atabey 0.0.6 → 0.0.8

package/framework-mcp/{src/constants.ts → dist/framework-mcp/src/constants.js}

@@ -1,12 +1,9 @@
 import path from "path";
-
 /**
  * Agent Atabey — Single Source of Truth for framework constants.
  * Import from here instead of hardcoding paths, phases, or directory names.
  */
-
 // ─── Framework identity ───────────────────────────────────────────────────
-
 export const FRAMEWORK = {
     NAME: "Agent Atabey",
     CORE_DIR: ".atabey",
@@ -17,7 +14,6 @@ export const FRAMEWORK = {
     // This is where all skills are stored
     SKILLS_DIR: "skills",
 };
-
 export const FRAMEWORK_SUBDIRS = {
     AGENTS: "agents",
     SKILLS: "skills",
@@ -28,51 +24,41 @@ export const FRAMEWORK_SUBDIRS = {
     LOGS: "logs",
     CONFIG: "config",
 };
-
 export const ROOT_CONFIG_FILES = {
     MCP: "mcp.json",
     NATIVE_MODULES: "native-modules.json",
     TSCONFIG: "tsconfig.json",
     ESLINT: "eslint.config.js",
 };
-
 export const MCP = {
     // Environment variable used by MCP to identify project root
     PROJECT_ROOT_ENV: "ATABEY_PROJECT_ROOT",
     // Environment variable for test mode
     TEST_DIR_ENV: "ATABEY_TEST_DIR",
 };
-
 export const MEMORY_FILES = {
     STATE: "state.json",
     SHARED_FACTS: "shared_facts.json",
 };
-
 export const NATIVE_AGENT_PATHS = {
     gemini: ".gemini/agents",
     claude: ".claude/agents",
     cursor: ".cursor/rules",
     codex: ".agents/instructions",
     grok: ".grok",
-    "antigravity-cli": ".antigravity/agents",
+    "antigravity-cli": ".agents/agents",
 };
-
 // ─── Backward-compatible aliases ──────────────────────────────────────────
-
 export const CORE_FRAMEWORK_DIR = FRAMEWORK.CORE_DIR;
 export const UNIFIED_HUB_DIR = FRAMEWORK.UNIFIED_HUB_DIR;
 export const SKILLS_HUB_PATH = pathJoin(UNIFIED_HUB_DIR, FRAMEWORK_SUBDIRS.SKILLS);
-
 // ─── Path Helpers ─────────────────────────────────────────────────────────
-
-function pathJoin(...args: string[]): string {
+function pathJoin(...args) {
     return path.join(...args);
 }
-
-function corePath(subdir: string, filename: string): string {
+function corePath(subdir, filename) {
     return pathJoin(FRAMEWORK.CORE_DIR, subdir, filename);
 }
-
-export function knowledgePath(filename: string): string {
+export function knowledgePath(filename) {
     return corePath(FRAMEWORK_SUBDIRS.KNOWLEDGE, filename);
 }

