atabey 0.0.16 → 0.0.18

package/framework-mcp/dist/framework-mcp/src/utils/permissions.js

@@ -1,207 +0,0 @@
-/**
- * ─── RBAC PERMISSION MATRIX ───────────────────────────────────────────────
- *
- * Enforces agent-scoped file system permissions at the MCP tool layer.
- * This is the file-level RBAC enforcement point for:
- *   - Claude Code  (calls write_file / read_file via MCP sub-agents)
- *   - Gemini CLI   (calls write_file / read_file via MCP server)
- *   - Cursor       (calls write_file / read_file via MCP rules)
- *   - Codex CLI    (calls write_file / read_file via agent allowed-tools)
- *   - Antigravity  (calls write_file / read_file via customAgentSpec tools)
- *
- * Permission matrix is stored in `.atabey/permission-matrix.json`:
- * {
- *   "@frontend": { "write": ["apps/web/**"], "read": ["apps/web/**", "docs/**"] },
- *   "@backend":  { "write": ["apps/backend/**"], "read": ["apps/backend/**", "apps/web/types/**"] }
- * }
- *
- * Agent Tier enforcement:
- *   supreme (@manager, @security) — no write/read restrictions (omnipotent)
- *   core    (@backend, @frontend, ...) — matrix-enforced
- *   recon   (@explorer, @git, @analyst, @native) — read-only by default,
- *             write requires explicit matrix entry
- */
-import fs from "fs";
-import path from "path";
-import { resolveFrameworkDir } from "./security.js";
-// ─── Tier hierarchy ─────────────────────────────────────────────────────────
-/** Well-known tier for agents defined in the built-in registry */
-const AGENT_TIER_MAP = {
-    "@manager": "supreme",
-    "@security": "supreme",
-    "@backend": "core",
-    "@frontend": "core",
-    "@mobile": "core",
-    "@quality": "core",
-    "@database": "core",
-    "@devops": "core",
-    "@architect": "core",
-    "@explorer": "recon",
-    "@git": "recon",
-    "@analyst": "recon",
-    "@native": "recon",
-};
-export function getAgentTier(agentName) {
-    return AGENT_TIER_MAP[agentName] ?? "core"; // unknown agents default to core
-}
-// ─── Glob → RegExp ──────────────────────────────────────────────────────────
-function globToRegex(glob) {
-    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-    const step1 = escaped.replace(/\*\*/g, "__DBL_STR__");
-    const step2 = step1.replace(/\*/g, "[^/]*");
-    const regexStr = "^" + step2.replace(/__DBL_STR__/g, ".*") + "$";
-    return new RegExp(regexStr);
-}
-// ─── Active Agent Resolution ─────────────────────────────────────────────────
-/**
- * Resolves the active agent for the current operation.
- *
- * Priority order:
- * 1. ATABEY_ACTIVE_AGENT env var (set by AgentLoop per-invocation — most reliable)
- * 2. `.atabey/memory/status.json` first EXECUTING agent (legacy fallback)
- *
- * Note: The traceId-scoped approach is preferred when AgentLoop sets
- * ATABEY_ACTIVE_AGENT before spawning the MCP tool call.
- */
-export function resolveActiveAgent(frameworkDir) {
-    // 1. Env var (highest reliability — set by orchestration layer)
-    const envAgent = process.env.ATABEY_ACTIVE_AGENT?.trim();
-    if (envAgent) {
-        return envAgent.startsWith("@") ? envAgent : `@${envAgent}`;
-    }
-    // 2. status.json fallback
-    const statusPath = path.join(frameworkDir, "memory", "status.json");
-    if (!fs.existsSync(statusPath))
-        return null;
-    try {
-        const status = JSON.parse(fs.readFileSync(statusPath, "utf8"));
-        for (const [agentName, info] of Object.entries(status)) {
-            if (info.state === "EXECUTING") {
-                return agentName.startsWith("@") ? agentName : `@${agentName}`;
-            }
-        }
-    }
-    catch (e) {
-        process.stderr.write(`[Permissions] Warning: Failed to read status.json: ${String(e)}\n`);
-    }
-    return null;
-}
-// ─── Matrix Loader ───────────────────────────────────────────────────────────
-function loadMatrix(frameworkDir) {
-    const matrixPath = path.join(frameworkDir, "permission-matrix.json");
-    if (!fs.existsSync(matrixPath))
-        return null;
-    try {
-        return JSON.parse(fs.readFileSync(matrixPath, "utf8"));
-    }
-    catch (e) {
-        throw new Error(`Failed to parse permission-matrix.json: ${String(e)}`, { cause: e });
-    }
-}
-/**
- * Internal enforcement logic for both read and write operations.
