atabey 0.0.37 → 0.1.0

package/dist/atabey-mcp/src/mcp/utils/ast-scan.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Real AST scanning using the TypeScript Compiler API (no regex heuristics).
+ *
+ * Detects:
+ *   - `any` keyword types (AnyKeyword)
+ *   - console.log/error/warn/debug/info property-access calls
+ *   - `debugger` statements
+ *   - TypeScript suppression directives (ts-ignore / ts-nocheck)
+ *
+ * Used by the rules engine to replace the fragile `:\s*any\b` regex so that
+ * comments/strings containing "any" no longer trigger false positives and
+ * type aliases / generic `any` are caught.
+ */
+export type AstRuleId = "no-any-types" | "no-console-log" | "no-ts-directives" | "no-debugger";
+export interface AstViolation {
+    ruleId: AstRuleId;
+    line: number;
+    column: number;
+    text: string;
+}
+export declare function scanSourceForViolations(filePath: string, content: string): AstViolation[];

package/dist/atabey-mcp/src/mcp/utils/ast-scan.js

@@ -0,0 +1,64 @@
+/**
+ * Real AST scanning using the TypeScript Compiler API (no regex heuristics).
+ *
+ * Detects:
+ *   - `any` keyword types (AnyKeyword)
+ *   - console.log/error/warn/debug/info property-access calls
+ *   - `debugger` statements
+ *   - TypeScript suppression directives (ts-ignore / ts-nocheck)
+ *
+ * Used by the rules engine to replace the fragile `:\s*any\b` regex so that
+ * comments/strings containing "any" no longer trigger false positives and
+ * type aliases / generic `any` are caught.
+ */
+import ts from "typescript";
+const CONSOLE_METHODS = new Set(["log", "error", "warn", "debug", "info", "trace"]);
+export function scanSourceForViolations(filePath, content) {
+    const scriptKind = /\.tsx$/i.test(filePath)
+        ? ts.ScriptKind.TSX
+        : /\.jsx$/i.test(filePath)
+            ? ts.ScriptKind.JSX
+            : /\.js$/i.test(filePath)
+                ? ts.ScriptKind.JS
+                : ts.ScriptKind.TS;
+    let sourceFile;
+    try {
+        sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, scriptKind);
+    }
+    catch {
+        return [];
+    }
+    const violations = [];
+    const at = (node, ruleId, text) => {
+        const start = node.getStart(sourceFile);
+        const { line, character } = sourceFile.getLineAndCharacterOfPosition(start);
+        violations.push({ ruleId, line: line + 1, column: character + 1, text });
+    };
+    const visit = (node) => {
+        // `any` keyword type
+        if (node.kind === ts.SyntaxKind.AnyKeyword) {
+            at(node, "no-any-types", "any");
+        }
+        // console.* calls
+        if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === "console") {
+            const method = node.name.text;
+            if (CONSOLE_METHODS.has(method))
+                at(node, "no-console-log", `console.${method}`);
+        }
+        // debugger
+        if (node.kind === ts.SyntaxKind.DebuggerStatement) {
+            at(node, "no-debugger", "debugger");
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    // TypeScript suppression directives (comment-based)
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        if (/@ts-(ignore|nocheck|expect-error)\b/.test(lines[i])) {
+            violations.push({ ruleId: "no-ts-directives", line: i + 1, column: 1, text: lines[i].trim().slice(0, 80) });
+        }
+    }
+    return violations;
+}
+//# sourceMappingURL=ast-scan.js.map

package/dist/atabey-mcp/src/mcp/utils/ast-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast-scan.js","sourceRoot":"","sources":["../../../../../../atabey-mcp/src/mcp/utils/ast-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAC;AAW5B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpF,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,OAAe;IACrE,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;QACnB,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;YACnB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACvB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;gBAClB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAE3B,IAAI,UAAyB,CAAC;IAC9B,IAAI,CAAC;QACD,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAmB,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,CAAC,IAAa,EAAE,MAAiB,EAAE,IAAY,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC;QAC5E,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QAClC,qBAAqB;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YACzC,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,kBAAkB;QAClB,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,WAAW;QACX,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAChD,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,CAAC;IAElB,oDAAoD;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}

