atabey 0.0.14 → 0.0.16

package/framework-mcp/dist/framework-mcp/src/utils/human-in-loop.js

@@ -31,7 +31,49 @@ const CONFIG = {
     AUTO_APPROVE_LOW_RISK: process.env.MCP_AUTO_APPROVE_LOW_RISK !== "false",
     /** Approval timeout in seconds */
     APPROVAL_TIMEOUT_SECONDS: parseInt(process.env.MCP_APPROVAL_TIMEOUT || "300", 10), // 5 min
+    /**
+     * Minimum risk score requiring Lead/Admin approval (legacy compat).
+     * Superseded by ROLE_RISK_MAP below — kept for backward compatibility with env var.
+     */
+    RBAC_HIGH_RISK_THRESHOLD: parseInt(process.env.MCP_RBAC_HIGH_RISK_THRESHOLD || "80", 10),
 };
+/**
+ * Maximum risk score each role is allowed to approve.
+ * A role can approve any operation with riskScore <= its max.
+ * Override via MCP_RBAC_ROLE_* env vars.
+ *
+ *   junior    → cannot approve anything (max = -1)
+ *   developer → can approve MEDIUM risk (0–59)
+ *   lead      → can approve HIGH risk (0–79)
+ *   admin     → can approve any risk (0–100)
+ */
+export const ROLE_RISK_MAP = {
+    admin: parseInt(process.env.MCP_RBAC_ROLE_ADMIN || "100", 10),
+    lead: parseInt(process.env.MCP_RBAC_ROLE_LEAD || "79", 10),
+    developer: parseInt(process.env.MCP_RBAC_ROLE_DEVELOPER || "59", 10),
+    junior: parseInt(process.env.MCP_RBAC_ROLE_JUNIOR || "-1", 10), // cannot approve
+};
+/**
+ * Returns the minimum role required to approve an operation at the given risk score.
+ */
+export function getMinimumRoleForScore(riskScore) {
+    if (riskScore <= ROLE_RISK_MAP.developer)
+        return "developer";
+    if (riskScore <= ROLE_RISK_MAP.lead)
+        return "lead";
+    return "admin";
+}
+/**
+ * Reads the active user role from environment only.
+ * AI-supplied userRole arguments are NOT trusted.
+ */
+function getActiveUserRole() {
+    const envRole = process.env.MCP_USER_ROLE?.trim().toLowerCase();
+    if (envRole === "admin" || envRole === "lead" || envRole === "developer" || envRole === "junior") {
+        return envRole;
+    }
+    return "junior"; // safest default
+}
 // ─── Active Approval Requests ─────────────────────────────────────
 const activeApprovals = new Map();
 /**
@@ -44,12 +86,25 @@ export function getRiskLevel(score) {
         return "MEDIUM";
     return "LOW";
 }
+/**
+ * Create an approval request for a high-risk operation.
+ * Returns the approval request and a message for the AI/developer.
+ */
+function generatePasscode() {
+    const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+    let code = "";
+    for (let i = 0; i < 5; i++) {
+        code += chars.charAt(Math.floor(Math.random() * chars.length));
+    }
+    return code;
+}
 /**
  * Create an approval request for a high-risk operation.
  * Returns the approval request and a message for the AI/developer.