- *
- * Enforcement logic per tier:
- * - supreme: always allowed (no matrix needed)
- * - core: enforced by matrix; if no rule defined → default-allow
- * - recon: write → always denied unless explicit matrix allow
- *           read  → allowed by default (recon agents must be able to explore)
- */
-function enforcePermission(projectRoot, targetFilePath, accessType) {
-    const frameworkDir = resolveFrameworkDir(projectRoot);
-    const absoluteFrameworkPath = path.isAbsolute(frameworkDir)
-        ? frameworkDir
-        : path.resolve(projectRoot, frameworkDir);
-    const activeAgent = resolveActiveAgent(absoluteFrameworkPath);
-    // No active agent identified → default-allow (non-agent call, e.g. CLI tools)
-    if (!activeAgent)
-        return;
-    const tier = getAgentTier(activeAgent);
-    // Supreme agents are omnipotent — no matrix enforcement
-    if (tier === "supreme")
-        return;
-    // Recon agents: block writes unless explicitly allowed in matrix
-    if (tier === "recon" && accessType === "write") {
-        const matrix = loadMatrix(absoluteFrameworkPath);
-        if (!matrix) {
-            throw new Error(`Permission Denied: Agent ${activeAgent} (tier: recon) cannot write files. ` +
-                "Recon agents (@explorer, @git, @analyst, @native) are read-only by default. " +
-                "Add an explicit write rule to permission-matrix.json to grant write access.");
-        }
-        const agentRules = matrix[activeAgent];
-        if (!agentRules?.write?.length) {
-            throw new Error(`Permission Denied: Agent ${activeAgent} (tier: recon) has no write rules in permission-matrix.json. ` +
-                "Recon agents are read-only by default.");
-        }
-        // Fall through to glob check below
-    }
-    const matrix = loadMatrix(absoluteFrameworkPath);
-    // No matrix file → default-allow (matrix is opt-in)
-    if (!matrix)
-        return;
-    const agentRules = matrix[activeAgent];
-    // No rules for this agent → default-allow
-    if (!agentRules)
-        return;
-    const rules = accessType === "write" ? agentRules.write : (agentRules.read ?? null);
-    // No rule for this access type → default-allow
-    if (!rules)
-        return;
-    const relativeTargetPath = path.relative(projectRoot, path.resolve(projectRoot, targetFilePath));
-    const allowed = rules.some(glob => globToRegex(glob).test(relativeTargetPath));
-    if (!allowed) {
-        throw new Error(`Permission Denied: Agent ${activeAgent} (tier: ${tier}) is not authorized to ` +
-            `${accessType} "${relativeTargetPath}". ` +
-            `Matrix rules restrict ${accessType} to: [${rules.join(", ")}].`);
-    }
-}
-// ─── Public API ─────────────────────────────────────────────────────────────
-/**
- * Verifies that the active agent has WRITE permission for the target file.
- * Called by: write_file, replace_text, batch_surgical_edit, patch_file
- *
- * Throws a descriptive error if permission is denied.
- */
-export function verifyWritePermission(projectRoot, targetFilePath) {
-    enforcePermission(projectRoot, targetFilePath, "write");
-}
-/**
- * Verifies that the active agent has READ permission for the target file.
- * Called by: read_file, view_file (alias)
- *
- * Throws a descriptive error if permission is denied.
- * Note: read enforcement is SOFTER than write — recon agents can read freely
- * unless an explicit read matrix restriction is defined.
- */
-export function verifyReadPermission(projectRoot, targetFilePath) {
-    enforcePermission(projectRoot, targetFilePath, "read");
-}
-/**
- * Verifies that the sender agent is allowed to send messages to the target agent
- * based on the AgentTier hierarchy.
