atabey 0.0.6 → 0.0.8

package/{src/shared/fs.ts → framework-mcp/dist/src/shared/fs.js}

@@ -1,42 +1,41 @@
 import fs from "fs";
 import path from "path";
+import { execFileSync } from "child_process";
 import { logger } from "./logger.js";
-
-export function ensureDir(dirPath: string, dryRun = false): void {
+export function ensureDir(dirPath, dryRun = false) {
     if (!fs.existsSync(dirPath)) {
         if (dryRun) {
             logger.info(`[DRY RUN] Would create directory: ${dirPath}`);
-        } else {
+        }
+        else {
             fs.mkdirSync(dirPath, { recursive: true });
         }
     }
 }
-
 /**
  * Writes content to a file atomically by using a temporary file.
  * This prevents data corruption during unexpected system failures.
  */
-export function writeTextFile(filePath: string, content: string, dryRun = false): void {
+export function writeTextFile(filePath, content, dryRun = false) {
     if (dryRun) {
         logger.info(`[DRY RUN] Would write file: ${filePath}`);
         return;
     }
     const dir = path.dirname(filePath);
     ensureDir(dir);
-
     const tempPath = `${filePath}.${Math.random().toString(36).slice(2, 9)}.tmp`;
     const finalContent = content.endsWith("\n") ? content : `${content}\n`;
-
     try {
         fs.writeFileSync(tempPath, finalContent, "utf8");
         fs.renameSync(tempPath, filePath);
-    } catch (err) {
-        if (fs.existsSync(tempPath)) fs.unlinkSync(tempPath);
+    }
+    catch (err) {
+        if (fs.existsSync(tempPath))
+            fs.unlinkSync(tempPath);
         throw err;
     }
 }
-
-export function appendFile(filePath: string, content: string, dryRun = false): void {
+export function appendFile(filePath, content, dryRun = false) {
     if (dryRun) {
         logger.info(`[DRY RUN] Would append to file: ${filePath}`);
         return;
@@ -44,7 +43,9 @@ export function appendFile(filePath: string, content: string, dryRun = false): v
     ensureDir(path.dirname(filePath));
     fs.appendFileSync(filePath, content, "utf8");
 }
-
-export function writeJsonFile(filePath: string, value: unknown, dryRun = false): void {
+export function writeJsonFile(filePath, value, dryRun = false) {
     writeTextFile(filePath, JSON.stringify(value, null, 2), dryRun);
 }
+export function runCommandQuiet(command, args, cwd) {
+    execFileSync(command, args, { cwd, stdio: "ignore" });
+}

