loki-mode 10.10.5 → 10.11.2

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '10.10.5'
+__version__ = '10.11.2'

package/mcp/server.py

@@ -112,7 +112,9 @@ def _get_mcp_state_manager():
     has disappeared (e.g., project changed) to prevent stale file handle errors.
     """
     global _state_manager
-    if not STATE_MANAGER_AVAILABLE:
+    if not STATE_MANAGER_AVAILABLE or _READ_ONLY_MODE:
+        # Read-only mode: StateManager creates .loki dirs on construction, so
+        # callers use their direct-file-read fallbacks instead.
         return None
     loki_dir = os.path.join(os.getcwd(), '.loki')
     if _state_manager is not None:
@@ -329,6 +331,10 @@ logger = logging.getLogger('loki-mcp')
 # EVENT EMISSION - Non-blocking tool call events
 # ============================================================
 
+# Set by apply_read_only_mode(). Every emitter checks it and returns before any
+# filesystem work, so a read-only server never writes .loki/events or signals.
+_READ_ONLY_MODE = False
+
 # Track tool call start times for duration calculation (per-tool stack)
 _tool_call_start_times: Dict[str, List[float]] = {}
 _tool_call_times_lock = threading.Lock()
@@ -345,6 +351,9 @@ def _emit_tool_event_async(tool_name: str, action: str, **kwargs) -> None:
     """
     import time
 
+    if _READ_ONLY_MODE:
+        return
+
     # Track timing for learning signals using a per-tool-name stack (thread-safe)
     if action == 'start':
         with _tool_call_times_lock:
@@ -411,7 +420,7 @@ def _emit_learning_signal_async(
         error: Error message if failed
         parameters: Tool parameters for context
     """
-    if not LEARNING_COLLECTOR_AVAILABLE:
+    if _READ_ONLY_MODE or not LEARNING_COLLECTOR_AVAILABLE:
         return
 
     def emit():
@@ -475,7 +484,7 @@ def _emit_context_relevance_signal(
         retrieved_ids: IDs of retrieved items
         context: Additional context
     """
-    if not LEARNING_COLLECTOR_AVAILABLE:
+    if _READ_ONLY_MODE or not LEARNING_COLLECTOR_AVAILABLE:
         return
 
     def emit():
@@ -1792,6 +1801,8 @@ def _maybe_autoreindex_code() -> None:
     Default behavior is warn-if-stale (the tools just report the staleness
     fields). Best-effort: never raises into the caller.
     """
+    if _READ_ONLY_MODE:
+        return
     if os.environ.get("LOKI_CODE_INDEX_AUTOREINDEX", "0") != "1":
         return
     if not _code_index_staleness().get("stale"):
@@ -1809,6 +1820,12 @@ def _maybe_autoreindex_code() -> None:
         logger.warning(f"Auto-reindex (LOKI_CODE_INDEX_AUTOREINDEX) failed: {e}")
 
 
+def _chroma_host_is_loopback() -> bool:
+    """True when LOKI_CHROMA_HOST is unset or a loopback name or address."""
+    host = os.environ.get("LOKI_CHROMA_HOST", "").strip().strip("[]").lower()
+    return host in ("", "localhost", "127.0.0.1", "::1")
+
+
 def _get_chroma_collection():
     """Get or create ChromaDB collection (lazy connection).
 
@@ -1879,6 +1896,12 @@ async def loki_code_search(
     await asyncio.to_thread(_maybe_autoreindex_code)
     _staleness = _code_index_staleness()
 
+    if _READ_ONLY_MODE and not _chroma_host_is_loopback():
+        return json.dumps({
+            "error": "read-only mode: code search refuses a non-loopback "
+                     "LOKI_CHROMA_HOST; set it to localhost or unset it"
+        })
+
     collection = _get_chroma_collection()
     if collection is None:
         # Emit 'complete' to balance the 'start' above. Without this the
@@ -2978,6 +3001,59 @@ def _run_http_transport(port):
     uvicorn.run(app, host=host, port=port, log_level="info")
 
