atabey 0.0.13 → 0.0.15

package/framework-mcp/dist/framework-mcp/src/utils/quality.js

@@ -0,0 +1,124 @@
+import fs from "fs";
+import path from "path";
+/**
+ * Shared Code Quality Heuristic Scanner
+ * Evaluates functions lengths, nesting depth, and usage of the forbidden 'any' type.
+ */
+export function analyzePathQuality(projectRoot, targetPath) {
+    const absolutePath = path.resolve(projectRoot, targetPath);
+    const files = [];
+    function collectFilesSync(dir, exts) {
+        if (!fs.existsSync(dir))
+            return;
+        try {
+            const stat = fs.statSync(dir);
+            if (stat.isFile()) {
+                if (exts.some(ext => dir.endsWith(ext))) {
+                    files.push(dir);
+                }
+                return;
+            }
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                if (entry.isDirectory() && !entry.name.startsWith("node_modules") && !entry.name.startsWith(".")) {
+                    collectFilesSync(fullPath, exts);
+                }
+                else if (entry.isFile() && exts.some(ext => entry.name.endsWith(ext))) {
+                    files.push(fullPath);
+                }
+            }
+        }
+        catch {
+            // Ignore errors reading files/dirs
+        }
+    }
+    collectFilesSync(absolutePath, [".ts", ".tsx"]);
+    const issues = [];
+    let longFunctions = 0;
+    let deepNesting = 0;
+    let anyTypes = 0;
+    files.forEach((f) => {
+        try {
+            const content = fs.readFileSync(f, "utf8");
+            const lines = content.split("\n");
+            const relativePath = path.relative(projectRoot, f);
+            // Check for `any` type
+            lines.forEach((line, idx) => {
+                if (line.trim().startsWith("//") || line.trim().startsWith("/*"))
+                    return;
+                if (line.match(/\bany\b/) && !line.includes("// eslint-disable") && !line.includes("as any")) {
+                    anyTypes++;
+                    issues.push({
+                        file: relativePath,
+                        line: idx + 1,
+                        type: "any-type",
+                        message: `Line ${idx + 1}: Usage of 'any' type`
+                    });
+                }
+            });
+            // Check for long functions
+            let inFunction = false;
+            let funcLines = 0;
+            let startLine = 0;
+            let funcName = "anonymous";
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                // Detect function/method starts using regex
+                const funcMatch = line.match(/(?:public|private|protected|static\s+)?(?:async\s+)?(?:function\s+)?(\w+)\s*\([^)]*\)\s*{/);
+                const methodMatch = !funcMatch ? line.match(/^\s*(?:public|private|protected|static\s+)?(\w+)\s*\([^)]*\)\s*{/) : null;
+                const arrowMatch = !funcMatch && !methodMatch ? line.match(/(?:const|let|var)?\s*(\w+)?\s*=\s*(?:async\s*)?\([^)]*\)\s*=>\s*{/) : null;
+                if (funcMatch || methodMatch || arrowMatch) {
+                    inFunction = true;
+                    funcLines = 1;
+                    startLine = i + 1;
+                    funcName = (funcMatch?.[1] || methodMatch?.[1] || arrowMatch?.[1] || "anonymous").trim();
+                    continue;
+                }
+                if (inFunction) {
+                    funcLines++;
+                    if (line.includes("}")) {
+                        if (funcLines > 50) {
+                            longFunctions++;
+                            issues.push({
+                                file: relativePath,
+                                line: startLine,
+                                type: "complexity",
+                                message: `Function '${funcName}' is ${funcLines} lines long (max: 50)`
+                            });
+                        }
+                        inFunction = false;
+                    }
+                }
+            }
+            // Check nesting depth
+            lines.forEach((line, idx) => {
+                const leadingSpaces = line.match(/^(\s*)/)?.[0].length || 0;
+                if (leadingSpaces >= 10 && !line.trim().startsWith("//") && !line.trim().startsWith("*")) {
+                    const indentSize = (leadingSpaces % 4 === 0) ? 4 : 2;
+                    const depth = Math.floor(leadingSpaces / indentSize);
+                    if (depth > 4) {
+                        deepNesting++;
+                        issues.push({
+                            file: relativePath,
+                            line: idx + 1,
+                            type: "complexity",
+                            message: `Line ${idx + 1}: Nesting depth ${depth}`
+                        });
+                    }
+                }
+            });
+        }
+        catch {
+            // Ignore files that can't be read
+        }
+    });
+    return {
+        totalFiles: files.length,
+        totalIssues: issues.length,
+        longFunctions,
+        deepNesting,
+        anyTypes,
+        issues
+    };
+}

package/framework-mcp/dist/framework-mcp/src/utils/rules-engine.js

@@ -0,0 +1,231 @@
+/**
+ * ─── RULES ENGINE (Prompt Conflict Resolution) ────────────────────
+ *
+ * Resolves conflicts between AI CLI built-in prompts and Atabey governance rules.