package/{src/shared/logger.ts → framework-mcp/dist/src/shared/logger.js}

@@ -1,27 +1,18 @@
 import chalk from "chalk";
 import path from "path";
 import { ensureDir, appendFile } from "./fs.js";
-
-export enum LogLevel {
-    DEBUG = 0,
-    INFO = 1,
-    WARN = 2,
-    ERROR = 3,
-    FATAL = 4,
-}
-
-export interface LoggerConfig {
-    minLevel: LogLevel;
-    enableColors: boolean;
-    jsonFormat: boolean;
-    logFile?: string;
-}
-
+export var LogLevel;
+(function (LogLevel) {
+    LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
+    LogLevel[LogLevel["INFO"] = 1] = "INFO";
+    LogLevel[LogLevel["WARN"] = 2] = "WARN";
+    LogLevel[LogLevel["ERROR"] = 3] = "ERROR";
+    LogLevel[LogLevel["FATAL"] = 4] = "FATAL";
+})(LogLevel || (LogLevel = {}));
 export class EnterpriseLogger {
-    private config: LoggerConfig;
-    private static instance: EnterpriseLogger;
-
-    private constructor() {
+    config;
+    static instance;
+    constructor() {
         const isProd = process.env.NODE_ENV === "production";
         this.config = {
             minLevel: isProd ? LogLevel.INFO : LogLevel.DEBUG,
@@ -29,31 +20,27 @@ export class EnterpriseLogger {
             jsonFormat: isProd,
         };
     }
-
-    public static getInstance(): EnterpriseLogger {
+    static getInstance() {
         if (!EnterpriseLogger.instance) {
             EnterpriseLogger.instance = new EnterpriseLogger();
         }
         return EnterpriseLogger.instance;
     }
-
-    public configure(config: Partial<LoggerConfig>): void {
+    configure(config) {
         this.config = { ...this.config, ...config };
-        
         if (this.config.logFile) {
             try {
                 ensureDir(path.dirname(this.config.logFile));
-            } catch (err) {
+            }
+            catch (err) {
                 // Directly write to stderr — using console here would be circular
                 process.stderr.write(`[Logger] Failed to create log directory: ${err}\n`);
             }
         }
     }
-
-    private formatMessage(level: LogLevel, message: string, meta?: unknown): string {
+    formatMessage(level, message, meta) {
         const timestamp = new Date().toISOString();
         const pid = process.pid;
-
         if (this.config.jsonFormat) {
             return JSON.stringify({
                 timestamp,
@@ -63,10 +50,8 @@ export class EnterpriseLogger {
                 meta,
             });
         }
-
         const levelName = LogLevel[level].padEnd(5);
         let coloredLevel = levelName;
-
         if (this.config.enableColors) {
             switch (level) {
                 case LogLevel.DEBUG:
@@ -86,54 +71,46 @@ export class EnterpriseLogger {
                     break;
             }
         }
-
         const metaStr = meta ? ` | Meta: ${JSON.stringify(meta)}` : "";
         return `[${timestamp}] [PID:${pid}] [${coloredLevel}]: ${message}${metaStr}`;
     }
-
-    private log(level: LogLevel, message: string, meta?: unknown): void {
-        if (level < this.config.minLevel) return;
-
+    log(level, message, meta) {
+        if (level < this.config.minLevel)
+            return;
         const formatted = this.formatMessage(level, message, meta);
-
         // Route to stderr for ERROR/FATAL, stdout otherwise.
         // Using process.write directly here is intentional — this IS the logger.
         if (level >= LogLevel.ERROR) {
             process.stderr.write(formatted + "\n");
-        } else {
+        }
+        else {
             process.stdout.write(formatted + "\n");
         }
-
         // Output to file if configured
         if (this.config.logFile) {
             try {
                 appendFile(this.config.logFile, formatted + "\n");
-            } catch (err) {
+            }
+            catch (err) {
                 // Directly write to stderr — using console here would be circular
                 process.stderr.write(`[Logger] Failed to write to log file: ${err}\n`);
             }
         }
     }
-
-    public debug(message: string, meta?: unknown): void {
+    debug(message, meta) {
         this.log(LogLevel.DEBUG, message, meta);
     }
-
-    public info(message: string, meta?: unknown): void {
+    info(message, meta) {
         this.log(LogLevel.INFO, message, meta);
     }
-
-    public warn(message: string, meta?: unknown): void {
+    warn(message, meta) {
         this.log(LogLevel.WARN, message, meta);
     }
-
-    public error(message: string, meta?: unknown): void {
+    error(message, meta) {
         this.log(LogLevel.ERROR, message, meta);
     }
-
-    public fatal(message: string, meta?: unknown): void {
+    fatal(message, meta) {
         this.log(LogLevel.FATAL, message, meta);
     }
 }
-
 export const logger = EnterpriseLogger.getInstance();