 
+# ============================================================
+# READ-ONLY MODE (CP-ASK slice 1)
+# ============================================================
+# `--read-only` (or LOKI_MCP_READ_ONLY=1) keeps ONLY the tools named here.
+# Everything else is removed from the registry, so a tool added later is absent
+# in read-only mode until someone classifies it and adds it to this list (fail
+# closed). Tools that spawn processes or write, even ones that sound like a
+# read (loki_verify_fast, loki_v10_verify), are deliberately excluded.
+READ_ONLY_TOOL_ALLOWLIST = frozenset({
+    "loki_memory_retrieve",
+    "loki_state_get",
+    "loki_metrics_efficiency",
+    "loki_v10_status",
+    "loki_project_status",
+    "loki_agent_metrics",
+    "loki_quality_report",
+    "loki_code_search",
+    "mem_search",
+    "mem_timeline",
+    "mem_get",
+    "loki_get_hotspots",
+    "loki_get_co_changes",
+    "loki_get_doc_coverage",
+    "loki_findings",
+    "loki_learnings",
+})
+
+
+def read_only_env_enabled() -> bool:
+    """LOKI_MCP_READ_ONLY accepts 1, true, yes (case-insensitive)."""
+    return os.environ.get('LOKI_MCP_READ_ONLY', '').strip().lower() in (
+        '1', 'true', 'yes')
+
+
+def apply_read_only_mode(server=None):
+    """Remove every registered tool that is not in READ_ONLY_TOOL_ALLOWLIST.
+
+    Also sets _READ_ONLY_MODE, which the event and learning-signal emitters
+    check so no call writes .loki/events or .loki/learning.
+    """
+    global _READ_ONLY_MODE
+    _READ_ONLY_MODE = True
+    try:
+        from memory.storage import MemoryStorage
+        MemoryStorage.READ_ONLY = True
+    except ImportError:
+        pass
+    server = server if server is not None else mcp
+    for name in list(server._tool_manager._tools):
+        if name not in READ_ONLY_TOOL_ALLOWLIST:
+            server.remove_tool(name)
+
+
 # ============================================================
 # MAIN
 # ============================================================
@@ -2997,6 +3073,10 @@ def main():
                              'server object built, non-zero otherwise. Used by '
                              '`loki mcp` to verify a venv before launching. '
                              'Does not start a server.'))
+    parser.add_argument('--read-only', action='store_true',
+                       help=('Register only the read allowlist '
+                             '(READ_ONLY_TOOL_ALLOWLIST). Also enabled by '
+                             'LOKI_MCP_READ_ONLY=1.'))
     args = parser.parse_args()
 
     # --check-sdk: if we reached here, the module-level loader already imported
@@ -3009,6 +3089,9 @@ def main():
             sys.exit(0)
         sys.exit(1)
 
+    if args.read_only or read_only_env_enabled():
+        apply_read_only_mode()
+
     # Register cleanup to prevent file handle leaks on shutdown/restart
     atexit.register(cleanup_mcp_singletons)
 

