atabey 0.0.13 → 0.0.14

package/dist/framework-mcp/src/tools/shell/run_command.js.map

@@ -1 +1 @@
-{"version":3,"file":"run_command.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/shell/run_command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,MAAM,kBAAkB,GAAG;IACvB,mBAAmB;IACnB,UAAU;IACV,SAAS;IACT,aAAa;IACb,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,WAAW;IACX,UAAU;IACV,cAAc;IACd,WAAW;IACX,UAAU;IACV,cAAc;IAEd,MAAM;IACN,YAAY;IACZ,UAAU;IACV,SAAS;IACT,YAAY;IACZ,WAAW;IACX,SAAS;IACT,YAAY;IACZ,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,YAAY;IACZ,cAAc;IACd,WAAW;IAEX,cAAc;IACd,eAAe;IACf,SAAS;IACT,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,aAAa;IACb,MAAM;IACN,OAAO;IACP,aAAa;IACb,eAAe;IACf,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,KAAK;IACL,WAAW;IACX,YAAY;IACZ,aAAa;IACb,aAAa;IACb,WAAW;IAEX,8EAA8E;IAC9E,yEAAyE;IACzE,OAAO;IACP,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,KAAK;IACL,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IACN,IAAI;IACJ,IAAI;CACP,CAAC;AAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,aAAa;AAEpC,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAAoB;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAExF,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,yBAAyB,OAAO,6DAA6D,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9I,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,sBAAsB,OAAO,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1F,OAAO,OAAO,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,QAAQ,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI;SAChB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,sBAAsB,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;YAE/E,IAAI,KAAK,EAAE,CAAC;gBACR,MAAM,QAAQ,GAAG,iCAAiC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC;gBAClF,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,sBAAsB,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACjF,OAAO,CAAC;oBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,QAAQ,aAAa,MAAM,EAAE,EAAE,CAAC;oBAC1E,OAAO,EAAE,IAAI;iBAChB,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,wBAAwB;YACxB,MAAM,iBAAiB,GAAG,IAAI,CAAC;YAC/B,IAAI,eAAe,GAAG,MAAM,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;gBACpC,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,qBAAqB,CAAC,CAAC,aAAa;YACnG,CAAC;YAED,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"run_command.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/shell/run_command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,MAAM,kBAAkB,GAAG;IACvB,mBAAmB;IACnB,UAAU;IACV,SAAS;IACT,aAAa;IACb,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,WAAW;IACX,UAAU;IACV,cAAc;IACd,WAAW;IACX,UAAU;IACV,cAAc;IAEd,MAAM;IACN,YAAY;IACZ,UAAU;IACV,SAAS;IACT,YAAY;IACZ,WAAW;IACX,SAAS;IACT,YAAY;IACZ,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;IACX,YAAY;IACZ,cAAc;IACd,WAAW;IAEX,cAAc;IACd,eAAe;IACf,SAAS;IACT,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,aAAa;IACb,MAAM;IACN,OAAO;IACP,aAAa;IACb,eAAe;IACf,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,KAAK;IACL,WAAW;IACX,YAAY;IACZ,aAAa;IACb,aAAa;IACb,WAAW;IAEX,8EAA8E;IAC9E,yEAAyE;IACzE,OAAO;IACP,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,KAAK;IACL,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IACN,IAAI;IACJ,IAAI;CACP,CAAC;AAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,aAAa;AAEpC,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAAoB;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAExF,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,yBAAyB,OAAO,6DAA6D,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9I,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,sBAAsB,OAAO,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1F,OAAO,OAAO,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,QAAQ,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI;SAChB,CAAC,CAAC;IACP,CAAC;IAED,uDAAuD;IACvD,MAAM,sBAAsB,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,sBAAsB,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,oFAAoF,CAAC;QACtG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,sBAAsB,OAAO,2BAA2B,EAAE,QAAQ,CAAC,CAAC;QAC1G,OAAO,OAAO,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,QAAQ,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI;SAChB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,sBAAsB,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;YAE/E,IAAI,KAAK,EAAE,CAAC;gBACR,MAAM,QAAQ,GAAG,iCAAiC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC;gBAClF,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,sBAAsB,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACjF,OAAO,CAAC;oBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,QAAQ,aAAa,MAAM,EAAE,EAAE,CAAC;oBAC1E,OAAO,EAAE,IAAI;iBAChB,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,wBAAwB;YACxB,MAAM,iBAAiB,GAAG,IAAI,CAAC;YAC/B,IAAI,eAAe,GAAG,MAAM,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;gBACpC,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,qBAAqB,CAAC,CAAC,aAAa;YACnG,CAAC;YAED,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/framework-mcp/src/tools/types.d.ts