+ * Ensures Atabey's critical rules ALWAYS override CLI-level instructions.
+ *
+ * Priority System:
+ * - CRITICAL (P0): Non-bypassable rules (zero any, no console.log, PII masking)
+ * - HIGH (P1): Important rules that should not be violated
+ * - MEDIUM (P2): Standard best practices
+ * - LOW (P3): Recommendations only
+ *
+ * Enforcement Mechanisms:
+ * 1. Pre-execution: Rule validation BEFORE tool runs
+ * 2. Post-execution: Scan changed files for violations → auto-rollback
+ * 3. CLI System Prompt Override: Inject critical rules at MCP initialization
+ */
+import path from "path";
+// ─── Built-in Governance Rules ────────────────────────────────────
+const GOVERNANCE_RULES = [
+    // ── CRITICAL (P0) Rules ────────────────────────────────────
+    {
+        id: "no-any-types",
+        name: "Zero Any Type Policy",
+        description: "TypeScript 'any' type is strictly forbidden",
+        priority: "CRITICAL",
+        detectPattern: /:\s*any\b/g,
+        appliesToExtensions: [".ts", ".tsx"],
+        errorMessage: "CRITICAL: 'any' type is forbidden. Use 'unknown' with proper type guards instead.",
+        bypassable: false,
+    },
+    {
+        id: "no-console-log",
+        name: "No Console Log",
+        description: "console.log/error/warn is forbidden (use logger instead)",
+        priority: "CRITICAL",
+        detectPattern: /console\.(log|error|warn|debug|info)\s*\(/g,
+        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx"],
+        errorMessage: "CRITICAL: console.log/error/warn is forbidden. Use the project's logger instead.",
+        bypassable: false,
+    },
+    {
+        id: "pii-masking",
+        name: "PII Masking Required",
+        description: "Sensitive data must be masked before logging or storing",
+        priority: "CRITICAL",
+        errorMessage: "CRITICAL: Detected potential PII in unmasked form. Use maskText() / maskObject() from pii.ts.",
+        bypassable: false,
+    },
+    // ── HIGH (P1) Rules ────────────────────────────────────────
+    {
+        id: "no-hardcoded-secrets",
+        name: "No Hardcoded Secrets",
+        description: "API keys, tokens, passwords must use environment variables",
+        priority: "HIGH",
+        detectPattern: /(['"])sk-[a-zA-Z0-9]{20,}['"]|(['"])ghp_[a-zA-Z0-9]{36,}['"]|(['"])AIza[0-9A-Za-z_-]{35}['"]/g,
+        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".java", ".yaml", ".yml", ".env.example"],
+        errorMessage: "HIGH: Hardcoded API keys/tokens detected. Use environment variables (process.env.*).",
+        bypassable: false,
+    },
+    {
+        id: "no-commented-code",
+        name: "No Commented-Out Code",
+        description: "Dead code should be removed, not commented out",
+        priority: "HIGH",
+        detectPattern: /\/\/\s*.{10,}/g,
+        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx"],
+        errorMessage: "HIGH: Commented-out code detected. Remove dead code instead of commenting.",
+        bypassable: true,
+    },
+    // ── MEDIUM (P2) Rules ──────────────────────────────────────
+    {
+        id: "no-console-in-jsx",
+        name: "No Console in JSX",
+        description: "Avoid console statements inside JSX/TSX components",
+        priority: "MEDIUM",
+        detectPattern: /{.*console\.(log|error|warn)\(.*}/g,
+        appliesToExtensions: [".tsx", ".jsx"],
+        errorMessage: "MEDIUM: Console statement inside JSX detected. Move to event handler or useEffect.",