package/dist/atabey-mcp/src/mcp/utils/auth.d.ts

@@ -0,0 +1,73 @@
+export interface AuthResult {
+    authenticated: boolean;
+    user: string;
+    reason?: string;
+    method?: "none" | "master" | "user" | "db" | "anonymous" | "denied";
+}
+export interface AuthStatus {
+    enabled: boolean;
+    required: boolean;
+    masterConfigured: boolean;
+    userCount: number;
+    dbUserCount: number;
+    openAccess: boolean;
+}
+/** Paths that never require a bearer token (health + login only by default). */
+export declare const DEFAULT_PUBLIC_API_PATHS: Set<string>;
+/**
+ * Initialize authentication from environment variables.
+ * Safe to call multiple times (re-reads env).
+ */
+export declare function initAuth(): void;
+/**
+ * Whether auth is mandatory (fail closed).
+ */
+export declare function isAuthRequired(): boolean;
+/**
+ * Whether any credential mechanism is configured.
+ */
+export declare function isAuthEnabled(): boolean;
+/**
+ * Authenticate a request using the Authorization header.
+ */
+export declare function authenticate(req: {
+    headers: Record<string, string | string[] | undefined>;
+}): AuthResult;
+/**
+ * Authenticate using a raw token string.
+ */
+export declare function authenticateToken(token: string): AuthResult;
+/**
+ * Whether this path may be accessed without a valid token.
+ */
+export declare function isPublicPath(pathname: string): boolean;
+/**
+ * Require auth for a path. Returns 401 payload or null if allowed.
+ */
+export declare function requireAuthForPath(pathname: string, req: {
+    headers: Record<string, string | string[] | undefined>;
+}): {
+    allowed: true;
+    user: string;
+} | {
+    allowed: false;
+    status: 401;
+    error: string;
+};
+/**
+ * True when the request may perform admin-only operations.
+ * Open local mode (no auth configured) is treated as admin; otherwise the
+ * master token or a DB user with role "admin" is required.
+ */
+export declare function isAdminRequest(req: {
+    headers: Record<string, string | string[] | undefined>;
+}): boolean;
+/**
+ * Stdio mode user identity (not HTTP).
+ */
+export declare function getCurrentUser(): string;
+export declare function getAuthHeader(user: string, token: string): string;
+export declare function getConfiguredUsers(): string[];
+export declare function getAuthStatus(): AuthStatus;
+/** Test helper */
+export declare function resetAuthForTests(): void;

