phaedo-mcp 0.3.7 → 0.3.13

package/server.js

@@ -197,14 +197,19 @@ const PKG_VERSION = JSON.parse(readFileSync(join(BASE_DIR, 'package.json'), 'utf
 // put this in the model's context on every turn.
 // The directory edition loads the profile only when asked (lib/config-dir.js explains why).
 const DIRECTORY_EDITION = isDirectoryEdition(BASE_DIR);
+// Codex keeps only the first 512 characters of a server's instructions, so the three rules an
+// agent must follow come first, tersely; the detail that only helps follows. A test pins it.
+export const INSTRUCTIONS_CORE_LIMIT = 512;
 const SERVER_INSTRUCTIONS = [
-  'Phaedo holds the user\'s profile: how they like answers written, and how they want decisions handled when an AI acts for them.',
+  'Phaedo knows how the user likes answers written and how they want decisions handled.',
   DIRECTORY_EDITION
-    ? '- When the user asks to load their Phaedo profile, call phaedo_request_injection and treat the returned projection as background on the user\'s style. Don\'t load it unasked.'
-    : '- At the start of a session, call phaedo_request_injection once and treat the returned projection as background on the user\'s style.',
-  '- Before a consequential action for the user (merging, deploying, publishing, sending a message, spending money, deleting, changing an account or setting), call phaedo_consult and follow its signal. If you are acting on your own and the decision should be the user\'s, use phaedo_escalate and do not proceed until it resolves.',
-  '- When the user reacts to an action you consulted on, call phaedo_record_outcome with its receipt_id: record what they chose, never what you inferred.',
-  '- If a tool says no Phaedo profile is set up, tell the user once, plainly, and carry on normally. Do not retry.',
+    ? '1. Only when the user asks to load their Phaedo profile, call phaedo_request_injection. Don\'t load it unasked.'
+    : '1. At session start, call phaedo_request_injection once and use it as background on their style.',
+  '2. Before a consequential action (merge, deploy, publish, send, spend, delete, change a setting), call phaedo_consult and follow its signal.',
+  '3. When the user reacts to that action, call phaedo_record_outcome with its receipt_id: what they chose, never what you inferred.',
+  // ── beyond the 512-character core ──
+  'If you are acting on your own and the decision should be the user\'s, use phaedo_escalate and do not proceed until it resolves.',
+  'If a tool says no Phaedo profile is set up, tell the user once, plainly, and carry on normally. Do not retry.',
 ].join('\n');
 const server = new McpServer({ name: 'phaedo', version: PKG_VERSION }, { instructions: SERVER_INSTRUCTIONS });
 

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.phaedo-labs/phaedo-mcp",
   "description": "Make AI apps answer your way, check with you before acting, and get approvals on your phone.",
-  "version": "0.3.7",
+  "version": "0.3.13",
   "repository": {
     "url": "https://github.com/phaedo-labs/phaedo-mcp",
     "source": "github",
@@ -13,7 +13,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "phaedo-mcp",
-      "version": "0.3.7",
+      "version": "0.3.13",
       "transport": {
         "type": "stdio"
       }