@@ -1,4 +1,8 @@
-import { TraceID, AgentID, TaskID } from "../utils/types.js";
+export type { AcquireLockArgs, AnalyzeCodeQualityArgs, BatchSurgicalEditArgs, CheckArchitectureComplianceArgs, CheckPortsArgs, GetProjectGapsArgs, GetProjectMapArgs, GrepSearchArgs, ListDirArgs, LogAgentActionArgs, PatchFileArgs, ReadFileArgs, RegisterAgentArgs, ReleaseLockArgs, ReplaceTextArgs, RunShellCommandArgs, RunTestsArgs, SendAgentMessageArgs, UpdateProjectMemoryArgs, WriteFileArgs } from "./schemas.js";
+export type { CheckPortsArgs as CheckActivePortsArgs, RunShellCommandArgs as RunCommandArgs } from "./schemas.js";
+export type GetStatusArgs = Record<string, never>;
+export type OrchestrateArgs = Record<string, never>;
+export type UpdateContractHashArgs = Record<string, never>;
 export interface ToolDefinition {
     name: string;
     description: string;
@@ -8,110 +12,12 @@ export interface ToolDefinition {
         required?: string[];
     };
 }
-export interface ReadFileArgs {
-    path: string;
-    startLine?: number;
-    endLine?: number;
-}
-export interface WriteFileArgs {
-    path: string;
-    content: string;
-}
-export interface ReplaceTextArgs {
-    path: string;
-    oldText: string;
-    newText: string;
-    allowMultiple?: boolean;
-}
-export interface PatchFileArgs {
-    path: string;
-    startLine: number;
-    endLine: number;
-    newContent: string;
-}
-export interface BatchSurgicalEditArgs {
-    edits: Array<{
-        path: string;
-        oldText: string;
-        newText: string;
-        allowMultiple?: boolean;
-    }>;
-}
-export interface ListDirArgs {
-    path?: string;
-}
-export interface GrepSearchArgs {
-    pattern: string;
-    includePattern?: string;
-    excludePattern?: string;
-}
-export interface GetProjectMapArgs {
-    maxDepth?: number;
-    includeFiles?: boolean;
-}
-export interface GetProjectGapsArgs {
-    path?: string;
-}
-export interface SendAgentMessageArgs {
-    from: AgentID;
-    to: AgentID;
-    category: "ACTION" | "DELEGATION" | "SUBTASK" | "REPLY" | "ALERT";
-    content: string;
-    traceId: TraceID;
-    parentId?: TaskID;
-    priority?: "HIGH" | "NORMAL" | "LOW";
-    requiresApproval?: boolean;
-}
-export interface LogAgentActionArgs {
-    agent: AgentID;
-    action: string;
-    traceId: TraceID;
-    status: "SUCCESS" | "FAILURE";
-    summary: string;
-    findings?: string;
-}
-export interface AcquireLockArgs {
-    resource: string;
-    agent: AgentID;
-    ttl?: number;
-}
-export interface ReleaseLockArgs {
-    resource: string;
-    agent: AgentID;
-}
-export interface RegisterAgentArgs {
-    agent: AgentID;
-    role: string;
-    capability?: number;
-    specialties?: Record<string, number>;
-}
-export interface StartDashboardArgs {
-    port?: number;
-}
-export interface CheckActivePortsArgs {
-    filter?: string;
-}
-export interface RunTestsArgs {
-    command?: string;
-    timeout?: number;
-}
-export interface UpdateProjectMemoryArgs {
-    section: string;
-    content: string;
-}
-export interface GetStatusArgs {
-    timeout?: number;
-}
-export interface OrchestrateArgs {
-    timeout?: number;
-}
-export interface UpdateContractHashArgs {
-    timeout?: number;
-}
-export interface RunCommandArgs {
-    command: string;
-}
-export type ToolArgs = ReadFileArgs | WriteFileArgs | ReplaceTextArgs | PatchFileArgs | BatchSurgicalEditArgs | ListDirArgs | GrepSearchArgs | GetProjectMapArgs | GetProjectGapsArgs | SendAgentMessageArgs | LogAgentActionArgs | AcquireLockArgs | ReleaseLockArgs | RegisterAgentArgs | StartDashboardArgs | CheckActivePortsArgs | RunTestsArgs | UpdateProjectMemoryArgs | GetStatusArgs | OrchestrateArgs | UpdateContractHashArgs;
+/**
+ * Generic tool arguments type.
+ * Handler functions receive `args: unknown` and cast internally.
+ * Zod schemas in schemas.ts provide the actual runtime validation.
+ */
+export type ToolArgs = Record<string, unknown>;
 export interface ToolResult {
     isError?: boolean;
     content: Array<{

