claude-spotter 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.10.0
+
+**project scope `.mcp.json` 対応**。v0.9.0 は `~/.claude/.mcp.json` (user scope) だけを読んでいたため、プロジェクト直下の `.mcp.json` に登録された MCP サーバーの認証情報 (env / headers) を拾えなかった。`<projectRoot>/.mcp.json` も読んで user scope に merge (project 勝ち = Claude Code 本体の precedence と整合) するよう変更。
+
+### 変更点
+
+- **編集 [src/tool-db/mcp-config.mjs](src/tool-db/mcp-config.mjs)**: `readMcpServers({projectRoot})` シグネチャへ変更。`projectRoot` が渡されれば user scope に project scope を merge して返す。missing file は空として扱う
+- **編集 [src/tool-db/investigate-mcp.mjs](src/tool-db/investigate-mcp.mjs)**: `listMcpServers` / `listMcpToolsAll` が `projectRoot` を受け取って伝搬
+- **編集 [src/tool-db/refresh.mjs](src/tool-db/refresh.mjs)**: `buildInvestigationSnapshot` / `refresh` が `projectRoot` を伝搬 (CLI からは既に渡されている、経路が繋がった)
+- **編集 [test/tool-db.test.mjs](test/tool-db.test.mjs)**: project-scope override + missing-file fallback の 2 ケース追加 (total 99 tests)
+
+### 非互換
+
+- `readMcpServers()` → `readMcpServers({projectRoot})`: 引数なしも引き続き動く (user scope のみ) ので既存コードは影響なし
+
 ## 0.9.0
 
 **`.mcp.json` を真実源として読み込み、user-registered HTTP/stdio MCP の認証情報を live fetch に活用**。v0.8.0 で HTTP transport を実装したが、`claude mcp list` / `claude mcp get` は bearer token や headers を CLI 出力に含めないため、認証が必要な MCP サーバー (x-api) は依然 401 で落ちていた。`~/.claude/.mcp.json` を直接読んで env / headers を取得、stdio なら spawn 時の env に、HTTP なら fetch request header に渡す。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-spotter",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離",
   "type": "module",
   "bin": {

package/src/tool-db/investigate-mcp-http.mjs

@@ -87,7 +87,7 @@ export async function listToolsHttp({ url, serverName, headers: staticHeaders =
     params: {
       protocolVersion: PROTOCOL_VERSION,
       capabilities: {},
-      clientInfo: { name: 'spotter', version: '0.9.0' },
+      clientInfo: { name: 'spotter', version: '0.10.0' },
     },
   });
   if (!initResult || initResult.error) {

package/src/tool-db/investigate-mcp.mjs

@@ -40,8 +40,8 @@ export class McpInvestigationError extends Error {
 
 // Returns: Map<server-name, Array<{name, description}>>.
 // Skips servers that fail (logs the failure) so one broken server doesn't block the rest.
-export async function listMcpToolsAll({ logFn = () => {}, claudeBin = 'claude' } = {}) {
-  const servers = await listMcpServers({ claudeBin });
+export async function listMcpToolsAll({ logFn = () => {}, claudeBin = 'claude', projectRoot } = {}) {
+  const servers = await listMcpServers({ claudeBin, projectRoot });
   const out = new Map();
   for (const server of servers) {
     try {
@@ -64,10 +64,10 @@ export async function listMcpToolsAll({ logFn = () => {}, claudeBin = 'claude' }
 // full descriptor (with env/headers). Otherwise we fall back to the parsed CLI line,
 // which at minimum gives us name + transport + url (or triggers `claude mcp get` for
 // stdio command tokenisation).
-export async function listMcpServers({ claudeBin = 'claude' } = {}) {
+export async function listMcpServers({ claudeBin = 'claude', projectRoot } = {}) {
   const [{ stdout }, mcpServers] = await Promise.all([
     execClaude(claudeBin, ['mcp', 'list'], { encoding: 'utf8' }),
-    readMcpServers(),
+    readMcpServers({ projectRoot }),
   ]);
   const cliList = parseMcpListOutput(stdout);
   return cliList.map((cliEntry) => {
@@ -247,7 +247,7 @@ async function spawnAndQuery({ command, args, env = {} }, serverName) {
         await request('initialize', {
           protocolVersion: PROTOCOL_VERSION,
           capabilities: {},
-          clientInfo: { name: 'spotter', version: '0.9.0' },
+          clientInfo: { name: 'spotter', version: '0.10.0' },
         });
         send({ jsonrpc: '2.0', method: 'notifications/initialized' });
         initializedSent = true;

