code-ai-installer 3.0.0 → 4.0.1-a

package/dist/mcp/tools/current_gate.js

@@ -0,0 +1,35 @@
+import { loadPipeline, getGateConfig, getInitialGate } from "../pipeline.js";
+import { createTaskState, latestClassification, readTaskState } from "../task_state.js";
+import { resolveActiveDomain } from "../config.js";
+/**
+ * Returns the task's current gate. Auto-creates the task state with the
+ * pipeline's default_mode and initial gate if no state file exists yet —
+ * there is no separate start_task tool in the v0 surface, so first-touch
+ * is implicit.
+ *
+ * The contract output includes allowed_tools and required_handoff_fields.
+ * For the prototype both are derived from the gate config in pipeline.yaml:
+ *   allowed_tools: empty array — hook layer resolves real tool allowlists.
+ *   required_handoff_fields: ["summary", "deliverable_path", "next_role"]
+ *   classification_pending: true if classify_required && no classification yet.
+ */
+export async function currentGate(input) {
+    const pipeline = await loadPipeline(await resolveActiveDomain());
+    let state = await readTaskState(input.task_id);
+    if (!state) {
+        state = await createTaskState({
+            task_id: input.task_id,
+            mode: pipeline.default_mode,
+            initial_gate: getInitialGate(pipeline, pipeline.default_mode),
+        });
+    }
+    const gateCfg = getGateConfig(pipeline, state.mode, state.current_gate);
+    const cls = latestClassification(state, state.current_gate);
+    return {
+        mode: state.mode,
+        gate: state.current_gate,
+        allowed_tools: [],
+        required_handoff_fields: ["summary", "deliverable_path", "next_role"],
+        classification_pending: gateCfg.classify_required && cls === null,
+    };
+}

package/dist/mcp/tools/dependency_supply_chain.d.ts

@@ -0,0 +1,2 @@
+import { type DependencySupplyChainInput, type DependencySupplyChainOutput } from "../../shared/index.js";
+export declare function dependencySupplyChain(input: DependencySupplyChainInput): Promise<DependencySupplyChainOutput>;

package/dist/mcp/tools/dependency_supply_chain.js

@@ -0,0 +1,59 @@
+import { npmCommand, spawnWithOutput, tail } from "./_subprocess.js";
+export async function dependencySupplyChain(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const result = await spawnWithOutput(npmCommand(), ["audit", "--json"], { cwd });
+    if (!result.stdout.trim()) {
+        return {
+            vulnerabilities: [
+                {
+                    code: "subprocess-error",
+                    message: `npm audit produced no output (exit=${result.exitCode})`,
+                    evidence: {
+                        stderr: tail(result.stderr, 2000),
+                        spawnError: result.spawnError?.message,
+                    },
+                },
+            ],
+            total_deps: 0,
+        };
+    }
+    let report;
+    try {
+        report = JSON.parse(result.stdout);
+    }
+    catch (err) {
+        return {
+            vulnerabilities: [
+                {
+                    code: "json-parse-error",
+                    message: `Failed to parse npm audit JSON: ${err.message}`,
+                    evidence: { raw: result.stdout.slice(0, 500) },
+                },
+            ],
+            total_deps: 0,
+        };
+    }
+    const vulnerabilities = [];
+    for (const [pkg, info] of Object.entries(report.vulnerabilities ?? {})) {
+        const severity = info.severity ?? "unknown";
+        const range = info.range ?? "";
+        const viaList = (info.via ?? [])
+            .map((v) => typeof v === "string" ? v : (v.title ?? v.name ?? ""))
+            .filter(Boolean);
+        vulnerabilities.push({
+            code: `npm-audit-${severity}-${pkg}`,
+            message: `${pkg}${range ? ` ${range}` : ""} — ${severity} severity${viaList.length ? `: ${viaList[0]}` : ""}`,
+            evidence: {
+                package: pkg,
+                severity,
+                range,
+                via: info.via,
+                effects: info.effects,
+            },
+        });
+    }
+    return {
+        vulnerabilities,
+        total_deps: report.metadata?.dependencies?.total ?? 0,
+    };
+}