package/dist/framework-mcp/src/tools/types.js

@@ -1,2 +1,3 @@
+// Import types locally for ToolArgs union usage
 export {};
 //# sourceMappingURL=types.js.map

package/dist/framework-mcp/src/tools/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../framework-mcp/src/tools/types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../framework-mcp/src/tools/types.ts"],"names":[],"mappings":"AAAA,gDAAgD"}

package/dist/framework-mcp/src/utils/auth.d.ts

@@ -0,0 +1,36 @@
+/**
+ * ─── MCP AUTHENTICATION ──────────────────────────────────────────
+ *
+ * Simple API key authentication for MCP server.
+ * When MCP_AUTH_TOKEN is set, all MCP and API requests require
+ * Authorization: Bearer <token> header.
+ *
+ * Environment Variables:
+ *   MCP_AUTH_TOKEN     - API key for authentication (optional)
+ *   MCP_AUTH_USERS     - Comma-separated list of user:token pairs (optional)
+ *                        Example: "alice:key1,bob:key2"
+ *
+ * If neither is set, authentication is disabled (open access).
+ */
+/**
+ * Initialize authentication from environment variables.
+ */
+export declare function initAuth(): void;
+/**
+ * Authenticate a request using the Authorization header.
+ * Returns the authenticated user name or null if unauthorized.
+ */
+export declare function authenticate(req: {
+    headers: Record<string, string | string[] | undefined>;
+}): {
+    authenticated: boolean;
+    user: string;
+};
+/**
+ * Generate authentication headers for MCP client configuration.
+ */
+export declare function getAuthHeader(user: string, token: string): string;
+/**
+ * Check if authentication is enabled.
+ */
+export declare function isAuthEnabled(): boolean;

package/dist/framework-mcp/src/utils/auth.js

@@ -0,0 +1,79 @@
+/**
+ * ─── MCP AUTHENTICATION ──────────────────────────────────────────
+ *
+ * Simple API key authentication for MCP server.
+ * When MCP_AUTH_TOKEN is set, all MCP and API requests require
+ * Authorization: Bearer <token> header.
+ *
+ * Environment Variables:
+ *   MCP_AUTH_TOKEN     - API key for authentication (optional)
+ *   MCP_AUTH_USERS     - Comma-separated list of user:token pairs (optional)
+ *                        Example: "alice:key1,bob:key2"
+ *
+ * If neither is set, authentication is disabled (open access).
+ */
+let authUsers = [];
+let masterToken = null;
+/**
+ * Initialize authentication from environment variables.
+ */
+export function initAuth() {
+    masterToken = process.env.MCP_AUTH_TOKEN || null;
+    const usersStr = process.env.MCP_AUTH_USERS || "";
+    if (usersStr) {
+        authUsers = usersStr.split(",").map(pair => {
+            const [name, token] = pair.split(":");
+            return { name: name?.trim() || "unknown", token: token?.trim() || "" };
+        }).filter(u => u.token);
+    }
+    if (masterToken) {
+        console.error(`[AUTH] Master token configured (${masterToken.length} chars)`);
+    }
+    if (authUsers.length > 0) {
+        console.error(`[AUTH] ${authUsers.length} user(s) configured: ${authUsers.map(u => u.name).join(", ")}`);
+    }
+    if (!masterToken && authUsers.length === 0) {
+        console.error("[AUTH] No authentication configured - OPEN ACCESS");
+        console.error("[AUTH] Set MCP_AUTH_TOKEN=<key> or MCP_AUTH_USERS=user1:key1,user2:key2 to enable");
+    }
+}
+/**
+ * Authenticate a request using the Authorization header.
+ * Returns the authenticated user name or null if unauthorized.
+ */
+export function authenticate(req) {
+    if (!masterToken && authUsers.length === 0) {
+        // Auth disabled - allow all
+        return { authenticated: true, user: "anonymous" };
+    }
+    const authHeader = req.headers["authorization"];
+    if (!authHeader) {
+        return { authenticated: false, user: "" };
+    }
+    // Support both "Bearer <key>" and "<key>" formats
+    const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : authHeader;
+    // Check master token first
+    if (masterToken && token === masterToken) {
+        return { authenticated: true, user: "admin" };
+    }
+    // Check user tokens
+    for (const user of authUsers) {
+        if (token === user.token) {
+            return { authenticated: true, user: user.name };
+        }
+    }
+    return { authenticated: false, user: "" };
+}
+/**
+ * Generate authentication headers for MCP client configuration.
+ */
+export function getAuthHeader(user, token) {
+    return `Bearer ${token}`;
+}
+/**
+ * Check if authentication is enabled.
+ */
+export function isAuthEnabled() {
+    return !!masterToken || authUsers.length > 0;
+}
+//# sourceMappingURL=auth.js.map