package/src/tool-db/mcp-config.mjs

@@ -6,10 +6,10 @@
 // of `claude mcp list` / `claude mcp get` hides those secrets. Without them, an HTTP
 // MCP server returns 401 and a stdio MCP server spawns without its API key.
 //
-// Scope: reads user-level `~/.claude/.mcp.json`. Project-level `.mcp.json` and
-// `settings.local.json` are not yet consulted — user scope covers the common case
-// (globally-installed MCP servers) and is the scope that Spotter's tool-db is
-// global-first anyway.
+// Scope: merges user-level `~/.claude/.mcp.json` with optional project-level
+// `<projectRoot>/.mcp.json`. Project scope overrides user scope on name collision
+// (matches Claude Code's own precedence — more-specific scope wins).
+// `settings.local.json` (local scope) is not yet consulted.
 //
 // This file does NOT read ~/.claude/.credentials.json (Anthropic OAuth token). That
 // remains off-limits per the v0.8.0 design decision. `.mcp.json` is user-authored
@@ -23,11 +23,13 @@ export function userMcpConfigPath() {
   return join(homedir(), '.claude', '.mcp.json');
 }
 
-// Returns the raw `mcpServers` object from ~/.claude/.mcp.json, or {} if missing.
-// Throws only on malformed JSON (not on missing file).
-export async function readMcpServers() {
+export function projectMcpConfigPath(projectRoot) {
+  return join(projectRoot, '.mcp.json');
+}
+
+async function readOne(path) {
   try {
-    const text = await readFile(userMcpConfigPath(), 'utf8');
+    const text = await readFile(path, 'utf8');
     const data = JSON.parse(text);
     return data.mcpServers ?? {};
   } catch (err) {
@@ -36,6 +38,16 @@ export async function readMcpServers() {
   }
 }
 
+// Returns the merged `mcpServers` object: user scope as base, project scope overrides
+// on name collision. Missing files are treated as empty (not an error). If projectRoot
+// is not supplied, only user scope is read.
+export async function readMcpServers({ projectRoot } = {}) {
+  const user = await readOne(userMcpConfigPath());
+  if (!projectRoot) return user;
+  const project = await readOne(projectMcpConfigPath(projectRoot));
+  return { ...user, ...project };
+}
+
 // Normalise an `.mcp.json` entry into a server descriptor the investigator can use.
 // Returns { name, transport: 'stdio'|'http'|'sse', ...transport-specific fields } or
 // null if the entry is not recognisable.

package/src/tool-db/refresh.mjs

@@ -17,7 +17,7 @@ import { localDbPath, globalDbPath } from './loader.mjs';
 // - Deferred: from the hardcoded baseline
 //
 // Returns an in-memory snapshot the caller can use as the investigate() backend.
-export async function buildInvestigationSnapshot({ logFn = () => {}, claudeBin = 'claude' } = {}) {
+export async function buildInvestigationSnapshot({ logFn = () => {}, claudeBin = 'claude', projectRoot } = {}) {
   const snapshot = new Map();
 
   // Deferred built-ins (Claude Code deferred tools like WebFetch, TodoWrite, etc.).
@@ -32,8 +32,9 @@ export async function buildInvestigationSnapshot({ logFn = () => {}, claudeBin =
     snapshot.set(name, getClaudeAiDescription(name));
   }
 
-  // MCP servers (stdio + user-registered HTTP/SSE).
-  const mcp = await listMcpToolsAll({ logFn, claudeBin });
+  // MCP servers (stdio + user-registered HTTP/SSE). projectRoot forwards for
+  // project-scope `.mcp.json` merge (see mcp-config.mjs).
+  const mcp = await listMcpToolsAll({ logFn, claudeBin, projectRoot });
   for (const [serverName, tools] of mcp.entries()) {
     for (const tool of tools) {
       if (!tool.description || tool.description.length === 0) continue;
@@ -47,7 +48,7 @@ export async function buildInvestigationSnapshot({ logFn = () => {}, claudeBin =
 // Refresh the tool-db. Discovers all currently available tools, resolves each via the
 // 3-tier lookup, writes through. Returns the resolved Map.
 export async function refresh({ projectRoot, logFn = () => {}, claudeBin = 'claude' }) {
-  const snapshot = await buildInvestigationSnapshot({ logFn, claudeBin });
+  const snapshot = await buildInvestigationSnapshot({ logFn, claudeBin, projectRoot });
   const toolNames = Array.from(snapshot.keys());
   const investigate = async (name) => snapshot.get(name) ?? null;
 

package/src/version.mjs

@@ -1 +1 @@
-export const version = '0.9.0';
+export const version = '0.10.0';