codecartographer-pi 0.17.1 → 0.18.0

package/dist/mcp-server/server.js

@@ -17,7 +17,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from "@modelcontextprotocol/sdk/types.js";
 import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
 import { basename, isAbsolute, join } from "node:path";
-import { buildPhasePrompt, buildSkillPrompt, buildValidationSummary, BROADSIDE_DIR, broadsideDirFor, BROADSIDE_LENS_IDS, BROADSIDE_SKILL_NAME, canonicalPath, copyPackagedWorkspace, collectResultText, completeValidatedPhase, computePerPhaseTotals, computeTotals, createEmptyStatus, DEFAULT_PIPELINE_PATH, deriveSlug, discoverLibrary, describeScaffoldStaleness, detectProvenanceConflicts, estimateSubmitText, getLens, getNextEligiblePhase, getPipelineLabel, getWorkspaceState, isValidSlug, isWithinPathResolved, listBatchModels, listEntries, listGuideTopics, loadBroadsideConfig, modelsText, readGuide, listSkillNames, loadCodecartoConfig, loadUsage, loadYamlFile, normalizeForComparison, PACKAGE_VERSION, packagedWorkspaceDir, pathExists, PhasePreflightError, publishEntry, reindex as libraryReindex, refreshScaffold, resolvePhase, resolvePipelineChoice, readBroadsideSkill, runBroadsideCollect, runBroadsideStatus, runBroadsideSubmit, seedOrchestratorFiles, statusText, stringifySimpleYaml, switchPipeline, validatePhaseOutput, writeLibraryConfig, } from "../core/index.js";
+import { buildPhasePrompt, buildSkillPrompt, buildValidationSummary, BROADSIDE_DIR, broadsideDirFor, BROADSIDE_LENS_IDS, BROADSIDE_SKILL_NAME, canonicalPath, copyPackagedWorkspace, collectResultText, completeValidatedPhase, computePerPhaseTotals, computeTotals, createEmptyStatus, DEFAULT_PIPELINE_PATH, deriveSlug, discoverLibrary, describeScaffoldStaleness, detectProvenanceConflicts, estimateSubmitText, getLens, getNextEligiblePhase, getPipelineLabel, getWorkspaceState, isValidSlug, isWithinPathResolved, listBatchModels, listEntries, listGuideTopics, loadBroadsideConfig, modelsText, readGuide, listSkillNames, loadCodecartoConfig, loadUsage, loadYamlFile, normalizeForComparison, PACKAGE_VERSION, packagedWorkspaceDir, pathExists, PhasePreflightError, previewPublishVersion, publishEntry, reindex as libraryReindex, refreshScaffold, resolvePhase, resolvePipelineChoice, readBroadsideSkill, runBroadsideCollect, runBroadsideStatus, runBroadsideSubmit, seedOrchestratorFiles, statusText, stringifySimpleYaml, switchPipeline, validatePhaseOutput, writeLibraryConfig, } from "../core/index.js";
 import { applyAmendment } from "../core/amendment.js";
 import { appendUsageRun } from "../core/usage.js";
 import { initLibrary } from "../core/library.js";
@@ -370,6 +370,17 @@ async function resolveLibraryPath(args) {
     }
     throw new McpError(ErrorCode.InvalidParams, "library_path is required (pass it explicitly, or pass cwd and configure library.path in ~/.codecarto/config.yaml or .codecarto/workflow/config.yaml).");
 }
+/**
+ * The configuration `codecarto_config` reports for the same `cwd`: workspace
+ * over user-global when a cwd is given, user-global alone otherwise. Publish
+ * reads its gate from here so the value the config tool displays is the value
+ * the publish tool enforces.
+ */
+async function loadEffectiveConfig(cwd) {
+    return typeof cwd === "string" && cwd.trim() !== ""
+        ? loadCodecartoConfig(join(cwd.trim(), ".codecarto"))
+        : loadUserConfig();
+}
 function asStringArray(value, fieldName) {
     if (!Array.isArray(value)) {
         throw new McpError(ErrorCode.InvalidParams, `${fieldName} must be an array of strings`);
@@ -550,6 +561,50 @@ export async function handlePublish(args) {
     const analyzedAt = typeof args.analyzed_at === "string" && args.analyzed_at !== ""
         ? args.analyzed_at
         : new Date().toISOString();
+    const headline = args.headline.trim();
+    const forceNewVersion = args.force_new_version === true;
+    // publish_confirm gate (#162). Pi shows a preview and asks before writing.
+    // An MCP server has no one to ask, so — as codecarto_broadside does for its
+    // spend limit — it refuses with the preview and lets the caller re-invoke
+    // with confirm: true. The gate applies only when a config layer actually
+    // set the key: the loader's default (true) exists to make Pi's dialog
+    // opt-out, and a host that never configured the key keeps the behavior it
+    // had. Runs after every argument check so the preview names the resolved
+    // slug and namespace, and before publishEntry so nothing is written.
