atabey 0.0.16 → 0.0.17

package/framework-mcp/dist/framework-mcp/src/resources/index.js

@@ -1,58 +0,0 @@
-import { Storage } from "../utils/storage.js";
-/**
- * [DATA] MCP Resource Definitions
- */
-export const RESOURCES = [
-    {
-        uri: "atabey://AL/status",
-        name: "AL Registry Status",
-        description: "Real-time state and active tasks of all specialized agents.",
-        mimeType: "text/markdown"
-    },
-    {
-        uri: "atabey://plan/active",
-        name: "Active Execution Plan",
-        description: "The current DAG of tasks and their completion status.",
-        mimeType: "text/markdown"
-    },
-    {
-        uri: "atabey://memory/project",
-        name: "Project Memory",
-        description: "The central source of truth for project context (PROJECT_MEMORY.md).",
-        mimeType: "text/markdown"
-    }
-];
-export async function handleReadResource(uri) {
-    if (uri === "atabey://AL/status") {
-        const agents = Storage.getAllAgents();
-        let md = "# [AI] AL Registry Status\n\n| Agent | State | Active Task | Last Updated |\n| :--- | :--- | :--- | :--- |\n";
-        agents.forEach((a) => {
-            md += `| @${a.name} | ${a.state} | ${a.task} | ${a.last_updated} |\n`;
-        });
-        return md;
-    }
-    if (uri === "atabey://plan/active") {
-        const tasks = Storage.getTasks();
-        let md = "# [LIST] Active Execution Plan\n\n| ID | Task | Agent | Status | Dependencies |\n| :--- | :--- | :--- | :--- | :--- |\n";
-        tasks.forEach((t) => {
-            const deps = t.dependencies.join(", ") || "-";
-            md += `| ${t.id} | ${t.description} | ${t.agent} | ${t.status} | ${deps} |\n`;
-        });
-        return md;
-    }
-    if (uri === "atabey://memory/project") {
-        const fs = await import("fs");
-        const path = await import("path");
-        const { getFrameworkDir } = await import("../utils/memory.js");
-        const projectRoot = process.env.ATABEY_PROJECT_ROOT || process.cwd();
-        const fwDir = getFrameworkDir();
-        const p = path.isAbsolute(fwDir)
-            ? path.join(fwDir, "memory", "PROJECT_MEMORY.md")
-            : path.join(projectRoot, fwDir, "memory", "PROJECT_MEMORY.md");
-        if (fs.existsSync(p)) {
-            return fs.readFileSync(p, "utf8");
-        }
-        return "Project memory not found. Run 'atabey init' first.";
-    }
-    throw new Error(`Unknown resource URI: ${uri}`);
-}

package/framework-mcp/dist/framework-mcp/src/tools/compliance/mask_pii.js

@@ -1,55 +0,0 @@
-import { classifyData, containsPII, maskObject, maskText } from "../../../../src/shared/pii.js";
-export function handleMaskPII(root, args) {
-    const mode = args.mode || "auto";
-    const strictMode = args.strictMode ?? false;
-    // Mode: text
-    if (mode === "text" || (mode === "auto" && args.text && !args.data)) {
-        if (!args.text) {
-            return {
-                isError: true,
-                content: [{ type: "text", text: "[ERROR] 'text' parameter is required when mode is 'text'." }],
-            };
-        }
-        const masked = maskText(args.text);
-        const hasPII = containsPII(args.text);
-        const classification = classifyData(args.text);
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        originalLength: args.text.length,
-                        maskedLength: masked.length,
-                        hasPII,
-                        classification,
-                        masked,
-                    }, null, 2),
-                }],
-        };
-    }
-    // Mode: object
-    if (mode === "object" || (mode === "auto" && args.data)) {
-        if (!args.data) {
-            return {
-                isError: true,
-                content: [{ type: "text", text: "[ERROR] 'data' parameter is required when mode is 'object'." }],
-            };
-        }
-        const masked = maskObject(args.data, 0, strictMode);
-        const hasPII = containsPII(JSON.stringify(args.data));
-        const classification = classifyData(JSON.stringify(args.data));
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        hasPII,
-                        classification,
-                        masked,
-                    }, null, 2),
-                }],
-        };
-    }
-    return {
-        isError: true,
-        content: [{ type: "text", text: "[ERROR] Provide either 'text' (string) or 'data' (object) parameter." }],
-    };
-}

