atabey 0.0.14 → 0.0.16

package/dist/framework-mcp/src/tools/messaging/approve_operation.js

@@ -1,21 +1,21 @@
-import { approveOperation, rejectOperation, getPendingApprovals } from "../../utils/human-in-loop.js";
+import { approveOperation, getPendingApprovals, rejectOperation } from "../../utils/human-in-loop.js";
 /**
- * ─── APPROVE OPERATION — In-Chat Risk Gate ──────────────────────────
+ * MCP Tool: approve_operation
  *
- * AI CLI kullanımında "atabey approve <traceId>" CLI komutu çalıştırmak mümkün
- * değildir — chat'e yazılan şey CLI komutu olarak değil mesaj olarak işlenir.
+ * In AI CLI (Claude Code, Gemini CLI), running "atabey approve <traceId>"
+ * is not possible — anything typed in chat is treated as a message, not a CLI command.
  *
- * Bu tool, risk gate approval flow'unu doğrudan MCP tool çağrısına taşır:
+ * This tool moves the risk gate approval flow directly into an MCP tool call:
  *
- * 1. Atabey yüksek riskli bir operasyonu bloklar
- * 2. Geliştiriciye: "approve_operation tool'unu çağır" der
- * 3. AI bu tool'u çağırır → operasyon onaylanır/reddedilir
+ * 1. Atabey blocks a high-risk operation
+ * 2. Tells the developer: "call the approve_operation tool"
+ * 3. AI calls this tool → operation is approved/rejected
  *
- * Geliştirici terminale geçmek zorunda kalmaz.
+ * Developer never has to switch to terminal.
  */
 export async function handleApproveOperation(_root, args) {
     const { action, traceId, reason } = args;
-    // LIST: Bekleyen approval'ları göster
+    // LIST: Show pending approvals
     if (action === "list") {
         const pending = getPendingApprovals();
         if (pending.length === 0) {
@@ -42,7 +42,7 @@ export async function handleApproveOperation(_root, args) {
             content: [{ type: "text", text: lines.join("\n") }],
         };
     }
-    // APPROVE or REJECT: traceId zorunlu
+    // APPROVE or REJECT: traceId is required
     if (!traceId) {
         return {
             isError: true,
@@ -50,7 +50,7 @@ export async function handleApproveOperation(_root, args) {
         };
     }
     if (action === "approve") {
-        const result = approveOperation(traceId);
+        const result = approveOperation(traceId, args.passcode, args.userRole);
         return {
             content: [{
                     type: "text",