  */
 export function createApprovalRequest(traceId, toolName, agent, riskScore, reason, args) {
     const now = Date.now();
+    const passcode = generatePasscode();
     const request = {
         traceId,
         toolName,
@@ -61,8 +116,11 @@ export function createApprovalRequest(traceId, toolName, agent, riskScore, reaso
         createdAt: now,
         expiresAt: now + CONFIG.APPROVAL_TIMEOUT_SECONDS * 1000,
         status: "PENDING",
+        passcode,
     };
     activeApprovals.set(traceId, request);
+    // Print passcode to stderr so the human developer sees it but AI cannot access it
+    process.stderr.write(`\n[ATABEY SECURITY GATES] APPROVAL PASSCODE FOR TRACE ${traceId}: ${passcode}\n\n`);
     // Create a Hermes approval message
     AtabeyStorage.saveMessage({
         from: asAgentID(agent),
@@ -92,14 +150,14 @@ export function createApprovalRequest(traceId, toolName, agent, riskScore, reaso
         `  Trace ID:   ${traceId}`,
         "",
         "─── IN-CHAT APPROVAL ────────────────────────────────────────",
-        "Ask your AI assistant to call the approve_operation tool:",
+        "This is a high-risk operation. To prevent autonomous bypass,",
+        "Atabey has printed a 5-character PASSCODE to your terminal's stderr.",
         "",
-        `  To approve: approve_operation { "action": "approve", "traceId": "${traceId}" }`,
-        `  To reject:  approve_operation { "action": "reject",  "traceId": "${traceId}" }`,
-        "  To list:    approve_operation { \"action\": \"list\" }",
+        "Ask the user for the passcode, then call the approve_operation tool:",
+        `  approve_operation { "action": "approve", "traceId": "${traceId}", "passcode": "<passcode_from_user>" }`,
         "─────────────────────────────────────────────────────────────",
         "",
-        `Alternative: atabey hitl answer "${traceId}:approve" in your terminal.`,
+        `Alternative: Run 'atabey approve ${traceId}' in your local terminal.`,
     ].join("\n");
     return { request, message };
 }
@@ -147,8 +205,16 @@ export function getApprovalStatus(traceId) {
 }
 /**
  * Approve a pending operation.
+ *
+ * RBAC enforcement (AI Governance layer):
+ * - Role is read from process.env.MCP_USER_ROLE ONLY.
+ * - The userRole parameter is accepted for API compatibility but completely IGNORED.
+ *   This prevents AI agents (Claude Code, Gemini, Cursor) from escalating privilege
+ *   by passing {userRole: "admin"} in the tool call arguments.
+ * - The passcode printed to stderr is the second factor — AI cannot read stderr.
  */
-export function approveOperation(traceId) {
+export function approveOperation(traceId, passcode, _userRoleIgnored // kept for API compat — value is intentionally ignored
+) {
     const request = activeApprovals.get(traceId);
     if (!request) {
         return { success: false, message: `No pending approval found for trace: ${traceId}` };
@@ -156,6 +222,29 @@ export function approveOperation(traceId) {
     if (request.status !== "PENDING") {
         return { success: false, message: `Approval for ${traceId} is already ${request.status}` };
     }
+    // ── RBAC Check ──────────────────────────────────────────────────────────
+    // Role is read exclusively from the environment — not from the tool argument.
+    // This ensures Claude Code, Gemini CLI, Cursor, or any MCP client cannot
+    // escalate privilege by injecting a role in the tool args.
+    const role = getActiveUserRole();
+    const maxApprovable = ROLE_RISK_MAP[role];
+    if (request.riskScore <= maxApprovable) {
+        // Role is allowed — proceed to passcode check
+    }
+    else {
+        const requiredRole = getMinimumRoleForScore(request.riskScore);
+        return {
+            success: false,
+            message: `[RBAC] Approval denied: Risk score ${request.riskScore}/100 requires at least '${requiredRole}' role. ` +
+                `Current role: '${role}' (max approvable: ${maxApprovable}). ` +
+                "Set MCP_USER_ROLE env var to a role with sufficient authority."
+        };
+    }
+    // ── End RBAC Check ──────────────────────────────────────────────────────
+    // Passcode second-factor (printed to stderr — AI cannot intercept)
+    if (request.passcode && (!passcode || passcode.trim().toUpperCase() !== request.passcode)) {
+        return { success: false, message: "Invalid or missing approval passcode. Verify the passcode printed to stderr." };
+    }
     request.status = "APPROVED";
     // Update Hermes message status
     const messages = AtabeyStorage.getPendingMessages();
@@ -165,12 +254,17 @@ export function approveOperation(traceId) {
             AtabeyStorage.updateMessageStatus(msg.id, "APPROVED");
         }
     }
-    return { success: true, message: `Operation ${traceId} approved. You may retry.` };
+    return { success: true, message: `Operation ${traceId} approved by '${role}'. You may retry.` };
 }
 /**
  * Reject a pending operation.
+ *
+ * RBAC: junior-role users cannot reject HIGH/CRITICAL operations.
+ * This prevents rogue or misconfigured recon agents from killing
+ * manager-delegated critical operations.