package/dist/mcp/tools/docker_compose.d.ts

@@ -0,0 +1,2 @@
+import { type DockerComposeInput, type DockerComposeOutput } from "../../shared/index.js";
+export declare function dockerCompose(input: DockerComposeInput): Promise<DockerComposeOutput>;

package/dist/mcp/tools/docker_compose.js

@@ -0,0 +1,24 @@
+import { spawnWithOutput } from "./_subprocess.js";
+const DOCKER = process.platform === "win32" ? "docker.exe" : "docker";
+export async function dockerCompose(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const args = buildArgs(input.command);
+    const result = await spawnWithOutput(DOCKER, args, { cwd });
+    return {
+        exit_code: result.exitCode ?? -1,
+        stdout: result.stdout,
+        stderr: result.stderr,
+    };
+}
+function buildArgs(command) {
+    switch (command) {
+        case "up":
+            return ["compose", "up", "-d"];
+        case "down":
+            return ["compose", "down"];
+        case "ps":
+            return ["compose", "ps"];
+        case "logs":
+            return ["compose", "logs", "--no-color", "--tail=200"];
+    }
+}

package/dist/mcp/tools/e2e_playwright.d.ts

@@ -0,0 +1,2 @@
+import { type E2EPlaywrightInput, type E2EPlaywrightOutput } from "../../shared/index.js";
+export declare function e2ePlaywright(input: E2EPlaywrightInput): Promise<E2EPlaywrightOutput>;

package/dist/mcp/tools/e2e_playwright.js

@@ -0,0 +1,88 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { readFile, unlink } from "node:fs/promises";
+import { npmCommand, spawnWithOutput, tail } from "./_subprocess.js";
+export async function e2ePlaywright(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const outFile = join(tmpdir(), `code-ai-playwright-${randomUUID()}.json`);
+    const args = ["exec", "--", "playwright", "test", "--reporter=json"];
+    if (input.spec)
+        args.push("--grep", input.spec);
+    const result = await spawnWithOutput(npmCommand(), args, {
+        cwd,
+        env: { PLAYWRIGHT_JSON_OUTPUT_NAME: outFile },
+    });
+    let raw = null;
+    try {
+        raw = await readFile(outFile, "utf8");
+        await unlink(outFile).catch(() => undefined);
+    }
+    catch {
+        raw = result.stdout.trim() || null;
+    }
+    if (!raw) {
+        return {
+            passed: 0,
+            failed: 0,
+            failures: [
+                {
+                    code: "subprocess-error",
+                    message: `playwright did not produce a JSON report (exit=${result.exitCode})`,
+                    evidence: {
+                        stderr: tail(result.stderr, 2000),
+                        stdout: tail(result.stdout, 2000),
+                        spawnError: result.spawnError?.message,
+                    },
+                },
+            ],
+        };
+    }
+    let report;
+    try {
+        report = JSON.parse(raw);
+    }
+    catch (err) {
+        return {
+            passed: 0,
+            failed: 0,
+            failures: [
+                {
+                    code: "json-parse-error",
+                    message: `Failed to parse playwright JSON report: ${err.message}`,
+                    evidence: { raw: raw.slice(0, 500) },
+                },
+            ],
+        };
+    }
+    return mapReport(report);
+}
+function mapReport(report) {
+    const passed = report.stats?.expected ?? 0;
+    const failed = (report.stats?.unexpected ?? 0) + (report.stats?.flaky ?? 0);
+    const failures = [];
+    walkSuites(report.suites ?? [], failures);
+    return { passed, failed, failures };
+}
+function walkSuites(suites, failures) {
+    for (const suite of suites) {
+        for (const spec of suite.specs ?? []) {
+            if (spec.ok === false) {
+                const lastTest = spec.tests?.[spec.tests.length - 1];
+                const lastResult = lastTest?.results?.[lastTest.results.length - 1];
+                const msg = (lastResult?.error?.message ?? "(no error message)").split("\n")[0] ??
+                    "";
+                failures.push({
+                    code: "playwright-test-failed",
+                    message: `${spec.file ?? suite.file ?? "<unknown>"} > ${spec.title ?? "<untitled>"}: ${msg}`,
+                    evidence: {
+                        file: spec.file ?? suite.file,
+                        title: spec.title,
+                        error: lastResult?.error,
+                    },
+                });
+            }
+        }
+        walkSuites(suite.suites ?? [], failures);
+    }
+}