package/dist/framework-mcp/src/utils/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../framework-mcp/src/utils/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,IAAI,SAAS,GAAe,EAAE,CAAC;AAC/B,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC;;GAEG;AACH,MAAM,UAAU,QAAQ;IACpB,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACX,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACvC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3E,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,mCAAmC,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,MAAM,wBAAwB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAA+D;IACxF,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,4BAA4B;QAC5B,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAuB,CAAC;IACtE,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAElF,2BAA2B;IAC3B,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;IACL,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACrD,OAAO,UAAU,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IACzB,OAAO,CAAC,CAAC,WAAW,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;AACjD,CAAC"}

package/dist/framework-mcp/src/utils/auto-rollback.d.ts

@@ -0,0 +1,71 @@
+/**
+ * ─── AUTO-ROLLBACK + REGENERATE ───────────────────────────────────
+ *
+ * When the AI generates code that violates governance rules (e.g., `any` type,
+ * console.log, copyleft license), this module:
+ *   1. Captures the file content before the write
+ *   2. Validates the new content against governance rules
+ *   3. If violation found: blocks the write, restores original, and sends
+ *      a regenerate instruction back to the AI via MCP notification
+ *
+ * Flow:
+ *   [Pre-Write Snapshot] → [Validate Content] → [Violation?] ─yes→ [Rollback] → [Notify AI]
+ *                                                         └─no─→ [Allow Write]
+ *
+ * Key Innovation: Unlike simple blocking, this tells the AI WHY it was
+ * blocked and gives it specific instructions to self-correct.
+ */
+export interface ViolationRecord {
+    rule: string;
+    severity: "CRITICAL" | "HIGH" | "MEDIUM" | "LOW";
+    filePath: string;
+    line: number;
+    detail: string;
+    regenerateInstruction: string;
+}
+export declare class AutoRollback {
+    private static snapshots;
+    /**
+     * Initialize the auto-rollback system.
+     * Sets up file watcher cleanup.
+     */
+    static initialize(): void;
+    /**
+     * Prepare for a file write by capturing the current state.
+     * Call this BEFORE the tool handler writes to the file.
+     */
+    static prepareWrite(filePath: string, traceId: string): void;
+    /**
+     * Validate content and rollback if violations are found.
+     * This is called after the tool handler writes the file, but
+     * BEFORE the response is returned to the AI.
+     *
+     * Returns:
+     *   - null if content is clean
+     *   - ViolationRecord[] if violations were found and rolled back
+     */
+    static validateAndRollback(filePath: string, content: string, violations: ViolationRecord[]): ViolationRecord[] | null;
+    /**
+     * Build a regenerate instruction for the AI.
+     * This is what gets sent back to the AI to tell it to fix its output.
+     */
+    static buildRegenerateInstruction(violations: ViolationRecord[], toolName: string): string;
+    /**
+     * Validate tool response content against governance rules.
+     * Used by the MCP middleware to check file write content before returning.
+     */
+    static checkWriteContent(filePath: string, content: string, traceId: string): {
+        allowed: boolean;
+        violations: ViolationRecord[];
+        instruction: string | null;
+    };
+    /**
+     * Get snapshot stats.
+     */
+    static getSnapshotStats(): {
+        total: number;
+        restored: number;
+        pending: number;
+    };
+}
+export { AutoRollback as AutoRollbackEngine };