package/framework-mcp/dist/src/shared/storage.js

@@ -0,0 +1,207 @@
+import Database from "better-sqlite3";
+import path from "path";
+import fs from "fs";
+import { getFrameworkDir } from "../cli/utils/memory.js";
+/**
+ * [DB] Atabey Storage Engine
+ * Central SQLite database for enterprise-scale agent state management.
+ */
+export class Storage {
+    static db = null;
+    static getDB() {
+        if (!this.db) {
+            const frameworkDir = getFrameworkDir();
+            if (!fs.existsSync(frameworkDir)) {
+                fs.mkdirSync(frameworkDir, { recursive: true });
+            }
+            const dbPath = path.join(frameworkDir, "atabey.db");
+            this.db = new Database(dbPath);
+            this.initializeSchema();
+        }
+        return this.db;
+    }
+    static initializeSchema() {
+        const db = this.db;
+        // Agents Table
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS agents (
+                name TEXT PRIMARY KEY,
+                state TEXT DEFAULT 'READY',
+                task TEXT DEFAULT 'Idle',
+                last_updated DATETIME DEFAULT CURRENT_TIMESTAMP
+            )
+        `);
+        // Messages (Hermes) Table
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS messages (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
+                sender TEXT,
+                receiver TEXT,
+                category TEXT,
+                content TEXT,
+                trace_id TEXT,
+                parent_id TEXT,
+                status TEXT DEFAULT 'PENDING',
+                priority TEXT DEFAULT 'NORMAL',
+                requires_approval BOOLEAN DEFAULT 0
+            )
+        `);
+        // Tasks Table
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS tasks (
+                id TEXT PRIMARY KEY,
+                trace_id TEXT,
+                description TEXT,
+                agent TEXT,
+                status TEXT DEFAULT 'PENDING',
+                priority TEXT DEFAULT 'NORMAL',
+                dependencies TEXT, -- JSON Array
+                created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+            )
+        `);
+        // Logs Table
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS logs (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
+                agent TEXT,
+                action TEXT,
+                trace_id TEXT,
+                status TEXT,
+                summary TEXT,
+                findings TEXT
+            )
+        `);
+        // Metadata (State) Table
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS metadata (
+                key TEXT PRIMARY KEY,
+                value TEXT
+            )
+        `);
+    }
+    // --- Agent Operations ---
+    static updateAgentStatus(name, state, task, lastUpdated) {
+        const db = this.getDB();
+        const cleanName = name.replace("@", "");
+        const timestamp = lastUpdated || new Date().toISOString();
+        db.prepare(`
+            INSERT INTO agents (name, state, task, last_updated) 
+            VALUES (?, ?, ?, ?)
+            ON CONFLICT(name) DO UPDATE SET 
+                state = excluded.state,
+                task = excluded.task,
+                last_updated = excluded.last_updated
+        `).run(cleanName, state, task, timestamp);
+    }
+    static getAllAgents() {
+        return this.getDB().prepare("SELECT * FROM agents").all();
+    }
+    // --- Message Operations ---
+    static saveMessage(msg) {
+        const db = this.getDB();
+        db.prepare(`
+            INSERT INTO messages (sender, receiver, category, content, trace_id, parent_id, status, priority, requires_approval)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(msg.from, msg.to, msg.category, msg.content, msg.traceId, msg.parentId || null, msg.status || "PENDING", msg.priority || "NORMAL", msg.requiresApproval ? 1 : 0);
+    }
+    static getPendingMessages() {
+        const rows = this.getDB().prepare("SELECT * FROM messages WHERE status IN ('PENDING', 'APPROVED') ORDER BY priority DESC, timestamp ASC").all();
+        return rows.map(r => ({
+            id: r.id,
+            timestamp: r.timestamp,
+            from: r.sender,
+            to: r.receiver,
+            category: r.category,
+            content: r.content,
+            traceId: r.trace_id,
+            parentId: r.parent_id || undefined,
+            status: r.status,
+            priority: r.priority,
+            requiresApproval: r.requires_approval === 1
+        }));
+    }
+    static updateMessageStatus(id, status) {
+        this.getDB().prepare("UPDATE messages SET status = ? WHERE id = ?").run(status, id);
+    }
+    // --- Task Operations ---
+    static saveTask(task) {
+        const db = this.getDB();
+        db.prepare(`
+            INSERT INTO tasks (id, trace_id, description, agent, status, priority, dependencies)
+            VALUES (?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT(id) DO UPDATE SET
+                status = excluded.status,
+                description = excluded.description
+        `).run(task.id, task.traceId, task.description, task.agent, task.status, task.priority, JSON.stringify(task.dependencies || []));
+    }
+    static getTasks(traceId) {
+        const db = this.getDB();
+        let rows;
+        if (traceId) {
+            rows = db.prepare("SELECT * FROM tasks WHERE trace_id = ?").all(traceId);
+        }
+        else {
+            rows = db.prepare("SELECT * FROM tasks").all();
+        }
+        return rows.map(r => {
+            let deps = [];
+            try {
+                const parsed = JSON.parse(r.dependencies || "[]");
+                // Handle cases where dependencies might be double-stringified or are raw JSON strings
+                deps = Array.isArray(parsed) ? parsed : JSON.parse(parsed);
+            }
+            catch {
+                // Keep empty array
+            }
+            return {
+                id: r.id,
+                traceId: r.trace_id,
+                description: r.description,
+                agent: r.agent,
+                status: r.status,
+                priority: r.priority,
+                dependencies: deps
+            };
+        });
+    }
+    static getLogs(agentName) {
+        const db = this.getDB();
+        let rows;
+        const cleanName = agentName ? agentName.replace("@", "") : undefined;
+        if (cleanName) {
+            rows = db.prepare("SELECT * FROM logs WHERE agent = ? ORDER BY timestamp DESC").all(cleanName);
+        }
+        else {
+            rows = db.prepare("SELECT * FROM logs ORDER BY timestamp DESC").all();
+        }
+        return rows.map(r => ({
+            id: r.id,
+            timestamp: r.timestamp,
+            agent: r.agent,
+            action: r.action,
+            trace_id: r.trace_id || undefined,
+            status: r.status,
+            summary: r.summary,
+            findings: r.findings || undefined
+        }));
+    }
+    // --- Metadata Operations ---
+    static setMetadata(key, value) {
+        this.getDB().prepare(`
+            INSERT INTO metadata (key, value) VALUES (?, ?)
+            ON CONFLICT(key) DO UPDATE SET value = excluded.value
+        `).run(key, value);
+    }
+    static getMetadata(key) {
+        const row = this.getDB().prepare("SELECT value FROM metadata WHERE key = ?").get(key);
+        return row ? row.value : null;
+    }
+    static reset() {
+        if (this.db) {
+            this.db.close();
+            this.db = null;
+        }
+    }
+}