package/dist/mcp/tools/get_artifact.d.ts

@@ -0,0 +1,11 @@
+import type { GetArtifactInput, GetArtifactOutput } from "../../shared/index.js";
+/**
+ * Resolves (task_id, gate) → artifact file content. Uses the per-task index
+ * .code-ai/state/artifacts/<task_id>.jsonl. If multiple writes happened at the
+ * same gate, returns the LATEST one (jsonl order).
+ *
+ * format=summary returns the first 5 lines of the content prepended with a
+ * heading; format=raw returns the full body. v1 keeps summary very simple —
+ * a fancier summarizer (per artifact class) is a future enhancement.
+ */
+export declare function getArtifact(input: GetArtifactInput): Promise<GetArtifactOutput>;

package/dist/mcp/tools/get_artifact.js

@@ -0,0 +1,46 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Resolves (task_id, gate) → artifact file content. Uses the per-task index
+ * .code-ai/state/artifacts/<task_id>.jsonl. If multiple writes happened at the
+ * same gate, returns the LATEST one (jsonl order).
+ *
+ * format=summary returns the first 5 lines of the content prepended with a
+ * heading; format=raw returns the full body. v1 keeps summary very simple —
+ * a fancier summarizer (per artifact class) is a future enhancement.
+ */
+export async function getArtifact(input) {
+    const safe = input.task_id.replace(/[^A-Za-z0-9_.-]/g, "_");
+    const indexPath = join(process.cwd(), ".code-ai", "state", "artifacts", `${safe}.jsonl`);
+    const raw = await readFile(indexPath, "utf8").catch(() => "");
+    if (!raw)
+        return { exists: false };
+    let latestPath = null;
+    for (const line of raw.split("\n")) {
+        if (!line)
+            continue;
+        try {
+            const obj = JSON.parse(line);
+            if (obj.gate === input.gate && typeof obj.path === "string") {
+                latestPath = obj.path; // overwrite — last match wins
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    if (!latestPath)
+        return { exists: false };
+    const content = await readFile(latestPath, "utf8").catch(() => null);
+    if (content === null)
+        return { exists: false };
+    if (input.format === "summary") {
+        const head = content.split("\n").slice(0, 5).join("\n");
+        return {
+            exists: true,
+            path: latestPath,
+            content: `=== summary of ${latestPath} ===\n${head}`,
+        };
+    }
+    return { exists: true, path: latestPath, content };
+}

package/dist/mcp/tools/get_skill.d.ts

@@ -0,0 +1,17 @@
+import { type GetSkillInput, type GetSkillOutput } from "../../shared/index.js";
+/**
+ * Reads a single SKILL.md from disk, validates its frontmatter against
+ * SkillFrontmatter (zod), and returns { frontmatter, body }.
+ *
+ * Throws:
+ *   - if the file does not exist (caller passed a name that has no SKILL.md)
+ *   - if the frontmatter block is missing
+ *   - if the YAML is malformed
+ *   - if the frontmatter fails SkillFrontmatter validation
+ *
+ * The body is everything AFTER the closing `---` of the frontmatter, with the
+ * BOM (if any) stripped from the file head. Line cap is NOT enforced here —
+ * `submit_artifact` validates writes; `get_skill` is read-only and surfaces
+ * whatever is on disk so callers can audit oversized bodies.
+ */
+export declare function getSkill(input: GetSkillInput): Promise<GetSkillOutput>;