package/mcp/tests/_read_only_wall_probe.py

@@ -0,0 +1,156 @@
+"""Subprocess probe for test_read_only.py: the read-only Wall check.
+
+Usage: _read_only_wall_probe.py REPO_ROOT PROJECT_DIR
+
+Runs inside PROJECT_DIR (cwd), applies read-only mode, then calls every
+allowlisted tool and every resource while a sys.addaudithook records writes,
+spawns and non-loopback connects. Prints one JSON document on the last line.
+"""
+
+import asyncio
+import json
+import os
+import sys
+import time
+
+repo_root, project = sys.argv[1], sys.argv[2]
+sys.path.insert(0, repo_root)
+os.chdir(project)
+os.environ["LOKI_NO_BROWSER"] = "1"
+sys.dont_write_bytecode = True
+
+from mcp import server  # noqa: E402
+
+# F1: arm the opt-in auto-reindex and point the manifest at a stale fixture
+# kept OUTSIDE the project dir, so the gate in _maybe_autoreindex_code is the
+# only thing standing between a call and a spawn. subprocess.run is replaced
+# by a recorder so the control run (default mode) never starts a real indexer.
+import json as _json  # noqa: E402
+import pathlib  # noqa: E402
+import subprocess  # noqa: E402
+import atexit  # noqa: E402
+import shutil  # noqa: E402
+import tempfile  # noqa: E402
+
+os.environ["LOKI_CODE_INDEX_AUTOREINDEX"] = "1"
+_manifest_dir = tempfile.mkdtemp(prefix="ro-manifest-")
+atexit.register(shutil.rmtree, _manifest_dir, True)
+_manifest = pathlib.Path(_manifest_dir) / "code-index-manifest.json"
+_manifest.write_text(_json.dumps({"files": {"does-not-exist.py": {"mtime": 1}}}))
+server.CODE_INDEX_MANIFEST_PATH = _manifest
+assert server._code_index_staleness()["stale"] is True, "fixture is not stale"
+
+_spawned = []
+
+
+def _recording_run(*a, **k):
+    _spawned.append((current["name"], str(a[0] if a else k.get("args"))[:200]))
+    return subprocess.CompletedProcess(a[0] if a else [], 0, b"", b"")
+
+
+subprocess.run = _recording_run
+
+DEFAULT_MODE = len(sys.argv) > 3 and sys.argv[3] == "default"
+if not DEFAULT_MODE:
+    server.apply_read_only_mode()
+
+CALLS = {
+    "loki_memory_retrieve": {"query": "auth"},
+    "loki_state_get": {},
+    "loki_metrics_efficiency": {},
+    "loki_v10_status": {"repo_path": project},
+    "loki_project_status": {},
+    "loki_agent_metrics": {},
+    "loki_quality_report": {},
+    "loki_code_search": {"query": "rate limit"},
+    "mem_search": {"query": "auth"},
+    "mem_timeline": {},
+    "mem_get": {"ids": "x"},
+    "loki_get_hotspots": {},
+    "loki_get_co_changes": {"file_path": "a.py"},
+    "loki_get_doc_coverage": {},
+    "loki_findings": {},
+    "loki_learnings": {},
+}
+RESOURCES = ["loki://state/continuity", "loki://memory/index",
+             "loki://queue/pending"]
+
+LOOPBACK = ("127.0.0.1", "::1", "localhost")
+current = {"name": None}
+events = []
+
+
+def _is_write_mode(mode, flags):
+    if isinstance(mode, str):
+        return any(c in mode for c in "wax+")
+    if isinstance(flags, int):
+        return bool(flags & (os.O_WRONLY | os.O_RDWR | os.O_CREAT | os.O_APPEND
+                             | os.O_TRUNC))
+    return False
+
+
+def hook(event, args):
+    who = current["name"]
+    if who is None:
+        return
+    rec = None
+    if event == "open":
+        path, mode, flags = args
+        if _is_write_mode(mode, flags) and path not in ("/dev/null",):
+            rec = ("write", str(path))
+    elif event in ("os.mkdir", "os.rename", "os.remove", "os.rmdir",
+                   "os.replace", "shutil.rmtree"):
+        rec = (event, str(args[0]))
+    elif event in ("subprocess.Popen", "os.system", "os.posix_spawn",
+                   "os.exec", "os.fork", "os.spawn"):
+        rec = ("spawn", str(args[:2]))
+    elif event == "socket.connect":
+        addr = args[1]
+        host = addr[0] if isinstance(addr, tuple) else str(addr)
+        if isinstance(addr, str) or host in LOOPBACK:
+            return
+        rec = ("connect", str(addr))
+    if rec:
+        events.append({"tool": who, "kind": rec[0], "detail": rec[1]})
+
+
+def snapshot():
+    out = set()
+    for root, dirs, files in os.walk(project):
+        if os.sep + ".git" + os.sep in root + os.sep or root.endswith(".git"):
+            continue
+        for n in dirs + files:
+            out.add(os.path.relpath(os.path.join(root, n), project))
+    return out
+
+
+async def run():
+    results = {}
+    before = snapshot()
+    sys.addaudithook(hook)
+    calls = {"loki_code_search": CALLS["loki_code_search"]} if DEFAULT_MODE else CALLS
+    for name, args in calls.items():
+        current["name"] = name
+        try:
+            await server.mcp.call_tool(name, args)
+            results[name] = "ok"
+        except Exception as e:  # tool errors are fine; writes are not
+            results[name] = "raised %s" % type(e).__name__
+    for uri in ([] if DEFAULT_MODE else RESOURCES):
+        current["name"] = uri
+        try:
+            await server.mcp.read_resource(uri)
+            results[uri] = "ok"
+        except Exception as e:
+            results[uri] = "raised %s" % type(e).__name__
+    current["name"] = None
+    for who, cmd in _spawned:
+        events.append({"tool": who, "kind": "spawn", "detail": cmd})
+    time.sleep(0.5)  # let any stray emitter thread surface
+    after = snapshot()
+    return results, sorted(after - before)
+
+
+results, new_files = asyncio.run(run())
+print(json.dumps({"results": results, "events": events,
+                  "new_files": new_files}))