package/ship-actions.js

@@ -71,10 +71,82 @@ const CLASSES = [
         : { magnitude: 'medium', reversible: true, summary: 'push directly to main' };
     },
   },
+  // ── The personal reviewer (2026-10-27): the other things an agent does for the subject that
+  // people disagree about. Auto mode's classifier judges these by TYPE and lets the routine
+  // ones through; Phaedo asks whether THIS subject would want to see this one.
+  {
+    id: 'force_push',
+    // Any force-push (main is push_main's, ranked first). Rewrites shared history.
+    match: (w) => w[0] === 'git' && w[1] === 'push' && hasForce(w),
+    describe: (w) => {
+      const ref = w.slice(2).filter((x) => !x.startsWith('-')).pop();
+      return { magnitude: 'high', reversible: false, summary: `force-push${ref ? ` ${ref.replace(/^\+/, '')}` : ''}` };
+    },
+  },
+  {
+    id: 'delete_branch',
+    // `git push <remote> --delete x` / `git push <remote> :x`.
+    match: (w) => w[0] === 'git' && w[1] === 'push' && (w.includes('--delete') || w.includes('-d') || w.slice(3).some((x) => /^:[^:]+$/.test(x))),
+    describe: (w) => {
+      const ref = w.slice(2).filter((x) => !x.startsWith('-')).slice(1).map((x) => x.replace(/^:/, '')).join(', ');
+      return { magnitude: 'medium', reversible: false, summary: `delete remote branch${ref ? ` ${ref}` : ''}` };
+    },
+  },
+  {
+    id: 'open_pr',
+    // Opening a PR is cheap and reversible, but whether an agent may open one unasked is
+    // exactly the kind of thing people differ on.
+    match: (w) => w[0] === 'gh' && w[1] === 'pr' && w[2] === 'create',
+    describe: () => ({ magnitude: 'low', reversible: true, summary: 'open a pull request' }),
+  },
+  {
+    id: 'comment',
+    // Speaking for the subject in public: comments and reviews can be edited, not unsaid.
+    match: (w) => w[0] === 'gh' && ((['pr', 'issue'].includes(w[1]) && w[2] === 'comment') || (w[1] === 'pr' && w[2] === 'review')),
+    describe: (w) => {
+      const approve = w[2] === 'review' && (w.includes('--approve') || w.includes('-a'));
+      const reject = w[2] === 'review' && (w.includes('--request-changes') || w.includes('-r'));
+      return {
+        magnitude: 'medium', reversible: false,
+        summary: approve ? 'approve a pull request' : reject ? 'request changes on a pull request' : `post a comment on a GitHub ${w[1] === 'issue' ? 'issue' : 'pull request'}`,
+      };
+    },
+  },
+  {
+    id: 'publish',
+    // A published package version can't be taken back cleanly (npm forbids re-using one).
+    match: (w) => !w.includes('--dry-run') && (
+      (['npm', 'pnpm', 'bun'].includes(w[0]) && w[1] === 'publish')
+      || (w[0] === 'yarn' && (w[1] === 'publish' || (w[1] === 'npm' && w[2] === 'publish')))
+      || (w[0] === 'cargo' && w[1] === 'publish') || (w[0] === 'twine' && w[1] === 'upload') || (w[0] === 'gem' && w[1] === 'push')),
+    describe: (w) => ({ magnitude: 'high', reversible: false, summary: `publish a package (${w[0]})` }),
+  },
+  {
+    id: 'release',
+    match: (w) => w[0] === 'gh' && w[1] === 'release' && w[2] === 'create',
+    describe: (w) => ({ magnitude: 'medium', reversible: true, summary: `create a GitHub release${w[3] && !w[3].startsWith('-') ? ` ${w[3]}` : ''}` }),
+  },
+  {
+    id: 'deploy_other',
+    // Production deploys outside Fly. `terraform destroy` and `kubectl delete` can't be undone.
+    match: (w) => (w[0] === 'vercel' && w.includes('--prod')) || (w[0] === 'netlify' && w[1] === 'deploy' && w.includes('--prod'))
+      || (w[0] === 'firebase' && w[1] === 'deploy') || (w[0] === 'terraform' && ['apply', 'destroy'].includes(w[1]))
+      || (w[0] === 'kubectl' && ['apply', 'delete'].includes(w[1])),
+    describe: (w) => {
+      const destroy = (w[0] === 'terraform' && w[1] === 'destroy') || (w[0] === 'kubectl' && w[1] === 'delete');
+      return { magnitude: 'high', reversible: !destroy, summary: destroy ? `${w[0]} ${w[1]}` : `deploy with ${w[0]}` };
+    },
+  },
 ];
 
-// Order matters for one pair: `eas build --auto-submit` is a submit, not a build.
-const ORDER = ['merge_pr', 'deploy', 'app_submit', 'app_build', 'push_main'];
+function hasForce(w) {
+  return w.some((x) => x === '-f' || x === '--force' || x.startsWith('--force-with-lease') || (x.startsWith('+') && x.length > 1));
+}
+
+// Order matters: `eas build --auto-submit` is a submit, not a build, and a force-push to main is
+// push_main's (it names main), so push_main is tried before the general force_push.
+const ORDER = ['merge_pr', 'deploy', 'app_submit', 'app_build', 'push_main', 'force_push', 'delete_branch',
+  'open_pr', 'comment', 'publish', 'release', 'deploy_other'];
 
 function isEas(w0) { return w0 === 'eas' || w0 === 'eas-cli'; }
 function platform(w) {
@@ -121,6 +193,83 @@ export function words(cmd) {
 const MAG_RANK = { low: 0, medium: 1, high: 2 };
 const stakes = (d) => (d.reversible === false ? 10 : 0) + (MAG_RANK[d.magnitude] ?? 1);
 