+        bypassable: true,
+    },
+    {
+        id: "i18n-usage",
+        name: "Internationalization Required",
+        description: "Use i18n for user-facing strings",
+        priority: "MEDIUM",
+        detectPattern: /(['"])([A-Z][a-z]+ [a-z]+ [a-z]+)['"]/g,
+        appliesToExtensions: [".tsx", ".jsx"],
+        errorMessage: "MEDIUM: User-facing string detected. Use i18n translation function instead.",
+        bypassable: true,
+    },
+];
+// ─── Rule Engine ──────────────────────────────────────────────────
+let rulesMap = null;
+function getRulesMap() {
+    if (!rulesMap) {
+        rulesMap = new Map();
+        for (const rule of GOVERNANCE_RULES) {
+            rulesMap.set(rule.id, rule);
+        }
+    }
+    return rulesMap;
+}
+/**
+ * Get all governance rules.
+ */
+export function getAllRules() {
+    return [...GOVERNANCE_RULES];
+}
+/**
+ * Get rules by priority level.
+ */
+export function getRulesByPriority(priority) {
+    return GOVERNANCE_RULES.filter(r => r.priority === priority);
+}
+/**
+ * Get non-bypassable rules (CRITICAL + HIGH non-bypassable).
+ */
+export function getNonBypassableRules() {
+    return GOVERNANCE_RULES.filter(r => !r.bypassable);
+}
+/**
+ * Scan file content for rule violations.
+ * Returns array of violations found.
+ */
+export function scanFileForViolations(filePath, content) {
+    const ext = path.extname(filePath);
+    const violations = [];
+    const lines = content.split("\n");
+    for (const rule of GOVERNANCE_RULES) {
+        // Check if rule applies to this file extension
+        if (rule.appliesToExtensions && !rule.appliesToExtensions.includes(ext)) {
+            continue;
+        }
+        // Check if rule has a detect pattern
+        if (!rule.detectPattern)
+            continue;
+        // Scan each line
+        for (let i = 0; i < lines.length; i++) {
+            const match = lines[i].match(rule.detectPattern);
+            if (match) {
+                violations.push({
+                    rule,
+                    match: match[0],
+                    line: i + 1,
+                });
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * Validate tool arguments against governance rules.
+ * Returns violation messages if any critical rule is violated.
+ */
+export function validateArgsAgainstRules(toolName, args) {
+    const nonBypassable = getNonBypassableRules();
+    for (const rule of nonBypassable) {
+        // Check if rule applies to this tool
+        if (rule.appliesToTools && !rule.appliesToTools.includes(toolName)) {
+            continue;
+        }
+        // For write_file and replace_text, check content for violations
+        if ((toolName === "write_file" || toolName === "replace_text") && args.content) {
+            const content = args.content;
+            const filePath = args.path || "unknown.ts";
+            const violations = scanFileForViolations(filePath, content);
+            if (violations.length > 0) {
+                const details = violations.map(v => `  Line ${v.line}: ${v.match} (${v.rule.name} - ${v.rule.priority})`).join("\n");
+                return [
+                    `[GOVERNANCE] ${rule.priority} rule violation: ${rule.name}`,
+                    `${rule.errorMessage}`,
+                    "\nViolations:",
+                    details,
+                ].join("\n");
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Validate tool response for governance violations.
+ * Returns violation messages if found.