package/mcp/tests/test_read_only.py

@@ -0,0 +1,289 @@
+"""CP-ASK slice 1: the MCP server's --read-only tool surface and write floor."""
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+
+_REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..'))
+_PROBE = os.path.join(os.path.dirname(__file__), "_read_only_wall_probe.py")
+
+# Written out here (not imported) so the test is an independent statement of
+# the contract: changing the server's allowlist alone turns this red.
+EXPECTED_ALLOWLIST = {
+    "loki_memory_retrieve", "loki_state_get", "loki_metrics_efficiency",
+    "loki_v10_status", "loki_project_status", "loki_agent_metrics",
+    "loki_quality_report", "loki_code_search", "mem_search", "mem_timeline",
+    "mem_get", "loki_get_hotspots", "loki_get_co_changes",
+    "loki_get_doc_coverage", "loki_findings", "loki_learnings",
+}
+
+# Tools that write, spawn processes, or are otherwise not on the allowlist.
+EXCLUDED_TOOLS = {
+    "loki_memory_store_pattern", "loki_task_queue_add", "loki_task_queue_update",
+    "loki_memory_capture_session_summary", "loki_consolidate_memory",
+    "loki_complete_task", "loki_v10_run", "loki_v10_verify",
+    "loki_start_project", "loki_checkpoint_restore", "loki_verify_fast",
+    "loki_counter_evidence_template", "loki_task_queue_list",
+    "loki_code_search_stats", "loki_memory_redact", "loki_graph_query",
+}
+
+# Known resources and prompts in read-only mode: a new one must fail this test.
+EXPECTED_RESOURCES = {
+    "loki://state/continuity", "loki://memory/index", "loki://queue/pending",
+}
+EXPECTED_PROMPTS = {"loki_start", "loki_phase_report"}
+
+_LIST_PROBE = """
+import asyncio, json, sys
+sys.path.insert(0, %r)
+from mcp import server
+if %r:
+    server.apply_read_only_mode()
+async def go():
+    m = server.mcp
+    return {
+        "tools": sorted(t.name for t in await m.list_tools()),
+        "resources": sorted(str(r.uri) for r in await m.list_resources()),
+        "prompts": sorted(p.name for p in await m.list_prompts()),
+    }
+print(json.dumps(asyncio.run(go())))
+"""
+
+# Drives main() itself: real argv, real env, mcp.run patched to capture the
+# tool list at the moment the server would start serving.
+_MAIN_PROBE = """
+import asyncio, json, sys
+sys.path.insert(0, %r)
+sys.argv = ['server.py'] + %r
+from mcp import server
+captured = {}
+def fake_run(*a, **k):
+    captured['tools'] = sorted(t.name for t in asyncio.run(server.mcp.list_tools()))
+server.mcp.run = fake_run
+server.main()
+print(json.dumps(captured))
+"""
+
+
+def _listing(read_only):
+    out = subprocess.run(
+        [sys.executable, "-c", _LIST_PROBE % (_REPO_ROOT, read_only)],
+        capture_output=True, text=True, timeout=120,
+        env={**os.environ, "LOKI_NO_BROWSER": "1"})
+    assert out.returncode == 0, out.stderr
+    return json.loads(out.stdout.strip().splitlines()[-1])
+
+
+def _tools(read_only):
+    return set(_listing(read_only)["tools"])
+
+
+def _main_tools(argv, env_value=None):
+    env = {k: v for k, v in os.environ.items() if k != "LOKI_MCP_READ_ONLY"}
+    env["LOKI_NO_BROWSER"] = "1"
+    if env_value is not None:
+        env["LOKI_MCP_READ_ONLY"] = env_value
+    out = subprocess.run(
+        [sys.executable, "-c", _MAIN_PROBE % (_REPO_ROOT, argv)],
+        capture_output=True, text=True, timeout=120, env=env)
+    assert out.returncode == 0, out.stderr
+    return set(json.loads(out.stdout.strip().splitlines()[-1])["tools"])
+
+
+class ReadOnlyTests(unittest.TestCase):
+    def test_read_only_surface_equals_allowlist(self):
+        self.assertEqual(_tools(True), EXPECTED_ALLOWLIST)
+
+    def test_write_tools_absent_in_read_only(self):
+        self.assertFalse(_tools(True) & EXCLUDED_TOOLS)
+
+    def test_default_mode_registers_full_set(self):
+        full = _tools(False)
+        self.assertTrue(EXPECTED_ALLOWLIST <= full)
+        self.assertTrue(EXCLUDED_TOOLS <= full)
+        self.assertGreaterEqual(len(full), 39)
+
+    def test_resources_and_prompts_are_a_known_list(self):
