open-multi-agent-kit 0.79.1 → 0.80.0

package/dist/mcp/omk-web-bridge-server.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+interface Tool {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: Record<string, unknown>;
+        required?: string[];
+    };
+}
+export declare const WEB_BRIDGE_MCP_TOOLS: readonly Tool[];
+export declare function handleWebBridgeMcpToolCall(name: string, args: unknown): Promise<unknown>;
+export declare function main(): Promise<void>;
+export {};

package/dist/mcp/omk-web-bridge-server.js

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+import { createInterface } from "readline";
+import { writeSync } from "fs";
+import { getOmkVersionSync } from "../util/version.js";
+import { WEB_BRIDGE_MCP_SERVER_NAME, getDefaultWebBridgeCapabilities, } from "../contracts/web-bridge.js";
+import { handleWebBridgeRequest } from "../web-bridge/host.js";
+import { getWebBridgeStatus, readLatestWebBridgePageContext } from "../web-bridge/status.js";
+const PROTOCOL_VERSION = "2024-11-05";
+const SERVER_VERSION = getOmkVersionSync();
+export const WEB_BRIDGE_MCP_TOOLS = [
+    {
+        name: "web_bridge_status",
+        description: "Return local OMK Web Bridge readiness, install state, permissions, and artifact paths. Read-only.",
+        inputSchema: { type: "object", properties: {} },
+    },
+    {
+        name: "web_bridge_list_tabs",
+        description: "List tabs from the latest sanitized bridge snapshot or supplied mock tabs. Read-only.",
+        inputSchema: { type: "object", properties: { tabs: { type: "array", description: "Optional mock tab list for tests/native-host forwarding" } } },
+    },
+    {
+        name: "web_bridge_read_page",
+        description: "Read sanitized text/metadata/DOM from the latest bridge page snapshot or supplied snapshot. Read-only.",
+        inputSchema: { type: "object", properties: { snapshot: { type: "object", description: "Optional page snapshot supplied by the extension/native host" } } },
+    },
+    {
+        name: "web_bridge_read_selection",
+        description: "Read sanitized selected text from the latest bridge page snapshot. Read-only.",
+        inputSchema: { type: "object", properties: { snapshot: { type: "object" } } },
+    },
+    {
+        name: "web_bridge_screenshot",
+        description: "Return screenshot artifact metadata when the user granted screenshot permission. Read-only.",
+        inputSchema: { type: "object", properties: { snapshot: { type: "object" } } },
+    },
+    {
+        name: "web_bridge_request_action",
+        description: "Request a browser mutation. Always denied unless explicit one-shot approval is provided; v1 remains read-only.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                action: { type: "string", description: "click | formFill | download | upload | post | clipboardWrite | navigate" },
+                target: { type: "string" },
+                approval: { type: "object" },
+            },
+            required: ["action", "target"],
+        },
+    },
+];
+export async function handleWebBridgeMcpToolCall(name, args) {
+    switch (name) {
+        case "web_bridge_status":
+            return await getWebBridgeStatus();
+        case "web_bridge_list_tabs":
+            return await webBridgeEnvelopeResult("browser.tabs.list", args);
+        case "web_bridge_read_page":
+            return await webBridgeEnvelopeResult("browser.page.read", args);
+        case "web_bridge_read_selection":
+            return await webBridgeEnvelopeResult("browser.selection.read", args);
+        case "web_bridge_screenshot":
+            return await webBridgeEnvelopeResult("browser.screenshot.capture", args);
+        case "web_bridge_request_action":
+            return await webBridgeEnvelopeResult("browser.action.request", { action: args });
+        default:
+            throw new Error(`Unknown OMK web bridge MCP tool: ${name}`);
+    }
+}
+function textResult(value, isError = false) {
+    return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }], ...(isError ? { isError: true } : {}) };
+}
+async function webBridgeEnvelopeResult(method, params) {
+    const response = await handleWebBridgeRequest({
+        schemaVersion: 1,
+        requestId: `mcp-${Date.now()}`,
+        method,
+        params,
+    });
+    return response.ok ? response.result : response;
+}
+async function handleToolCall(name, args) {
+    try {
+        return textResult(await handleWebBridgeMcpToolCall(name, args));
+    }
+    catch (err) {
+        return textResult({ ok: false, error: err instanceof Error ? err.message : String(err) }, true);
+    }
+}
+function send(response) {
+    writeSync(process.stdout.fd, `${JSON.stringify(response)}\n`);
+}
+function sendResult(id, result) {
+    send({ jsonrpc: "2.0", id, result });
+}
+function sendError(id, code, message, data) {
+    send({ jsonrpc: "2.0", id, error: { code, message, data } });
+}
+async function handleRequest(req) {
+    const id = req.id ?? 0;
+    if (req.method === "initialize") {
+        sendResult(id, {
+            protocolVersion: PROTOCOL_VERSION,
+            capabilities: { tools: {}, resources: {}, prompts: {} },
+            serverInfo: { name: WEB_BRIDGE_MCP_SERVER_NAME, version: SERVER_VERSION },
+        });
+        return;
+    }
+    if (req.method === "notifications/initialized")
+        return;
+    if (req.method === "tools/list") {
+        sendResult(id, { tools: WEB_BRIDGE_MCP_TOOLS });
+        return;
+    }
+    if (req.method === "tools/call") {
+        const params = req.params && typeof req.params === "object" ? req.params : {};
+        const name = typeof params.name === "string" ? params.name : "";
+        const args = params.arguments ?? {};
+        sendResult(id, await handleToolCall(name, args));
+        return;
+    }
+    if (req.method === "resources/list") {
+        sendResult(id, { resources: [] });
+        return;
+    }
+    if (req.method === "prompts/list") {
+        sendResult(id, { prompts: [] });
+        return;
+    }
+    sendError(id, -32601, `Method not found: ${req.method}`);
+}
+export async function main() {
+    // Touch these imports in the bundle and keep capability metadata reachable for direct tests.
+    void getDefaultWebBridgeCapabilities;
+    void readLatestWebBridgePageContext;
+    void undefined;
+    const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+    for await (const line of rl) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            const req = JSON.parse(trimmed);
+            await handleRequest(req);
+        }
+        catch (err) {
+            sendError(0, -32700, err instanceof Error ? err.message : String(err));
+        }
+    }
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+    main().catch((err) => {
+        process.stderr.write(`[omk-web-bridge-mcp] ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+    });
+}