  */
-export function rejectOperation(traceId) {
+export function rejectOperation(traceId, _userRoleIgnored // kept for API compat — value intentionally ignored
+) {
     const request = activeApprovals.get(traceId);
     if (!request) {
         return { success: false, message: `No pending approval found for trace: ${traceId}` };
@@ -178,6 +272,16 @@ export function rejectOperation(traceId) {
     if (request.status !== "PENDING") {
         return { success: false, message: `Approval for ${traceId} is already ${request.status}` };
     }
+    // RBAC: reject also requires minimum role for HIGH+ operations
+    const role = getActiveUserRole();
+    const canReject = !(role === "junior" && request.riskScore >= CONFIG.HIGH_RISK_THRESHOLD);
+    if (!canReject) {
+        return {
+            success: false,
+            message: `[RBAC] Reject denied: Risk score ${request.riskScore}/100 operations cannot be rejected by '${role}'. ` +
+                "Minimum role required to reject is 'developer'. Set MCP_USER_ROLE env var."
+        };
+    }
     request.status = "REJECTED";
     // Update Hermes message status
     const messages = AtabeyStorage.getPendingMessages();
@@ -187,7 +291,7 @@ export function rejectOperation(traceId) {
             AtabeyStorage.updateMessageStatus(msg.id, "REJECTED");
         }
     }
-    return { success: true, message: `Operation ${traceId} rejected.` };
+    return { success: true, message: `Operation ${traceId} rejected by '${role}'.` };
 }
 /**
  * Get all pending approval requests.
@@ -196,7 +300,7 @@ export function getPendingApprovals() {
     const now = Date.now();
     const pending = [];
     // Clean expired
-    for (const [traceId, request] of activeApprovals) {
+    for (const [, request] of activeApprovals) {
         if (request.status === "PENDING" && now > request.expiresAt) {
             request.status = "EXPIRED";
         }

package/framework-mcp/dist/framework-mcp/src/utils/loop-detector.js

@@ -274,7 +274,7 @@ export function recordAndCheck(agent, toolName, args) {
 /**
  * Apply cooldown to an agent.
  */
-function applyCooldown(history, alert, agent) {
+function applyCooldown(history, alert, _agent) {
     history.inCooldown = true;
     history.cooldownUntil = alert.cooldownUntil || Date.now() + CONFIG.COOLDOWN_MS;
     history.cooldownCount++;
@@ -347,8 +347,8 @@ export function getLoopStats(agent) {
  */
 export function getAllLoopStats() {
     const stats = {};
-    for (const [agent] of agentHistories) {
-        stats[agent] = getLoopStats(agent);
+    for (const [agentName] of agentHistories) {
+        stats[agentName] = getLoopStats(agentName);
     }
     return stats;
 }

package/framework-mcp/dist/framework-mcp/src/utils/permissions.js

@@ -1,6 +1,50 @@
+/**
+ * ─── RBAC PERMISSION MATRIX ───────────────────────────────────────────────
+ *
+ * Enforces agent-scoped file system permissions at the MCP tool layer.
+ * This is the file-level RBAC enforcement point for:
+ *   - Claude Code  (calls write_file / read_file via MCP sub-agents)
+ *   - Gemini CLI   (calls write_file / read_file via MCP server)
+ *   - Cursor       (calls write_file / read_file via MCP rules)
+ *   - Codex CLI    (calls write_file / read_file via agent allowed-tools)
+ *   - Antigravity  (calls write_file / read_file via customAgentSpec tools)
+ *
+ * Permission matrix is stored in `.atabey/permission-matrix.json`:
+ * {
+ *   "@frontend": { "write": ["apps/web/**"], "read": ["apps/web/**", "docs/**"] },
+ *   "@backend":  { "write": ["apps/backend/**"], "read": ["apps/backend/**", "apps/web/types/**"] }
+ * }
+ *
+ * Agent Tier enforcement:
+ *   supreme (@manager, @security) — no write/read restrictions (omnipotent)
+ *   core    (@backend, @frontend, ...) — matrix-enforced
+ *   recon   (@explorer, @git, @analyst, @native) — read-only by default,
+ *             write requires explicit matrix entry
+ */
 import fs from "fs";
 import path from "path";
 import { resolveFrameworkDir } from "./security.js";
+// ─── Tier hierarchy ─────────────────────────────────────────────────────────
+/** Well-known tier for agents defined in the built-in registry */
+const AGENT_TIER_MAP = {
+    "@manager": "supreme",
+    "@security": "supreme",
+    "@backend": "core",
+    "@frontend": "core",
+    "@mobile": "core",
+    "@quality": "core",
+    "@database": "core",
+    "@devops": "core",
+    "@architect": "core",
+    "@explorer": "recon",
+    "@git": "recon",
+    "@analyst": "recon",
+    "@native": "recon",
+};
+export function getAgentTier(agentName) {
+    return AGENT_TIER_MAP[agentName] ?? "core"; // unknown agents default to core
+}
+// ─── Glob → RegExp ──────────────────────────────────────────────────────────
 function globToRegex(glob) {
     const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
     const step1 = escaped.replace(/\*\*/g, "__DBL_STR__");
@@ -8,64 +52,156 @@ function globToRegex(glob) {
     const regexStr = "^" + step2.replace(/__DBL_STR__/g, ".*") + "$";
     return new RegExp(regexStr);
 }
+// ─── Active Agent Resolution ─────────────────────────────────────────────────
 /**
- * Validates if the active agent has write permission for the target file.