package/dist/framework-mcp/src/utils/auto-rollback.js

@@ -0,0 +1,266 @@
+/**
+ * ─── AUTO-ROLLBACK + REGENERATE ───────────────────────────────────
+ *
+ * When the AI generates code that violates governance rules (e.g., `any` type,
+ * console.log, copyleft license), this module:
+ *   1. Captures the file content before the write
+ *   2. Validates the new content against governance rules
+ *   3. If violation found: blocks the write, restores original, and sends
+ *      a regenerate instruction back to the AI via MCP notification
+ *
+ * Flow:
+ *   [Pre-Write Snapshot] → [Validate Content] → [Violation?] ─yes→ [Rollback] → [Notify AI]
+ *                                                         └─no─→ [Allow Write]
+ *
+ * Key Innovation: Unlike simple blocking, this tells the AI WHY it was
+ * blocked and gives it specific instructions to self-correct.
+ */
+import fs from "fs";
+import path from "path";
+class SnapshotManager {
+    snapshots = new Map();
+    /**
+     * Capture a pre-write snapshot of a file.
+     */
+    capture(filePath, traceId) {
+        const resolvedPath = path.resolve(filePath);
+        let originalContent = null;
+        try {
+            if (fs.existsSync(resolvedPath)) {
+                originalContent = fs.readFileSync(resolvedPath, "utf8");
+            }
+        }
+        catch { /* file doesn't exist yet (new file) */ }
+        this.snapshots.set(resolvedPath, {
+            filePath: resolvedPath,
+            originalContent,
+            timestamp: Date.now(),
+            traceId,
+            restored: false,
+        });
+    }
+    /**
+     * Get a snapshot for a file.
+     */
+    get(filePath) {
+        return this.snapshots.get(path.resolve(filePath));
+    }
+    /**
+     * Restore a file to its pre-write state.
+     * Returns true if restored, false if no snapshot exists.
+     */
+    restore(filePath) {
+        const resolvedPath = path.resolve(filePath);
+        const snapshot = this.snapshots.get(resolvedPath);
+        if (!snapshot || snapshot.restored)
+            return false;
+        try {
+            if (snapshot.originalContent !== null) {
+                // File existed before – restore original
+                fs.writeFileSync(resolvedPath, snapshot.originalContent, "utf8");
+                process.stderr.write(`[ROLLBACK] Restored: ${path.relative(process.cwd(), resolvedPath)}\n`);
+            }
+            else {
+                // File was new – delete it
+                if (fs.existsSync(resolvedPath)) {
+                    fs.unlinkSync(resolvedPath);
+                    process.stderr.write(`[ROLLBACK] Deleted (new file): ${path.relative(process.cwd(), resolvedPath)}\n`);
+                }
+            }
+            snapshot.restored = true;
+            return true;
+        }
+        catch (error) {
+            process.stderr.write(`[ROLLBACK] Failed to restore ${resolvedPath}: ${error}\n`);
+            return false;
+        }
+    }
+    /**
+     * Clean up old snapshots.
+     */
+    cleanup(maxAgeMs = 300000) {
+        const cutoff = Date.now() - maxAgeMs;
+        for (const [filePath, snapshot] of this.snapshots) {
+            if (snapshot.timestamp < cutoff) {
+                this.snapshots.delete(filePath);
+            }
+        }
+    }
+    /**
+     * Get all active snapshots.
+     */
+    getAll() {
+        return Array.from(this.snapshots.values());
+    }
+}
+// ─── Auto-Rollback Engine ─────────────────────────────────────────
+export class AutoRollback {
+    static snapshots = new SnapshotManager();
+    /**
+     * Initialize the auto-rollback system.
+     * Sets up file watcher cleanup.
+     */
+    static initialize() {
+        // Periodic cleanup of old snapshots (every 5 minutes)
+        setInterval(() => {
+            AutoRollback.snapshots.cleanup();
+        }, 300000);
+    }
+    /**
+     * Prepare for a file write by capturing the current state.
+     * Call this BEFORE the tool handler writes to the file.
+     */
+    static prepareWrite(filePath, traceId) {
+        AutoRollback.snapshots.capture(filePath, traceId);
+    }
+    /**
+     * Validate content and rollback if violations are found.
+     * This is called after the tool handler writes the file, but
+     * BEFORE the response is returned to the AI.
+     *
+     * Returns:
+     *   - null if content is clean
+     *   - ViolationRecord[] if violations were found and rolled back
+     */
+    static validateAndRollback(filePath, content, violations) {
+        if (violations.length === 0)
+            return null;
+        // Restore the original file
+        const restored = AutoRollback.snapshots.restore(filePath);
+        if (restored) {
+            process.stderr.write(`[ROLLBACK] Rolled back ${path.relative(process.cwd(), filePath)} due to ${violations.length} violation(s)\n`);
+        }
+        return violations;
+    }
+    /**
+     * Build a regenerate instruction for the AI.
+     * This is what gets sent back to the AI to tell it to fix its output.
+     */
+    static buildRegenerateInstruction(violations, toolName) {
+        const criticalViolations = violations.filter(v => v.severity === "CRITICAL");
+        const lines = [
+            "## ⛔ AI Output Blocked – Governance Violation",
+            "",
+            `The code you generated for tool "${toolName}" has been BLOCKED and ROLLED BACK.`,
+            "The file has been restored to its previous state.",
+            "",
+        ];