package/dist/mcp/permission-resolver.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Unified permission resolver.
+ *
+ * Chains: static rules → consent flow → default policy.
+ *
+ * Replaces the fragmented permission checking in:
+ * - host.ts checkPermission() (server-level only)
+ * - host.ts governedCallTool() (no consent integration)
+ * - governance.ts PermissionMatcher (rules only, no consent)
+ * - consent-flow.ts ConsentAwareResolver (consent only, no rules)
+ */
+import { EventEmitter } from 'events';
+import { PermissionMatcher, ToolPermissionLevel, ToolPermissionRule, GovernanceRule } from './governance.js';
+import { ConsentFlowManager, ConsentDecision, ConsentRequest } from './consent-flow.js';
+export interface PermissionResolution {
+    /** Final decision */
+    level: ToolPermissionLevel;
+    /** Source of the decision */
+    source: 'rule' | 'consent' | 'default';
+    /** Human-readable reason */
+    reason: string;
+    /** The rule that matched (if source is 'rule') */
+    matchedRule?: ToolPermissionRule;
+    /** The consent request (if source is 'consent') */
+    consentRequest?: ConsentRequest;
+}
+export interface UnifiedResolverOptions {
+    /** Default permission when no rule or consent matches */
+    defaultLevel?: ToolPermissionLevel;
+    /** Default reason for default permission */
+    defaultReason?: string;
+    /** Enable consent flow for ASK decisions */
+    enableConsent?: boolean;
+    /** Custom consent flow options */
+    consentOptions?: {
+        timeoutMs?: number;
+        promptFn?: (request: ConsentRequest) => Promise<ConsentDecision>;
+    };
+}
+export declare class UnifiedPermissionResolver extends EventEmitter {
+    private readonly matcher;
+    private readonly consentResolver;
+    private readonly defaultLevel;
+    private readonly defaultReason;
+    constructor(rules: GovernanceRule[], options?: UnifiedResolverOptions);
+    /**
+     * Resolve permission for a tool call.
+     *
+     * Resolution order:
+     * 1. Static rules (highest priority)
+     * 2. Consent flow (for ASK decisions)
+     * 3. Default policy
+     */
+    resolvePermission(toolName: string, serverName?: string, args?: Record<string, unknown>): Promise<PermissionResolution>;
+    /**
+     * Update rules (e.g., when config changes).
+     */
+    updateRules(rules: GovernanceRule[]): void;
+    /**
+     * Get the underlying PermissionMatcher (for testing).
+     */
+    getMatcher(): PermissionMatcher;
+    /**
+     * Get the underlying ConsentFlowManager (for testing).
+     */
+    getConsentManager(): ConsentFlowManager | null;
+}