+        listing = _listing(True)
+        self.assertEqual(set(listing["resources"]), EXPECTED_RESOURCES)
+        self.assertEqual(set(listing["prompts"]), EXPECTED_PROMPTS)
+
+    def test_main_flag_enables_read_only(self):
+        self.assertEqual(_main_tools(["--read-only"]), EXPECTED_ALLOWLIST)
+
+    def test_main_env_enables_read_only(self):
+        for value in ("1", "true", "TRUE", "Yes", "yes"):
+            self.assertEqual(_main_tools([], value), EXPECTED_ALLOWLIST, value)
+
+    def test_main_default_is_full_set(self):
+        self.assertGreaterEqual(len(_main_tools([])), 39)
+        self.assertGreaterEqual(len(_main_tools([], "0")), 39)
+
+
+def _git(cwd, *args):
+    subprocess.run(["git", *args], cwd=cwd, check=True, capture_output=True,
+                   env={**os.environ, "GIT_AUTHOR_NAME": "t",
+                        "GIT_AUTHOR_EMAIL": "t@t", "GIT_COMMITTER_NAME": "t",
+                        "GIT_COMMITTER_EMAIL": "t@t"})
+
+
+def _make_empty(root):
+    _git(root, "init", "-q")
+    os.makedirs(os.path.join(root, ".loki"))
+
+
+def _make_seeded(root):
+    _make_empty(root)
+    mem = os.path.join(root, ".loki", "memory")
+    for sub in ("episodic", "semantic", "skills"):
+        os.makedirs(os.path.join(mem, sub))
+    with open(os.path.join(mem, "episodic", "ep-1.json"), "w") as f:
+        json.dump({"id": "ep-1", "task_id": "t1", "summary": "auth work",
+                   "timestamp": "2026-10-01T00:00:00Z", "outcome": "success",
+                   "context": {"goal": "auth"}}, f)
+    with open(os.path.join(mem, "index.json"), "w") as f:
+        json.dump({"version": "1.0", "topics": []}, f)
+    with open(os.path.join(mem, "timeline.json"), "w") as f:
+        json.dump({"version": "1.0", "entries": []}, f)
+    os.makedirs(os.path.join(root, ".loki", "state"))
+    with open(os.path.join(root, ".loki", "state", "orchestrator.json"), "w") as f:
+        json.dump({"currentPhase": "DEVELOPMENT"}, f)
+    with open(os.path.join(root, "a.py"), "w") as f:
+        f.write("x = 1\n")
+    _git(root, "add", "a.py")
+    _git(root, "commit", "-q", "-m", "seed")
+
+
+def _wall(maker, extra_env=None, mode=""):
+    with tempfile.TemporaryDirectory(prefix="ro-wall-") as root:
+        root = os.path.realpath(root)
+        maker(root)
+        env = {k: v for k, v in os.environ.items()
+               if not k.startswith("LOKI_CHROMA")}
+        env.update(extra_env or {})
+        out = subprocess.run([sys.executable, _PROBE, _REPO_ROOT, root] + ([mode] if mode else []),
+                             capture_output=True, text=True, timeout=300,
+                             env=env)
+        assert out.returncode == 0, out.stderr[-2000:]
+        return json.loads(out.stdout.strip().splitlines()[-1])
+
+
+class WallTests(unittest.TestCase):
+    """Every allowlisted tool, called in read-only mode, writes nothing."""
+
+    def _assert_floor(self, report):
+        self.assertEqual(report["events"], [], "writes/spawns/connects seen")
+        self.assertEqual(report["new_files"], [], "new files created")
+        self.assertEqual(
+            set(report["results"]),
+            EXPECTED_ALLOWLIST | EXPECTED_RESOURCES)
+
+    def test_empty_project(self):
+        self._assert_floor(_wall(_make_empty))
+
+    def test_seeded_memory_store(self):
+        self._assert_floor(_wall(_make_seeded))
+
+    def test_autoreindex_gate_blocks_spawn_in_read_only(self):
+        # Positive control: with the stale manifest and the opt-in armed, the
+        # DEFAULT mode does reach the indexer spawn, so the probe can see it.
+        control = _wall(_make_empty, mode="default")
+        self.assertTrue([e for e in control["events"] if e["kind"] == "spawn"],
+                        "control: default mode never reached the indexer spawn")
+        # Read-only: the same setup must spawn nothing.
+        ro = _wall(_make_empty)
+        self.assertEqual([e for e in ro["events"] if e["kind"] == "spawn"], [])