package/framework-mcp/dist/framework-mcp/src/tools/control_plane/locking.js

@@ -1,84 +0,0 @@
-import fs from "fs";
-import path from "path";
-import { resolveFrameworkDir } from "../../utils/security.js";
-import { Metrics } from "../../utils/metrics.js";
-/**
- * Handles acquiring a stateful lock on a resource with Deadlock Resolution.
- */
-export async function handleAcquireLock(projectRoot, args) {
-    const { resource, agent, ttl = 300 } = args; // Default TTL 5 minutes to prevent deadlocks
-    const frameworkDir = resolveFrameworkDir(projectRoot);
-    const lockDir = path.join(projectRoot, frameworkDir, "locks");
-    const lockPath = path.join(lockDir, `${resource}.lock`);
-    try {
-        if (!fs.existsSync(lockDir))
-            fs.mkdirSync(lockDir, { recursive: true });
-        // Check for stale lock first (DEADLOCK RESOLUTION)
-        if (fs.existsSync(lockPath)) {
-            const stat = fs.statSync(lockPath);
-            const now = new Date().getTime();
-            const age = (now - stat.mtimeMs) / 1000;
-            if (age < ttl) {
-                return {
-                    isError: true,
-                    content: [{ type: "text", text: `[LOCKED] Resource '${resource}' is currently locked by another agent. Try again later.` }]
-                };
-            }
-            // Lock expired: Force Eviction
-            const oldLockData = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-            Metrics.logError(projectRoot, "@mcp", "lock_eviction", `Forcefully evicted stale lock on '${resource}' held by ${oldLockData.agent} for ${Math.round(age)}s.`);
-            const tempLockPath = `${lockPath}.${Math.random().toString(36).substring(2)}.old`;
-            try {
-                fs.renameSync(lockPath, tempLockPath);
-                fs.unlinkSync(tempLockPath);
-            }
-            catch {
-                // Ignore if already evicted by race condition
-            }
-        }
-        // Use 'wx' flag for atomic file creation
-        const lockData = JSON.stringify({ agent, timestamp: new Date().toISOString() });
-        fs.writeFileSync(lockPath, lockData, { flag: "wx" });
-        return {
-            content: [{ type: "text", text: `[OK] Lock acquired for resource '${resource}' by ${agent}.` }]
-        };
-    }
-    catch (e) {
-        const error = e;
-        if (error.code === "EEXIST") {
-            return {
-                isError: true,
-                content: [{ type: "text", text: `[LOCKED] Resource '${resource}' was just acquired by another agent.` }]
-            };
-        }
-        return {
-            isError: true,
-            content: [{ type: "text", text: `Failed to acquire lock: ${String(e)}` }]
-        };
-    }
-}
-/**
- * Handles releasing a lock.
- */
-export async function handleReleaseLock(projectRoot, args) {
-    const { resource, agent } = args;
-    const frameworkDir = resolveFrameworkDir(projectRoot);
-    const lockPath = path.join(projectRoot, frameworkDir, "locks", `${resource}.lock`);
-    try {
-        if (!fs.existsSync(lockPath)) {
-            return { content: [{ type: "text", text: `[INFO] No lock found for resource '${resource}'.` }] };
-        }
-        const lockData = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-        if (lockData.agent !== agent) {
-            return {
-                isError: true,
-                content: [{ type: "text", text: `[ERROR] Denied: You do not own the lock for '${resource}'. Owned by ${lockData.agent}.` }]
-            };
-        }
-        fs.unlinkSync(lockPath);
-        return { content: [{ type: "text", text: `[OK] Lock released for resource '${resource}' by ${agent}.` }] };
-    }
-    catch (e) {
-        return { isError: true, content: [{ type: "text", text: `Failed to release lock: ${String(e)}` }] };
-    }
-}