package/dist/framework-mcp/src/tools/messaging/approve_operation.js.map

@@ -1 +1 @@
-{"version":3,"file":"approve_operation.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/messaging/approve_operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAStG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,KAAa,EACb,IAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEzC,sCAAsC;IACtC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,yDAAyD,EAAE,CAAC;aAC/F,CAAC;QACN,CAAC;QAED,MAAM,KAAK,GAAG;YACV,eAAe,OAAO,CAAC,MAAM,0BAA0B;YACvD,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,yCAAyC;gBACzC,iBAAiB,GAAG,CAAC,OAAO,EAAE;gBAC9B,iBAAiB,GAAG,CAAC,QAAQ,EAAE;gBAC/B,iBAAiB,GAAG,CAAC,KAAK,EAAE;gBAC5B,iBAAiB,GAAG,CAAC,SAAS,SAAS,GAAG,CAAC,SAAS,GAAG;gBACvD,iBAAiB,GAAG,CAAC,MAAM,EAAE;gBAC7B,iBAAiB,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE;aAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,EAAE;YACF,iFAAiF;YACjF,gFAAgF;SACnF,CAAC;QAEF,OAAO;YACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACtD,CAAC;IACN,CAAC;IAED,qCAAqC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,MAAM,WAAW,EAAE,CAAC;SAC3F,CAAC;IACN,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO;YACH,OAAO,EAAE,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,4CAA4C;wBAC5E,CAAC,CAAC,WAAW,MAAM,CAAC,OAAO,EAAE;iBACpC,CAAC;YACF,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO;SAC3B,CAAC;IACN,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO;YACH,OAAO,EAAE,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;wBACxE,CAAC,CAAC,WAAW,MAAM,CAAC,OAAO,EAAE;iBACpC,CAAC;YACF,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO;SAC3B,CAAC;IACN,CAAC;IAED,OAAO;QACH,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,MAAM,CAAC,MAAM,CAAC,wCAAwC,EAAE,CAAC;KACxH,CAAC;AACN,CAAC"}
+{"version":3,"file":"approve_operation.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/messaging/approve_operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAWtG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,KAAa,EACb,IAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEzC,+BAA+B;IAC/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,yDAAyD,EAAE,CAAC;aAC/F,CAAC;QACN,CAAC;QAED,MAAM,KAAK,GAAG;YACV,eAAe,OAAO,CAAC,MAAM,0BAA0B;YACvD,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,yCAAyC;gBACzC,iBAAiB,GAAG,CAAC,OAAO,EAAE;gBAC9B,iBAAiB,GAAG,CAAC,QAAQ,EAAE;gBAC/B,iBAAiB,GAAG,CAAC,KAAK,EAAE;gBAC5B,iBAAiB,GAAG,CAAC,SAAS,SAAS,GAAG,CAAC,SAAS,GAAG;gBACvD,iBAAiB,GAAG,CAAC,MAAM,EAAE;gBAC7B,iBAAiB,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE;aAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,EAAE;YACF,iFAAiF;YACjF,gFAAgF;SACnF,CAAC;QAEF,OAAO;YACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACtD,CAAC;IACN,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,MAAM,WAAW,EAAE,CAAC;SAC3F,CAAC;IACN,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvE,OAAO;YACH,OAAO,EAAE,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,4CAA4C;wBAC5E,CAAC,CAAC,WAAW,MAAM,CAAC,OAAO,EAAE;iBACpC,CAAC;YACF,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO;SAC3B,CAAC;IACN,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO;YACH,OAAO,EAAE,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;wBACxE,CAAC,CAAC,WAAW,MAAM,CAAC,OAAO,EAAE;iBACpC,CAAC;YACF,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO;SAC3B,CAAC;IACN,CAAC;IAED,OAAO;QACH,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,MAAM,CAAC,MAAM,CAAC,wCAAwC,EAAE,CAAC;KACxH,CAAC;AACN,CAAC"}

package/dist/framework-mcp/src/tools/messaging/ask_human.d.ts

@@ -6,16 +6,16 @@ interface AskHumanArgs {
 /**
  * ─── ASK HUMAN — File Bridge ─────────────────────────────────────────
  *
- * AI CLI'lar (Claude Code, Gemini CLI) MCP server'ı stdio subprocess olarak
- * başlatır. Bu subprocess'te stdin isTTY=false olur (MCP JSON-RPC için kullanılır).
+ * AI CLIs (Claude Code, Gemini CLI) start the MCP server as a stdio subprocess.
+ * In this subprocess, stdin is isTTY=false (used for MCP JSON-RPC).
  *
- * Çözüm: File-based Q&A bridge.
- * 1. Soru → .atabey/hitl/question.txt dosyasına yazılır
- * 2. Geliştirici `atabey hitl` komutuyla cevap girer
- * 3. Cevap → .atabey/hitl/answer.txt dosyasına yazılır
- * 4. Bu handler cevabı okur ve AI'ya döner
+ * Solution: File-based Q&A bridge.
+ * 1. Question → written to .atabey/hitl/question.txt
+ * 2. Developer answers via `atabey hitl` command
+ * 3. Answer → written to .atabey/hitl/answer.txt
+ * 4. This handler reads the answer and returns it to the AI
  *
- * Dashboard: /api/approvals endpoint'i üzerinden web dashboard'dan da cevaplanabilir.
+ * Dashboard: Can also be answered via /api/approvals endpoint on the web dashboard.
  */
 export declare function handleAskHuman(root: string, args: AskHumanArgs): Promise<ToolResult>;
 export {};

