continuous-improvement 3.11.0 → 3.15.0

package/bin/mcp-server.mjs

@@ -3,7 +3,7 @@
  * continuous-improvement MCP Server
  *
  * Exposes instincts, observations, and reflection as MCP tools + resources.
- * Two modes: beginner (3 tools) and expert (all tools).
+ * Two modes: beginner (4 tools) and expert (all tools).
  *
  * Usage:
  *   node bin/mcp-server.mjs                  # default: beginner mode
@@ -13,15 +13,15 @@
 import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
 import { PACKAGE_NAME, VERSION, getToolDefinitions, isPluginMode, } from "../lib/plugin-metadata.mjs";
 import { formatDriftReport, parseGoalFromPlan, scoreObservations, } from "../lib/goal-state.mjs";
 import { buildIndex, formatRecallHits, parseSince, query as queryRecall, } from "../lib/recall-index.mjs";
-import { draftFromCandidate, extractTrajectories, findCandidates, formatCandidates, serializeDraft, } from "../lib/skill-distill.mjs";
-import { MAX_CLEARED_FILES, clearFiles, resolveSessionDir, } from "../lib/gateguard-state.mjs";
+import { draftFromCandidate, draftFromWorkflowRun, extractTrajectories, findCandidates, formatCandidates, serializeDraft, workflowRunFromObservations, } from "../lib/skill-distill.mjs";
+import { MAX_CLEARED_FILES, canonicalizeFileKey, clearFiles, resolveInstinctsRoot, resolveSessionDir, } from "../lib/gateguard-state.mjs";
 function getHomeDir() {
     return process.env.HOME || process.env.USERPROFILE || homedir();
 }
@@ -508,10 +508,11 @@ function handleTool(name, params) {
         }
         case "ci_gateguard_clear": {
             // Beginner-available on purpose: the GateGuard hook fires for every
-            // install, so the clearance action must too. Resolves the session dir via
-            // gateguard-state (canonical), the same way the hook does, so the marker
-            // lands where the hook looks regardless of how each process spelled the
-            // project root.
+            // install, so the clearance action must too. The hook's block reason now
+            // prints state_path (the session-scoped state file); honoring it writes
+            // the marker exactly where the hook looks. Without it the MCP server can't
+            // know the caller's session, so it falls back to the canonical session dir
+            // — correct only on the legacy unscoped path.
             const rawList = Array.isArray(params.file_paths) ? params.file_paths : [];
             const listPaths = rawList.filter((value) => typeof value === "string" && value.length > 0);
             const single = getString(params.file_path).trim();
@@ -519,7 +520,24 @@ function handleTool(name, params) {
             if (paths.length === 0) {
                 return error("file_paths is required — pass the file path(s) named in the GateGuard block reason, e.g. { file_paths: [\"src/x.ts\"] }.");
             }
-            const sessionDir = resolveSessionDir();
+            // state_path is a model-controlled argument, so it could be a traversal
+            // string (`../../etc/...`). dirname leaves `..` segments for the OS to
+            // resolve at write time, so without a bound this is an arbitrary-write
+            // primitive. Resolve + canonicalize, then require containment within the
+            // instincts root (the only tree the hook ever prints a state_path inside).
+            const rawStatePath = getString(params.state_path).trim();
+            let sessionDir;
+            if (rawStatePath) {
+                const resolvedKey = canonicalizeFileKey(resolve(rawStatePath));
+                const rootKey = canonicalizeFileKey(resolveInstinctsRoot());
+                if (resolvedKey !== rootKey && !resolvedKey.startsWith(`${rootKey}/`)) {
+                    return error("state_path must resolve inside ~/.claude/instincts/. Pass it verbatim from the GateGuard block reason.");
+                }
+                sessionDir = dirname(resolve(rawStatePath));
+            }
+            else {
+                sessionDir = resolveSessionDir();
+            }
             const { cleared, skippedForCap } = clearFiles(sessionDir, paths);
             const lines = [
                 "## GateGuard clearance",
@@ -837,6 +855,45 @@ function handleTool(name, params) {
                 "```",
             ].join("\n"));
         }
+        case "ci_distill_from_workflow": {
+            if (MODE !== "expert") {
+                return error("ci_distill_from_workflow requires expert mode");
+            }
+            const run = workflowRunFromObservations(readDistillObservations(project.hash));
+            if (!run) {
+                return text("No completed-and-verified Workflow run found in this project's observations. " +
+                    "A run qualifies when a `Workflow` tool call is followed by a passing verify/test/build in the same feed. " +
+                    "Run a workflow, verify its output, then try `ci_distill_from_workflow` again.");
+            }
+            const draftInstinct = draftFromWorkflowRun(run);
+            if (!isSafeDraftId(draftInstinct.id)) {
+                return error(`Internal error: generated draft id "${draftInstinct.id}" failed the safety check.`);
+            }
+            const draft = serializeDraft(draftInstinct);
+            const draftsDir = join(INSTINCTS_DIR, project.hash, "drafts");
+            const draftPath = join(draftsDir, `${draftInstinct.id}.yaml`);
+            try {
+                mkdirSync(draftsDir, { recursive: true });
+                writeFileSync(draftPath, draft);
+            }
+            catch (err) {
+                return error(`Failed to write draft to ${draftPath}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return text([
+                "## Draft written from a verified workflow run",
+                "",
+                `**Workflow:** ${run.name}`,
+                `**Path:** ${draftPath}`,
+                "",
+                "Edit the body to capture the real recipe (preconditions, concrete steps, gotchas), then promote with:",
+                "",
+                `  ci_distill_promote id=${draftInstinct.id}`,
+                "",
+                "```yaml",
+                draft.trimEnd(),
+                "```",
+            ].join("\n"));
+        }
         case "ci_distill_promote": {
             if (MODE !== "expert") {
                 return error("ci_distill_promote requires expert mode");