package/framework-mcp/dist/framework-mcp/src/tools/control_plane/registry.js

@@ -1,83 +0,0 @@
-import fs from "fs";
-import path from "path";
-import { resolveFrameworkDir } from "../../utils/security.js";
-/**
- * Valid agent roles in the Atabey governance system.
- * Mirrors AgentTier from src/modules/agents/types.ts.
- */
-const VALID_ROLES = ["supreme", "core", "recon"];
-/**
- * Roles that cannot be self-assigned via the MCP register_agent tool.
- * Supreme registration must be done through the orchestrator bootstrap,
- * not via AI tool calls (Claude Code, Gemini CLI, Cursor, etc.).
- */
-const PROTECTED_ROLES = ["supreme"];
-/**
- * Well-known supreme agents allowed to register with supreme role.
- * Any other agent attempting supreme registration is blocked.
- */
-const SUPREMES_WHITELIST = ["@manager", "@security"];
-/**
- * Handles agent registration with the Control Plane.
- * Validates tier/role to prevent privilege escalation via MCP tool injection.
- */
-export async function handleRegisterAgent(projectRoot, args) {
-    const { agent, role, capability = 5, specialties } = args;
-    const frameworkDir = resolveFrameworkDir(projectRoot);
-    const registryDir = path.join(projectRoot, frameworkDir, "registry");
-    const agentFile = path.join(registryDir, `${agent.replace("@", "")}_active.json`);
-    // ── RBAC: Validate role ──────────────────────────────────────────────
-    if (!VALID_ROLES.includes(role)) {
-        return {
-            isError: true,
-            content: [{ type: "text", text: `[RBAC] Invalid role '${role}'. Valid roles: ${VALID_ROLES.join(", ")}.` }]
-        };
-    }
-    // ── RBAC: Block unauthorized supreme registration ─────────────────────
-    // Prevents AI agents (Claude Code, Gemini, Cursor) from self-assigning supreme tier.
-    if (PROTECTED_ROLES.includes(role) && !SUPREMES_WHITELIST.includes(agent)) {
-        return {
-            isError: true,
-            content: [{ type: "text", text: `[RBAC] Privilege escalation blocked: Agent '${agent}' cannot self-register as '${role}'. ` +
-                        `Supreme role is reserved for: ${SUPREMES_WHITELIST.join(", ")}. ` +
-                        "This attempt has been logged."
-                }]
-        };
-    }
-    // ── Validate capability range ─────────────────────────────────────────
-    const cap = typeof capability === "number" ? Math.min(10, Math.max(1, capability)) : 5;
-    try {
-        if (!fs.existsSync(registryDir))
-            fs.mkdirSync(registryDir, { recursive: true });
-        // Idempotent: merge with existing registration if present
-        let existingData = {};
-        if (fs.existsSync(agentFile)) {
-            try {
-                existingData = JSON.parse(fs.readFileSync(agentFile, "utf8"));
-            }
-            catch { /* ignore corrupt registry file, overwrite */ }
-        }
-        const agentData = {
-            ...existingData, // preserve existing fields (e.g. prior specialties)
-            agent,
-            role,
-            capability: cap,
-            specialties: specialties // overwrite specialties if provided
-                ? { ...(existingData.specialties ?? {}), ...specialties }
-                : existingData.specialties,
-            registered_at: existingData.registered_at ?? new Date().toISOString(),
-            last_seen: new Date().toISOString(),
-            status: "ACTIVE"
-        };
-        fs.writeFileSync(agentFile, JSON.stringify(agentData, null, 2));
-        return {
-            content: [{ type: "text", text: `[ATABEY] Agent ${agent} (${role}, capability: ${cap}/10) registered in the Control Plane.` }]
-        };
-    }
-    catch (e) {
-        return {
-            isError: true,
-            content: [{ type: "text", text: `Failed to register agent: ${String(e)}` }]
-        };
-    }
-}

