).run(msg.from, msg.to, msg.category, maskedContent, msg.traceId, msg.parentId || null, msg.status || "PENDING", msg.priority || "NORMAL", msg.requiresApproval ? 1 : 0);
     }
     static getPendingMessages() {
         const rows = this.getDB().prepare("SELECT * FROM messages WHERE status IN ('PENDING', 'APPROVED') ORDER BY priority DESC, timestamp ASC").all();
@@ -151,7 +190,6 @@ export class Storage {
             let deps = [];
             try {
                 const parsed = JSON.parse(r.dependencies || "[]");
-                // Handle cases where dependencies might be double-stringified or are raw JSON strings
                 deps = Array.isArray(parsed) ? parsed : JSON.parse(parsed);
             }
             catch (err) {
@@ -164,7 +202,8 @@ export class Storage {
                 agent: asAgentID(r.agent),
                 status: r.status,
                 priority: r.priority,
-                dependencies: deps
+                dependencies: deps,
+                createdAt: r.created_at
             };
         });
     }
@@ -185,8 +224,9 @@ export class Storage {
             action: r.action,
             trace_id: r.trace_id || undefined,
             status: r.status,
-            summary: r.summary,
-            findings: r.findings || undefined
+            // [KVKK/GDPR] Mask PII in log summaries before returning
+            summary: maskText(r.summary),
+            findings: r.findings ? maskText(r.findings) : undefined
         }));
     }
     // --- Metadata Operations ---
@@ -207,3 +247,5 @@ export class Storage {
         }
     }
 }
+/** @deprecated Use AtabeyStorage instead. Kept for backward compatibility. */
+export const Storage = AtabeyStorage;

package/framework-mcp/dist/src/shared/string.js

@@ -0,0 +1,29 @@
+export function stripMarkdownCodeBlocks(text) {
+    // Regex to find markdown code blocks (```lang ... ```) and extract their content.
+    // Handles cases where LLMs might wrap JSON in such blocks.
+    const markdownCodeBlockRegex = /```(?:\w+)?\s*([\s\S]*?)\s*```/g;
+    // Attempt to extract content from a single markdown code block.
+    const cleanedText = text.replace(markdownCodeBlockRegex, "$1").trim();
+    // If after stripping, it looks like JSON, return it.
+    if ((cleanedText.startsWith("{") && cleanedText.endsWith("}")) || (cleanedText.startsWith("[") && cleanedText.endsWith("]"))) {
+        return cleanedText;
+    }
+    // Fallback: If the original text itself was valid JSON (without being in a code block)
+    // or if the stripping made it valid, this check helps.
+    try {
+        JSON.parse(text.trim());
+        return text.trim(); // Original text was valid JSON
+    }
+    catch {
+        // Continue if original text wasn't valid JSON
+    }
+    // Try a more specific JSON code block extraction if the generic one didn't yield valid JSON
+    const specificJsonCodeBlockRegex = /```json\s*(\{[\s\S]*?\}|\[[\s\S]*?\])\s*```/g;
+    const specificMatch = text.match(specificJsonCodeBlockRegex);
+    if (specificMatch && specificMatch[1]) {
+        return specificMatch[1].trim();
+    }
+    // If all else fails, return the most aggressively stripped version.
+    // JSON.parse will fail if it's not valid, which is the expected behavior.
+    return cleanedText;
+}

package/framework-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atabey-mcp",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "description": "Agent Atabey Model Context Protocol (MCP) Server",
   "author": "Yusuf BEKAR",
   "license": "MIT",
@@ -22,7 +22,12 @@
   "scripts": {
     "build": "npx tsc",
     "start": "node dist/index.js",
-    "dev": "tsx src/index.ts"
+    "dev": "tsx src/index.ts",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "vitest": {
+    "include": ["tests/**/*.test.ts"]
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -32,6 +37,7 @@
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^25.9.1",
+    "tsx": "^4.22.3",
     "typescript": "^5.9.3"
   }
 }

package/mcp.json

@@ -2,13 +2,18 @@
   "mcpServers": {
     "atabey": {
       "command": "atabey",
-      "args": [
-        "mcp",
-        "start"
-      ],
+      "args": ["mcp", "start"],
       "env": {
         "ATABEY_PROJECT_ROOT": "/Users/ybekar/Desktop/Projeler/atabey"
-      }
+      },
+      "description": "Stdio mode: her kullanici kendi IDE'sinden baglanir."
+    },
+    "atabey-sse": {
+      "url": "http://localhost:5858/mcp/sse",
+      "env": {
+        "ATABEY_PROJECT_ROOT": "/Users/ybekar/Desktop/Projeler/atabey"
+      },
+      "description": "Unified mode: Tek port 5858'de MCP + Dashboard birlikte. Dashboard: http://localhost:5858"
     }
   }
-}
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "atabey",
-  "version": "0.0.12",
-  "description": "The Supreme AI Governance & Autonomous Orchestration Framework for Enterprise Development. Supports Polyglot Backends (Go, Java, Python, .NET, Node.js) and Multi-Language Communication (TR/EN).",
+  "version": "0.0.14",
+  "description": "MCP-Powered AI Governance & Autonomous Orchestration Framework. Plugs into Claude Code, Gemini CLI, and Cursor as an MCP server.",
   "author": "Yusuf BEKAR",
   "license": "MIT",
   "readme": "README.md",
@@ -21,7 +21,10 @@
     "agents",
     "mcp",
     "typescript",
-    "framework"
+    "framework",
+    "kvkk",
+    "gdpr",
+    "privacy"
   ],
   "workspaces": [
     "framework-mcp"
@@ -38,6 +41,7 @@
     "LICENSE",
     "mcp.json",
     "ATABEY.md",
+    "PRIVACY.md",
     "framework-mcp/dist",
     "framework-mcp/package.json"
   ],
@@ -48,13 +52,20 @@
     "build": "npm run build:core && npm run build:mcp && npm run build:ui",
     "build:core": "tsc",
     "build:mcp": "npm run build --prefix framework-mcp",
-    "build:ui": "npm run build --prefix src/dashboard",
+    "build:ui": "npm run build --prefix framework-mcp/dashboard",
     "lint": "eslint .",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "prepublishOnly": "npm run build",
-    "clean": "rm -rf dist node_modules framework-mcp/node_modules framework-mcp/dist"
+    "clean": "rm -rf dist node_modules framework-mcp/node_modules framework-mcp/dist",
+    "atabey:status": "atabey status",
+    "atabey:trace": "atabey trace:new",
+    "atabey:verify": "atabey verify-contract",
+    "atabey:check": "atabey check",
+    "atabey:test": "vitest run",
+    "atabey:test:watch": "vitest",
+    "atabey:build": "npm run build --prefix framework-mcp"
   },
   "publishConfig": {
     "access": "public"
@@ -65,22 +76,24 @@
     "chalk": "^5.6.2",
     "js-yaml": "^4.2.0",
     "typescript": "^5.9.3",
+    "ws": "^8.21.0",
     "zod": "^3.24.2"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@pandacss/dev": "^1.11.1",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^25.9.1",
+    "@types/ws": "^8.18.1",
     "@vitest/coverage-v8": "^3.2.6",
     "eslint": "^10.4.0",
     "globals": "^17.6.0",
     "tsx": "^4.22.3",
     "typescript-eslint": "^8.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.0.0",
+    "atabey": "^0.0.14"
   },
   "atabey": {
-    "version": "0.0.12",
-    "initializedAt": "2026-06-17T12:23:33.114Z"
+    "version": "0.0.14",
+    "initializedAt": "2026-06-20T15:11:43.308Z"
   }
 }