- * Automatically identifies the active agent by checking the status.json store
- * for the agent in the "EXECUTING" state.
+ * Resolves the active agent for the current operation.
+ *
+ * Priority order:
+ * 1. ATABEY_ACTIVE_AGENT env var (set by AgentLoop per-invocation — most reliable)
+ * 2. `.atabey/memory/status.json` first EXECUTING agent (legacy fallback)
+ *
+ * Note: The traceId-scoped approach is preferred when AgentLoop sets
+ * ATABEY_ACTIVE_AGENT before spawning the MCP tool call.
  */
-export function verifyWritePermission(projectRoot, targetFilePath) {
-    const frameworkDir = resolveFrameworkDir(projectRoot);
-    const absoluteFrameworkPath = path.isAbsolute(frameworkDir)
-        ? frameworkDir
-        : path.resolve(projectRoot, frameworkDir);
-    const matrixPath = path.join(absoluteFrameworkPath, "permission-matrix.json");
-    // If no permission matrix exists, skip enforcement (default allow)
-    if (!fs.existsSync(matrixPath)) {
-        return;
+export function resolveActiveAgent(frameworkDir) {
+    // 1. Env var (highest reliability — set by orchestration layer)
+    const envAgent = process.env.ATABEY_ACTIVE_AGENT?.trim();
+    if (envAgent) {
+        return envAgent.startsWith("@") ? envAgent : `@${envAgent}`;
     }
-    let matrix;
+    // 2. status.json fallback
+    const statusPath = path.join(frameworkDir, "memory", "status.json");
+    if (!fs.existsSync(statusPath))
+        return null;
     try {
-        matrix = JSON.parse(fs.readFileSync(matrixPath, "utf8"));
+        const status = JSON.parse(fs.readFileSync(statusPath, "utf8"));
+        for (const [agentName, info] of Object.entries(status)) {
+            if (info.state === "EXECUTING") {
+                return agentName.startsWith("@") ? agentName : `@${agentName}`;
+            }
+        }
+    }
+    catch (e) {
+        process.stderr.write(`[Permissions] Warning: Failed to read status.json: ${String(e)}\n`);
+    }
+    return null;
+}
+// ─── Matrix Loader ───────────────────────────────────────────────────────────
+function loadMatrix(frameworkDir) {
+    const matrixPath = path.join(frameworkDir, "permission-matrix.json");
+    if (!fs.existsSync(matrixPath))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(matrixPath, "utf8"));
     }
     catch (e) {
         throw new Error(`Failed to parse permission-matrix.json: ${String(e)}`, { cause: e });
     }
-    // Determine the active agent from status.json
-    const statusPath = path.join(absoluteFrameworkPath, "memory", "status.json");
-    let activeAgent = null;
-    if (fs.existsSync(statusPath)) {
-        try {
-            const status = JSON.parse(fs.readFileSync(statusPath, "utf8"));
-            // Find an agent that is currently in the EXECUTING state
-            for (const [agentName, info] of Object.entries(status)) {
-                const data = info;
-                if (data.state === "EXECUTING") {
-                    activeAgent = agentName.startsWith("@") ? agentName : `@${agentName}`;
-                    break;
-                }
-            }
+}
+/**
+ * Internal enforcement logic for both read and write operations.