+        if (criticalViolations.length > 0) {
+            lines.push(`### 🔴 Critical Violations (${criticalViolations.length})`);
+            lines.push("");
+            for (const v of criticalViolations) {
+                lines.push(`- **${v.rule}** (${v.filePath}:${v.line})`);
+                lines.push(`  - Detail: ${v.detail}`);
+                lines.push(`  - Fix: ${v.regenerateInstruction}`);
+                lines.push("");
+            }
+        }
+        const otherViolations = violations.filter(v => v.severity !== "CRITICAL");
+        if (otherViolations.length > 0) {
+            lines.push(`### 🟠 Other Violations (${otherViolations.length})`);
+            lines.push("");
+            for (const v of otherViolations) {
+                lines.push(`- **${v.rule}** (${v.filePath}:${v.line})`);
+                lines.push(`  - Detail: ${v.detail}`);
+                lines.push(`  - Fix: ${v.regenerateInstruction}`);
+                lines.push("");
+            }
+        }
+        lines.push("---");
+        lines.push("> **Instruction:** Please regenerate the code for this operation.");
+        lines.push("> Address ALL violations listed above.");
+        lines.push("> Do NOT reintroduce the same violations.");
+        return lines.join("\n");
+    }
+    /**
+     * Validate tool response content against governance rules.
+     * Used by the MCP middleware to check file write content before returning.
+     */
+    static checkWriteContent(filePath, content, traceId) {
+        const ext = path.extname(filePath).toLowerCase();
+        const violations = [];
+        // Only check source files
+        if (![".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".java", ".rs", ".swift", ".kt"].includes(ext)) {
+            return { allowed: true, violations: [], instruction: null };
+        }
+        const lines = content.split("\n");
+        // 1. Check for `any` type (CRITICAL)
+        if ([".ts", ".tsx"].includes(ext)) {
+            for (let i = 0; i < lines.length; i++) {
+                const anyMatch = lines[i].match(/:\s*any\b/);
+                if (anyMatch) {
+                    violations.push({
+                        rule: "No `any` Type",
+                        severity: "CRITICAL",
+                        filePath,
+                        line: i + 1,
+                        detail: `Line ${i + 1}: ${anyMatch[0].substring(0, 60)}`,
+                        regenerateInstruction: "Replace `any` with `unknown` and add proper type guards. Or use a specific interface/type.",
+                    });
+                }
+            }
+        }
+        // 2. Check for console.log (CRITICAL)
+        for (let i = 0; i < lines.length; i++) {
+            const consoleMatch = lines[i].match(/console\.(log|error|warn|debug)\s*\(/);
+            if (consoleMatch) {
+                // Check if file is exempt
+                if (!filePath.includes("logger.ts") && !filePath.includes("cli.ts") && !filePath.includes("compliance.ts")) {
+                    violations.push({
+                        rule: "No Console Log",
+                        severity: "CRITICAL",
+                        filePath,
+                        line: i + 1,
+                        detail: `Line ${i + 1}: ${consoleMatch[0].substring(0, 60)}`,
+                        regenerateInstruction: "Replace with the project's logger (import from the appropriate logger module).",
+                    });
+                }
+            }
+        }
+        // 3. Check for hardcoded secrets (HIGH)
+        const secretPatterns = [
+            { pattern: /(['"])sk-[a-zA-Z0-9]{20,}['"]/, name: "OpenAI API Key" },
+            { pattern: /(['"])ghp_[a-zA-Z0-9]{36,}['"]/, name: "GitHub Token" },
+            { pattern: /(['"])AIza[0-9A-Za-z_-]{35}['"]/, name: "Google API Key" },
+        ];
+        for (let i = 0; i < lines.length; i++) {
+            for (const { pattern, name } of secretPatterns) {
+                if (pattern.test(lines[i])) {
+                    violations.push({
+                        rule: `Hardcoded Secret: ${name}`,
+                        severity: "HIGH",
+                        filePath,
+                        line: i + 1,
+                        detail: `Potential ${name} hardcoded at line ${i + 1}`,
+                        regenerateInstruction: `Use environment variables (process.env.*) instead of hardcoding ${name}.`,
+                    });
+                }
+            }
+        }
+        // If violations found, prepare snapshot and rollback
+        if (violations.length > 0) {
+            AutoRollback.prepareWrite(filePath, traceId);
+            const rolledBack = AutoRollback.validateAndRollback(filePath, content, violations);
+            const instruction = AutoRollback.buildRegenerateInstruction(violations, "write_file");
+            return {
+                allowed: false,
+                violations: rolledBack || violations,
+                instruction,
+            };
+        }
+        return { allowed: true, violations: [], instruction: null };
+    }
+    /**
+     * Get snapshot stats.
+     */
+    static getSnapshotStats() {
+        const all = AutoRollback.snapshots.getAll();
+        return {
+            total: all.length,
+            restored: all.filter(s => s.restored).length,
+            pending: all.filter(s => !s.restored).length,
+        };
+    }
+}
+export { AutoRollback as AutoRollbackEngine };
+//# sourceMappingURL=auto-rollback.js.map