- *
- * Messaging rules (AI IDE governance layer):
- * - Any tier → supreme:  allowed (escalation always permitted)
- * - core → core:         allowed
- * - recon → core:        allowed (recon can delegate up)
- * - recon → supreme:     allowed
- * - core → recon:        BLOCKED (core agents should not delegate down to recon)
- * - supreme → any:       allowed
- *
- * Rationale: Recon agents (@explorer, @git) are information-gatherers.
- * If a core agent delegates to a recon agent, it bypasses the quality gate
- * and risk engine — a potential governance gap.
- */
-export function verifyMessagingPermission(fromAgent, toAgent) {
-    const fromTier = getAgentTier(fromAgent);
-    const toTier = getAgentTier(toAgent);
-    // supreme senders: unrestricted
-    if (fromTier === "supreme")
-        return;
-    // core → recon: block (prevents quality-gate bypass via recon delegation)
-    if (fromTier === "core" && toTier === "recon") {
-        throw new Error(`[RBAC] Messaging violation: Agent ${fromAgent} (tier: core) cannot delegate to ` +
-            `${toAgent} (tier: recon). Core agents must delegate up to @manager or peer core agents. ` +
-            "Recon agents are read-only information gatherers and cannot execute delegated tasks.");
-    }
-}

package/framework-mcp/dist/framework-mcp/src/utils/prompt-injection.js

@@ -1,63 +0,0 @@
-/**
- * ─── PROMPT INJECTION PROTECTION ENGINE ────────────────────────────
- *
- * Scans, detects, and neutralizes prompt injection payloads in tool outputs
- * before they are returned to the AI assistant's context.
- *
- * This prevents malicious files, code comments, or external resources from
- * hijacking the AI client (e.g., instructing it to delete files or ignore safety).
- */
-import { logger } from "../../../src/shared/logger.js";
-// Common prompt injection signatures
-const INJECTION_PATTERNS = [
-    /ignore\s+(?:all\s+)?instructions/gi,
-    /system\s+override/gi,
-    /you\s+must\s+now/gi,
-    /you\s+are\s+now/gi,
-    /bypass\s+governance/gi,
-    /bypass\s+safety/gi,
-    /bypass\s+atabey/gi,
-    /dan\s+mode/gi,
-    /developer\s+mode/gi,
-    /override\s+system\s+instructions/gi,
-    /ignore\s+safety\s+rules/gi,
-    /\[system\s+prompt\]/gi,
-    /<system_prompt>/gi,
-    /disable\s+restrictions/gi
-];
-export class PromptInjectionProtection {
-    /**
-     * Scan tool response text for injection patterns.
-     * Replaces any matches with a redirection block and logs it.
-     */
-    static sanitizeResponse(text) {
-        if (!text) {
-            return { sanitized: text, detected: false, patterns: [] };
-        }
-        let detected = false;
-        const patternsMatched = [];
-        let sanitized = text;
-        for (const pattern of INJECTION_PATTERNS) {
-            if (pattern.test(sanitized)) {
-                detected = true;
-                const matches = text.match(pattern);
-                if (matches) {
-                    matches.forEach(m => {
-                        if (!patternsMatched.includes(m)) {
-                            patternsMatched.push(m);
-                        }
-                    });
-                }
-                sanitized = sanitized.replace(pattern, "[REDACTED PROMPT INJECTION]");
-            }
-        }
-        if (detected) {
-            logger.warn(`[INJECTION PROTECTION] Blocked prompt injection pattern in tool response: ${patternsMatched.join(", ")}`);
-        }
-        return {
-            sanitized,
-            detected,
-            patterns: patternsMatched
-        };
-    }
-}

package/framework-mcp/dist/framework-mcp/src/utils/quality.js

@@ -1,124 +0,0 @@
-import fs from "fs";
-import path from "path";
-/**
- * Shared Code Quality Heuristic Scanner
- * Evaluates functions lengths, nesting depth, and usage of the forbidden 'any' type.