package/framework-mcp/dist/src/shared/types.js

@@ -0,0 +1,12 @@
+/**
+ * Agent Atabey Framework — Internal Branded Types
+ * Used to enforce absolute type safety within the core orchestration logic.
+ */
+/**
+ * Casts a raw string to a Branded Type.
+ * Use this only at the boundaries of the system.
+ */
+export function asTraceID(val) { return val; }
+export function asAgentID(val) { return val; }
+export function asPhaseID(val) { return val; }
+export function asProjectPath(val) { return val; }

package/framework-mcp/dist/tools/control_plane/locking.js

@@ -38,7 +38,7 @@ export async function handleAcquireLock(projectRoot, args) {
         const lockData = JSON.stringify({ agent, timestamp: new Date().toISOString() });
         fs.writeFileSync(lockPath, lockData, { flag: "wx" });
         return {
-            content: [{ type: "text", text: `✅ Lock acquired for resource '${resource}' by ${agent}.` }]
+            content: [{ type: "text", text: `[OK] Lock acquired for resource '${resource}' by ${agent}.` }]
         };
     }
     catch (e) {
@@ -70,11 +70,11 @@ export async function handleReleaseLock(projectRoot, args) {
         if (lockData.agent !== agent) {
             return {
                 isError: true,
-                content: [{ type: "text", text: `❌ Denied: You do not own the lock for '${resource}'. Owned by ${lockData.agent}.` }]
+                content: [{ type: "text", text: `[ERROR] Denied: You do not own the lock for '${resource}'. Owned by ${lockData.agent}.` }]
             };
         }
         fs.unlinkSync(lockPath);
-        return { content: [{ type: "text", text: `✅ Lock released for resource '${resource}' by ${agent}.` }] };
+        return { content: [{ type: "text", text: `[OK] Lock released for resource '${resource}' by ${agent}.` }] };
     }
     catch (e) {
         return { isError: true, content: [{ type: "text", text: `Failed to release lock: ${String(e)}` }] };

package/framework-mcp/dist/tools/control_plane/registry.js

@@ -6,7 +6,7 @@ import { resolveFrameworkDir } from "../../utils/security.js";
  * This can be used to validate permissions and active status.
  */
 export async function handleRegisterAgent(projectRoot, args) {
-    const { agent, role, capability = 5 } = args;
+    const { agent, role, capability = 5, specialties } = args;
     const frameworkDir = resolveFrameworkDir(projectRoot);
     const registryDir = path.join(projectRoot, frameworkDir, "registry");
     const agentFile = path.join(registryDir, `${agent.replace("@", "")}_active.json`);
@@ -17,12 +17,13 @@ export async function handleRegisterAgent(projectRoot, args) {
             agent,
             role,
             capability,
+            specialties,
             last_seen: new Date().toISOString(),
             status: "ACTIVE"
         };
         fs.writeFileSync(agentFile, JSON.stringify(agentData, null, 2));
         return {
-            content: [{ type: "text", text: `🎖️ Agent ${agent} (${role}) registered successfully in the Atabey Control Plane.` }]
+            content: [{ type: "text", text: `[ATABEY] Agent ${agent} (${role}) registered successfully in the Atabey Control Plane.` }]
         };
     }
     catch (e) {