package/dist/framework-mcp/src/utils/auto-rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-rollback.js","sourceRoot":"","sources":["../../../../framework-mcp/src/utils/auto-rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,eAAe;IACT,SAAS,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEzD;;OAEG;IACI,OAAO,CAAC,QAAgB,EAAE,OAAe;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,eAAe,GAAkB,IAAI,CAAC;QAE1C,IAAI,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9B,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC5D,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;QAEnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,YAAY;YACtB,eAAe;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,OAAO;YACP,QAAQ,EAAE,KAAK;SAClB,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACI,GAAG,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACI,OAAO,CAAC,QAAgB;QAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAElD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEjD,IAAI,CAAC;YACD,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;gBACpC,yCAAyC;gBACzC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YACjG,CAAC;iBAAM,CAAC;gBACJ,2BAA2B;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9B,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC3G,CAAC;YACL,CAAC;YAED,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC;YACzB,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,YAAY,KAAK,KAAK,IAAI,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,WAAmB,MAAM;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;QACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChD,IAAI,QAAQ,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;QACL,CAAC;IACL,CAAC;IAED;;OAEG;IACI,MAAM;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;CACJ;AAaD,qEAAqE;AAErE,MAAM,OAAO,YAAY;IACb,MAAM,CAAC,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IAEjD;;;OAGG;IACI,MAAM,CAAC,UAAU;QACpB,sDAAsD;QACtD,WAAW,CAAC,GAAG,EAAE;YACb,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC,EAAE,MAAM,CAAC,CAAC;IACf,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,YAAY,CAAC,QAAgB,EAAE,OAAe;QACxD,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,mBAAmB,CAC7B,QAAgB,EAChB,OAAe,EACf,UAA6B;QAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,WAAW,UAAU,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACxI,CAAC;QAED,OAAO,UAAU,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,0BAA0B,CACpC,UAA6B,EAC7B,QAAgB;QAEhB,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;QAE7E,MAAM,KAAK,GAAa;YACpB,+CAA+C;YAC/C,EAAE;YACF,oCAAoC,QAAQ,qCAAqC;YACjF,mDAAmD;YACnD,EAAE;SACL,CAAC;QAEF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,+BAA+B,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;QAC1E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,4BAA4B,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAExD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,iBAAiB,CAC3B,QAAgB,EAChB,OAAe,EACf,OAAe;QAEf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,0BAA0B;QAC1B,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,qCAAqC;QACrC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC7C,IAAI,QAAQ,EAAE,CAAC;oBACX,UAAU,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,eAAe;wBACrB,QAAQ,EAAE,UAAU;wBACpB,QAAQ;wBACR,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;wBACxD,qBAAqB,EAAE,4FAA4F;qBACtH,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC5E,IAAI,YAAY,EAAE,CAAC;gBACf,0BAA0B;gBAC1B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBACzG,UAAU,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,UAAU;wBACpB,QAAQ;wBACR,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;wBAC5D,qBAAqB,EAAE,gFAAgF;qBAC1G,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,MAAM,cAAc,GAAG;YACnB,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,gBAAgB,EAAE;YACpE,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,cAAc,EAAE;YACnE,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACzE,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,cAAc,EAAE,CAAC;gBAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzB,UAAU,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,qBAAqB,IAAI,EAAE;wBACjC,QAAQ,EAAE,MAAM;wBAChB,QAAQ;wBACR,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,MAAM,EAAE,aAAa,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE;wBACtD,qBAAqB,EAAE,mEAAmE,IAAI,GAAG;qBACpG,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QAED,qDAAqD;QACrD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,UAAU,GAAG,YAAY,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACnF,MAAM,WAAW,GAAG,YAAY,CAAC,0BAA0B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAEtF,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,UAAU,IAAI,UAAU;gBACpC,WAAW;aACd,CAAC;QACN,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,gBAAgB;QAK1B,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO;YACH,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM;YAC5C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM;SAC/C,CAAC;IACN,CAAC;;AAGL,OAAO,EAAE,YAAY,IAAI,kBAAkB,EAAE,CAAC"}