package/framework-mcp/dist/framework-mcp/src/tools/definitions.js

@@ -1,198 +0,0 @@
-import { zodToMcpSchema } from "../utils/zod-to-mcp.js";
-import * as schemas from "./schemas.js";
-/**
- * ─── SUPREME TOOL REGISTRY ─────────────────────────────────────────
- * Every tool is dynamically generated from its Zod schema.
- * ZERO manual JSON schema maintenance permitted.
- */
-export const TOOLS = [
-    // File System
-    {
-        name: "read_file",
-        description: "Read the content of a file within the project. Supports optional line range reading to prevent stream overload.",
-        inputSchema: zodToMcpSchema(schemas.ReadFileSchema),
-    },
-    {
-        name: "view_file",
-        description: "Alias for read_file. Views the content of a file within the project.",
-        inputSchema: zodToMcpSchema(schemas.ReadFileSchema),
-    },
-    {
-        name: "write_file",
-        description: "Write content to a file. Creates directories if missing.",
-        inputSchema: zodToMcpSchema(schemas.WriteFileSchema),
-    },
-    {
-        name: "replace_text",
-        description: "Surgically replace a string in a file with another string.",
-        inputSchema: zodToMcpSchema(schemas.ReplaceTextSchema),
-    },
-    {
-        name: "batch_surgical_edit",
-        description: "Perform multiple surgical text replacements across multiple files in a single batch request.",
-        inputSchema: zodToMcpSchema(schemas.BatchSurgicalEditSchema),
-    },
-    {
-        name: "patch_file",
-        description: "Safely update a file by replacing a specific line range with new content.",
-        inputSchema: zodToMcpSchema(schemas.PatchFileSchema),
-    },
-    // Search & Exploration
-    {
-        name: "list_dir",
-        description: "List the contents of a directory. Essential for codebase exploration.",
-        inputSchema: zodToMcpSchema(schemas.ListDirSchema),
-    },
-    {
-        name: "grep_search",
-        description: "Perform a recursive regex search across the codebase.",
-        inputSchema: zodToMcpSchema(schemas.GrepSearchSchema),
-    },
-    {
-        name: "get_project_map",
-        description: "Generate a tree-view map of the project structure.",
-        inputSchema: zodToMcpSchema(schemas.GetProjectMapSchema),
-    },
-    {
-        name: "get_project_gaps",
-        description: "Scans the codebase for TODOs, FIXMEs, and empty function bodies.",
-        inputSchema: zodToMcpSchema(schemas.GetProjectGapsSchema),
-    },
-    // Framework & System
-    {
-        name: "run_shell_command",
-        description: "Execute a shell command. Restricted for security.",
-        inputSchema: zodToMcpSchema(schemas.RunShellCommandSchema),
-    },
-    {
-        name: "run_tests",
-        description: "Execute project test suites and capture pass/fail reports.",
-        inputSchema: zodToMcpSchema(schemas.RunTestsSchema),
-    },
-    {
-        name: "get_system_health",
-        description: "Retrieve real-time system metrics (CPU, RAM).",
-        inputSchema: zodToMcpSchema(schemas.GetSystemHealthSchema),
-    },
-    {
-        name: "check_active_ports",
-        description: "Identify which network ports are currently active.",
-        inputSchema: zodToMcpSchema(schemas.CheckPortsSchema),
-    },
-    {
-        name: "get_framework_status",
-        description: "Get the current project phase, active traces, and agent states.",
-        inputSchema: zodToMcpSchema(schemas.GetFrameworkStatusSchema),
-    },
-    {
-        name: "read_project_memory",
-        description: "Read the full project central memory (PROJECT_MEMORY.md).",
-        inputSchema: zodToMcpSchema(schemas.ReadProjectMemorySchema),
-    },
-    {
-        name: "get_memory_insights",
-        description: "Retrieve a summarized version of the project memory.",
-        inputSchema: zodToMcpSchema(schemas.GetMemoryInsightsSchema),
-    },
-    {
-        name: "update_project_memory",
-        description: "Update a specific section in PROJECT_MEMORY.md.",
-        inputSchema: zodToMcpSchema(schemas.UpdateProjectMemorySchema),
-    },
-    // Memory (Core Memory)
-    {
-        name: "store_knowledge",