package/dist/framework-mcp/src/tools/messaging/ask_human.js

@@ -3,16 +3,16 @@ import path from "path";
 /**
  * ─── ASK HUMAN — File Bridge ─────────────────────────────────────────
  *
- * AI CLI'lar (Claude Code, Gemini CLI) MCP server'ı stdio subprocess olarak
- * başlatır. Bu subprocess'te stdin isTTY=false olur (MCP JSON-RPC için kullanılır).
+ * AI CLIs (Claude Code, Gemini CLI) start the MCP server as a stdio subprocess.
+ * In this subprocess, stdin is isTTY=false (used for MCP JSON-RPC).
  *
- * Çözüm: File-based Q&A bridge.
- * 1. Soru → .atabey/hitl/question.txt dosyasına yazılır
- * 2. Geliştirici `atabey hitl` komutuyla cevap girer
- * 3. Cevap → .atabey/hitl/answer.txt dosyasına yazılır
- * 4. Bu handler cevabı okur ve AI'ya döner
+ * Solution: File-based Q&A bridge.
+ * 1. Question → written to .atabey/hitl/question.txt
+ * 2. Developer answers via `atabey hitl` command
+ * 3. Answer → written to .atabey/hitl/answer.txt
+ * 4. This handler reads the answer and returns it to the AI
  *
- * Dashboard: /api/approvals endpoint'i üzerinden web dashboard'dan da cevaplanabilir.
+ * Dashboard: Can also be answered via /api/approvals endpoint on the web dashboard.
  */
 export async function handleAskHuman(root, args) {
     const timeoutSeconds = args.timeoutSeconds ?? 120;

package/dist/framework-mcp/src/tools/messaging/send_message.js

@@ -2,15 +2,31 @@ import fs from "fs";
 import path from "path";
 import { resolveFrameworkDir } from "../../utils/security.js";
 import { Metrics } from "../../utils/metrics.js";
+import { verifyMessagingPermission, resolveActiveAgent } from "../../utils/permissions.js";
 export async function handleSendAgentMessage(projectRoot, args) {
     const { to, category, content, traceId, parentId, requiresApproval } = args;
-    const from = args.from || "@mcp";
+    const frameworkDir = resolveFrameworkDir(projectRoot);
+    const absoluteFrameworkPath = path.isAbsolute(frameworkDir)
+        ? frameworkDir
+        : path.resolve(projectRoot, frameworkDir);
+    const activeAgent = resolveActiveAgent(absoluteFrameworkPath);
+    const from = activeAgent || args.from || "@mcp";
     if (!to || !category || !content || !traceId) {
         const err = "Missing required messaging arguments (to, category, content, or traceId).";
         Metrics.logError(projectRoot, from, "send_agent_message", err);
         return { isError: true, content: [{ type: "text", text: `[ERROR] ${err}` }] };
     }
-    const frameworkDir = resolveFrameworkDir(projectRoot);
+    // ENFORCE AGENT TIER MESSAGING RBAC
+    // Prevents core agents from delegating to recon agents, bypassing the quality gate.
+    // This is the AI Governance enforcement point for Claude Code, Gemini CLI, Cursor.
+    try {
+        verifyMessagingPermission(from, to);
+    }
+    catch (e) {
+        const err = String(e instanceof Error ? e.message : e);
+        Metrics.logError(projectRoot, from, "send_agent_message", err);
+        return { isError: true, content: [{ type: "text", text: `[ERROR] ${err}` }] };
+    }
     const messagesDir = path.join(projectRoot, frameworkDir, "messages");
     const agentName = to.replace("@", "");
     const messagePath = path.join(messagesDir, `${agentName}.json`);
@@ -23,7 +39,7 @@ export async function handleSendAgentMessage(projectRoot, args) {
             if (fs.existsSync(lockPath)) {
                 try {
                     const stats = fs.statSync(lockPath);
-                    if (Date.now() - stats.mtimeMs > 10000) {
+                    if (Date.now() - stats.mtimeMs > 15000) {
                         const tempLockPath = `${lockPath}.${Math.random().toString(36).substring(2)}.old`;
                         fs.renameSync(lockPath, tempLockPath);
                         fs.unlinkSync(tempLockPath);