package/dist/atabey-mcp/src/mcp/utils/auth.js

@@ -0,0 +1,316 @@
+import { execSync } from "child_process";
+import crypto from "crypto";
+import { AtabeyStorage } from "../../shared/storage.js";
+let authUsers = [];
+let masterToken = null;
+let authRequired = false;
+let initialized = false;
+/** Paths that never require a bearer token (health + login only by default). */
+export const DEFAULT_PUBLIC_API_PATHS = new Set([
+    "/api/health",
+    "/mcp/health",
+    "/api/auth/login",
+]);
+function timingSafeTokenEqual(a, b) {
+    try {
+        const ba = Buffer.from(a, "utf8");
+        const bb = Buffer.from(b, "utf8");
+        if (ba.length !== bb.length || ba.length === 0) {
+            // Still do a compare to reduce timing signal on length
+            const dummy = Buffer.alloc(ba.length || 1);
+            crypto.timingSafeEqual(dummy, dummy);
+            return false;
+        }
+        return crypto.timingSafeEqual(ba, bb);
+    }
+    catch {
+        return false;
+    }
+}
+function hasCredentialStore() {
+    let dbUsers;
+    try {
+        dbUsers = AtabeyStorage.hasUsers();
+    }
+    catch {
+        dbUsers = false;
+    }
+    return !!masterToken || authUsers.length > 0 || dbUsers;
+}
+/**
+ * Initialize authentication from environment variables.
+ * Safe to call multiple times (re-reads env).
+ */
+export function initAuth() {
+    masterToken = process.env.MCP_AUTH_TOKEN?.trim() || null;
+    authRequired =
+        process.env.MCP_AUTH_REQUIRED === "true" ||
+            process.env.MCP_AUTH_REQUIRED === "1" ||
+            process.env.ATABEY_AUTH_REQUIRED === "true" ||
+            process.env.ATABEY_AUTH_REQUIRED === "1";
+    const usersStr = process.env.MCP_AUTH_USERS || "";
+    if (usersStr) {
+        authUsers = usersStr.split(",").map((pair) => {
+            const idx = pair.indexOf(":");
+            if (idx <= 0)
+                return { name: "unknown", token: "" };
+            return {
+                name: pair.slice(0, idx).trim() || "unknown",
+                token: pair.slice(idx + 1).trim() || "",
+            };
+        }).filter((u) => u.token);
+    }
+    else {
+        authUsers = [];
+    }
+    if (masterToken) {
+        process.stderr.write(`[AUTH] Master token configured (${masterToken.length} chars)\n`);
+    }
+    if (authUsers.length > 0) {
+        process.stderr.write(`[AUTH] ${authUsers.length} user(s) configured: ${authUsers.map((u) => u.name).join(", ")}\n`);
+    }
+    try {
+        if (AtabeyStorage.hasUsers()) {
+            const dbUsers = AtabeyStorage.getUsers();
+            process.stderr.write(`[AUTH] Database authentication active (${dbUsers.length} users)\n`);
+        }
+    }
+    catch {
+        // storage not ready
+    }
+    if (authRequired) {
+        process.stderr.write("[AUTH] REQUIRED mode ON — unauthenticated API/MCP HTTP access denied\n");
+        if (!hasCredentialStore()) {
+            process.stderr.write("[AUTH] WARNING: Auth required but no MCP_AUTH_TOKEN / MCP_AUTH_USERS / DB users configured. All requests will be denied.\n");
+        }
+    }
+    else if (!hasCredentialStore()) {
+        process.stderr.write("[AUTH] No authentication configured — OPEN ACCESS (anonymous)\n");
+        process.stderr.write("[AUTH] Set MCP_AUTH_REQUIRED=true and MCP_AUTH_TOKEN=<key> to require token authentication\n");
+    }
+    initialized = true;
+}
+/**
+ * Whether auth is mandatory (fail closed).
+ */
+export function isAuthRequired() {
+    if (!initialized)
+        initAuth();
+    return authRequired;
+}
+/**
+ * Whether any credential mechanism is configured.
+ */
+export function isAuthEnabled() {
+    if (!initialized)
+        initAuth();
+    return hasCredentialStore();
+}
+/**
+ * Authenticate a request using the Authorization header.
+ */
+export function authenticate(req) {
+    if (!initialized)
+        initAuth();
+    const credentials = hasCredentialStore();
+    // Open access only when not required and no credentials
+    if (!authRequired && !credentials) {
+        return { authenticated: true, user: "anonymous", method: "anonymous" };
+    }
+    // Required but no credentials configured → fail closed
+    if (authRequired && !credentials) {
+        return {
+            authenticated: false,
+            user: "",
+            method: "denied",
+            reason: "Auth required but no tokens configured",
+        };
+    }
+    const authHeader = req.headers["authorization"];
+    const headerVal = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+    if (!headerVal) {
+        return {
+            authenticated: false,
+            user: "",
+            method: "denied",
+            reason: "Missing Authorization header",
+        };
+    }
+    const token = headerVal.startsWith("Bearer ") ? headerVal.slice(7).trim() : headerVal.trim();
+    if (!token) {
+        return { authenticated: false, user: "", method: "denied", reason: "Empty bearer token" };
+    }
+    return authenticateToken(token);
+}
+/**
+ * Authenticate using a raw token string.
+ */
+export function authenticateToken(token) {