+ *
+ * Enforcement logic per tier:
+ * - supreme: always allowed (no matrix needed)
+ * - core: enforced by matrix; if no rule defined → default-allow
+ * - recon: write → always denied unless explicit matrix allow
+ *           read  → allowed by default (recon agents must be able to explore)
+ */
+function enforcePermission(projectRoot, targetFilePath, accessType) {
+    const frameworkDir = resolveFrameworkDir(projectRoot);
+    const absoluteFrameworkPath = path.isAbsolute(frameworkDir)
+        ? frameworkDir
+        : path.resolve(projectRoot, frameworkDir);
+    const activeAgent = resolveActiveAgent(absoluteFrameworkPath);
+    // No active agent identified → default-allow (non-agent call, e.g. CLI tools)
+    if (!activeAgent)
+        return;
+    const tier = getAgentTier(activeAgent);
+    // Supreme agents are omnipotent — no matrix enforcement
+    if (tier === "supreme")
+        return;
+    // Recon agents: block writes unless explicitly allowed in matrix
+    if (tier === "recon" && accessType === "write") {
+        const matrix = loadMatrix(absoluteFrameworkPath);
+        if (!matrix) {
+            throw new Error(`Permission Denied: Agent ${activeAgent} (tier: recon) cannot write files. ` +
+                "Recon agents (@explorer, @git, @analyst, @native) are read-only by default. " +
+                "Add an explicit write rule to permission-matrix.json to grant write access.");
         }
-        catch (e) {
-            // Log warning but don't crash, default to allowing if status can't be parsed
-            process.stderr.write(`[Permissions] Warning: Failed to read status.json: ${String(e)}\n`);
+        const agentRules = matrix[activeAgent];
+        if (!agentRules?.write?.length) {
+            throw new Error(`Permission Denied: Agent ${activeAgent} (tier: recon) has no write rules in permission-matrix.json. ` +
+                "Recon agents are read-only by default.");
         }
+        // Fall through to glob check below
     }
-    // If no active executing agent is found, default to allowing
-    if (!activeAgent) {
+    const matrix = loadMatrix(absoluteFrameworkPath);
+    // No matrix file → default-allow (matrix is opt-in)
+    if (!matrix)
         return;
-    }
     const agentRules = matrix[activeAgent];
-    // If no rules defined for the agent, default to allowing
-    if (!agentRules || !agentRules.write) {
+    // No rules for this agent → default-allow
+    if (!agentRules)
+        return;
+    const rules = accessType === "write" ? agentRules.write : (agentRules.read ?? null);
+    // No rule for this access type → default-allow
+    if (!rules)
         return;
-    }
-    // Resolve target path relative to project root for glob matching
     const relativeTargetPath = path.relative(projectRoot, path.resolve(projectRoot, targetFilePath));
-    const allowed = agentRules.write.some(glob => {
-        const regex = globToRegex(glob);
-        return regex.test(relativeTargetPath);
-    });
+    const allowed = rules.some(glob => globToRegex(glob).test(relativeTargetPath));
     if (!allowed) {
-        throw new Error(`Permission Denied: Agent ${activeAgent} is not authorized to write to "${relativeTargetPath}". Matrix rules restrict writes to: [${agentRules.write.join(", ")}].`);
+        throw new Error(`Permission Denied: Agent ${activeAgent} (tier: ${tier}) is not authorized to ` +
+            `${accessType} "${relativeTargetPath}". ` +
+            `Matrix rules restrict ${accessType} to: [${rules.join(", ")}].`);
+    }
+}
+// ─── Public API ─────────────────────────────────────────────────────────────
+/**
+ * Verifies that the active agent has WRITE permission for the target file.
+ * Called by: write_file, replace_text, batch_surgical_edit, patch_file
+ *
+ * Throws a descriptive error if permission is denied.
+ */
+export function verifyWritePermission(projectRoot, targetFilePath) {
+    enforcePermission(projectRoot, targetFilePath, "write");
+}
+/**
+ * Verifies that the active agent has READ permission for the target file.
+ * Called by: read_file, view_file (alias)
+ *
+ * Throws a descriptive error if permission is denied.
+ * Note: read enforcement is SOFTER than write — recon agents can read freely
+ * unless an explicit read matrix restriction is defined.
+ */
+export function verifyReadPermission(projectRoot, targetFilePath) {
+    enforcePermission(projectRoot, targetFilePath, "read");
+}
+/**
+ * Verifies that the sender agent is allowed to send messages to the target agent
+ * based on the AgentTier hierarchy.