+// ── Actions through connected tools (MCP), not the shell ──────────────────────────────────
+// The same decisions arrive as tool calls: a Gmail `send_message`, a Slack `post_message`, a
+// payments `create_payment`, a Drive `trash_file`. Tool names follow `mcp__<server>__<tool>`;
+// the VERB in the tool name says what it does. Read-only tools (get_/list_/search_) never match,
+// and Phaedo's own tools are never classified (consulting Phaedo about consulting Phaedo).
+const MCP_VERBS = [
+  { re: /(?:^|_)(send|reply|forward|post|publish|comment|share|invite)(?:_|$)/, kind: 'send' },
+  { re: /(?:^|_)(pay|payment|purchase|transfer|checkout|buy)(?:_|$)/, kind: 'spend' },
+  { re: /(?:^|_)(delete|purge|destroy)(?:_|$)/, kind: 'delete' },
+  { re: /(?:^|_)(trash)(?:_|$)/, kind: 'trash' },
+  { re: /(?:^|_)(merge)(?:_|$)/, kind: 'merge' },
+];
+// A broad first cut for the hook's matcher (hooks.json): cheap to spawn on, then refined here.
+export const MCP_HOOK_MATCHER = 'mcp__.*(send|reply|forward|post|publish|comment|share|invite|pay|purchase|transfer|checkout|buy|delete|purge|destroy|trash|merge).*';
+
+export function parseMcpToolName(name) {
+  const m = /^mcp__(.+?)__(.+)$/.exec(String(name || ''));
+  return m ? { server: m[1], tool: m[2].toLowerCase() } : null;
+}
+
+// A short, privacy-conscious preview of who/what the call targets — never a message body.
+const PREVIEW_KEYS = ['to', 'recipient', 'recipients', 'channel', 'chat', 'subject', 'title', 'name', 'amount', 'currency', 'merchant', 'payee', 'repo', 'pull_number', 'file_id', 'id'];
+function previewOf(input) {
+  if (!input || typeof input !== 'object') return '';
+  const parts = [];
+  for (const k of PREVIEW_KEYS) {
+    const v = input[k];
+    if (v == null || typeof v === 'object' && !Array.isArray(v)) continue;
+    parts.push(`${k}: ${Array.isArray(v) ? v.slice(0, 3).join(', ') : String(v)}`);
+  }
+  return parts.join('; ').slice(0, 120);
+}
+
+/**
+ * Classify an MCP tool call. Returns null for anything that isn't a consequential action, else
+ * the same shape as classifyShipCommand.
+ */
+export function classifyMcpCall(toolName, toolInput) {
+  const p = parseMcpToolName(toolName);
+  if (!p || /(^|_)phaedo($|_)/.test(p.server) || p.server.startsWith('plugin_phaedo')) return null;
+  const verb = MCP_VERBS.find((v) => v.re.test(p.tool));
+  if (!verb) return null;
+  // Connector servers are often named by an id ("597bdf05-a786-…"); say what it is instead.
+  const named = p.server.replace(/^plugin_/, '').replace(/_/g, ' ');
+  const via = /^[0-9a-f]{6,}(-[0-9a-f]+)*$/i.test(p.server) ? 'a connected app' : named;
+  // An amount only means money on a payment; on a message or a delete it's just a field.
+  const amount = verb.kind === 'spend' && typeof toolInput?.amount === 'number' && isFinite(toolInput.amount) ? toolInput.amount : undefined;
+  const d = {
+    send:   { domain: 'communication', magnitude: 'medium', reversible: false, summary: `send or post a message via ${via}` },
+    spend:  { domain: 'payments', magnitude: 'high', reversible: false, summary: `make a payment via ${via}` },
+    delete: { domain: 'data', magnitude: 'medium', reversible: false, summary: `delete something via ${via}` },
+    trash:  { domain: 'data', magnitude: 'low', reversible: true, summary: `move something to the trash via ${via}` },
+    merge:  { domain: 'engineering', magnitude: 'medium', reversible: true, summary: `merge via ${via}` },
+  }[verb.kind];
+  const preview = previewOf(toolInput);
+  return {
+    class: `mcp_${verb.kind}`,
+    summary: d.summary,
+    multiple: false,
+    action_descriptor: {
+      domain: d.domain, reversible: d.reversible, magnitude: d.magnitude, summary: d.summary,
+      ...(amount !== undefined ? { amount } : {}),
+    },
+    action_binding: {
+      tool_name: String(toolName),
+      arguments_hash: createHash('sha256').update(JSON.stringify(toolInput ?? null)).digest('hex'),
+      ...(preview ? { arguments_preview: preview } : {}),
+    },
+  };
+}
+
+/** Either kind of call: a Bash command, or an MCP tool. Null when it isn't a decision. */
+export function classifyToolCall(toolName, toolInput) {
+  if (toolName === 'Bash') return classifyShipCommand(toolInput?.command);
+  return classifyMcpCall(toolName, toolInput);
+}
+
 /**
  * Classify a Bash command. Returns null when no part of it is a ship action, else the
  * highest-stakes ship action in it (ties: the first), with `multiple` set when the line

