atabey 0.0.13 → 0.0.14

package/framework-mcp/dist/framework-mcp/src/utils/rules-engine.js

@@ -0,0 +1,231 @@
+/**
+ * ─── RULES ENGINE (Prompt Conflict Resolution) ────────────────────
+ *
+ * Resolves conflicts between AI CLI built-in prompts and Atabey governance rules.
+ * Ensures Atabey's critical rules ALWAYS override CLI-level instructions.
+ *
+ * Priority System:
+ * - CRITICAL (P0): Non-bypassable rules (zero any, no console.log, PII masking)
+ * - HIGH (P1): Important rules that should not be violated
+ * - MEDIUM (P2): Standard best practices
+ * - LOW (P3): Recommendations only
+ *
+ * Enforcement Mechanisms:
+ * 1. Pre-execution: Rule validation BEFORE tool runs
+ * 2. Post-execution: Scan changed files for violations → auto-rollback
+ * 3. CLI System Prompt Override: Inject critical rules at MCP initialization
+ */
+import path from "path";
+// ─── Built-in Governance Rules ────────────────────────────────────
+const GOVERNANCE_RULES = [
+    // ── CRITICAL (P0) Rules ────────────────────────────────────
+    {
+        id: "no-any-types",
+        name: "Zero Any Type Policy",
+        description: "TypeScript 'any' type is strictly forbidden",
+        priority: "CRITICAL",
+        detectPattern: /:\s*any\b/g,
+        appliesToExtensions: [".ts", ".tsx"],
+        errorMessage: "CRITICAL: 'any' type is forbidden. Use 'unknown' with proper type guards instead.",
+        bypassable: false,
+    },
+    {
+        id: "no-console-log",
+        name: "No Console Log",
+        description: "console.log/error/warn is forbidden (use logger instead)",
+        priority: "CRITICAL",
+        detectPattern: /console\.(log|error|warn|debug|info)\s*\(/g,
+        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx"],
+        errorMessage: "CRITICAL: console.log/error/warn is forbidden. Use the project's logger instead.",
+        bypassable: false,
+    },
+    {
+        id: "pii-masking",
+        name: "PII Masking Required",
+        description: "Sensitive data must be masked before logging or storing",
+        priority: "CRITICAL",
+        errorMessage: "CRITICAL: Detected potential PII in unmasked form. Use maskText() / maskObject() from pii.ts.",
+        bypassable: false,
+    },
+    // ── HIGH (P1) Rules ────────────────────────────────────────
+    {
+        id: "no-hardcoded-secrets",
+        name: "No Hardcoded Secrets",
+        description: "API keys, tokens, passwords must use environment variables",
+        priority: "HIGH",
+        detectPattern: /(['"])sk-[a-zA-Z0-9]{20,}['"]|(['"])ghp_[a-zA-Z0-9]{36,}['"]|(['"])AIza[0-9A-Za-z_-]{35}['"]/g,
+        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".java", ".yaml", ".yml", ".env.example"],
+        errorMessage: "HIGH: Hardcoded API keys/tokens detected. Use environment variables (process.env.*).",
+        bypassable: false,
+    },
+    {
+        id: "no-commented-code",
+        name: "No Commented-Out Code",
+        description: "Dead code should be removed, not commented out",
+        priority: "HIGH",
+        detectPattern: /\/\/\s*.{10,}/g,
+        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx"],
+        errorMessage: "HIGH: Commented-out code detected. Remove dead code instead of commenting.",
+        bypassable: true,
+    },
+    // ── MEDIUM (P2) Rules ──────────────────────────────────────
+    {
+        id: "no-console-in-jsx",
+        name: "No Console in JSX",
+        description: "Avoid console statements inside JSX/TSX components",
+        priority: "MEDIUM",
+        detectPattern: /{.*console\.(log|error|warn)\(.*}/g,
+        appliesToExtensions: [".tsx", ".jsx"],
+        errorMessage: "MEDIUM: Console statement inside JSX detected. Move to event handler or useEffect.",
+        bypassable: true,
+    },
+    {
+        id: "i18n-usage",
+        name: "Internationalization Required",
+        description: "Use i18n for user-facing strings",
+        priority: "MEDIUM",
+        detectPattern: /(['"])([A-Z][a-z]+ [a-z]+ [a-z]+)['"]/g,
+        appliesToExtensions: [".tsx", ".jsx"],
+        errorMessage: "MEDIUM: User-facing string detected. Use i18n translation function instead.",
+        bypassable: true,
+    },
+];
+// ─── Rule Engine ──────────────────────────────────────────────────
+let rulesMap = null;
+function getRulesMap() {
+    if (!rulesMap) {
+        rulesMap = new Map();
+        for (const rule of GOVERNANCE_RULES) {
+            rulesMap.set(rule.id, rule);
+        }
+    }
+    return rulesMap;
+}
+/**