package/dist/mcp/tools/get_skill.js

@@ -0,0 +1,64 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { SkillFrontmatter, } from "../../shared/index.js";
+import { resolveSkillsRoot } from "../paths.js";
+import { recordSkillInvocation } from "../skill_invocations.js";
+/**
+ * Reads a single SKILL.md from disk, validates its frontmatter against
+ * SkillFrontmatter (zod), and returns { frontmatter, body }.
+ *
+ * Throws:
+ *   - if the file does not exist (caller passed a name that has no SKILL.md)
+ *   - if the frontmatter block is missing
+ *   - if the YAML is malformed
+ *   - if the frontmatter fails SkillFrontmatter validation
+ *
+ * The body is everything AFTER the closing `---` of the frontmatter, with the
+ * BOM (if any) stripped from the file head. Line cap is NOT enforced here —
+ * `submit_artifact` validates writes; `get_skill` is read-only and surfaces
+ * whatever is on disk so callers can audit oversized bodies.
+ */
+export async function getSkill(input) {
+    const file = join(resolveSkillsRoot(input.domain), input.name, "SKILL.md");
+    const raw = await readFile(file, "utf8").catch((err) => {
+        if (err.code === "ENOENT") {
+            throw new Error(`get_skill: SKILL.md not found for '${input.name}' in domain '${input.domain}' (expected at ${file})`);
+        }
+        throw err;
+    });
+    const stripped = raw.startsWith("") ? raw.slice(1) : raw;
+    const m = stripped.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
+    if (!m) {
+        throw new Error(`get_skill: no frontmatter block found in ${file}`);
+    }
+    let parsedYaml;
+    try {
+        parsedYaml = parseYaml(m[1]);
+    }
+    catch (err) {
+        throw new Error(`get_skill: malformed YAML frontmatter in ${file} — ${err.message}`);
+    }
+    const fm = SkillFrontmatter.safeParse(parsedYaml);
+    if (!fm.success) {
+        throw new Error(`get_skill: frontmatter validation failed for ${file} — ${fm.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`);
+    }
+    const body = stripped.slice(m[0].length);
+    // Auditor telemetry (ADR-DEV-121): when associated with a run, log the fetch
+    // as a skill invocation. Best-effort — a logging failure must never break a
+    // read (telemetry is not load-bearing for get_skill).
+    if (input.task_id !== undefined) {
+        try {
+            await recordSkillInvocation({
+                task_id: input.task_id,
+                gate: input.gate ?? null,
+                skill: input.name,
+                timestamp: new Date().toISOString(),
+            });
+        }
+        catch {
+            /* swallow */
+        }
+    }
+    return { frontmatter: fm.data, body };
+}

package/dist/mcp/tools/git_commit.d.ts

@@ -0,0 +1,2 @@
+import { type GitCommitInput, type GitCommitOutput } from "../../shared/index.js";
+export declare function gitCommit(input: GitCommitInput): Promise<GitCommitOutput>;