package/dist/framework-mcp/src/tools/messaging/send_message.js.map

@@ -1 +1 @@
-{"version":3,"file":"send_message.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/messaging/send_message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB,EAAE,IAA0B;IACxF,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IAEjC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,2EAA2E,CAAC;QACxF,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAE7D,wDAAwD;IACxD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,OAAO,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACpC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;wBACrC,MAAM,YAAY,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;wBAClF,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;wBACtC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBAChC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACL,6CAA6C;gBACjD,CAAC;YACL,CAAC;YACD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM;QACV,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,GAA0C,CAAC;YACzD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAC;gBACV,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBACd,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9I,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,6BAA6B,EAAE,wBAAwB,CAAC;QACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,CAAC;QACD,MAAM,eAAe,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5F,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,SAAS;YACxD,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QAE3B,MAAM,OAAO,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI;YACJ,EAAE;YACF,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,OAAO;YACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe;YAC1C,MAAM,EAAE,SAAS;YACjB,gBAAgB,EAAE,qBAAqB;SAC1C,CAAC;QAEF,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,WAAW,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,4BAA4B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;YAAS,CAAC;QACP,IAAI,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC;gBACD,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACL,SAAS;YACb,CAAC;QACL,CAAC;IACL,CAAC;AACL,CAAC"}
+{"version":3,"file":"send_message.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/messaging/send_message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAE3F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB,EAAE,IAA0B;IACxF,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5E,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,qBAAqB,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QACvD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,WAAW,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IAEhD,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,2EAA2E,CAAC;QACxF,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,oCAAoC;IACpC,oFAAoF;IACpF,mFAAmF;IACnF,IAAI,CAAC;QACD,yBAAyB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAE7D,wDAAwD;IACxD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,OAAO,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACpC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;wBACrC,MAAM,YAAY,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;wBAClF,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;wBACtC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBAChC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACL,6CAA6C;gBACjD,CAAC;YACL,CAAC;YACD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM;QACV,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,GAA0C,CAAC;YACzD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAC;gBACV,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBACd,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9I,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,6BAA6B,EAAE,wBAAwB,CAAC;QACpE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,CAAC;QACD,MAAM,eAAe,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5F,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,SAAS;YACxD,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QAE3B,MAAM,OAAO,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI;YACJ,EAAE;YACF,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,OAAO;YACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe;YAC1C,MAAM,EAAE,SAAS;YACjB,gBAAgB,EAAE,qBAAqB;SAC1C,CAAC;QAEF,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,WAAW,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,4BAA4B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;YAAS,CAAC;QACP,IAAI,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC;gBACD,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACL,SAAS;YACb,CAAC;QACL,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/framework-mcp/src/tools/observability/check_ports.d.ts

@@ -1,5 +1,6 @@
 import { CheckActivePortsArgs, ToolResult } from "../types.js";
 /**
  * Checks for active network ports and their status.
+ * Uses spawnSync instead of execSync to prevent shell injection.
  */
 export declare function handleCheckPorts(projectRoot: string, args: CheckActivePortsArgs): ToolResult;

package/dist/framework-mcp/src/tools/observability/check_ports.js

@@ -1,18 +1,32 @@
-import { execSync } from "child_process";
+import { spawnSync } from "child_process";
 /**
  * Checks for active network ports and their status.
+ * Uses spawnSync instead of execSync to prevent shell injection.
  */
 export function handleCheckPorts(projectRoot, args) {
     const rawFilter = args.filter || "";
     // Sanitize filter to prevent command injection (allow only alphanumeric, dots, colons, dashes, underscores)
     const filter = rawFilter.replace(/[^a-zA-Z0-9.:_-]/g, "");
     try {
-        // Using 'lsof -i -P -n' to list open files and network connections
-        // Note: may require permissions or behave differently on non-Unix systems
-        const command = process.platform === "win32"
-            ? `netstat -ano | findstr LISTENING ${filter ? `| findstr ${filter}` : ""}`
-            : `lsof -i -P -n | grep LISTEN ${filter ? `| grep ${filter}` : ""}`;
-        const output = execSync(command, { encoding: "utf8" });
+        let output;
+        if (process.platform === "win32") {
+            const result = spawnSync("netstat", ["-ano"], { encoding: "utf8" });
+            if (result.error)
+                throw result.error;
+            const lines = (result.stdout || "").split("\n").filter(l => l.includes("LISTENING"));
+            output = filter
+                ? lines.filter(l => l.includes(filter)).join("\n")
+                : lines.join("\n");
+        }
+        else {
+            const result = spawnSync("lsof", ["-i", "-P", "-n"], { encoding: "utf8" });
+            if (result.error)
+                throw result.error;
+            const lines = (result.stdout || "").split("\n").filter(l => l.includes("LISTEN"));
+            output = filter
+                ? lines.filter(l => l.includes(filter)).join("\n")
+                : lines.join("\n");
+        }
         return {
             content: [{
                     type: "text",