+    const config = await loadEffectiveConfig(args.cwd);
+    if (config.library.publish_confirm && config.library.publish_confirm_configured && args.confirm !== true) {
+        const preview = await previewPublishVersion(libraryPath, spec, { slug, namespace }, { forceNewVersion });
+        const label = `${namespace ? `${namespace}/` : ""}${slug}`;
+        const versionLine = preview.latestVersion === 0
+            ? "v1 (first version of a new entry)"
+            : preview.isNewVersion
+                ? `v${preview.version} (new content version; the newest is v${preview.latestVersion})`
+                : `v${preview.version} (metadata-only update; the content hash matches the newest version)`;
+        const specSource = typeof args.spec_path === "string" && args.spec_path.trim() !== ""
+            ? args.spec_path.trim()
+            : `inline (${spec.length} characters)`;
+        throw new McpError(ErrorCode.InvalidRequest, [
+            "Publish not performed: library.publish_confirm is set and this call did not carry confirm: true. Nothing was written.",
+            `Would publish ${label} to ${libraryPath}`,
+            `  Version: ${versionLine}`,
+            `  Source repo: ${sourceRepo}`,
+            `  Headline: ${headline}`,
+            `  Confidentiality: ${confidentiality ?? "internal (the default; none declared)"}`,
+            `  Spec: ${specSource}`,
+            "Re-invoke codecarto_publish with the same arguments plus confirm: true to publish, or set library.publish_confirm: false in config to drop this gate.",
+        ].join("\n"), {
+            refused: "publish_confirm",
+            libraryPath,
+            namespace: namespace ?? null,
+            slug,
+            version: preview.version,
+            isNewVersion: preview.isNewVersion,
+            latestVersion: preview.latestVersion,
+            source_repo: sourceRepo,
+            headline,
+            confidentiality: confidentiality ?? null,
+        });
+    }
     const result = await publishEntry(libraryPath, spec, {
         slug,
         namespace: namespace ?? undefined,
@@ -560,13 +615,13 @@ export async function handlePublish(args) {
         analyzed_at: analyzedAt,
         pipeline: defaults.pipeline,
         codecarto_version: PACKAGE_VERSION,
-        headline: args.headline.trim(),
+        headline,
         tags,
         capabilities,
         confidentiality,
         generation,
     }, {
-        forceNewVersion: args.force_new_version === true,
+        forceNewVersion,
         allowSourceRepoChange: args.allow_source_repo_change === true,
         allowConfidentialityMismatch: args.allow_confidentiality_mismatch === true,
     });
@@ -1060,7 +1115,7 @@ const TOOLS = [
     },
     {
         name: "codecarto_publish",
-        description: "Publish a reimplementation-spec to a CodeCartographer library. Identified by library_path (absolute) or cwd's config.yaml. Content-hash idempotent — re-publishing identical spec bytes updates metadata in place rather than bumping the version. Required: source_repo, headline, and either spec (inline) or spec_path (absolute file). Slug derives from source_repo if not provided. If the library is namespaced, namespace is required (or pass cwd to inherit from config). Generation context (agent, model, vendor, reasoning) is passed via model_metadata so the host can record provenance; omitted fields default to 'unknown'.",
+        description: "Publish a reimplementation-spec to a CodeCartographer library. Identified by library_path (absolute) or cwd's config.yaml. Content-hash idempotent — re-publishing identical spec bytes updates metadata in place rather than bumping the version. Required: source_repo, headline, and either spec (inline) or spec_path (absolute file). Slug derives from source_repo if not provided. If the library is namespaced, namespace is required (or pass cwd to inherit from config). Generation context (agent, model, vendor, reasoning) is passed via model_metadata so the host can record provenance; omitted fields default to 'unknown'. When library.publish_confirm is set in config, a call without confirm: true is refused with a preview of what would be published (nothing is written); re-invoke with confirm: true to publish.",
         inputSchema: {
             type: "object",
             properties: {
@@ -1104,6 +1159,10 @@ const TOOLS = [
                     type: "boolean",
                     description: "Permit publishing when the entry's confidentiality is more restricted than the library's visibility (internal < shared < public: an internal entry into a shared or public library, a shared entry into a public one). Off by default, because that direction exposes the spec to everyone the library reaches. An omitted confidentiality counts as internal. Set only when the exposure is intended; the recorded confidentiality is not changed.",
                 },
+                confirm: {
+                    type: "boolean",
+                    description: "Acknowledge the publish_confirm gate. When library.publish_confirm is set in config (user-global ~/.codecarto/config.yaml, or the workspace's .codecarto/workflow/config.yaml when cwd is passed), a call without confirm: true is refused and the refusal previews what would be published — library, entry, whether a new version or a metadata-only update, source_repo, headline, confidentiality — so the caller can show it before committing to the write. Pass true to publish. No effect when publish_confirm is unset or false.",
+                },
             },
             required: ["source_repo", "headline"],
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecartographer-pi",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "mcpName": "io.github.HuginnIndustries/codecartographer",
   "description": "Turn an unfamiliar codebase into a validated reimplementation spec, then synthesize confirmed specs and a product vision into a traceable plan.",
   "type": "module",