-        description: "Store a new piece of project knowledge, decision, or code snippet into the vector-based core memory.",
-        inputSchema: zodToMcpSchema(schemas.StoreKnowledgeSchema),
-    },
-    {
-        name: "search_knowledge",
-        description: "Search the vector-based core memory for relevant project knowledge, past decisions, or rules.",
-        inputSchema: zodToMcpSchema(schemas.SearchKnowledgeSchema),
-    },
-    {
-        name: "delete_knowledge",
-        description: "Delete an obsolete or incorrect knowledge entry from the Core Memory.",
-        inputSchema: zodToMcpSchema(schemas.DeleteKnowledgeSchema),
-    },
-    {
-        name: "orchestrate_loop",
-        description: "Process pending Hermes messages and trigger transitions.",
-        inputSchema: zodToMcpSchema(schemas.OrchestrateLoopSchema),
-    },
-    {
-        name: "submit_plan",
-        description: "Submit a structured DAG plan of tasks for the project.",
-        inputSchema: zodToMcpSchema(schemas.SubmitPlanSchema),
-    },
-    {
-        name: "update_contract_hash",
-        description: "Re-generate and synchronize the backend contract SHA-256 hash.",
-        inputSchema: zodToMcpSchema(schemas.UpdateContractHashSchema),
-    },
-    {
-        name: "audit_dependencies",
-        description: "Audits package.json for unused or redundant packages.",
-        inputSchema: zodToMcpSchema(schemas.AuditDependenciesSchema),
-    },
-    {
-        name: "check_lint",
-        description: "Run the project's linter (e.g., ESLint).",
-        inputSchema: zodToMcpSchema(schemas.CheckLintSchema),
-    },
-    // Control Plane
-    {
-        name: "acquire_lock",
-        description: "Acquire a stateful lock on a shared resource.",
-        inputSchema: zodToMcpSchema(schemas.AcquireLockSchema),
-    },
-    {
-        name: "release_lock",
-        description: "Release a previously acquired lock.",
-        inputSchema: zodToMcpSchema(schemas.ReleaseLockSchema),
-    },
-    {
-        name: "register_agent",
-        description: "Register an agent instance with the Control Plane.",
-        inputSchema: zodToMcpSchema(schemas.RegisterAgentSchema),
-    },
-    // Messaging (Hermes)
-    {
-        name: "send_agent_message",
-        description: "Send a Hermes protocol message to another agent.",
-        inputSchema: zodToMcpSchema(schemas.SendAgentMessageSchema),
-    },
-    {
-        name: "log_agent_action",
-        description: "Log an agent action to the framework logs.",
-        inputSchema: zodToMcpSchema(schemas.LogAgentActionSchema),
-    },
-    {
-        name: "ask_human",
-        description: "Pause execution and ask the human developer a clarifying question via the terminal.",
-        inputSchema: zodToMcpSchema(schemas.AskHumanSchema),
-    },
-    // ─── PII / Compliance ─────────────────────────────────────────
-    {
-        name: "mask_pii",
-        description: "Mask Personally Identifiable Information (PII) in text or structured data. Compliant with KVKK (Law No. 6698) and GDPR. Detects and masks emails, phone numbers, TC IDs, API keys, tokens, IPs, credit cards, IBANs, and more.",
-        inputSchema: zodToMcpSchema(schemas.MaskPIISchema),
-    },
-    // ─── Code Quality ─────────────────────────────────────────────
-    {
-        name: "analyze_code_quality",
-        description: "Analyze code quality in a given path. Checks TypeScript types, lint rules, and code complexity.",
-        inputSchema: zodToMcpSchema(schemas.AnalyzeCodeQualitySchema),
-    },
-    {
-        name: "check_architecture_compliance",
-        description: "Check architecture compliance in a given path. Verifies layer boundaries (Controller→Service→Repository), import direction rules, and strict mode.",
-        inputSchema: zodToMcpSchema(schemas.CheckArchitectureComplianceSchema),
-    },
-    // ─── Human-in-the-Loop ────────────────────────────────────────
-    {
-        name: "approve_operation",
-        description: "Approve, reject, or list pending risk-gated operations. Use this when an operation was blocked by the Risk Gate (risk score ≥ 60). Action: 'approve' | 'reject' | 'list'.",
-        inputSchema: zodToMcpSchema(schemas.ApproveOperationSchema),
-    },
-];