package/dist/framework-mcp/src/tools/observability/check_ports.js.map

@@ -1 +1 @@
-{"version":3,"file":"check_ports.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/observability/check_ports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAA0B;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,4GAA4G;IAC5G,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAE1D,IAAI,CAAC;QACD,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;YACxC,CAAC,CAAC,oCAAoC,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3E,CAAC,CAAC,+BAA+B,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAExE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvD,OAAO;YACH,OAAO,EAAE,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,2CAA2C,MAAM,IAAI,kDAAkD,EAAE;iBAClH,CAAC;SACL,CAAC;IACN,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC;QACV,OAAO;YACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0FAA0F,EAAE,CAAC;SAChI,CAAC;IACN,CAAC;AACL,CAAC"}
+{"version":3,"file":"check_ports.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/observability/check_ports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAA0B;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,4GAA4G;IAC5G,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAE1D,IAAI,CAAC;QACD,IAAI,MAAc,CAAC;QAEnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC;YACrC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,MAAM,GAAG,MAAM;gBACX,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACJ,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,CAAC,KAAK;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC;YACrC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClF,MAAM,GAAG,MAAM;gBACX,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO;YACH,OAAO,EAAE,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,2CAA2C,MAAM,IAAI,kDAAkD,EAAE;iBAClH,CAAC;SACL,CAAC;IACN,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC;QACV,OAAO;YACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0FAA0F,EAAE,CAAC;SAChI,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/framework-mcp/src/tools/schemas.d.ts

@@ -285,11 +285,11 @@ export declare const DeleteKnowledgeSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
     category: z.ZodOptional<z.ZodEnum<["ARCHITECTURE", "DECISION", "CODE_SNIPPET", "RULE", "TASK_HISTORY"]>>;
 }, "strict", z.ZodTypeAny, {
-    id?: string | undefined;
     category?: "ARCHITECTURE" | "DECISION" | "CODE_SNIPPET" | "RULE" | "TASK_HISTORY" | undefined;
-}, {
     id?: string | undefined;
+}, {
     category?: "ARCHITECTURE" | "DECISION" | "CODE_SNIPPET" | "RULE" | "TASK_HISTORY" | undefined;
+    id?: string | undefined;
 }>;
 export declare const SendAgentMessageSchema: z.ZodObject<{
     from: z.ZodString;
@@ -303,7 +303,7 @@ export declare const SendAgentMessageSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     traceId: string;
     from: string;
-    priority: "NORMAL" | "HIGH" | "LOW";
+    priority: "NORMAL" | "LOW" | "HIGH";
     to: string;
     category: "ALERT" | "DELEGATION" | "ACTION" | "SUBTASK" | "REPLY";
     content: string;
@@ -315,7 +315,7 @@ export declare const SendAgentMessageSchema: z.ZodObject<{
     to: string;
     category: "ALERT" | "DELEGATION" | "ACTION" | "SUBTASK" | "REPLY";
     content: string;
-    priority?: "NORMAL" | "HIGH" | "LOW" | undefined;
+    priority?: "NORMAL" | "LOW" | "HIGH" | undefined;
     parentId?: string | undefined;
     requiresApproval?: boolean | undefined;
 }>;

package/dist/framework-mcp/src/tools/search/grep_search.js

@@ -1,6 +1,7 @@
 import fs from "fs";
 import path from "path";
 import { Metrics } from "../../utils/metrics.js";
+import { verifyReadPermission } from "../../utils/permissions.js";
 /**
  * Searches for a regex pattern within files in the project.
  */
@@ -42,12 +43,18 @@ export function handleGrepSearch(projectRoot, args) {
                     if (includePattern && !filePath.endsWith(includePattern)) {
                         continue;
                     }
-                    const content = fs.readFileSync(filePath, "utf8");
-                    if (new RegExp(pattern).test(content)) {
-                        if (results.length < 30) {
-                            results.push(filePath);
+                    try {
+                        verifyReadPermission(projectRoot, filePath);
+                        const content = fs.readFileSync(filePath, "utf8");
+                        if (new RegExp(pattern).test(content)) {
+                            if (results.length < 30) {
+                                results.push(filePath);
+                            }
                         }
                     }
+                    catch {
+                        // Silently skip files without read permissions
+                    }
                 }
             }
         }