package/framework-mcp/{src/index.ts → dist/framework-mcp/src/index.js}

@@ -4,51 +4,39 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import {
-    CallToolRequestSchema,
-    ListToolsRequestSchema,
-} from "@modelcontextprotocol/sdk/types.js";
-
-
+import { CallToolRequestSchema, ListToolsRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { TOOLS, toolHandlers } from "./tools/index.js";
-
-
+import { RESOURCES, handleReadResource } from "./resources/index.js";
 // ─── Server Setup ─────────────────────────────────────────────────
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
 // Robustly find package.json by walking up from __dirname
-function findPackageJson(startDir: string): string {
+function findPackageJson(startDir) {
     let currentDir = startDir;
     while (currentDir !== path.parse(currentDir).root) {
         const pkgPath = path.join(currentDir, "package.json");
-        if (fs.existsSync(pkgPath)) return pkgPath;
+        if (fs.existsSync(pkgPath))
+            return pkgPath;
         currentDir = path.dirname(currentDir);
     }
     throw new Error("Could not find package.json for atabey-mcp");
 }
-
 const pkgPath = findPackageJson(__dirname);
 const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
 const serverVersion = pkg.version;
-
-const server = new Server(
-    {
-        name: "atabey-mcp",
-        version: serverVersion,
+const server = new Server({
+    name: "atabey-mcp",
+    version: serverVersion,
+}, {
+    capabilities: {
+        tools: {},
+        resources: {},
     },
-    {
-        capabilities: {
-            tools: {},
-        },
-    }
-);
-
+});
 // Basic Schema Validator for Required Fields
-function validateArgs(toolName: string, args: Record<string, unknown>): string | null {
+function validateArgs(toolName, args) {
     const definition = TOOLS.find(t => t.name === toolName);
-    if (!definition) return `Unknown tool: ${toolName}`;
-    
+    if (!definition)
+        return `Unknown tool: ${toolName}`;
     const required = definition.inputSchema.required || [];
     for (const field of required) {
         if (args[field] === undefined || args[field] === null || args[field] === "") {
@@ -57,88 +45,99 @@ function validateArgs(toolName: string, args: Record<string, unknown>): string |
     }
     return null;
 }
-
 server.setRequestHandler(ListToolsRequestSchema, async (request) => {
     // 2026 Stateless Spec: Log client info from metadata if available
-    const meta = (request as { _meta?: { client?: { name?: string; version?: string } } })._meta;
+    const meta = request._meta;
     if (meta) {
         process.stderr.write(`[MCP] Stateless ListTools from ${meta.client?.name || "unknown"} v${meta.client?.version || "?.?"}\n`);
     }
     return { tools: TOOLS };
 });
-
+server.setRequestHandler(ListResourcesRequestSchema, async () => {
+    return { resources: RESOURCES };
+});
+server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+    const uri = request.params.uri;
+    try {
+        const content = await handleReadResource(uri);
+        return {
+            contents: [
+                {
+                    uri,
+                    mimeType: "text/markdown",
+                    text: content,
+                },
+            ],
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to read resource: ${message}`, { cause: error });
+    }
+});
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    const req = request as { params: { name: string, arguments?: Record<string, unknown> } };
+    const req = request;
     const { name, arguments: args } = req.params;
-    const meta = (request as { _meta?: { client?: { name?: string; version?: string } } })._meta;
-    
+    const meta = request._meta;
     // 2026 Stateless Spec: Prioritize metadata-driven context
     if (meta) {
         process.stderr.write(`[MCP] Stateless CallTool: ${name} (Client: ${meta.client?.name || "unknown"})\n`);
     }
-
     const projectRoot = process.env.ATABEY_PROJECT_ROOT || process.cwd();
-
     try {
         const handler = toolHandlers[name];
         if (!handler) {
             return {
                 isError: true,
-                content: [{ type: "text" as const, text: `❌ Unknown tool: ${name}` }],
+                content: [{ type: "text", text: `[ERROR] Unknown tool: ${name}` }],
             };
         }
-
-        // 🛡️ Runtime Validation
+        // [SECURITY] Runtime Validation
         const validationError = validateArgs(name, args || {});
         if (validationError) {
             return {
                 isError: true,
-                content: [{ type: "text" as const, text: `❌ Validation Error: ${validationError}` }],
+                content: [{ type: "text", text: `[ERROR] Validation Error: ${validationError}` }],
             };
         }
-        
         return await handler(projectRoot, args || {});
-    } catch (error: unknown) {
+    }
+    catch (error) {
         const message = error instanceof Error ? error.message : "Unknown error occurred";
         return {
             isError: true,
-            content: [{ type: "text" as const, text: `❌ Execution failed: ${message}` }],
+            content: [{ type: "text", text: `[ERROR] Execution failed: ${message}` }],
         };
     }
 });
-
 // ─── Graceful Startup & Shutdown ──────────────────────────────────
-
 async function run() {
     const transport = new StdioServerTransport();
-
     // Prevent unhandled errors from crashing the MCP stream
-    process.on("uncaughtException", (error: Error) => {
+    process.on("uncaughtException", (error) => {
         process.stderr.write(`[atabey-mcp] Uncaught exception: ${error.message}
 `);
     });
-    process.on("unhandledRejection", (reason: unknown) => {
+    process.on("unhandledRejection", (reason) => {
         const message = reason instanceof Error ? reason.message : String(reason);
         process.stderr.write(`[atabey-mcp] Unhandled rejection: ${message}
 `);
     });
-
     // Graceful shutdown on SIGINT/SIGTERM
     const shutdown = async () => {
         try {
             await server.close();
-        } catch {
+        }
+        catch {
             // Already closed or failed — safe to ignore
         }
         process.exit(0);
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
-
     await server.connect(transport);
 }
-
-run().catch((error: Error) => {
+run().catch((error) => {
     process.stderr.write(`[atabey-mcp] Fatal startup error: ${error.message}
 `);
     process.exit(1);