+    if (!initialized)
+        initAuth();
+    const credentials = hasCredentialStore();
+    if (!authRequired && !credentials) {
+        return { authenticated: true, user: "anonymous", method: "anonymous" };
+    }
+    if (authRequired && !credentials) {
+        return {
+            authenticated: false,
+            user: "",
+            method: "denied",
+            reason: "Auth required but no tokens configured",
+        };
+    }
+    if (masterToken && timingSafeTokenEqual(token, masterToken)) {
+        return { authenticated: true, user: "admin", method: "master" };
+    }
+    for (const user of authUsers) {
+        if (timingSafeTokenEqual(token, user.token)) {
+            return { authenticated: true, user: user.name, method: "user" };
+        }
+    }
+    try {
+        const dbUser = AtabeyStorage.getUserByToken(token);
+        if (dbUser) {
+            return { authenticated: true, user: dbUser.name, method: "db" };
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    return { authenticated: false, user: "", method: "denied", reason: "Invalid token" };
+}
+/**
+ * Whether this path may be accessed without a valid token.
+ */
+export function isPublicPath(pathname) {
+    if (DEFAULT_PUBLIC_API_PATHS.has(pathname))
+        return true;
+    if (pathname === "/")
+        return true;
+    return false;
+}
+/**
+ * Require auth for a path. Returns 401 payload or null if allowed.
+ */
+export function requireAuthForPath(pathname, req) {
+    if (isPublicPath(pathname)) {
+        const auth = authenticate(req);
+        return { allowed: true, user: auth.authenticated ? auth.user : "anonymous" };
+    }
+    // When auth not required and open access, allow
+    if (!isAuthRequired() && !isAuthEnabled()) {
+        return { allowed: true, user: "anonymous" };
+    }
+    // When credentials configured OR required → enforce
+    if (isAuthRequired() || isAuthEnabled()) {
+        const auth = authenticate(req);
+        if (!auth.authenticated) {
+            return {
+                allowed: false,
+                status: 401,
+                error: auth.reason ||
+                    "Unauthorized. Provide Authorization: Bearer <token> header.",
+            };
+        }
+        return { allowed: true, user: auth.user };
+    }
+    return { allowed: true, user: "anonymous" };
+}
+/**
+ * True when the request may perform admin-only operations.
+ * Open local mode (no auth configured) is treated as admin; otherwise the
+ * master token or a DB user with role "admin" is required.
+ */
+export function isAdminRequest(req) {
+    if (!initialized)
+        initAuth();
+    if (!isAuthRequired() && !isAuthEnabled())
+        return true; // open local mode
+    const auth = authenticate(req);
+    if (!auth.authenticated)
+        return false;
+    if (auth.method === "master" || auth.user === "admin")
+        return true;
+    try {
+        const header = req.headers["authorization"];
+        const hv = Array.isArray(header) ? header[0] : header;
+        const token = hv ? (hv.startsWith("Bearer ") ? hv.slice(7).trim() : hv.trim()) : "";
+        if (token) {
+            const u = AtabeyStorage.getUserByToken(token);
+            if (u?.role === "admin")
+                return true;
+        }
+    }
+    catch {
+        /* fall through → not admin */
+    }
+    return false;
+}
+/**
+ * Stdio mode user identity (not HTTP).
+ */
+export function getCurrentUser() {
+    const envUser = process.env.MCP_USER;
+    if (envUser)
+        return envUser;
+    try {
+        const gitUser = execSync("git config user.name", { encoding: "utf8" }).trim();
+        if (gitUser)
+            return gitUser;
+    }
+    catch {
+        /* ignore */
+    }
+    const systemUser = process.env.USER || process.env.USERNAME;
+    if (systemUser)
+        return systemUser;
+    return "anonymous";
+}
+export function getAuthHeader(user, token) {
+    return `Bearer ${token}`;
+}
+export function getConfiguredUsers() {
+    const list = new Set();
+    if (masterToken)
+        list.add("admin");
+    authUsers.forEach((u) => list.add(u.name));
+    try {
+        AtabeyStorage.getUsers().forEach((u) => list.add(u.name));
+    }
+    catch {
+        /* ignore */
+    }
+    if (list.size === 0)
+        return ["anonymous"];
+    return Array.from(list);
+}
+export function getAuthStatus() {
+    if (!initialized)
+        initAuth();
+    let dbUserCount;
+    try {
+        dbUserCount = AtabeyStorage.getUsers().length;
+    }
+    catch {
+        dbUserCount = 0;
+    }
+    const enabled = isAuthEnabled();
+    return {
+        enabled,
+        required: authRequired,
+        masterConfigured: !!masterToken,
+        userCount: authUsers.length,
+        dbUserCount,
+        openAccess: !authRequired && !hasCredentialStore(),
+    };
+}
+/** Test helper */
+export function resetAuthForTests() {
+    authUsers = [];
+    masterToken = null;
+    authRequired = false;
+    initialized = false;
+}
+// Auto-initialize on load
+initAuth();
+//# sourceMappingURL=auth.js.map