package/dist/mcp/permission-resolver.js

@@ -0,0 +1,124 @@
+/**
+ * Unified permission resolver.
+ *
+ * Chains: static rules → consent flow → default policy.
+ *
+ * Replaces the fragmented permission checking in:
+ * - host.ts checkPermission() (server-level only)
+ * - host.ts governedCallTool() (no consent integration)
+ * - governance.ts PermissionMatcher (rules only, no consent)
+ * - consent-flow.ts ConsentAwareResolver (consent only, no rules)
+ */
+import { EventEmitter } from 'events';
+import { PermissionMatcher, ToolPermissionLevel, } from './governance.js';
+import { ConsentFlowManager, ConsentAwareResolver, } from './consent-flow.js';
+// ---------------------------------------------------------------------------
+// UnifiedPermissionResolver
+// ---------------------------------------------------------------------------
+export class UnifiedPermissionResolver extends EventEmitter {
+    matcher;
+    consentResolver;
+    defaultLevel;
+    defaultReason;
+    constructor(rules, options = {}) {
+        super();
+        this.matcher = new PermissionMatcher(rules);
+        this.defaultLevel = options.defaultLevel ?? ToolPermissionLevel.ALLOW;
+        this.defaultReason = options.defaultReason ?? 'No matching rule';
+        if (options.enableConsent !== false) {
+            const consentManager = new ConsentFlowManager(options.consentOptions ? { timeoutMs: options.consentOptions.timeoutMs } : undefined);
+            this.consentResolver = new ConsentAwareResolver(consentManager);
+            // Forward consent events
+            consentManager.on('consent:requested', (req) => this.emit('consent:requested', req));
+            consentManager.on('consent:granted', (res) => this.emit('consent:granted', res));
+            consentManager.on('consent:denied', (res) => this.emit('consent:denied', res));
+        }
+        else {
+            this.consentResolver = null;
+        }
+    }
+    /**
+     * Resolve permission for a tool call.
+     *
+     * Resolution order:
+     * 1. Static rules (highest priority)
+     * 2. Consent flow (for ASK decisions)
+     * 3. Default policy
+     */
+    async resolvePermission(toolName, serverName, args) {
+        // Step 1: Check static rules
+        const resolved = this.matcher.resolve(toolName);
+        if (resolved.permission === ToolPermissionLevel.ALLOW) {
+            return {
+                level: ToolPermissionLevel.ALLOW,
+                source: 'rule',
+                reason: resolved.matchedRule?.reason ?? 'Allowed by rule',
+                matchedRule: resolved.matchedRule ?? undefined,
+            };
+        }
+        if (resolved.permission === ToolPermissionLevel.DENY) {
+            return {
+                level: ToolPermissionLevel.DENY,
+                source: 'rule',
+                reason: resolved.matchedRule?.reason ?? 'Denied by rule',
+                matchedRule: resolved.matchedRule ?? undefined,
+            };
+        }
+        // Step 2: Consent flow (for ASK decisions)
+        if (this.consentResolver) {
+            const consentResult = this.consentResolver.resolveWithConsent(toolName, serverName ?? 'unknown', args ?? {}, resolved);
+            if (consentResult.permission === ToolPermissionLevel.ALLOW) {
+                return {
+                    level: ToolPermissionLevel.ALLOW,
+                    source: 'consent',
+                    reason: consentResult.consentRequest
+                        ? `Consent granted (${consentResult.consentResult?.decision ?? 'approved'})`
+                        : 'Consent granted',
+                    consentRequest: consentResult.consentRequest ?? undefined,
+                };
+            }
+            if (consentResult.permission === ToolPermissionLevel.DENY) {
+                return {
+                    level: ToolPermissionLevel.DENY,
+                    source: 'consent',
+                    reason: consentResult.consentRequest
+                        ? `Consent denied (${consentResult.consentResult?.decision ?? 'denied'})`
+                        : 'Consent denied',
+                    consentRequest: consentResult.consentRequest ?? undefined,
+                };
+            }
+        }
+        if (resolved.permission === ToolPermissionLevel.ASK) {
+            return {
+                level: ToolPermissionLevel.DENY,
+                source: 'default',
+                reason: 'Consent required but consent flow is disabled',
+                matchedRule: resolved.matchedRule ?? undefined,
+            };
+        }
+        // Step 3: Default policy
+        return {
+            level: this.defaultLevel,
+            source: 'default',
+            reason: this.defaultReason,
+        };
+    }
+    /**
+     * Update rules (e.g., when config changes).
+     */
+    updateRules(rules) {
+        this.matcher.updateRules(rules);
+    }
+    /**
+     * Get the underlying PermissionMatcher (for testing).
+     */
+    getMatcher() {
+        return this.matcher;
+    }
+    /**
+     * Get the underlying ConsentFlowManager (for testing).
+     */
+    getConsentManager() {
+        return this.consentResolver?.getConsentManager() ?? null;
+    }
+}