package/framework-mcp/dist/framework-mcp/src/tools/file_system/batch_surgical_edit.js

@@ -1,64 +0,0 @@
-import fs from "fs";
-import { verifyCorporateCompliance, verifyRiskAndAwaitApproval } from "../../utils/compliance.js";
-import { writeTextFile } from "../../utils/fs.js";
-import { Metrics } from "../../utils/metrics.js";
-import { verifyWritePermission } from "../../utils/permissions.js";
-import { safePath } from "../../utils/security.js";
-/**
- * Performs multiple surgical text replacements across multiple files in a single batch.
- */
-export async function handleBatchSurgicalEdit(projectRoot, args) {
-    const edits = args.edits;
-    if (!Array.isArray(edits) || edits.length === 0) {
-        const err = "No edits provided in the batch request.";
-        Metrics.logError(projectRoot, "@mcp", "batch_surgical_edit", err);
-        throw new Error(err);
-    }
-    const results = [];
-    let totalTokens = 0;
-    for (const edit of edits) {
-        const filePath = safePath(projectRoot, edit.path);
-        // ENFORCE PERMISSION MATRIX
-        verifyWritePermission(projectRoot, edit.path);
-        if (!fs.existsSync(filePath)) {
-            const err = `File not found: ${edit.path}`;
-            Metrics.logError(projectRoot, "@mcp", `batch_surgical_edit:${edit.path}`, err);
-            throw new Error(err);
-        }
-        const content = fs.readFileSync(filePath, "utf8");
-        const { oldText, newText, allowMultiple = false } = edit;
-        if (!content.includes(oldText)) {
-            const err = `Text not found in file ${edit.path}`;
-            Metrics.logError(projectRoot, "@mcp", `batch_surgical_edit:${edit.path}`, err);
-            throw new Error(err);
-        }
-        // Surgical precision guard
-        if (!allowMultiple) {
-            const firstIndex = content.indexOf(oldText);
-            const lastIndex = content.lastIndexOf(oldText);
-            if (firstIndex !== lastIndex) {
-                const err = `Ambiguous replacement in ${edit.path}`;
-                Metrics.logError(projectRoot, "@mcp", `batch_surgical_edit:${edit.path}`, err);
-                throw new Error(err);
-            }
-        }
-        const newContent = allowMultiple
-            ? content.replace(new RegExp(oldText.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), newText)
-            : content.replace(oldText, newText);
-        // ENFORCE CORPORATE COMPLIANCE
-        verifyCorporateCompliance(newContent, edit.path);
-        // ENFORCE RISK & HUMAN APPROVAL GATEWAY
-        await verifyRiskAndAwaitApproval(projectRoot, newContent, edit.path);
-        writeTextFile(filePath, newContent);
-        const tokens = Metrics.estimateTokens(newText);
-        totalTokens += tokens;
-        results.push(`[OK] Edited ${edit.path}`);
-    }
-    Metrics.logUsage(projectRoot, "@mcp", `batch_surgical_edit: ${edits.length} files`, totalTokens);
-    return {
-        content: [{
-                type: "text",
-                text: `Successfully performed ${edits.length} edits:\n${results.join("\n")}`
-            }]
-    };
-}

package/framework-mcp/dist/framework-mcp/src/tools/file_system/patch_file.js

@@ -1,34 +0,0 @@
-import fs from "fs";
-import { safePath } from "../../utils/security.js";
-import { Metrics } from "../../utils/metrics.js";
-import { verifyCorporateCompliance, verifyRiskAndAwaitApproval } from "../../utils/compliance.js";
-import { verifyWritePermission } from "../../utils/permissions.js";
-export async function handlePatchFile(projectRoot, args) {
-    const filePath = safePath(projectRoot, args.path);
-    // ENFORCE PERMISSION MATRIX
-    verifyWritePermission(projectRoot, args.path);
-    const lines = fs.readFileSync(filePath, "utf8").split("\n");
-    const start = args.startLine - 1;
-    const end = args.endLine;
-    const newContent = args.newContent.split("\n");
-    if (start < 0 || start > lines.length) {
-        const err = `Invalid start line: ${start + 1}. File has ${lines.length} lines.`;
-        Metrics.logError(projectRoot, "@mcp", `patch_file:${args.path}`, err);
-        throw new Error(err);
-    }
-    if (end < start + 1 || end > lines.length) {
-        const err = `Invalid end line: ${end}. Must be between ${start + 1} and ${lines.length}.`;
-        Metrics.logError(projectRoot, "@mcp", `patch_file:${args.path}`, err);
-        throw new Error(err);
-    }
-    lines.splice(start, end - start, ...newContent);
-    const patchedContent = lines.join("\n");
-    // ENFORCE CORPORATE COMPLIANCE
-    verifyCorporateCompliance(patchedContent, args.path);
-    // ENFORCE RISK & HUMAN APPROVAL GATEWAY
-    await verifyRiskAndAwaitApproval(projectRoot, patchedContent, args.path);
-    fs.writeFileSync(filePath, patchedContent);
-    const tokens = Metrics.estimateTokens(args.newContent);
-    Metrics.logUsage(projectRoot, "@mcp", `patch_file: ${args.path}`, tokens);
-    return { content: [{ type: "text", text: `[OK] File patched successfully: ${args.path}` }] };
-}