+ *
+ * Messaging rules (AI IDE governance layer):
+ * - Any tier → supreme:  allowed (escalation always permitted)
+ * - core → core:         allowed
+ * - recon → core:        allowed (recon can delegate up)
+ * - recon → supreme:     allowed
+ * - core → recon:        BLOCKED (core agents should not delegate down to recon)
+ * - supreme → any:       allowed
+ *
+ * Rationale: Recon agents (@explorer, @git) are information-gatherers.
+ * If a core agent delegates to a recon agent, it bypasses the quality gate
+ * and risk engine — a potential governance gap.
+ */
+export function verifyMessagingPermission(fromAgent, toAgent) {
+    const fromTier = getAgentTier(fromAgent);
+    const toTier = getAgentTier(toAgent);
+    // supreme senders: unrestricted
+    if (fromTier === "supreme")
+        return;
+    // core → recon: block (prevents quality-gate bypass via recon delegation)
+    if (fromTier === "core" && toTier === "recon") {
+        throw new Error(`[RBAC] Messaging violation: Agent ${fromAgent} (tier: core) cannot delegate to ` +
+            `${toAgent} (tier: recon). Core agents must delegate up to @manager or peer core agents. ` +
+            "Recon agents are read-only information gatherers and cannot execute delegated tasks.");
     }
 }

package/framework-mcp/dist/framework-mcp/src/utils/prompt-injection.js

@@ -0,0 +1,63 @@
+/**
+ * ─── PROMPT INJECTION PROTECTION ENGINE ────────────────────────────
+ *
+ * Scans, detects, and neutralizes prompt injection payloads in tool outputs
+ * before they are returned to the AI assistant's context.
+ *
+ * This prevents malicious files, code comments, or external resources from
+ * hijacking the AI client (e.g., instructing it to delete files or ignore safety).
+ */
+import { logger } from "../../../src/shared/logger.js";
+// Common prompt injection signatures
+const INJECTION_PATTERNS = [
+    /ignore\s+(?:all\s+)?instructions/gi,
+    /system\s+override/gi,
+    /you\s+must\s+now/gi,
+    /you\s+are\s+now/gi,
+    /bypass\s+governance/gi,
+    /bypass\s+safety/gi,
+    /bypass\s+atabey/gi,
+    /dan\s+mode/gi,
+    /developer\s+mode/gi,
+    /override\s+system\s+instructions/gi,
+    /ignore\s+safety\s+rules/gi,
+    /\[system\s+prompt\]/gi,
+    /<system_prompt>/gi,
+    /disable\s+restrictions/gi
+];
+export class PromptInjectionProtection {
+    /**
+     * Scan tool response text for injection patterns.
+     * Replaces any matches with a redirection block and logs it.
+     */
+    static sanitizeResponse(text) {
+        if (!text) {
+            return { sanitized: text, detected: false, patterns: [] };
+        }
+        let detected = false;
+        const patternsMatched = [];
+        let sanitized = text;
+        for (const pattern of INJECTION_PATTERNS) {
+            if (pattern.test(sanitized)) {
+                detected = true;
+                const matches = text.match(pattern);
+                if (matches) {
+                    matches.forEach(m => {
+                        if (!patternsMatched.includes(m)) {
+                            patternsMatched.push(m);
+                        }
+                    });
+                }
+                sanitized = sanitized.replace(pattern, "[REDACTED PROMPT INJECTION]");
+            }
+        }
+        if (detected) {
+            logger.warn(`[INJECTION PROTECTION] Blocked prompt injection pattern in tool response: ${patternsMatched.join(", ")}`);
+        }
+        return {
+            sanitized,
+            detected,
+            patterns: patternsMatched
+        };
+    }
+}

package/framework-mcp/dist/framework-mcp/src/utils/quality.js

@@ -93,9 +93,10 @@ export function analyzePathQuality(projectRoot, targetPath) {
             }
             // Check nesting depth
             lines.forEach((line, idx) => {
-                const indentMatch = line.match(/^(?:\s{2}){5,}/);
-                if (indentMatch && !line.trim().startsWith("//") && !line.trim().startsWith("*")) {
-                    const depth = Math.floor(indentMatch[0].length / 2);
+                const leadingSpaces = line.match(/^(\s*)/)?.[0].length || 0;
+                if (leadingSpaces >= 10 && !line.trim().startsWith("//") && !line.trim().startsWith("*")) {