package/dist/mcp/quality-gate.d.ts

@@ -0,0 +1,36 @@
+export type QualityGateName = "lint" | "typecheck" | "test" | "build";
+export type PackageManager = "npm" | "pnpm" | "yarn" | "bun";
+export type QualityGateStatus = "passed" | "failed" | "skipped" | "blocked" | "missing" | "timeout" | "error";
+export type QualityGateFailureType = "exit-code" | "timeout" | "mcp-error" | null;
+export interface QualityGateResult {
+    command: string;
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    status: QualityGateStatus;
+    failureType: QualityGateFailureType;
+    logPath?: string;
+}
+export interface QualityGateResults {
+    lint: QualityGateResult;
+    typecheck: QualityGateResult;
+    test: QualityGateResult;
+    build: QualityGateResult;
+}
+interface ResolvedQualityCommand {
+    command: string;
+    executable?: PackageManager;
+    args?: string[];
+    skipped?: boolean;
+    blocked?: boolean;
+    missing?: boolean;
+}
+export declare function detectPackageManager(projectRoot: string): PackageManager;
+export declare function resolvePackageManagerExecutable(pm: PackageManager): string;
+export declare function readPackageScripts(projectRoot: string): Promise<Set<string> | undefined>;
+export declare function getQualitySetting(config: string, key: QualityGateName): string;
+export declare function resolveQualityCommand(setting: string, defaultScript: QualityGateName, detectedPackageManager: PackageManager, availableScripts?: Set<string>): ResolvedQualityCommand;
+export declare function runQualityGate(projectRoot: string, config: string): Promise<QualityGateResults>;
+export declare function printQualityGateResults(results: QualityGateResults, printMode?: boolean): string;
+export declare function getQualityKeys(): QualityGateName[];
+export {};