package/ship-readout.js

@@ -21,10 +21,20 @@ const ASKING = new Set(['escalate', 'clarify', 'decline']);
 export function actionKind(summary) {
   const s = String(summary || '');
   if (/^(admin-)?merge\b/.test(s)) return 'merge';
-  if (/^deploy\b/.test(s)) return 'deploy';
+  if (/^deploy\b|^terraform |^kubectl /.test(s)) return 'deploy';
   if (/^submit\b/.test(s)) return 'phone submit';
   if (/^phone build\b/.test(s)) return 'phone build';
-  if (/push/.test(s)) return 'push to main';
+  if (/^(force-push to main|push directly to main)$/.test(s)) return 'push to main';
+  // The personal reviewer's kinds (ship-actions.js, 2026-10-27).
+  if (/^force-push\b/.test(s)) return 'force-push';
+  if (/^delete remote branch\b/.test(s)) return 'delete branch';
+  if (/^open a pull request$/.test(s)) return 'open PR';
+  if (/^(post a comment|approve a pull request|request changes)/.test(s)) return 'comment or review';
+  if (/^publish a package\b/.test(s)) return 'publish';
+  if (/^create a GitHub release\b/.test(s)) return 'release';
+  if (/^send or post a message\b/.test(s)) return 'message';
+  if (/^make a payment\b/.test(s)) return 'payment';
+  if (/^(delete something|move something to the trash)\b/.test(s)) return 'delete';
   return 'other';
 }
 

package/weekly.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// "This week Phaedo handled N decisions for you" — the visible win.
+//
+// Phaedo's case is fewer, better interruptions: an agent asks Phaedo instead of you, and only the
+// decisions you'd actually want to see reach you. That is invisible unless it's counted, so this
+// counts it from the local decision records (receipts.js), over the last 7 days:
+//
+//   went_ahead  — Phaedo said go ahead (proceed / proceed_with_note): you weren't interrupted
+//   stopped     — Phaedo said no (decline), usually one of your rules: you weren't interrupted
+//   came_to_you — Phaedo said check with you (escalate / clarify)
+//   unsure      — Phaedo didn't know (insufficient_signal); the agent fell back to its own default
+//
+// "Handled" is went_ahead + stopped. Pure over the receipts list; the CLI reads the local store.
+//
+//   npm run week
+
+import { readReceipts } from './receipts.js';
+import { defaultStateDir } from './cache.js';
+import { isMainModule } from './lib/is-main.js';
+
+export const WEEK_DAYS = 7;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const BUCKET = {
+  proceed: 'went_ahead', proceed_with_note: 'went_ahead',
+  decline: 'stopped',
+  escalate: 'came_to_you', clarify: 'came_to_you',
+  insufficient_signal: 'unsure',
+};
+
+export function weeklyHandled(receipts, { now = Date.now(), days = WEEK_DAYS } = {}) {
+  const since = now - days * DAY_MS;
+  const out = { days, went_ahead: 0, stopped: 0, came_to_you: 0, unsure: 0 };
+  for (const r of Array.isArray(receipts) ? receipts : []) {
+    const t = Date.parse(r?.created_at);
+    if (!Number.isFinite(t) || t < since || t > now) continue;
+    const b = BUCKET[r?.response?.signal];
+    if (b) out[b]++;
+  }
+  out.handled = out.went_ahead + out.stopped;
+  out.total = out.handled + out.came_to_you + out.unsure;
+  return out;
+}
+
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+/** One plain sentence (two at most) for a person. */
+export function formatWeekly(w) {
+  if (!w || !w.total) return 'No decisions came to Phaedo this week yet.';
+  const parts = [];
+  if (w.went_ahead) parts.push(`${w.went_ahead} went ahead`);
+  if (w.stopped) parts.push(`${w.stopped} stopped`);
+  const handled = w.handled
+    ? `This week Phaedo handled ${plural(w.handled, 'decision')} without interrupting you (${parts.join(', ')})`
+    : 'This week Phaedo handled no decisions on its own';
+  const asked = w.came_to_you ? ` and brought ${w.came_to_you} to you` : '';
+  const unsure = w.unsure ? ` ${w.unsure === 1 ? 'One more was' : `${w.unsure} more were`} too unclear to call.` : '';
+  return `${handled}${asked}.${unsure}`;
+}
+
+if (isMainModule(import.meta.url)) {
+  const receipts = await readReceipts(defaultStateDir()).catch(() => []);
+  console.log(formatWeekly(weeklyHandled(receipts)));
+}