package/framework-mcp/dist/framework-mcp/src/resources/index.js

@@ -0,0 +1,58 @@
+import { Storage } from "../../../src/shared/storage.js";
+/**
+ * [DATA] MCP Resource Definitions
+ */
+export const RESOURCES = [
+    {
+        uri: "atabey://army/status",
+        name: "Agent Army Status",
+        description: "Real-time state and active tasks of all specialized agents.",
+        mimeType: "text/markdown"
+    },
+    {
+        uri: "atabey://plan/active",
+        name: "Active Execution Plan",
+        description: "The current DAG of tasks and their completion status.",
+        mimeType: "text/markdown"
+    },
+    {
+        uri: "atabey://memory/project",
+        name: "Project Memory",
+        description: "The central source of truth for project context (PROJECT_MEMORY.md).",
+        mimeType: "text/markdown"
+    }
+];
+export async function handleReadResource(uri) {
+    if (uri === "atabey://army/status") {
+        const agents = Storage.getAllAgents();
+        let md = "# [AI] Agent Army Status\n\n| Agent | State | Active Task | Last Updated |\n| :--- | :--- | :--- | :--- |\n";
+        agents.forEach((a) => {
+            md += `| @${a.name} | ${a.state} | ${a.task} | ${a.last_updated} |\n`;
+        });
+        return md;
+    }
+    if (uri === "atabey://plan/active") {
+        const tasks = Storage.getTasks();
+        let md = "# 📋 Active Execution Plan\n\n| ID | Task | Agent | Status | Dependencies |\n| :--- | :--- | :--- | :--- | :--- |\n";
+        tasks.forEach((t) => {
+            const deps = t.dependencies.join(", ") || "-";
+            md += `| ${t.id} | ${t.description} | ${t.agent} | ${t.status} | ${deps} |\n`;
+        });
+        return md;
+    }
+    if (uri === "atabey://memory/project") {
+        const fs = await import("fs");
+        const path = await import("path");
+        const { getFrameworkDir } = await import("../../../src/cli/utils/memory.js");
+        const projectRoot = process.env.ATABEY_PROJECT_ROOT || process.cwd();
+        const fwDir = getFrameworkDir();
+        const p = path.isAbsolute(fwDir)
+            ? path.join(fwDir, "memory", "PROJECT_MEMORY.md")
+            : path.join(projectRoot, fwDir, "memory", "PROJECT_MEMORY.md");
+        if (fs.existsSync(p)) {
+            return fs.readFileSync(p, "utf8");
+        }
+        return "Project memory not found. Run 'atabey init' first.";
+    }
+    throw new Error(`Unknown resource URI: ${uri}`);
+}

package/framework-mcp/{src/tools/control_plane/locking.ts → dist/framework-mcp/src/tools/control_plane/locking.js}