package/framework-mcp/dist/framework-mcp/src/tools/file_system/read_file.js

@@ -1,56 +0,0 @@
-import fs from "fs";
-import { safePath } from "../../utils/security.js";
-import { Metrics } from "../../utils/metrics.js";
-import { verifyReadPermission } from "../../utils/permissions.js";
-export function handleReadFile(projectRoot, args) {
-    if (!args.path) {
-        const err = "Missing 'path' argument.";
-        Metrics.logError(projectRoot, "@mcp", "read_file", err);
-        return { isError: true, content: [{ type: "text", text: `[ERROR] ${err}` }] };
-    }
-    try {
-        const filePath = safePath(projectRoot, args.path);
-        // ENFORCE READ PERMISSION MATRIX
-        // Checked before file existence to avoid leaking path information
-        // to agents without read access (Claude Code, Cursor, Gemini CLI, etc.)
-        verifyReadPermission(projectRoot, args.path);
-        if (!fs.existsSync(filePath)) {
-            const err = `File not found: ${args.path}`;
-            Metrics.logError(projectRoot, "@mcp", "read_file", err);
-            return { isError: true, content: [{ type: "text", text: `[ERROR] ${err}` }] };
-        }
-        const startLine = args.startLine;
-        const endLine = args.endLine;
-        const content = fs.readFileSync(filePath, "utf8");
-        const lines = content.split(/\r?\n/);
-        if (startLine !== undefined || endLine !== undefined) {
-            const start = startLine !== undefined ? Math.max(1, startLine) - 1 : 0;
-            const end = endLine !== undefined ? Math.min(lines.length, endLine) : lines.length;
-            const sliced = lines.slice(start, end).join("\n");
-            const tokens = Metrics.estimateTokens(sliced);
-            Metrics.logUsage(projectRoot, "@mcp", `read_file: ${args.path}`, tokens);
-            return { content: [{ type: "text", text: sliced }] };
-        }
-        // ENFORCE TOKEN ECONOMY: Hard Limit for large files
-        const HARD_LIMIT_LINES = 300;
-        if (lines.length > HARD_LIMIT_LINES && (startLine === undefined || endLine === undefined)) {
-            const errMsg = `[TOKEN ECONOMY GUARD] File '${args.path}' is too large (${lines.length} lines). To prevent context overflow and token waste, you MUST provide both 'startLine' and 'endLine' parameters to read specific sections of this file.`;
-            Metrics.logError(projectRoot, "@mcp", `read_file: ${args.path} (blocked)`, errMsg);
-            return {
-                isError: true,
-                content: [{
-                        type: "text",
-                        text: `[ERROR] ${errMsg}`
-                    }]
-            };
-        }
-        const tokens = Metrics.estimateTokens(content);
-        Metrics.logUsage(projectRoot, "@mcp", `read_file: ${args.path}`, tokens);
-        return { content: [{ type: "text", text: content }] };
-    }
-    catch (e) {
-        const err = `Failed to read file: ${String(e)}`;
-        Metrics.logError(projectRoot, "@mcp", `read_file:${args.path}`, err);
-        return { isError: true, content: [{ type: "text", text: `[ERROR] ${err}` }] };
-    }
-}