package/dist/atabey-mcp/src/mcp/utils/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../../../atabey-mcp/src/mcp/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAwCxD,IAAI,SAAS,GAAe,EAAE,CAAC;AAC/B,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,YAAY,GAAG,KAAK,CAAC;AACzB,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IAC5C,aAAa;IACb,aAAa;IACb,iBAAiB;CACpB,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,uDAAuD;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB;IACvB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACD,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ;IACpB,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACzD,YAAY;QACR,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM;YACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG;YACrC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;YAC3C,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;IAE7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACX,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,GAAG,IAAI,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACpD,OAAO;gBACH,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;gBAC5C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE;aAC1C,CAAC;QACN,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACJ,SAAS,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,WAAW,CAAC,MAAM,WAAW,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,UAAU,SAAS,CAAC,MAAM,wBAAwB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAChG,CAAC;IACN,CAAC;IACD,IAAI,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,oBAAoB;IACxB,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC/F,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,4HAA4H,CAC/H,CAAC;QACN,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,8FAA8F,CACjG,CAAC;IACN,CAAC;IAED,WAAW,GAAG,IAAI,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC1B,IAAI,CAAC,WAAW;QAAE,QAAQ,EAAE,CAAC;IAC7B,OAAO,YAAY,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IACzB,IAAI,CAAC,WAAW;QAAE,QAAQ,EAAE,CAAC;IAC7B,OAAO,kBAAkB,EAAE,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CACxB,GAA+D;IAE/D,IAAI,CAAC,WAAW;QAAE,QAAQ,EAAE,CAAC;IAE7B,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IAEzC,wDAAwD;IACxD,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,uDAAuD;IACvD,IAAI,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO;YACH,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,wCAAwC;SACnD,CAAC;IACN,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACzE,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,OAAO;YACH,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,8BAA8B;SACzC,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7F,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9F,CAAC;IAED,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,IAAI,CAAC,WAAW;QAAE,QAAQ,EAAE,CAAC;IAE7B,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO;YACH,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,wCAAwC;SACnD,CAAC;IACN,CAAC;IAED,IAAI,WAAW,IAAI,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACpE,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpE,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,YAAY;IAChB,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACzF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IACzC,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAC9B,QAAgB,EAChB,GAA+D;IAE/D,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAChD,CAAC;IAED,oDAAoD;IACpD,IAAI,cAAc,EAAE,IAAI,aAAa,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG;gBACX,KAAK,EACD,IAAI,CAAC,MAAM;oBACX,6DAA6D;aACpE,CAAC;QACN,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAE9B;IACG,IAAI,CAAC,WAAW;QAAE,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAE1E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAEnE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACtD,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,8BAA8B;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9E,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,YAAY;IAChB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC5D,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACrD,OAAO,UAAU,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,kBAAkB;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,WAAW;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC;QACD,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACL,YAAY;IAChB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa;IACzB,IAAI,CAAC,WAAW;QAAE,QAAQ,EAAE,CAAC;IAC7B,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACD,WAAW,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACL,WAAW,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,OAAO;QACH,OAAO;QACP,QAAQ,EAAE,YAAY;QACtB,gBAAgB,EAAE,CAAC,CAAC,WAAW;QAC/B,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,WAAW;QACX,UAAU,EAAE,CAAC,YAAY,IAAI,CAAC,kBAAkB,EAAE;KACrD,CAAC;AACN,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,iBAAiB;IAC7B,SAAS,GAAG,EAAE,CAAC;IACf,WAAW,GAAG,IAAI,CAAC;IACnB,YAAY,GAAG,KAAK,CAAC;IACrB,WAAW,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,0BAA0B;AAC1B,QAAQ,EAAE,CAAC"}