@@ -1,26 +1,22 @@
 import fs from "fs";
 import path from "path";
-import { ToolResult, AcquireLockArgs, ReleaseLockArgs } from "../types.js";
 import { resolveFrameworkDir } from "../../utils/security.js";
-
 /**
  * Handles acquiring a stateful lock on a resource.
  */
-export async function handleAcquireLock(projectRoot: string, args: AcquireLockArgs): Promise<ToolResult> {
+export async function handleAcquireLock(projectRoot, args) {
     const { resource, agent, ttl = 60 } = args;
     const frameworkDir = resolveFrameworkDir(projectRoot);
     const lockDir = path.join(projectRoot, frameworkDir, "locks");
     const lockPath = path.join(lockDir, `${resource}.lock`);
-
     try {
-        if (!fs.existsSync(lockDir)) fs.mkdirSync(lockDir, { recursive: true });
-
+        if (!fs.existsSync(lockDir))
+            fs.mkdirSync(lockDir, { recursive: true });
         // Check for stale lock first
         if (fs.existsSync(lockPath)) {
             const stat = fs.statSync(lockPath);
             const now = new Date().getTime();
             const age = (now - stat.mtimeMs) / 1000;
-
             if (age < ttl) {
                 return {
                     isError: true,
@@ -32,21 +28,21 @@ export async function handleAcquireLock(projectRoot: string, args: AcquireLockAr
             try {
                 fs.renameSync(lockPath, tempLockPath);
                 fs.unlinkSync(tempLockPath);
-            } catch {
+            }
+            catch {
                 // If rename failed, it means another agent already evicting/deleting it.
                 // Do not delete anything else; proceed and let writeFileSync (wx flag) fail if a new lock exists.
             }
         }
-
         // Use 'wx' flag for atomic file creation
         const lockData = JSON.stringify({ agent, timestamp: new Date().toISOString() });
         fs.writeFileSync(lockPath, lockData, { flag: "wx" });
-        
         return {
-            content: [{ type: "text", text: `✅ Lock acquired for resource '${resource}' by ${agent}.` }]
+            content: [{ type: "text", text: `[OK] Lock acquired for resource '${resource}' by ${agent}.` }]
         };
-    } catch (e) {
-        const error = e as { code?: string };
+    }
+    catch (e) {
+        const error = e;
         if (error.code === "EEXIST") {
             return {
                 isError: true,
@@ -59,31 +55,28 @@ export async function handleAcquireLock(projectRoot: string, args: AcquireLockAr
         };
     }
 }
-
 /**
  * Handles releasing a lock.
  */
-export async function handleReleaseLock(projectRoot: string, args: ReleaseLockArgs): Promise<ToolResult> {
+export async function handleReleaseLock(projectRoot, args) {
     const { resource, agent } = args;
     const frameworkDir = resolveFrameworkDir(projectRoot);
     const lockPath = path.join(projectRoot, frameworkDir, "locks", `${resource}.lock`);
-
     try {
         if (!fs.existsSync(lockPath)) {
             return { content: [{ type: "text", text: `ℹ️ No lock found for resource '${resource}'.` }] };
         }
-
         const lockData = JSON.parse(fs.readFileSync(lockPath, "utf8"));
         if (lockData.agent !== agent) {
             return {
                 isError: true,
-                content: [{ type: "text", text: `❌ Denied: You do not own the lock for '${resource}'. Owned by ${lockData.agent}.` }]
+                content: [{ type: "text", text: `[ERROR] Denied: You do not own the lock for '${resource}'. Owned by ${lockData.agent}.` }]
             };
         }
-
         fs.unlinkSync(lockPath);
-        return { content: [{ type: "text", text: `✅ Lock released for resource '${resource}' by ${agent}.` }] };
-    } catch (e) {
+        return { content: [{ type: "text", text: `[OK] Lock released for resource '${resource}' by ${agent}.` }] };
+    }
+    catch (e) {
         return { isError: true, content: [{ type: "text", text: `Failed to release lock: ${String(e)}` }] };
     }
 }

package/framework-mcp/{src/tools/control_plane/registry.ts → dist/framework-mcp/src/tools/control_plane/registry.js}

@@ -1,35 +1,32 @@
 import fs from "fs";
 import path from "path";
-import { ToolResult, RegisterAgentArgs } from "../types.js";
 import { resolveFrameworkDir } from "../../utils/security.js";
-
 /**
  * Handles agent registration with the Control Plane.
  * This can be used to validate permissions and active status.
  */
-export async function handleRegisterAgent(projectRoot: string, args: RegisterAgentArgs): Promise<ToolResult> {
-    const { agent, role, capability = 5 } = args;
+export async function handleRegisterAgent(projectRoot, args) {
+    const { agent, role, capability = 5, specialties } = args;
     const frameworkDir = resolveFrameworkDir(projectRoot);
     const registryDir = path.join(projectRoot, frameworkDir, "registry");
     const agentFile = path.join(registryDir, `${agent.replace("@", "")}_active.json`);
-
     try {
-        if (!fs.existsSync(registryDir)) fs.mkdirSync(registryDir, { recursive: true });
-
+        if (!fs.existsSync(registryDir))
+            fs.mkdirSync(registryDir, { recursive: true });
         const agentData = {
             agent,
             role,
             capability,
+            specialties,
             last_seen: new Date().toISOString(),
             status: "ACTIVE"
         };
-
         fs.writeFileSync(agentFile, JSON.stringify(agentData, null, 2));
-        
         return {
-            content: [{ type: "text", text: `🎖️ Agent ${agent} (${role}) registered successfully in the Atabey Control Plane.` }]
+            content: [{ type: "text", text: `[ATABEY] Agent ${agent} (${role}) registered successfully in the Atabey Control Plane.` }]
         };
-    } catch (e) {
+    }
+    catch (e) {
         return {
             isError: true,
             content: [{ type: "text", text: `Failed to register agent: ${String(e)}` }]

package/framework-mcp/{src/tools/definitions.ts → dist/framework-mcp/src/tools/definitions.js}