- */
-export function analyzePathQuality(projectRoot, targetPath) {
-    const absolutePath = path.resolve(projectRoot, targetPath);
-    const files = [];
-    function collectFilesSync(dir, exts) {
-        if (!fs.existsSync(dir))
-            return;
-        try {
-            const stat = fs.statSync(dir);
-            if (stat.isFile()) {
-                if (exts.some(ext => dir.endsWith(ext))) {
-                    files.push(dir);
-                }
-                return;
-            }
-            const entries = fs.readdirSync(dir, { withFileTypes: true });
-            for (const entry of entries) {
-                const fullPath = path.join(dir, entry.name);
-                if (entry.isDirectory() && !entry.name.startsWith("node_modules") && !entry.name.startsWith(".")) {
-                    collectFilesSync(fullPath, exts);
-                }
-                else if (entry.isFile() && exts.some(ext => entry.name.endsWith(ext))) {
-                    files.push(fullPath);
-                }
-            }
-        }
-        catch {
-            // Ignore errors reading files/dirs
-        }
-    }
-    collectFilesSync(absolutePath, [".ts", ".tsx"]);
-    const issues = [];
-    let longFunctions = 0;
-    let deepNesting = 0;
-    let anyTypes = 0;
-    files.forEach((f) => {
-        try {
-            const content = fs.readFileSync(f, "utf8");
-            const lines = content.split("\n");
-            const relativePath = path.relative(projectRoot, f);
-            // Check for `any` type
-            lines.forEach((line, idx) => {
-                if (line.trim().startsWith("//") || line.trim().startsWith("/*"))
-                    return;
-                if (line.match(/\bany\b/) && !line.includes("// eslint-disable") && !line.includes("as any")) {
-                    anyTypes++;
-                    issues.push({
-                        file: relativePath,
-                        line: idx + 1,
-                        type: "any-type",
-                        message: `Line ${idx + 1}: Usage of 'any' type`
-                    });
-                }
-            });
-            // Check for long functions
-            let inFunction = false;
-            let funcLines = 0;
-            let startLine = 0;
-            let funcName = "anonymous";
-            for (let i = 0; i < lines.length; i++) {
-                const line = lines[i];
-                // Detect function/method starts using regex
-                const funcMatch = line.match(/(?:public|private|protected|static\s+)?(?:async\s+)?(?:function\s+)?(\w+)\s*\([^)]*\)\s*{/);
-                const methodMatch = !funcMatch ? line.match(/^\s*(?:public|private|protected|static\s+)?(\w+)\s*\([^)]*\)\s*{/) : null;
-                const arrowMatch = !funcMatch && !methodMatch ? line.match(/(?:const|let|var)?\s*(\w+)?\s*=\s*(?:async\s*)?\([^)]*\)\s*=>\s*{/) : null;
-                if (funcMatch || methodMatch || arrowMatch) {
-                    inFunction = true;
-                    funcLines = 1;
-                    startLine = i + 1;
-                    funcName = (funcMatch?.[1] || methodMatch?.[1] || arrowMatch?.[1] || "anonymous").trim();
-                    continue;
-                }
-                if (inFunction) {
-                    funcLines++;
-                    if (line.includes("}")) {
-                        if (funcLines > 50) {
-                            longFunctions++;
-                            issues.push({
-                                file: relativePath,
-                                line: startLine,
-                                type: "complexity",
-                                message: `Function '${funcName}' is ${funcLines} lines long (max: 50)`
-                            });
-                        }
-                        inFunction = false;
-                    }
-                }
-            }
-            // Check nesting depth
-            lines.forEach((line, idx) => {
-                const leadingSpaces = line.match(/^(\s*)/)?.[0].length || 0;
-                if (leadingSpaces >= 10 && !line.trim().startsWith("//") && !line.trim().startsWith("*")) {
-                    const indentSize = (leadingSpaces % 4 === 0) ? 4 : 2;
-                    const depth = Math.floor(leadingSpaces / indentSize);
-                    if (depth > 4) {
-                        deepNesting++;
-                        issues.push({
-                            file: relativePath,
-                            line: idx + 1,
-                            type: "complexity",
-                            message: `Line ${idx + 1}: Nesting depth ${depth}`
-                        });
-                    }
-                }
-            });
-        }
-        catch {
-            // Ignore files that can't be read
-        }
-    });
-    return {
-        totalFiles: files.length,
-        totalIssues: issues.length,
-        longFunctions,
-        deepNesting,
-        anyTypes,
-        issues
-    };
-}

package/framework-mcp/dist/framework-mcp/src/utils/rules-engine.js

@@ -1,231 +0,0 @@
-/**
- * ─── RULES ENGINE (Prompt Conflict Resolution) ────────────────────
- *
- * Resolves conflicts between AI CLI built-in prompts and Atabey governance rules.