package/dist/mcp/tools/git_commit.js

@@ -0,0 +1,30 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { writeFile, unlink } from "node:fs/promises";
+import { spawnWithOutput, tail } from "./_subprocess.js";
+const GIT = process.platform === "win32" ? "git.exe" : "git";
+export async function gitCommit(input) {
+    const cwd = input.cwd ?? process.cwd();
+    if (input.paths.length > 0) {
+        const add = await spawnWithOutput(GIT, ["add", "--", ...input.paths], { cwd });
+        if (add.exitCode !== 0) {
+            throw new Error(`git add failed (exit=${add.exitCode}): ${tail(add.stderr, 2000) || tail(add.stdout, 2000)}`);
+        }
+    }
+    const msgPath = join(tmpdir(), `code-ai-commit-msg-${randomUUID()}.txt`);
+    await writeFile(msgPath, input.message, "utf8");
+    const args = input.paths.length === 0
+        ? ["commit", "-a", "-F", msgPath]
+        : ["commit", "-F", msgPath];
+    const commit = await spawnWithOutput(GIT, args, { cwd });
+    await unlink(msgPath).catch(() => undefined);
+    if (commit.exitCode !== 0) {
+        throw new Error(`git commit failed (exit=${commit.exitCode}): ${tail(commit.stderr, 2000) || tail(commit.stdout, 2000)}`);
+    }
+    const sha = await spawnWithOutput(GIT, ["rev-parse", "HEAD"], { cwd });
+    if (sha.exitCode !== 0) {
+        throw new Error(`git rev-parse HEAD failed: ${tail(sha.stderr, 1000)}`);
+    }
+    return { sha: sha.stdout.trim() };
+}

package/dist/mcp/tools/list_artifacts.d.ts

@@ -0,0 +1,8 @@
+import type { ListArtifactsInput, ListArtifactsOutput } from "../../shared/index.js";
+/**
+ * Returns artifacts written via submit_artifact with `gate` provided.
+ * Source: .code-ai/state/artifacts/<task_id>.jsonl (one line per write).
+ * Empty array if no artifacts were indexed for this task (older callers may
+ * have written without the gate field; those won't show up here).
+ */
+export declare function listArtifacts(input: ListArtifactsInput): Promise<ListArtifactsOutput>;

package/dist/mcp/tools/list_artifacts.js

@@ -0,0 +1,35 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Returns artifacts written via submit_artifact with `gate` provided.
+ * Source: .code-ai/state/artifacts/<task_id>.jsonl (one line per write).
+ * Empty array if no artifacts were indexed for this task (older callers may
+ * have written without the gate field; those won't show up here).
+ */
+export async function listArtifacts(input) {
+    const safe = input.task_id.replace(/[^A-Za-z0-9_.-]/g, "_");
+    const indexPath = join(process.cwd(), ".code-ai", "state", "artifacts", `${safe}.jsonl`);
+    const raw = await readFile(indexPath, "utf8").catch(() => "");
+    if (!raw)
+        return { artifacts: [] };
+    const artifacts = [];
+    for (const line of raw.split("\n")) {
+        if (!line)
+            continue;
+        try {
+            const obj = JSON.parse(line);
+            if (typeof obj.gate !== "string" || typeof obj.class !== "string")
+                continue;
+            artifacts.push({
+                gate: obj.gate,
+                class: obj.class,
+                path: obj.path,
+                line_count: obj.line_count,
+            });
+        }
+        catch {
+            continue;
+        }
+    }
+    return { artifacts };
+}

package/dist/mcp/tools/list_proposals.d.ts

@@ -0,0 +1,6 @@
+import { type ListProposalsInput, type ListProposalsOutput } from "../../shared/index.js";
+/**
+ * List stored proposals, newest first, with optional surfacing filters
+ * (status / risk / domain). Read-only — never mutates the store.
+ */
+export declare function listProposals(input: ListProposalsInput): Promise<ListProposalsOutput>;

package/dist/mcp/tools/list_proposals.js

@@ -0,0 +1,16 @@
+import { readProposals } from "../proposal_store.js";
+/**
+ * List stored proposals, newest first, with optional surfacing filters
+ * (status / risk / domain). Read-only — never mutates the store.
+ */
+export async function listProposals(input) {
+    let proposals = await readProposals();
+    if (input.status)
+        proposals = proposals.filter((p) => p.status === input.status);
+    if (input.risk)
+        proposals = proposals.filter((p) => p.risk === input.risk);
+    if (input.domain)
+        proposals = proposals.filter((p) => p.target.domain === input.domain);
+    proposals.sort((a, b) => b.created_at.localeCompare(a.created_at));
+    return { proposals };
+}