@@ -1,6 +1,4 @@
-import { ToolDefinition } from "../tools/types.js";
-
-export const TOOLS: ToolDefinition[] = [
+export const TOOLS = [
     {
         name: "read_file",
         description: "Read the content of a file within the project. Supports optional line range reading to prevent stream overload.",
@@ -234,7 +232,12 @@ export const TOOLS: ToolDefinition[] = [
             properties: {
                 agent: { type: "string", description: "The agent name (e.g., '@backend')." },
                 role: { type: "string", description: "The role of the agent." },
-                capability: { type: "number", description: "The capability score (1-10)." }
+                capability: { type: "number", description: "The capability score (1-10)." },
+                specialties: {
+                    type: "object",
+                    additionalProperties: { type: "number" },
+                    description: "Sub-specialty weights mapping (e.g. {\"postgres\": 10, \"redis\": 8})"
+                }
             },
             required: ["agent", "role"]
         }
@@ -276,6 +279,33 @@ export const TOOLS: ToolDefinition[] = [
         description: "Run the project's linter (e.g., ESLint) to check for code quality and style issues.",
         inputSchema: { type: "object", properties: {} },
     },
+    {
+        name: "submit_plan",
+        description: "Submit a structured DAG plan of tasks for the project. This will be decomposed and queued for execution.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                tasks: {
+                    type: "array",
+                    items: {
+                        type: "object",
+                        properties: {
+                            id: { type: "string", description: "Unique task ID (e.g. TASK_01)" },
+                            agent: { type: "string", description: "The agent responsible for the task (e.g. @backend)" },
+                            task: { type: "string", description: "The task description" },
+                            dependencies: {
+                                type: "array",
+                                items: { type: "string" },
+                                description: "List of task IDs that must be completed before this task."
+                            }
+                        },
+                        required: ["id", "agent", "task"]
+                    }
+                }
+            },
+            required: ["tasks"],
+        },
+    },
     {
         name: "view_file",
         description: "Alias for read_file. Reads the content of a file within the project.",
@@ -289,4 +319,4 @@ export const TOOLS: ToolDefinition[] = [
             required: ["path"],
         },
     }
-];
+];

package/framework-mcp/{src/tools/file_system/batch_surgical_edit.ts → dist/framework-mcp/src/tools/file_system/batch_surgical_edit.js}