+                    const indentSize = (leadingSpaces % 4 === 0) ? 4 : 2;
+                    const depth = Math.floor(leadingSpaces / indentSize);
                     if (depth > 4) {
                         deepNesting++;
                         issues.push({

package/framework-mcp/dist/framework-mcp/src/utils/silent-router.js

@@ -9,10 +9,11 @@
  *
  * Features:
  * - Auto-agent detection from tool call context
- * - Silent system prompt injection
+ * - Silent system prompt injection with specialty memory
  * - Multi-agent chain support
  * - Stealth notifications (stderr/dashboard only, never chat)
  */
+import { EvaluationEngine } from "../../../src/modules/engines/evaluation-engine.js";
 import { RoutingEngine } from "../../../src/modules/engines/routing-engine.js";
 // ─── Configuration ────────────────────────────────────────────────
 const CONFIG = {
@@ -22,6 +23,8 @@ const CONFIG = {
     STEALTH_NOTIFY: process.env.MCP_SILENT_STEALTH !== "false",
     /** Agent override via env (for testing/debugging) */
     FORCE_AGENT: process.env.MCP_FORCE_AGENT || null,
+    /** Enable specialty memory injection into context */
+    INJECT_SPECIALTY_MEMORY: process.env.MCP_INJECT_SPECIALTY_MEMORY !== "false",
 };
 let agentRuleCache = null;
 async function loadAgentRules() {
@@ -40,7 +43,6 @@ async function loadAgentRules() {
         }
     }
     catch {
-        // Fallback: use discipline rules file
         agentRuleCache = new Map();
     }
     return agentRuleCache;
@@ -52,9 +54,8 @@ async function loadAgentRules() {
 export function detectAgent(toolName, args) {
     if (CONFIG.FORCE_AGENT)
         return CONFIG.FORCE_AGENT;
-    // Build context from args for routing
     const contextParts = [toolName];
-    for (const [key, value] of Object.entries(args)) {
+    for (const [, value] of Object.entries(args)) {
         if (typeof value === "string") {
             contextParts.push(value);
         }
@@ -63,7 +64,6 @@ export function detectAgent(toolName, args) {
         }
     }
     const context = contextParts.join(" ").substring(0, 500);
-    // Use RoutingEngine to detect the best agent
     return RoutingEngine.resolveAgent(context);
 }
 /**
@@ -88,9 +88,32 @@ export async function getAgentPrompt(agentName) {
         "> They supplement (not replace) your existing instructions.",
     ].join("\n");
 }
+/**
+ * Load specialty memory for an agent and format it for injection.
+ */
+function getSpecialtyMemoryContext(agentName) {
+    if (!CONFIG.INJECT_SPECIALTY_MEMORY)
+        return null;
+    try {
+        const conventions = EvaluationEngine.readLearnedConventions(agentName);
+        if (!conventions)
+            return null;
+        return [
+            "",
+            "### Previously Learned Conventions",
+            `The following lessons were learned from past tasks for @${agentName}:`,
+            "",
+            conventions,
+            "",
+        ].join("\n");
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Build a silent context injection payload.
- * This is prepended to tool responses to guide the AI without @agent commands.
+ * Injects agent rules + specialty memory into tool responses.
  */
 export async function buildSilentContext(detectedAgent, toolName, responseText) {
     if (!CONFIG.ENABLED)
@@ -98,14 +121,17 @@ export async function buildSilentContext(detectedAgent, toolName, responseText)
     const agentPrompt = await getAgentPrompt(detectedAgent);
     if (!agentPrompt)
         return responseText;
-    // Only inject if the response is substantial enough to warrant governance
     if (responseText.length < 50)
         return responseText;
-    // Inject as a comment block that won't break tool results
+    // Inject specialty memory if available
+    const specialtyContext = getSpecialtyMemoryContext(detectedAgent);
+    const fullPrompt = specialtyContext
+        ? `${agentPrompt}\n${specialtyContext}`
+        : agentPrompt;
     const injection = [
         "",
         `<!-- ATABEY_GOVERNANCE agent="${detectedAgent}" tool="${toolName}" -->`,
-        `${agentPrompt}`,
+        `${fullPrompt}`,
         "<!-- /ATABEY_GOVERNANCE -->",
         "",
     ].join("\n");