+ * Get all governance rules.
+ */
+export function getAllRules() {
+    return [...GOVERNANCE_RULES];
+}
+/**
+ * Get rules by priority level.
+ */
+export function getRulesByPriority(priority) {
+    return GOVERNANCE_RULES.filter(r => r.priority === priority);
+}
+/**
+ * Get non-bypassable rules (CRITICAL + HIGH non-bypassable).
+ */
+export function getNonBypassableRules() {
+    return GOVERNANCE_RULES.filter(r => !r.bypassable);
+}
+/**
+ * Scan file content for rule violations.
+ * Returns array of violations found.
+ */
+export function scanFileForViolations(filePath, content) {
+    const ext = path.extname(filePath);
+    const violations = [];
+    const lines = content.split("\n");
+    for (const rule of GOVERNANCE_RULES) {
+        // Check if rule applies to this file extension
+        if (rule.appliesToExtensions && !rule.appliesToExtensions.includes(ext)) {
+            continue;
+        }
+        // Check if rule has a detect pattern
+        if (!rule.detectPattern)
+            continue;
+        // Scan each line
+        for (let i = 0; i < lines.length; i++) {
+            const match = lines[i].match(rule.detectPattern);
+            if (match) {
+                violations.push({
+                    rule,
+                    match: match[0],
+                    line: i + 1,
+                });
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * Validate tool arguments against governance rules.
+ * Returns violation messages if any critical rule is violated.
+ */
+export function validateArgsAgainstRules(toolName, args) {
+    const nonBypassable = getNonBypassableRules();
+    for (const rule of nonBypassable) {
+        // Check if rule applies to this tool
+        if (rule.appliesToTools && !rule.appliesToTools.includes(toolName)) {
+            continue;
+        }
+        // For write_file and replace_text, check content for violations
+        if ((toolName === "write_file" || toolName === "replace_text") && args.content) {
+            const content = args.content;
+            const filePath = args.path || "unknown.ts";
+            const violations = scanFileForViolations(filePath, content);
+            if (violations.length > 0) {
+                const details = violations.map(v => `  Line ${v.line}: ${v.match} (${v.rule.name} - ${v.rule.priority})`).join("\n");
+                return [
+                    `[GOVERNANCE] ${rule.priority} rule violation: ${rule.name}`,
+                    `${rule.errorMessage}`,
+                    "\nViolations:",
+                    details,
+                ].join("\n");
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Validate tool response for governance violations.
+ * Returns violation messages if found.
+ */
+export function validateResponseAgainstRules(toolName, responseText) {
+    // For file reads, check if the content contains PII or secrets
+    if (toolName === "read_file" && responseText.length > 0) {
+        const criticalRules = getNonBypassableRules();
+        for (const rule of criticalRules) {
+            if (rule.detectPattern && rule.detectPattern.test(responseText)) {
+                return `[GOVERNANCE] ${rule.priority} violation detected in response: ${rule.name}. ${rule.errorMessage}`;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Build system prompt override block for CLI initialization.
+ * This is injected into the AI's system prompt at MCP connect time.
+ */
+export function buildSystemPromptOverride() {
+    const criticalRules = getRulesByPriority("CRITICAL");
+    const highRules = getRulesByPriority("HIGH");
+    return [
+        "## [ATABEY GOVERNANCE] Critical Rules — DO NOT OVERRIDE",
+        "",
+        "The following rules are ENFORCED by the Atabey Governance Layer.",
+        "They CANNOT be bypassed or disabled.",
+        "",
+        "### Critical Rules (Non-Bypassable)",
+        ...criticalRules.map(r => `- 🔴 ${r.name}: ${r.description}`),
+        "",
+        "### High Priority Rules",
+        ...highRules.map(r => `- 🟠 ${r.name}: ${r.description}`),
+        "",
+        "> These rules are injected at the MCP middleware layer and enforced",
+        "> at both pre-execution and post-execution stages.",
+        "",
+    ].join("\n");
+}
+/**
+ * Add a custom governance rule at runtime.
+ */
+export function addRule(rule) {
+    const map = getRulesMap();
+    if (!map.has(rule.id)) {
+        GOVERNANCE_RULES.push(rule);
+        map.set(rule.id, rule);
+    }
+}
+export { GOVERNANCE_RULES as DefaultGovernanceRules };