@@ -1,48 +1,37 @@
 import fs from "fs";
 import { safePath } from "../../utils/security.js";
 import { writeTextFileAtomic } from "../../utils/fs.js";
-import { BatchSurgicalEditArgs, ToolResult } from "../types.js";
 import { Metrics } from "../../utils/metrics.js";
-import { verifyCorporateCompliance } from "../../utils/compliance.js";
-
-interface SurgicalEdit {
-    path: string;
-    oldText: string;
-    newText: string;
-    allowMultiple?: boolean;
-}
-
+import { verifyCorporateCompliance, verifyRiskAndAwaitApproval } from "../../utils/compliance.js";
+import { verifyWritePermission } from "../../utils/permissions.js";
 /**
  * Performs multiple surgical text replacements across multiple files in a single batch.
  */
-export function handleBatchSurgicalEdit(projectRoot: string, args: BatchSurgicalEditArgs): ToolResult {
-    const edits = args.edits as SurgicalEdit[];
+export async function handleBatchSurgicalEdit(projectRoot, args) {
+    const edits = args.edits;
     if (!Array.isArray(edits) || edits.length === 0) {
         const err = "No edits provided in the batch request.";
         Metrics.logError(projectRoot, "@mcp", "batch_surgical_edit", err);
         throw new Error(err);
     }
-
-    const results: string[] = [];
+    const results = [];
     let totalTokens = 0;
-
     for (const edit of edits) {
         const filePath = safePath(projectRoot, edit.path);
+        // ENFORCE PERMISSION MATRIX
+        verifyWritePermission(projectRoot, edit.path);
         if (!fs.existsSync(filePath)) {
             const err = `File not found: ${edit.path}`;
             Metrics.logError(projectRoot, "@mcp", `batch_surgical_edit:${edit.path}`, err);
             throw new Error(err);
         }
-
         const content = fs.readFileSync(filePath, "utf8");
         const { oldText, newText, allowMultiple = false } = edit;
-
         if (!content.includes(oldText)) {
             const err = `Text not found in file ${edit.path}`;
             Metrics.logError(projectRoot, "@mcp", `batch_surgical_edit:${edit.path}`, err);
             throw new Error(err);
         }
-
         // Surgical precision guard
         if (!allowMultiple) {
             const firstIndex = content.indexOf(oldText);
@@ -53,27 +42,23 @@ export function handleBatchSurgicalEdit(projectRoot: string, args: BatchSurgical
                 throw new Error(err);
             }
         }
-
-        const newContent = allowMultiple 
+        const newContent = allowMultiple
             ? content.replace(new RegExp(oldText.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), newText)
             : content.replace(oldText, newText);
-
         // ENFORCE CORPORATE COMPLIANCE
         verifyCorporateCompliance(newContent, edit.path);
-
+        // ENFORCE RISK & HUMAN APPROVAL GATEWAY
+        await verifyRiskAndAwaitApproval(projectRoot, newContent, edit.path);
         writeTextFileAtomic(filePath, newContent);
-        
         const tokens = Metrics.estimateTokens(newText);
         totalTokens += tokens;
-        results.push(`✅ Edited ${edit.path}`);
+        results.push(`[OK] Edited ${edit.path}`);
     }
-
     Metrics.logUsage(projectRoot, "@mcp", `batch_surgical_edit: ${edits.length} files`, totalTokens);
-
-    return { 
-        content: [{ 
-            type: "text", 
-            text: `Successfully performed ${edits.length} edits:\n${results.join("\n")}` 
-        }] 
+    return {
+        content: [{
+                type: "text",
+                text: `Successfully performed ${edits.length} edits:\n${results.join("\n")}`
+            }]
     };
 }

package/framework-mcp/{src/tools/file_system/patch_file.ts → dist/framework-mcp/src/tools/file_system/patch_file.js}

@@ -1,16 +1,16 @@
 import fs from "fs";
 import { safePath } from "../../utils/security.js";
-import { PatchFileArgs, ToolResult } from "../types.js";
 import { Metrics } from "../../utils/metrics.js";
-import { verifyCorporateCompliance } from "../../utils/compliance.js";
-
-export function handlePatchFile(projectRoot: string, args: PatchFileArgs): ToolResult {
+import { verifyCorporateCompliance, verifyRiskAndAwaitApproval } from "../../utils/compliance.js";
+import { verifyWritePermission } from "../../utils/permissions.js";
+export async function handlePatchFile(projectRoot, args) {
     const filePath = safePath(projectRoot, args.path);
+    // ENFORCE PERMISSION MATRIX
+    verifyWritePermission(projectRoot, args.path);
     const lines = fs.readFileSync(filePath, "utf8").split("\n");
     const start = args.startLine - 1;
     const end = args.endLine;
     const newContent = args.newContent.split("\n");
-
     if (start < 0 || start > lines.length) {
         const err = `Invalid start line: ${start + 1}. File has ${lines.length} lines.`;
         Metrics.logError(projectRoot, "@mcp", `patch_file:${args.path}`, err);
@@ -21,19 +21,14 @@ export function handlePatchFile(projectRoot: string, args: PatchFileArgs): ToolR
         Metrics.logError(projectRoot, "@mcp", `patch_file:${args.path}`, err);
         throw new Error(err);
     }
-
     lines.splice(start, end - start, ...newContent);
     const patchedContent = lines.join("\n");
-
     // ENFORCE CORPORATE COMPLIANCE
     verifyCorporateCompliance(patchedContent, args.path);
-
+    // ENFORCE RISK & HUMAN APPROVAL GATEWAY
+    await verifyRiskAndAwaitApproval(projectRoot, patchedContent, args.path);
     fs.writeFileSync(filePath, patchedContent);
-
-    const tokens = Metrics.estimateTokens(args.newContent as string);
+    const tokens = Metrics.estimateTokens(args.newContent);
     Metrics.logUsage(projectRoot, "@mcp", `patch_file: ${args.path}`, tokens);
-
-    return { content: [{ type: "text", text: `✅ File patched successfully: ${args.path}` }] };
+    return { content: [{ type: "text", text: `[OK] File patched successfully: ${args.path}` }] };
 }
-
-