+ */
+export function validateResponseAgainstRules(toolName, responseText) {
+    // For file reads, check if the content contains PII or secrets
+    if (toolName === "read_file" && responseText.length > 0) {
+        const criticalRules = getNonBypassableRules();
+        for (const rule of criticalRules) {
+            if (rule.detectPattern && rule.detectPattern.test(responseText)) {
+                return `[GOVERNANCE] ${rule.priority} violation detected in response: ${rule.name}. ${rule.errorMessage}`;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Build system prompt override block for CLI initialization.
+ * This is injected into the AI's system prompt at MCP connect time.
+ */
+export function buildSystemPromptOverride() {
+    const criticalRules = getRulesByPriority("CRITICAL");
+    const highRules = getRulesByPriority("HIGH");
+    return [
+        "## [ATABEY GOVERNANCE] Critical Rules — DO NOT OVERRIDE",
+        "",
+        "The following rules are ENFORCED by the Atabey Governance Layer.",
+        "They CANNOT be bypassed or disabled.",
+        "",
+        "### Critical Rules (Non-Bypassable)",
+        ...criticalRules.map(r => `- 🔴 ${r.name}: ${r.description}`),
+        "",
+        "### High Priority Rules",
+        ...highRules.map(r => `- 🟠 ${r.name}: ${r.description}`),
+        "",
+        "> These rules are injected at the MCP middleware layer and enforced",
+        "> at both pre-execution and post-execution stages.",
+        "",
+    ].join("\n");
+}
+/**
+ * Add a custom governance rule at runtime.
+ */
+export function addRule(rule) {
+    const map = getRulesMap();
+    if (!map.has(rule.id)) {
+        GOVERNANCE_RULES.push(rule);
+        map.set(rule.id, rule);
+    }
+}
+export { GOVERNANCE_RULES as DefaultGovernanceRules };

package/framework-mcp/dist/framework-mcp/src/utils/silent-router.js

@@ -0,0 +1,154 @@
+/**
+ * ─── SILENT ROUTER ─────────────────────────────────────────────────
+ *
+ * Automatically routes tool calls to the most appropriate agent
+ * WITHOUT requiring the developer to type `@agent` commands.
+ *
+ * The magic: developer types "Make this API secure" and Atabey
+ * silently activates @security agent rules behind the scenes.
+ *
+ * Features:
+ * - Auto-agent detection from tool call context
+ * - Silent system prompt injection with specialty memory
+ * - Multi-agent chain support
+ * - Stealth notifications (stderr/dashboard only, never chat)
+ */
+import { EvaluationEngine } from "../../../src/modules/engines/evaluation-engine.js";
+import { RoutingEngine } from "../../../src/modules/engines/routing-engine.js";
+// ─── Configuration ────────────────────────────────────────────────
+const CONFIG = {
+    /** Enable silent routing (default: true) */
+    ENABLED: process.env.MCP_SILENT_ROUTING !== "false",
+    /** Enable stealth notifications to stderr */
+    STEALTH_NOTIFY: process.env.MCP_SILENT_STEALTH !== "false",
+    /** Agent override via env (for testing/debugging) */
+    FORCE_AGENT: process.env.MCP_FORCE_AGENT || null,
+    /** Enable specialty memory injection into context */
+    INJECT_SPECIALTY_MEMORY: process.env.MCP_INJECT_SPECIALTY_MEMORY !== "false",
+};
+let agentRuleCache = null;
+async function loadAgentRules() {
+    if (agentRuleCache)
+        return agentRuleCache;
+    try {
+        const { ALL_AGENTS } = await import("../../../src/modules/agents/definitions.js");
+        agentRuleCache = new Map();
+        for (const agent of ALL_AGENTS) {
+            agentRuleCache.set(agent.name, {
+                name: agent.name,
+                identity: agent.instructions.identity,
+                mission: agent.instructions.mission,
+                rules: agent.instructions.rules,
+            });
+        }
+    }
+    catch {
+        agentRuleCache = new Map();
+    }
+    return agentRuleCache;
+}
+/**
+ * Detect the most appropriate agent for a given tool call and arguments.
+ * Uses RoutingEngine's TF-IDF matching on the args context.