- * Ensures Atabey's critical rules ALWAYS override CLI-level instructions.
- *
- * Priority System:
- * - CRITICAL (P0): Non-bypassable rules (zero any, no console.log, PII masking)
- * - HIGH (P1): Important rules that should not be violated
- * - MEDIUM (P2): Standard best practices
- * - LOW (P3): Recommendations only
- *
- * Enforcement Mechanisms:
- * 1. Pre-execution: Rule validation BEFORE tool runs
- * 2. Post-execution: Scan changed files for violations → auto-rollback
- * 3. CLI System Prompt Override: Inject critical rules at MCP initialization
- */
-import path from "path";
-// ─── Built-in Governance Rules ────────────────────────────────────
-const GOVERNANCE_RULES = [
-    // ── CRITICAL (P0) Rules ────────────────────────────────────
-    {
-        id: "no-any-types",
-        name: "Zero Any Type Policy",
-        description: "TypeScript 'any' type is strictly forbidden",
-        priority: "CRITICAL",
-        detectPattern: /:\s*any\b/g,
-        appliesToExtensions: [".ts", ".tsx"],
-        errorMessage: "CRITICAL: 'any' type is forbidden. Use 'unknown' with proper type guards instead.",
-        bypassable: false,
-    },
-    {
-        id: "no-console-log",
-        name: "No Console Log",
-        description: "console.log/error/warn is forbidden (use logger instead)",
-        priority: "CRITICAL",
-        detectPattern: /console\.(log|error|warn|debug|info)\s*\(/g,
-        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx"],
-        errorMessage: "CRITICAL: console.log/error/warn is forbidden. Use the project's logger instead.",
-        bypassable: false,
-    },
-    {
-        id: "pii-masking",
-        name: "PII Masking Required",
-        description: "Sensitive data must be masked before logging or storing",
-        priority: "CRITICAL",
-        errorMessage: "CRITICAL: Detected potential PII in unmasked form. Use maskText() / maskObject() from pii.ts.",
-        bypassable: false,
-    },
-    // ── HIGH (P1) Rules ────────────────────────────────────────
-    {
-        id: "no-hardcoded-secrets",
-        name: "No Hardcoded Secrets",
-        description: "API keys, tokens, passwords must use environment variables",
-        priority: "HIGH",
-        detectPattern: /(['"])sk-[a-zA-Z0-9]{20,}['"]|(['"])ghp_[a-zA-Z0-9]{36,}['"]|(['"])AIza[0-9A-Za-z_-]{35}['"]/g,
-        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".java", ".yaml", ".yml", ".env.example"],
-        errorMessage: "HIGH: Hardcoded API keys/tokens detected. Use environment variables (process.env.*).",
-        bypassable: false,
-    },
-    {
-        id: "no-commented-code",
-        name: "No Commented-Out Code",
-        description: "Dead code should be removed, not commented out",
-        priority: "HIGH",
-        detectPattern: /\/\/\s*.{10,}/g,
-        appliesToExtensions: [".ts", ".tsx", ".js", ".jsx"],
-        errorMessage: "HIGH: Commented-out code detected. Remove dead code instead of commenting.",
-        bypassable: true,
-    },
-    // ── MEDIUM (P2) Rules ──────────────────────────────────────
-    {
-        id: "no-console-in-jsx",
-        name: "No Console in JSX",
-        description: "Avoid console statements inside JSX/TSX components",
-        priority: "MEDIUM",
-        detectPattern: /{.*console\.(log|error|warn)\(.*}/g,
-        appliesToExtensions: [".tsx", ".jsx"],
-        errorMessage: "MEDIUM: Console statement inside JSX detected. Move to event handler or useEffect.",
-        bypassable: true,
-    },
-    {
-        id: "i18n-usage",
-        name: "Internationalization Required",
-        description: "Use i18n for user-facing strings",
-        priority: "MEDIUM",
-        detectPattern: /(['"])([A-Z][a-z]+ [a-z]+ [a-z]+)['"]/g,
-        appliesToExtensions: [".tsx", ".jsx"],
-        errorMessage: "MEDIUM: User-facing string detected. Use i18n translation function instead.",
-        bypassable: true,
-    },
-];
-// ─── Rule Engine ──────────────────────────────────────────────────
-let rulesMap = null;
-function getRulesMap() {
-    if (!rulesMap) {
-        rulesMap = new Map();
-        for (const rule of GOVERNANCE_RULES) {
-            rulesMap.set(rule.id, rule);
-        }
-    }
-    return rulesMap;
-}
-/**
- * Get all governance rules.