package/dist/framework-mcp/src/utils/compliance.js

@@ -53,7 +53,14 @@ export function verifyCorporateCompliance(content, filePath) {
                 }
                 // 5. Secure CLI Policy (No direct child_process)
                 if (moduleSpecifier.text === "child_process") {
-                    errors.push(`[ERROR] Corporate Compliance Breach: Direct 'child_process' usage is forbidden at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Use secure framework APIs.`);
+                    const isExempt = filePath.includes("src/cli/commands/") ||
+                        filePath.includes("shared/fs.ts") ||
+                        filePath.includes("shared/lock.ts") ||
+                        filePath.includes("quality-gate.ts") ||
+                        filePath.includes("providers/shared.ts");
+                    if (!isExempt) {
+                        errors.push(`[ERROR] Corporate Compliance Breach: Direct 'child_process' usage is forbidden at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Use secure framework APIs.`);
+                    }
                 }
             }
         }
@@ -75,10 +82,11 @@ export function verifyCorporateCompliance(content, filePath) {
             const prop = node.expression;
             if (ts.isIdentifier(prop.expression) && prop.expression.text === "fs") {
                 if (["writeFileSync", "appendFileSync"].includes(prop.name.text)) {
-                    // Lock files are exempt
+                    // Lock files, core atomic fs wrapper, and mcp configs are exempt
                     const args = node.arguments;
                     const firstArgText = args.length > 0 ? args[0].getText(sourceFile).toLowerCase() : "";
-                    if (!firstArgText.includes("lock")) {
+                    const isExemptFile = filePath.includes("shared/fs.ts") || filePath.includes("src/cli/commands/mcp.ts");
+                    if (!firstArgText.includes("lock") && !isExemptFile) {
                         errors.push(`[ERROR] Corporate Compliance Breach: Raw 'fs.${prop.name.text}' mutation detected at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Use atomic utilities instead.`);
                     }
                 }
@@ -118,7 +126,7 @@ export function scanProjectCompliance(targetDir = "src") {
     const files = getAllFiles(targetDir);
     for (const file of files) {
         // Skip exempt files
-        if (file.includes("compliance") || file.includes("definitions") || file.includes("logger") || file.includes("cli/index.ts"))
+        if (file.includes("compliance") || file.includes("definitions") || file.includes("logger") || file.includes("cli/index.ts") || file.includes("shared/fs.ts") || file.includes("shared/lock.ts"))
             continue;
         const content = fs.readFileSync(file, "utf8");
         try {