package/framework-mcp/dist/framework-mcp/src/utils/silent-router.js

@@ -0,0 +1,128 @@
+/**
+ * ─── SILENT ROUTER ─────────────────────────────────────────────────
+ *
+ * Automatically routes tool calls to the most appropriate agent
+ * WITHOUT requiring the developer to type `@agent` commands.
+ *
+ * The magic: developer types "Make this API secure" and Atabey
+ * silently activates @security agent rules behind the scenes.
+ *
+ * Features:
+ * - Auto-agent detection from tool call context
+ * - Silent system prompt injection
+ * - Multi-agent chain support
+ * - Stealth notifications (stderr/dashboard only, never chat)
+ */
+import { RoutingEngine } from "../../../src/modules/engines/routing-engine.js";
+// ─── Configuration ────────────────────────────────────────────────
+const CONFIG = {
+    /** Enable silent routing (default: true) */
+    ENABLED: process.env.MCP_SILENT_ROUTING !== "false",
+    /** Enable stealth notifications to stderr */
+    STEALTH_NOTIFY: process.env.MCP_SILENT_STEALTH !== "false",
+    /** Agent override via env (for testing/debugging) */
+    FORCE_AGENT: process.env.MCP_FORCE_AGENT || null,
+};
+let agentRuleCache = null;
+async function loadAgentRules() {
+    if (agentRuleCache)
+        return agentRuleCache;
+    try {
+        const { ALL_AGENTS } = await import("../../../src/modules/agents/definitions.js");
+        agentRuleCache = new Map();
+        for (const agent of ALL_AGENTS) {
+            agentRuleCache.set(agent.name, {
+                name: agent.name,
+                identity: agent.instructions.identity,
+                mission: agent.instructions.mission,
+                rules: agent.instructions.rules,
+            });
+        }
+    }
+    catch {
+        // Fallback: use discipline rules file
+        agentRuleCache = new Map();
+    }
+    return agentRuleCache;
+}
+/**
+ * Detect the most appropriate agent for a given tool call and arguments.
+ * Uses RoutingEngine's TF-IDF matching on the args context.
+ */
+export function detectAgent(toolName, args) {
+    if (CONFIG.FORCE_AGENT)
+        return CONFIG.FORCE_AGENT;
+    // Build context from args for routing
+    const contextParts = [toolName];
+    for (const [key, value] of Object.entries(args)) {
+        if (typeof value === "string") {
+            contextParts.push(value);
+        }
+        else if (Array.isArray(value)) {
+            contextParts.push(value.filter(v => typeof v === "string").join(" "));
+        }
+    }
+    const context = contextParts.join(" ").substring(0, 500);
+    // Use RoutingEngine to detect the best agent
+    return RoutingEngine.resolveAgent(context);
+}
+/**
+ * Get the system prompt rules for a given agent.
+ * Used to inject discipline silently into tool context.
+ */
+export async function getAgentPrompt(agentName) {
+    const rules = await loadAgentRules();
+    const agent = rules.get(agentName.replace("@", ""));
+    if (!agent)
+        return null;
+    return [
+        `## [ATABEY SILENT] ${agent.name} (${agent.identity})`,
+        "",
+        "### Mission",
+        `${agent.mission}`,
+        "",
+        "### Active Disciplines",
+        ...agent.rules.map(r => `- ${r}`),
+        "",
+        "> These rules are injected by Atabey governance layer.",
+        "> They supplement (not replace) your existing instructions.",
+    ].join("\n");
+}
+/**
+ * Build a silent context injection payload.
+ * This is prepended to tool responses to guide the AI without @agent commands.
+ */
+export async function buildSilentContext(detectedAgent, toolName, responseText) {
+    if (!CONFIG.ENABLED)
+        return responseText;
+    const agentPrompt = await getAgentPrompt(detectedAgent);
+    if (!agentPrompt)
+        return responseText;
+    // Only inject if the response is substantial enough to warrant governance
+    if (responseText.length < 50)
+        return responseText;
+    // Inject as a comment block that won't break tool results
+    const injection = [
+        "",
+        `<!-- ATABEY_GOVERNANCE agent="${detectedAgent}" tool="${toolName}" -->`,
+        `${agentPrompt}`,
+        "<!-- /ATABEY_GOVERNANCE -->",
+        "",
+    ].join("\n");
+    return injection + responseText;
+}
+/**
+ * Send a stealth notification to stderr (never to the chat).
+ */
+export function stealthNotify(agent, toolName, message) {
+    if (!CONFIG.STEALTH_NOTIFY)
+        return;
+    process.stderr.write(`[ATABEY:${agent}] ${message} (tool: ${toolName})\n`);
+}
+/**
+ * Get silent router config.
+ */
+export function getSilentRouterConfig() {
+    return { ...CONFIG };
+}
+export { CONFIG as SilentRouterConfig };

package/framework-mcp/dist/framework-mcp/src/utils/storage.js

@@ -149,7 +149,6 @@ export class Storage {
             let deps = [];
             try {
                 const parsed = JSON.parse(r.dependencies || "[]");
-                // Handle cases where dependencies might be double-stringified or are raw JSON strings
                 deps = Array.isArray(parsed) ? parsed : JSON.parse(parsed);
             }
             catch {
@@ -162,7 +161,8 @@ export class Storage {
                 agent: r.agent,
                 status: r.status,
                 priority: r.priority,
-                dependencies: deps
+                dependencies: deps,
+                createdAt: r.created_at
             };
         });
     }