package/dist/mcp/quality-gate.js

@@ -0,0 +1,247 @@
+import { execFileSync } from "child_process";
+import { existsSync } from "fs";
+import { readFile, writeFile, mkdir } from "fs/promises";
+import { join } from "path";
+import { getOmkResourceSettings } from "../util/resource-profile.js";
+import { redactSecrets as redactSecretText } from "./secret-scanner.js";
+const QUALITY_KEYS = ["lint", "typecheck", "test", "build"];
+const SCRIPT_NAME_PATTERN = /^[A-Za-z0-9:_-]+$/;
+const PACKAGE_MANAGERS = new Set(["npm", "pnpm", "yarn", "bun"]);
+const AUTO_SCRIPT_CANDIDATES = {
+    lint: ["lint"],
+    typecheck: ["typecheck", "check"],
+    test: ["test"],
+    build: ["build"],
+};
+const DEBUG = !!process.env.OMK_DEBUG;
+function debugLog(...args) {
+    if (DEBUG) {
+        console.error("[quality-gate]", ...args);
+    }
+}
+function redactQualityText(text) {
+    return redactSecretText(text).redacted;
+}
+export function detectPackageManager(projectRoot) {
+    if (existsSync(join(projectRoot, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(join(projectRoot, "yarn.lock")))
+        return "yarn";
+    if (existsSync(join(projectRoot, "bun.lockb")) || existsSync(join(projectRoot, "bun.lock")))
+        return "bun";
+    return "npm";
+}
+export function resolvePackageManagerExecutable(pm) {
+    if (process.platform === "win32") {
+        return `${pm}.cmd`;
+    }
+    return pm;
+}
+export async function readPackageScripts(projectRoot) {
+    try {
+        const packageJson = JSON.parse(await readFile(join(projectRoot, "package.json"), "utf-8"));
+        if (!packageJson.scripts || typeof packageJson.scripts !== "object")
+            return new Set();
+        return new Set(Object.entries(packageJson.scripts)
+            .filter(([, value]) => typeof value === "string")
+            .map(([key]) => key));
+    }
+    catch {
+        return undefined;
+    }
+}
+export function getQualitySetting(config, key) {
+    const regex = new RegExp(`^${key}\\s*=\\s*"([^"]+)"`, "m");
+    return config.match(regex)?.[1]?.trim() ?? "auto";
+}
+export function resolveQualityCommand(setting, defaultScript, detectedPackageManager, availableScripts) {
+    const normalized = setting.trim();
+    if (normalized === "off") {
+        return { command: "", skipped: true };
+    }
+    const parsed = normalized === "auto"
+        ? { scriptName: resolveAutoScriptName(defaultScript, availableScripts) }
+        : parseQualitySetting(normalized);
+    if (!parsed || !SCRIPT_NAME_PATTERN.test(parsed.scriptName)) {
+        return { command: "[blocked unsafe quality command]", blocked: true };
+    }
+    const packageManager = parsed.packageManager ?? detectedPackageManager;
+    if (availableScripts && !availableScripts.has(parsed.scriptName)) {
+        return {
+            command: formatPackageScriptCommand(packageManager, parsed.scriptName),
+            missing: true,
+        };
+    }
+    return {
+        command: formatPackageScriptCommand(packageManager, parsed.scriptName),
+        executable: packageManager,
+        args: ["run", parsed.scriptName],
+    };
+}
+function resolveAutoScriptName(defaultScript, availableScripts) {
+    const candidates = AUTO_SCRIPT_CANDIDATES[defaultScript];
+    if (!availableScripts)
+        return candidates[0];
+    return candidates.find((script) => availableScripts.has(script)) ?? candidates[0];
+}
+export async function runQualityGate(projectRoot, config) {
+    const resources = await getOmkResourceSettings();
+    const packageManager = detectPackageManager(projectRoot);
+    const availableScripts = await readPackageScripts(projectRoot);
+    // Run gates sequentially to avoid dist race conditions
+    const results = [];
+    for (const gate of QUALITY_KEYS) {
+        const command = resolveQualityCommand(getQualitySetting(config, gate), gate, packageManager, availableScripts);
+        results.push(await runResolvedQualityCommand(gate, command, projectRoot, resources.shellMaxBufferBytes));
+    }
+    const [lint, typecheck, test, build] = results;
+    return { lint, typecheck, test, build };
+}
+function parseQualitySetting(setting) {
+    if (SCRIPT_NAME_PATTERN.test(setting)) {
+        return { scriptName: setting };
+    }
+    const parts = setting.split(/\s+/);
+    if (parts.length === 3 && isPackageManager(parts[0]) && parts[1] === "run") {
+        return { packageManager: parts[0], scriptName: parts[2] };
+    }
+    if (parts.length === 2 && parts[0] === "yarn") {
+        return { packageManager: "yarn", scriptName: parts[1] };
+    }
+    return null;
+}
+function isPackageManager(value) {
+    return PACKAGE_MANAGERS.has(value);
+}
+function formatPackageScriptCommand(packageManager, scriptName) {
+    return `${packageManager} run ${scriptName}`;
+}
+async function runResolvedQualityCommand(gateName, command, projectRoot, maxBuffer) {
+    if (command.skipped) {
+        return {
+            command: "",
+            exitCode: 0,
+            stdout: "",
+            stderr: "skipped (off)",
+            status: "skipped",
+            failureType: null,