+ */
+export function detectAgent(toolName, args) {
+    if (CONFIG.FORCE_AGENT)
+        return CONFIG.FORCE_AGENT;
+    const contextParts = [toolName];
+    for (const [, value] of Object.entries(args)) {
+        if (typeof value === "string") {
+            contextParts.push(value);
+        }
+        else if (Array.isArray(value)) {
+            contextParts.push(value.filter(v => typeof v === "string").join(" "));
+        }
+    }
+    const context = contextParts.join(" ").substring(0, 500);
+    return RoutingEngine.resolveAgent(context);
+}
+/**
+ * Get the system prompt rules for a given agent.
+ * Used to inject discipline silently into tool context.
+ */
+export async function getAgentPrompt(agentName) {
+    const rules = await loadAgentRules();
+    const agent = rules.get(agentName.replace("@", ""));
+    if (!agent)
+        return null;
+    return [
+        `## [ATABEY SILENT] ${agent.name} (${agent.identity})`,
+        "",
+        "### Mission",
+        `${agent.mission}`,
+        "",
+        "### Active Disciplines",
+        ...agent.rules.map(r => `- ${r}`),
+        "",
+        "> These rules are injected by Atabey governance layer.",
+        "> They supplement (not replace) your existing instructions.",
+    ].join("\n");
+}
+/**
+ * Load specialty memory for an agent and format it for injection.
+ */
+function getSpecialtyMemoryContext(agentName) {
+    if (!CONFIG.INJECT_SPECIALTY_MEMORY)
+        return null;
+    try {
+        const conventions = EvaluationEngine.readLearnedConventions(agentName);
+        if (!conventions)
+            return null;
+        return [
+            "",
+            "### Previously Learned Conventions",
+            `The following lessons were learned from past tasks for @${agentName}:`,
+            "",
+            conventions,
+            "",
+        ].join("\n");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build a silent context injection payload.
+ * Injects agent rules + specialty memory into tool responses.
+ */
+export async function buildSilentContext(detectedAgent, toolName, responseText) {
+    if (!CONFIG.ENABLED)
+        return responseText;
+    const agentPrompt = await getAgentPrompt(detectedAgent);
+    if (!agentPrompt)
+        return responseText;
+    if (responseText.length < 50)
+        return responseText;
+    // Inject specialty memory if available
+    const specialtyContext = getSpecialtyMemoryContext(detectedAgent);
+    const fullPrompt = specialtyContext
+        ? `${agentPrompt}\n${specialtyContext}`
+        : agentPrompt;
+    const injection = [
+        "",
+        `<!-- ATABEY_GOVERNANCE agent="${detectedAgent}" tool="${toolName}" -->`,
+        `${fullPrompt}`,
+        "<!-- /ATABEY_GOVERNANCE -->",
+        "",
+    ].join("\n");
+    return injection + responseText;
+}
+/**
+ * Send a stealth notification to stderr (never to the chat).
+ */
+export function stealthNotify(agent, toolName, message) {
+    if (!CONFIG.STEALTH_NOTIFY)
+        return;
+    process.stderr.write(`[ATABEY:${agent}] ${message} (tool: ${toolName})\n`);
+}
+/**
+ * Get silent router config.
+ */
+export function getSilentRouterConfig() {
+    return { ...CONFIG };
+}
+export { CONFIG as SilentRouterConfig };

package/framework-mcp/dist/framework-mcp/src/utils/storage.js

@@ -149,7 +149,6 @@ export class Storage {
             let deps = [];
             try {
                 const parsed = JSON.parse(r.dependencies || "[]");
-                // Handle cases where dependencies might be double-stringified or are raw JSON strings
                 deps = Array.isArray(parsed) ? parsed : JSON.parse(parsed);
             }
             catch {
@@ -162,7 +161,8 @@ export class Storage {
                 agent: r.agent,
                 status: r.status,
                 priority: r.priority,
-                dependencies: deps
+                dependencies: deps,
+                createdAt: r.created_at
             };
         });
     }