- */
-export function getAllRules() {
-    return [...GOVERNANCE_RULES];
-}
-/**
- * Get rules by priority level.
- */
-export function getRulesByPriority(priority) {
-    return GOVERNANCE_RULES.filter(r => r.priority === priority);
-}
-/**
- * Get non-bypassable rules (CRITICAL + HIGH non-bypassable).
- */
-export function getNonBypassableRules() {
-    return GOVERNANCE_RULES.filter(r => !r.bypassable);
-}
-/**
- * Scan file content for rule violations.
- * Returns array of violations found.
- */
-export function scanFileForViolations(filePath, content) {
-    const ext = path.extname(filePath);
-    const violations = [];
-    const lines = content.split("\n");
-    for (const rule of GOVERNANCE_RULES) {
-        // Check if rule applies to this file extension
-        if (rule.appliesToExtensions && !rule.appliesToExtensions.includes(ext)) {
-            continue;
-        }
-        // Check if rule has a detect pattern
-        if (!rule.detectPattern)
-            continue;
-        // Scan each line
-        for (let i = 0; i < lines.length; i++) {
-            const match = lines[i].match(rule.detectPattern);
-            if (match) {
-                violations.push({
-                    rule,
-                    match: match[0],
-                    line: i + 1,
-                });
-            }
-        }
-    }
-    return violations;
-}
-/**
- * Validate tool arguments against governance rules.
- * Returns violation messages if any critical rule is violated.
- */
-export function validateArgsAgainstRules(toolName, args) {
-    const nonBypassable = getNonBypassableRules();
-    for (const rule of nonBypassable) {
-        // Check if rule applies to this tool
-        if (rule.appliesToTools && !rule.appliesToTools.includes(toolName)) {
-            continue;
-        }
-        // For write_file and replace_text, check content for violations
-        if ((toolName === "write_file" || toolName === "replace_text") && args.content) {
-            const content = args.content;
-            const filePath = args.path || "unknown.ts";
-            const violations = scanFileForViolations(filePath, content);
-            if (violations.length > 0) {
-                const details = violations.map(v => `  Line ${v.line}: ${v.match} (${v.rule.name} - ${v.rule.priority})`).join("\n");
-                return [
-                    `[GOVERNANCE] ${rule.priority} rule violation: ${rule.name}`,
-                    `${rule.errorMessage}`,
-                    "\nViolations:",
-                    details,
-                ].join("\n");
-            }
-        }
-    }
-    return null;
-}
-/**
- * Validate tool response for governance violations.
- * Returns violation messages if found.
- */
-export function validateResponseAgainstRules(toolName, responseText) {
-    // For file reads, check if the content contains PII or secrets
-    if (toolName === "read_file" && responseText.length > 0) {
-        const criticalRules = getNonBypassableRules();
-        for (const rule of criticalRules) {
-            if (rule.detectPattern && rule.detectPattern.test(responseText)) {
-                return `[GOVERNANCE] ${rule.priority} violation detected in response: ${rule.name}. ${rule.errorMessage}`;
-            }
-        }
-    }
-    return null;
-}
-/**
- * Build system prompt override block for CLI initialization.