+        };
+    }
+    if (command.blocked) {
+        const result = {
+            command: command.command,
+            exitCode: 126,
+            stdout: "",
+            stderr: "blocked unsafe quality command; use auto, off, a package script name, or '<package-manager> run <script>'",
+            status: "blocked",
+            failureType: "mcp-error",
+        };
+        await saveQualityGateLog(projectRoot, gateName, result);
+        return result;
+    }
+    if (command.missing || !command.executable || !command.args) {
+        const result = {
+            command: command.command,
+            exitCode: 127,
+            stdout: "",
+            stderr: "package.json script not found",
+            status: "missing",
+            failureType: "mcp-error",
+        };
+        await saveQualityGateLog(projectRoot, gateName, result);
+        return result;
+    }
+    try {
+        debugLog(`Running ${gateName}: ${command.command}`);
+        const stdout = execFileSync(resolvePackageManagerExecutable(command.executable), command.args, {
+            cwd: projectRoot,
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 120000,
+            maxBuffer,
+            shell: process.platform === "win32",
+        });
+        const stdoutStr = redactQualityText(stdout ?? "");
+        const result = {
+            command: command.command,
+            exitCode: 0,
+            stdout: stdoutStr,
+            stderr: "",
+            status: "passed",
+            failureType: null,
+        };
+        await saveQualityGateLog(projectRoot, gateName, result);
+        return result;
+    }
+    catch (err) {
+        const e = err;
+        const stdoutStr = redactQualityText(String(e.stdout ?? ""));
+        const stderrStr = redactQualityText(String(e.stderr ?? ""));
+        const signal = e.signal ? `\nterminated by signal: ${e.signal}` : "";
+        let status = "failed";
+        let failureType = "exit-code";
+        if (e.code === "ETIMEDOUT" || signal.includes("terminated by signal")) {
+            status = "timeout";
+            failureType = "timeout";
+        }
+        else if (e.status !== 0 && e.status !== undefined) {
+            failureType = "exit-code";
+        }
+        debugLog(`${gateName} ${status}: ${failureType}`);
+        const result = {
+            command: command.command,
+            exitCode: e.status ?? 1,
+            stdout: stdoutStr,
+            stderr: redactQualityText(`${stderrStr}${signal}`),
+            status,
+            failureType,
+        };
+        await saveQualityGateLog(projectRoot, gateName, result);
+        return result;
+    }
+}
+async function saveQualityGateLog(projectRoot, gateName, result) {
+    try {
+        const logsDir = join(projectRoot, ".omk", "logs", "quality-gate");
+        await mkdir(logsDir, { recursive: true });
+        const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+        const fileName = `${gateName}-${timestamp}.log`;
+        const logPath = join(logsDir, fileName);
+        const logContent = [
+            `gate: ${gateName}`,
+            `command: ${result.command || "(none)"}`,
+            `status: ${result.status}`,
+            `failureType: ${result.failureType ?? "none"}`,
+            `exitCode: ${result.exitCode}`,
+            `--- stdout ---`,
+            redactQualityText(result.stdout || "(empty)"),
+            `--- stderr ---`,
+            redactQualityText(result.stderr || "(empty)"),
+        ].join("\n");
+        await writeFile(logPath, logContent, "utf-8");
+        result.logPath = logPath;
+    }
+    catch (err) {
+        debugLog("Failed to save quality gate log:", err);
+    }
+}
+export function printQualityGateResults(results, printMode = false) {
+    const lines = [];
+    if (printMode) {
+        lines.push("{\"qualityGates\":");
+    }
+    const entries = QUALITY_KEYS.map((key) => {
+        const r = results[key];
+        const icon = r.status === "passed" ? "✓" : r.status === "skipped" ? "○" : "✗";
+        const failureDetail = r.failureType ? ` (${r.failureType})` : "";
+        return `  ${icon} ${key}: ${r.status}${failureDetail}${r.logPath ? ` [log: ${r.logPath}]` : ""}`;
+    });
+    lines.push(...entries);
+    if (printMode) {
+        lines.push("}");
+    }
+    return lines.join("\n");
+}
+export function getQualityKeys() {
+    return [...QUALITY_KEYS];
+}

package/dist/mcp/quarantine.d.ts

@@ -0,0 +1,11 @@
+export interface McpQuarantineEntry {
+    name: string;
+    reason: "missing-env" | "http-fail" | "stdio-fail" | "timeout" | "npm-fail";
+    detail: string;
+    quarantinedAt: string;
+    configSource: string;
+}
+export declare function readQuarantine(root: string): Promise<McpQuarantineEntry[]>;
+export declare function writeQuarantine(root: string, entries: McpQuarantineEntry[]): Promise<void>;
+export declare function isQuarantined(name: string, entries: McpQuarantineEntry[]): boolean;
+export declare function addQuarantineEntry(entries: McpQuarantineEntry[], entry: Omit<McpQuarantineEntry, "quarantinedAt">): McpQuarantineEntry[];