+
+    def test_non_loopback_chroma_host_is_refused_without_connecting(self):
+        report = _wall(_make_empty, {"LOKI_CHROMA_HOST": "chroma.example.com"})
+        self.assertEqual(report["events"], [])
+
+
+# F2: every public mutator of MemoryStorage refuses under READ_ONLY.
+MUTATORS = {
+    "save_episode": (None,), "delete_episode": ("ep-1",),
+    "save_pattern": (None,), "update_pattern": (None,),
+    "update_pattern_with_merge": ("p-1", lambda x: x),
+    "save_skill": (None,), "update_index": (), "update_timeline": ({},),
+    "set_active_context": ({},), "ensure_directory": ("newdir",),
+    "write_json": ("new.json", {}), "delete_file": ("index.json",),
+    "persist_boost": ({},), "increment_pattern_usage": ("p-1",),
+    "batch_apply_decay": (), "copy_to_namespace": ("other",),
+    "merge_from_namespace": ("other",),
+}
+# Public members that only read or compute in memory. A new public member that
+# is in neither set fails test_every_public_method_is_classified.
+READERS = {
+    "namespace", "root_path", "with_namespace", "load_episode", "list_episodes",
+    "load_pattern", "list_patterns", "load_skill", "list_skills", "get_index",
+    "get_timeline", "get_active_context", "read_json", "list_files",
+    "calculate_importance", "apply_decay", "boost_on_retrieval",
+    "list_namespaces", "get_namespace_stats",
+}
+
+
+def _tree(base):
+    return sorted(os.path.relpath(os.path.join(r, n), base)
+                  for r, ds, fs in os.walk(base) for n in ds + fs)
+
+
+class StorageReadOnlyTests(unittest.TestCase):
+    def setUp(self):
+        sys.path.insert(0, _REPO_ROOT)
+        from memory.storage import MemoryStorage
+        self.cls = MemoryStorage
+        self.tmp = tempfile.TemporaryDirectory(prefix="ro-store-")
+        self.store = MemoryStorage(self.tmp.name)  # created in default mode
+
+    def tearDown(self):
+        self.cls.READ_ONLY = False
+        self.tmp.cleanup()
+
+    def test_every_public_method_is_classified(self):
+        public = {n for n in dir(self.cls) if not n.startswith("_")}
+        public -= {"VERSION", "READ_ONLY"}
+        unknown = public - set(MUTATORS) - READERS
+        self.assertEqual(unknown, set(), "classify new MemoryStorage members")
+
+    def test_every_mutator_raises_and_creates_nothing(self):
+        before = _tree(self.tmp.name)
+        self.cls.READ_ONLY = True
+        for name, args in MUTATORS.items():
+            with self.subTest(method=name):
+                with self.assertRaises(PermissionError):
+                    getattr(self.store, name)(*args)
+        self.assertEqual(_tree(self.tmp.name), before)
+
+    def test_every_mutator_calls_check_writable_directly(self):
+        # A mutator relying only on a downstream _atomic_write re-check would
+        # survive a mutation of its own guard; require the direct call.
+        import ast
+        import inspect
+        tree = ast.parse(inspect.getsource(self.cls))
+        funcs = {n.name: n for n in ast.walk(tree)
+                 if isinstance(n, ast.FunctionDef)}
+        for name in MUTATORS:
+            with self.subTest(method=name):
+                calls = [
+                    c for c in ast.walk(funcs[name])
+                    if isinstance(c, ast.Call)
+                    and isinstance(c.func, ast.Attribute)
+                    and c.func.attr == "_check_writable"
+                    and isinstance(c.func.value, ast.Name)
+                    and c.func.value.id == "self"
+                ]
+                self.assertTrue(calls, "%s lacks self._check_writable()" % name)
+
+    def test_default_mode_mutators_still_work(self):
+        self.store.write_json("x.json", {"a": 1})
+        self.assertEqual(self.store.read_json("x.json"), {"a": 1})
+        self.assertTrue(self.store.delete_file("x.json"))
+        self.store.ensure_directory("newdir")
+        self.assertTrue(os.path.isdir(os.path.join(self.tmp.name, "newdir")))
+
+
+if __name__ == "__main__":
+    unittest.main()