- * This is injected into the AI's system prompt at MCP connect time.
- */
-export function buildSystemPromptOverride() {
-    const criticalRules = getRulesByPriority("CRITICAL");
-    const highRules = getRulesByPriority("HIGH");
-    return [
-        "## [ATABEY GOVERNANCE] Critical Rules — DO NOT OVERRIDE",
-        "",
-        "The following rules are ENFORCED by the Atabey Governance Layer.",
-        "They CANNOT be bypassed or disabled.",
-        "",
-        "### Critical Rules (Non-Bypassable)",
-        ...criticalRules.map(r => `- 🔴 ${r.name}: ${r.description}`),
-        "",
-        "### High Priority Rules",
-        ...highRules.map(r => `- 🟠 ${r.name}: ${r.description}`),
-        "",
-        "> These rules are injected at the MCP middleware layer and enforced",
-        "> at both pre-execution and post-execution stages.",
-        "",
-    ].join("\n");
-}
-/**
- * Add a custom governance rule at runtime.
- */
-export function addRule(rule) {
-    const map = getRulesMap();
-    if (!map.has(rule.id)) {
-        GOVERNANCE_RULES.push(rule);
-        map.set(rule.id, rule);
-    }
-}
-export { GOVERNANCE_RULES as DefaultGovernanceRules };

package/framework-mcp/dist/framework-mcp/src/utils/security.js

@@ -1,60 +0,0 @@
-import path from "path";
-import fs from "fs";
-import { FRAMEWORK, MCP, UNIFIED_HUB_DIR } from "../constants.js"; // New import
-import os from "os"; // Need os.homedir()
-/**
- * Validates and resolves a user-provided path to prevent path traversal attacks.
- * Ensures the resolved path stays within the project root boundary.
- */
-export function safePath(projectRoot, userPath) {
-    const resolved = path.resolve(projectRoot, userPath);
-    const normalizedRoot = path.resolve(projectRoot);
-    if (!resolved.startsWith(normalizedRoot + path.sep) && resolved !== normalizedRoot) {
-        throw new Error(`Access denied: path "${userPath}" escapes project root.`);
-    }
-    return resolved;
-}
-/**
- * Resolves the active framework directory.
- * Priority: ATABEY_TEST_DIR (env) -> package.json `atabey.frameworkDir` -> `.atabey` -> other adapter dirs -> global HOME.
- */
-export function resolveFrameworkDir(projectRoot) {
-    // For test environments, use the explicitly set test directory.
-    const testDir = process.env[MCP.TEST_DIR_ENV];
-    if (testDir)
-        return testDir;
-    // 1. Authoritative source: read from package.json if present
-    try {
-        const pkgPath = path.join(projectRoot, "package.json");
-        if (fs.existsSync(pkgPath)) {
-            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-            const atabeyConfig = pkg["atabey"];
-            if (atabeyConfig && typeof atabeyConfig["frameworkDir"] === "string") {
-                // Ensure the path is relative if it's within the project, otherwise use as-is.
-                const resolvedDir = path.resolve(projectRoot, atabeyConfig["frameworkDir"]);
-                if (resolvedDir.startsWith(path.resolve(projectRoot))) {
-                    return path.relative(projectRoot, resolvedDir);
-                }
-                return atabeyConfig["frameworkDir"];
-            }
-        }
-    }
-    catch {
-        // ignore — fall through to filesystem scan
-    }
-    // 2. Filesystem scan in projectRoot for common framework directories
-    const localCandidates = [
-        FRAMEWORK.CORE_DIR, // .atabey
-        UNIFIED_HUB_DIR, // .agents
-        // Add other adapter specific directories if needed, or remove if unified is strictly enforced
-    ];
-    for (const candidate of localCandidates) {
-        const candidatePath = path.join(projectRoot, candidate);
-        if (fs.existsSync(candidatePath)) {
-            return candidate;
-        }
-    }
-    // 3. Fallback to global home directory.
-    const homeDir = os.homedir();
-    return path.join(homeDir, FRAMEWORK.CORE_DIR);
-}