package/dist/mcp/tools/list_skills.d.ts

@@ -0,0 +1,8 @@
+import { type ListSkillsInput, type ListSkillsOutput } from "../../shared/index.js";
+/**
+ * Reads every SKILL.md under the given domain's `.agents/skills/<name>/SKILL.md`
+ * and returns the subset matching the filter. Frontmatter is parsed via the YAML
+ * lib (BOM-aware) and the type-narrowing is done at the filter step — we don't
+ * fail the whole call if one skill has a malformed frontmatter; we just skip it.
+ */
+export declare function listSkills(input: ListSkillsInput): Promise<ListSkillsOutput>;

package/dist/mcp/tools/list_skills.js

@@ -0,0 +1,62 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { SkillFrontmatter, } from "../../shared/index.js";
+import { resolveSkillsRoot } from "../paths.js";
+/**
+ * Reads every SKILL.md under the given domain's `.agents/skills/<name>/SKILL.md`
+ * and returns the subset matching the filter. Frontmatter is parsed via the YAML
+ * lib (BOM-aware) and the type-narrowing is done at the filter step — we don't
+ * fail the whole call if one skill has a malformed frontmatter; we just skip it.
+ */
+export async function listSkills(input) {
+    const domain = input.domain ?? "development";
+    const root = resolveSkillsRoot(domain);
+    const dirs = (await readdir(root, { withFileTypes: true })).filter((d) => d.isDirectory());
+    const out = [];
+    for (const dir of dirs) {
+        const md = await readFile(join(root, dir.name, "SKILL.md"), "utf8").catch(() => null);
+        if (!md)
+            continue;
+        const fm = parseFrontmatter(md);
+        if (!fm)
+            continue;
+        if (input.type && fm.type !== input.type)
+            continue;
+        if (input.gate && !(fm.gates ?? []).includes(input.gate))
+            continue;
+        if (input.tech && !(fm.tech ?? []).includes(input.tech))
+            continue;
+        if (input.topic && !(fm.topic ?? []).includes(input.topic))
+            continue;
+        if (input.owner && !(fm.owners ?? []).includes(input.owner))
+            continue;
+        out.push({
+            name: fm.name,
+            description: fm.description,
+            type: fm.type,
+            gates: fm.gates ?? [],
+        });
+    }
+    out.sort((a, b) => a.name.localeCompare(b.name));
+    return { skills: out };
+}
+function parseFrontmatter(raw) {
+    const stripped = raw.startsWith("") ? raw.slice(1) : raw;
+    const m = stripped.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!m)
+        return null;
+    let parsed;
+    try {
+        parsed = parseYaml(m[1]);
+    }
+    catch {
+        return null;
+    }
+    // Strict validation — skills with garbage frontmatter (missing type, bad
+    // enum, etc.) are silently skipped. Drift detection is run_drift_audit's job;
+    // list_skills returns only schema-conformant skills so downstream output.parse
+    // never sees a partially-typed entry.
+    const result = SkillFrontmatter.safeParse(parsed);
+    return result.success ? result.data : null;
+}

package/dist/mcp/tools/load_role.d.ts

@@ -0,0 +1,13 @@
+import { type LoadRoleInput, type LoadRoleOutput } from "../../shared/index.js";
+/**
+ * SessionStart loader for an agent role.
+ *
+ * Base persona ships inside the package at
+ * `domains/<domain>/persona/persona-base.md` (resolved per active domain via
+ * resolvePersonaBase); absent file degrades gracefully to no base layer.
+ *
+ * User-layer persona is currently always absent (persona-user-denis.md is
+ * gitignored and not loaded by name match). Future versions read the user
+ * handle from env or config.
+ */
+export declare function loadRole(input: LoadRoleInput): Promise<LoadRoleOutput>;