package/bin/plan-pack.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * plan-pack (`ci-plan-pack`).
+ *
+ * Turn a plan doc into a commentable review packet a colleague can mark up.
+ *
+ *   node bin/plan-pack.mjs <plan.md>            write <plan>.review.md
+ *   node bin/plan-pack.mjs <plan.md> --stdout   print the packet to stdout
+ *   node bin/plan-pack.mjs <plan.md> --gh-issue write the packet, then print a
+ *                                               ready-to-run `gh issue create`
+ *                                               command (does NOT auto-post)
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { extname } from "node:path";
+import { pathToFileURL } from "node:url";
+import { buildReviewPacket } from "../lib/plan-review-packet.mjs";
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function reviewPathFor(source) {
+    const ext = extname(source);
+    return ext ? `${source.slice(0, -ext.length)}.review${ext}` : `${source}.review.md`;
+}
+function packetTitle(packet) {
+    const match = /^# Review packet: (.*)$/m.exec(packet);
+    return match ? match[1].trim() : "Plan review";
+}
+const HELP = `
+plan-pack (ci-plan-pack) - turn a plan doc into a commentable review packet
+
+Usage: ci-plan-pack <plan.md> [--stdout] [--gh-issue]
+
+Options:
+  --stdout      Print the packet to stdout instead of writing a file
+  --gh-issue    Write the packet, then print a 'gh issue create' command
+                (does not post anything - you run it)
+
+Examples:
+  ci-plan-pack docs/plans/2026-06-15-plan-pack.md
+  ci-plan-pack docs/plans/2026-06-15-plan-pack.md --stdout
+`;
+function main() {
+    const args = process.argv.slice(2);
+    if (args.length === 0 || args.includes("--help") || args.includes("-h")) {
+        console.log(HELP);
+        process.exit(args.length === 0 ? 1 : 0);
+    }
+    const toStdout = args.includes("--stdout");
+    const ghIssue = args.includes("--gh-issue");
+    const source = args.find((a) => !a.startsWith("-"));
+    if (!source) {
+        throw new Error("Usage: ci-plan-pack <plan.md> [--stdout] [--gh-issue]");
+    }
+    const markdown = readFileSync(source, "utf8");
+    const packet = buildReviewPacket(markdown, { source });
+    if (toStdout) {
+        process.stdout.write(packet.endsWith("\n") ? packet : `${packet}\n`);
+        return;
+    }
+    const outPath = reviewPathFor(source);
+    writeFileSync(outPath, packet.endsWith("\n") ? packet : `${packet}\n`);
+    console.log(`Wrote review packet: ${outPath}`);
+    if (ghIssue) {
+        const title = packetTitle(packet);
+        console.log("\nTo open it for comments on GitHub, run:");
+        console.log(`  gh issue create --title "${title}" --body-file "${outPath}"`);
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    try {
+        main();
+    }
+    catch (error) {
+        console.error(`Error: ${getErrorMessage(error)}`);
+        process.exit(1);
+    }
+}