package/framework-mcp/dist/tools/definitions.js

@@ -232,7 +232,12 @@ export const TOOLS = [
             properties: {
                 agent: { type: "string", description: "The agent name (e.g., '@backend')." },
                 role: { type: "string", description: "The role of the agent." },
-                capability: { type: "number", description: "The capability score (1-10)." }
+                capability: { type: "number", description: "The capability score (1-10)." },
+                specialties: {
+                    type: "object",
+                    additionalProperties: { type: "number" },
+                    description: "Sub-specialty weights mapping (e.g. {\"postgres\": 10, \"redis\": 8})"
+                }
             },
             required: ["agent", "role"]
         }
@@ -274,6 +279,33 @@ export const TOOLS = [
         description: "Run the project's linter (e.g., ESLint) to check for code quality and style issues.",
         inputSchema: { type: "object", properties: {} },
     },
+    {
+        name: "submit_plan",
+        description: "Submit a structured DAG plan of tasks for the project. This will be decomposed and queued for execution.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                tasks: {
+                    type: "array",
+                    items: {
+                        type: "object",
+                        properties: {
+                            id: { type: "string", description: "Unique task ID (e.g. TASK_01)" },
+                            agent: { type: "string", description: "The agent responsible for the task (e.g. @backend)" },
+                            task: { type: "string", description: "The task description" },
+                            dependencies: {
+                                type: "array",
+                                items: { type: "string" },
+                                description: "List of task IDs that must be completed before this task."
+                            }
+                        },
+                        required: ["id", "agent", "task"]
+                    }
+                }
+            },
+            required: ["tasks"],
+        },
+    },
     {
         name: "view_file",
         description: "Alias for read_file. Reads the content of a file within the project.",

package/framework-mcp/dist/tools/file_system/batch_surgical_edit.js

@@ -2,11 +2,12 @@ import fs from "fs";
 import { safePath } from "../../utils/security.js";
 import { writeTextFileAtomic } from "../../utils/fs.js";
 import { Metrics } from "../../utils/metrics.js";
-import { verifyCorporateCompliance } from "../../utils/compliance.js";
+import { verifyCorporateCompliance, verifyRiskAndAwaitApproval } from "../../utils/compliance.js";
+import { verifyWritePermission } from "../../utils/permissions.js";
 /**
  * Performs multiple surgical text replacements across multiple files in a single batch.
  */
-export function handleBatchSurgicalEdit(projectRoot, args) {
+export async function handleBatchSurgicalEdit(projectRoot, args) {
     const edits = args.edits;
     if (!Array.isArray(edits) || edits.length === 0) {
         const err = "No edits provided in the batch request.";
@@ -17,6 +18,8 @@ export function handleBatchSurgicalEdit(projectRoot, args) {
     let totalTokens = 0;
     for (const edit of edits) {
         const filePath = safePath(projectRoot, edit.path);
+        // ENFORCE PERMISSION MATRIX
+        verifyWritePermission(projectRoot, edit.path);
         if (!fs.existsSync(filePath)) {
             const err = `File not found: ${edit.path}`;
             Metrics.logError(projectRoot, "@mcp", `batch_surgical_edit:${edit.path}`, err);
@@ -44,10 +47,12 @@ export function handleBatchSurgicalEdit(projectRoot, args) {
             : content.replace(oldText, newText);
         // ENFORCE CORPORATE COMPLIANCE
         verifyCorporateCompliance(newContent, edit.path);
+        // ENFORCE RISK & HUMAN APPROVAL GATEWAY
+        await verifyRiskAndAwaitApproval(projectRoot, newContent, edit.path);
         writeTextFileAtomic(filePath, newContent);
         const tokens = Metrics.estimateTokens(newText);
         totalTokens += tokens;
-        results.push(`✅ Edited ${edit.path}`);
+        results.push(`[OK] Edited ${edit.path}`);
     }
     Metrics.logUsage(projectRoot, "@mcp", `batch_surgical_edit: ${edits.length} files`, totalTokens);
     return {