package/dist/framework-mcp/src/tools/search/grep_search.js.map

@@ -1 +1 @@
-{"version":3,"file":"grep_search.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/search/grep_search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAAoB;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAiB,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAwB,IAAI,EAAE,CAAC,CAAC,cAAc;IAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAwB,IAAI,cAAc,CAAC;IAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,6BAA6B,CAAC;QAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,0BAA0B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO;QACjC,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;oBAAE,OAAO;gBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtC,IAAI,cAAc,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;oBACtD,SAAS;gBACb,CAAC;gBACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACrB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACnB,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBACvB,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;wBACvD,SAAS;oBACb,CAAC;oBACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAClD,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBACpC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;4BACtB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC3B,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,yCAAyC;QAC7C,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,kBAAkB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7D,CAAC,CAAC,mBAAmB,CAAC;IAE1B,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvB,YAAY,IAAI,oIAAoI,CAAC;IACzJ,CAAC;IAED,OAAO;QACH,OAAO,EAAE,CAAC;gBACN,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,YAAY;aACrB,CAAC;KACL,CAAC;AACN,CAAC"}
+{"version":3,"file":"grep_search.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/search/grep_search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAAoB;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAiB,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAwB,IAAI,EAAE,CAAC,CAAC,cAAc;IAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAwB,IAAI,cAAc,CAAC;IAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,6BAA6B,CAAC;QAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,0BAA0B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO;QACjC,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;oBAAE,OAAO;gBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtC,IAAI,cAAc,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;oBACtD,SAAS;gBACb,CAAC;gBACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACrB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACnB,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBACvB,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;wBACvD,SAAS;oBACb,CAAC;oBACD,IAAI,CAAC;wBACD,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;wBAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;wBAClD,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;4BACpC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gCACtB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;4BAC3B,CAAC;wBACL,CAAC;oBACL,CAAC;oBAAC,MAAM,CAAC;wBACL,+CAA+C;oBACnD,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,yCAAyC;QAC7C,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,kBAAkB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7D,CAAC,CAAC,mBAAmB,CAAC;IAE1B,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvB,YAAY,IAAI,oIAAoI,CAAC;IACzJ,CAAC;IAED,OAAO;QACH,OAAO,EAAE,CAAC;gBACN,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,YAAY;aACrB,CAAC;KACL,CAAC;AACN,CAAC"}

package/dist/framework-mcp/src/tools/search/list_dir.js

@@ -1,11 +1,14 @@
 import fs from "fs";
 import path from "path";
 import { safePath } from "../../utils/security.js";
+import { verifyReadPermission } from "../../utils/permissions.js";
 /**
  * Lists the contents of a directory.
  */
 export function handleListDir(projectRoot, args) {
     const dirPath = safePath(projectRoot, args.path || ".");
+    // ENFORCE READ PERMISSION MATRIX FOR DIRECTORY
+    verifyReadPermission(projectRoot, path.join(args.path || ".", "placeholder"));
     if (!fs.existsSync(dirPath)) {
         throw new Error(`Directory not found: ${args.path}`);
     }

package/dist/framework-mcp/src/tools/search/list_dir.js.map

@@ -1 +1 @@
-{"version":3,"file":"list_dir.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/search/list_dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,IAAiB;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAExD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO;QACH,OAAO,EAAE,CAAC;gBACN,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,yBAAyB,IAAI,CAAC,IAAI,IAAI,GAAG,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC9E,CAAC;KACL,CAAC;AACN,CAAC"}
+{"version":3,"file":"list_dir.js","sourceRoot":"","sources":["../../../../../framework-mcp/src/tools/search/list_dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,IAAiB;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAExD,+CAA+C;IAC/C,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IAE9E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO;QACH,OAAO,EAAE,CAAC;gBACN,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,yBAAyB,IAAI,CAAC,IAAI,IAAI,GAAG,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC9E,CAAC;KACL,CAAC;AACN,CAAC"}