package/dist/atabey-mcp/src/mcp/utils/auto-rollback.d.ts

@@ -0,0 +1,83 @@
+/**
+ * ─── AUTO-ROLLBACK + REGENERATE ───────────────────────────────────
+ *
+ * When the AI generates code that violates governance rules (e.g., `any` type,
+ * console.log, copyleft license), this module:
+ *   1. Captures the file content before the write
+ *   2. Validates the new content against governance rules
+ *   3. If violation found: blocks the write, restores original, and sends
+ *      a regenerate instruction back to the AI via MCP notification
+ *
+ * Flow:
+ *   [Pre-Write Snapshot] → [Validate Content] → [Violation?] ─yes→ [Rollback] → [Notify AI]
+ *                                                         └─no─→ [Allow Write]
+ *
+ * Key Innovation: Unlike simple blocking, this tells the AI WHY it was
+ * blocked and gives it specific instructions to self-correct.
+ */
+/** Set the project root used for durable rollback snapshots. */
+export declare function setAutoRollbackRoot(projectRoot: string): void;
+export interface ViolationRecord {
+    rule: string;
+    severity: "CRITICAL" | "HIGH" | "MEDIUM" | "LOW";
+    filePath: string;
+    line: number;
+    detail: string;
+    regenerateInstruction: string;
+}
+export declare class AutoRollback {
+    private static snapshots;
+    /**
+     * Initialize the auto-rollback system.
+     * Sets up file watcher cleanup.
+     */
+    static initialize(): void;
+    /**
+     * Prepare for a file write by capturing the current state.
+     * Call this BEFORE the tool handler writes to the file.
+     */
+    static prepareWrite(filePath: string, traceId: string): void;
+    /**
+     * Validate content and rollback if violations are found.
+     * This is called after the tool handler writes the file, but
+     * BEFORE the response is returned to the AI.
+     *
+     * Returns:
+     *   - null if content is clean
+     *   - ViolationRecord[] if violations were found and rolled back
+     */
+    static validateAndRollback(filePath: string, content: string, violations: ViolationRecord[]): ViolationRecord[] | null;
+    /**
+     * Restore a set of files to their pre-write snapshots (atomic multi-file
+     * rollback). Files without a snapshot are skipped.
+     */
+    static restoreFiles(filePaths: string[]): number;
+    /**
+     * Restore every snapshot captured under a given trace id (task-level
+     * transaction rollback).
+     */
+    static restoreTrace(traceId: string): number;
+    /**
+     * Build a regenerate instruction for the AI.
+     * This is what gets sent back to the AI to tell it to fix its output.
+     */
+    static buildRegenerateInstruction(violations: ViolationRecord[], toolName: string): string;
+    /**
+     * Validate tool response content against governance rules.
+     * Used by the MCP middleware to check file write content before returning.
+     */
+    static checkWriteContent(filePath: string, content: string, traceId: string): {
+        allowed: boolean;
+        violations: ViolationRecord[];
+        instruction: string | null;
+    };
+    /**
+     * Get snapshot stats.
+     */
+    static getSnapshotStats(): {
+        total: number;
+        restored: number;
+        pending: number;
+    };
+}
+export { AutoRollback as AutoRollbackEngine };