package/framework-mcp/dist/tools/file_system/patch_file.js

@@ -1,9 +1,12 @@
 import fs from "fs";
 import { safePath } from "../../utils/security.js";
 import { Metrics } from "../../utils/metrics.js";
-import { verifyCorporateCompliance } from "../../utils/compliance.js";
-export function handlePatchFile(projectRoot, args) {
+import { verifyCorporateCompliance, verifyRiskAndAwaitApproval } from "../../utils/compliance.js";
+import { verifyWritePermission } from "../../utils/permissions.js";
+export async function handlePatchFile(projectRoot, args) {
     const filePath = safePath(projectRoot, args.path);
+    // ENFORCE PERMISSION MATRIX
+    verifyWritePermission(projectRoot, args.path);
     const lines = fs.readFileSync(filePath, "utf8").split("\n");
     const start = args.startLine - 1;
     const end = args.endLine;
@@ -22,8 +25,10 @@ export function handlePatchFile(projectRoot, args) {
     const patchedContent = lines.join("\n");
     // ENFORCE CORPORATE COMPLIANCE
     verifyCorporateCompliance(patchedContent, args.path);
+    // ENFORCE RISK & HUMAN APPROVAL GATEWAY
+    await verifyRiskAndAwaitApproval(projectRoot, patchedContent, args.path);
     fs.writeFileSync(filePath, patchedContent);
     const tokens = Metrics.estimateTokens(args.newContent);
     Metrics.logUsage(projectRoot, "@mcp", `patch_file: ${args.path}`, tokens);
-    return { content: [{ type: "text", text: `✅ File patched successfully: ${args.path}` }] };
+    return { content: [{ type: "text", text: `[OK] File patched successfully: ${args.path}` }] };
 }

package/framework-mcp/dist/tools/file_system/read_file.js

@@ -5,14 +5,14 @@ export function handleReadFile(projectRoot, args) {
     if (!args.path) {
         const err = "Missing 'path' argument.";
         Metrics.logError(projectRoot, "@mcp", "read_file", err);
-        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+        return { isError: true, content: [{ type: "text", text: `[ERROR] ${err}` }] };
     }
     try {
         const filePath = safePath(projectRoot, args.path);
         if (!fs.existsSync(filePath)) {
             const err = `File not found: ${args.path}`;
             Metrics.logError(projectRoot, "@mcp", "read_file", err);
-            return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+            return { isError: true, content: [{ type: "text", text: `[ERROR] ${err}` }] };
         }
         const startLine = args.startLine;
         const endLine = args.endLine;
@@ -46,6 +46,6 @@ export function handleReadFile(projectRoot, args) {
     catch (e) {
         const err = `Failed to read file: ${String(e)}`;
         Metrics.logError(projectRoot, "@mcp", `read_file:${args.path}`, err);
-        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+        return { isError: true, content: [{ type: "text", text: `[ERROR] ${err}` }] };
     }
 }

package/framework-mcp/dist/tools/file_system/replace_text.js

@@ -2,9 +2,12 @@ import fs from "fs";
 import { safePath } from "../../utils/security.js";
 import { writeTextFileAtomic } from "../../utils/fs.js";
 import { Metrics } from "../../utils/metrics.js";
-import { verifyCorporateCompliance } from "../../utils/compliance.js";
-export function handleReplaceText(projectRoot, args) {
+import { verifyCorporateCompliance, verifyRiskAndAwaitApproval } from "../../utils/compliance.js";
+import { verifyWritePermission } from "../../utils/permissions.js";
+export async function handleReplaceText(projectRoot, args) {
     const filePath = safePath(projectRoot, args.path);
+    // ENFORCE PERMISSION MATRIX
+    verifyWritePermission(projectRoot, args.path);
     const content = fs.readFileSync(filePath, "utf8");
     const oldText = args.oldText;
     const newText = args.newText;
@@ -38,8 +41,10 @@ export function handleReplaceText(projectRoot, args) {
     }
     // ENFORCE CORPORATE COMPLIANCE
     verifyCorporateCompliance(newContent, args.path);
+    // ENFORCE RISK & HUMAN APPROVAL GATEWAY
+    await verifyRiskAndAwaitApproval(projectRoot, newContent, args.path);
     writeTextFileAtomic(filePath, newContent);
     const tokens = Metrics.estimateTokens(newText);
     Metrics.logUsage(projectRoot, "@mcp", `replace_text: ${args.path}`, tokens);
-    return { content: [{ type: "text", text: `✅ Surgical edit successful in ${args.path}` }] };
+    return { content: [{ type: "text", text: `[OK] Surgical edit successful in ${args.path}` }] };
 }