qa360 2.2.1 → 2.2.13

package/packages/mcp/README.md

@@ -1,294 +0,0 @@
-# QA360 MCP CLI – Zero-Friction Developer Experience
-
-> From zero to usable QA360 tools inside  in < 3 minutes
-
-## 🚀 Quick Start
-
-```bash
-# Install globally
-npm i -g @qa360/mcp
-
-# Configure VS Code + 
-qa360-mcp init
-
-# Start MCP server
-qa360-mcp up
-
-# Open  and try:
-/qa360.health
-
-# Diagnostic (JSON output for CI)
-qa360-mcp doctor --json
-
-# Telemetry (opt-in, privacy-first)
-qa360-mcp telemetry on|off|status
-```
-
-## 📋 Commands
-
-| Command | Description | Options |
-|---------|-------------|---------|
-| `qa360-mcp init` | Configure VS Code &  | `--non-interactive`, `--force` |
-| `qa360-mcp up` | Start MCP Server (stdio mode) | `--debug`, `--allow-run`, `--allow-secrets` |
-| `qa360-mcp serve` | Alias for `up` command | Same as `up` |
-| `qa360-mcp doctor` | Check setup health | `--json`, `--verbose` |
-| `qa360-mcp fix` | Repair issues automatically | `--force` |
-| `qa360-mcp reset` | Clean all configurations | `--yes` |
-| `qa360-mcp uninstall` | Remove QA360 MCP completely | `--force` |
-| `qa360-mcp telemetry` | Manage opt-in telemetry | `on\|off\|status` |
-| `qa360-mcp test:dx` | Run DX compliance tests | `--ci` |
-
-## 🎯 Features
-
-### ✅ Zero Manual Configuration
-- Auto-detects VS Code installation
-- Auto-writes `settings.json` with backup
-- Auto-discovers  extension
-
-### ✅ Multi-Platform Support
-- **macOS**: Full support (Intel + Apple Silicon)
-- **Linux**: Ubuntu, Debian, Fedora, Arch
-- **Windows**: PowerShell + WSL
-
-### ✅ Auto-Recovery
-- Server crashes → Auto-restart (max 3 attempts)
-- Corrupted config → Auto-backup + repair
-- Missing dependencies → Clear error messages
-
-### ✅ Intelligent Feedback
-- Human-readable messages
-- No raw stacktraces
-- Actionable fix suggestions
-
-## 🔧 Configuration
-
-### Automatic (Recommended)
-
-```bash
-qa360-mcp init
-```
-
-This will:
-1. Detect VS Code `settings.json`
-2. Create backup (`.qa360.backup.json`)
-3. Add MCP server configuration
-4. Verify  extension
-
-### Manual
-
-Add to VS Code `settings.json`:
-
-```json
-{
-  "claude.mcpServers": {
-    "qa360": {
-      "command": "qa360-mcp",
-      "args": ["serve", "--stdio", "--allow-run"],
-      "env": {
-        "QA360_HOME": "~/.qa360"
-      }
-    }
-  }
-}
-```
-
-## 🧪 DX Testing
-
-```bash
-# Run DX compliance tests
-qa360-mcp test:dx
-
-# CI mode (exit with code on failure)
-qa360-mcp test:dx --ci
-```
-
-**Target**: 100% DX Compliance
-
-## 🛠️ Troubleshooting
-
-### Server won't start
-
-```bash
-qa360-mcp doctor
-qa360-mcp fix
-```
-
-###  not detecting tools
-
-1. Restart VS Code
-2. Check server logs: `qa360-mcp up --verbose`
-3. Verify configuration: `qa360-mcp doctor`
-
-### Permission errors
-
-```bash
-# macOS/Linux
-chmod +x $(which qa360-mcp)
-
-# Windows (PowerShell as Admin)
-Set-ExecutionPolicy RemoteSigned
-```
-
-### Port already in use
-
-```bash
-# Use different port
-qa360-mcp up --port 3001
-```
-
-## 📊 System Requirements
-
-- **Node.js**: ≥ 18.0.0
-- **VS Code**: Latest stable
-- ****: v2.0.0+
-- **Disk Space**: ~50MB
-
-## 🎯 From Zero to Running (< 3 min)
-
-```bash
-# Step 1: Install (30s)
-npm i -g @qa360/mcp
-
-# Step 2: Configure (30s)
-qa360-mcp init
-
-# Step 3: Start (30s)
-qa360-mcp up
-
-# Step 4: Verify (30s)
-# Open  → Type: /qa360.health
-```
-
-**Total**: ~2 minutes ✅
-
-## 🔐 Security & Permissions
-
-### Default (Read-Only)
-- ✅ `qa360.health` - Health check
-- ✅ `qa360.history.list` - List runs
-- ✅ `qa360.pack.validate` - Validate packs
-
-### Opt-In (Explicit)
-- 🔒 `qa360.run` - Requires `--allow-run`
-- 🔒 `qa360.secrets.*` - Requires `--allow-secrets`
-
-```bash
-# Enable all permissions
-qa360-mcp up --allow-run --allow-secrets
-```
-
-### Supply Chain Security
-
-**SBOM (Software Bill of Materials)**: Automatically generated CycloneDX 1.5 SBOM with every build, including all 19 dependencies (9 production + 10 development) with cryptographic verification.
-
-**Note**: During SBOM generation, you may see `npm error missing: ...` messages. These are **harmless warnings** from upstream peer/dev dependencies (ESLint, Vitest, etc.) not required at runtime. The SBOM pipeline uses `package-lock.json` with automatic fallback and verification (> 500 bytes). CI fails only if SBOM is absent or invalid.
-
-## 🔄 CI/CD Integration
-
-### JSON Output for Automation
-
-```bash
-# Get structured health check results
-qa360-mcp doctor --json
-
-# Example output:
-{
-  "timestamp": "2025-10-25T14:30:00.000Z",
-  "summary": {
-    "total": 7,
-    "passed": 7,
-    "warnings": 0,
-    "errors": 0,
-    "status": "ok"
-  },
-  "checks": [...]
-}
-
-# Exit codes: 0 = PASS, 1 = FAIL
-```
-
-### Non-Interactive Mode
-
-```bash
-# CI/CD pipeline
-qa360-mcp init --non-interactive --force
-qa360-mcp doctor --json
-qa360-mcp uninstall --force
-```
-
-### GitHub Actions Example
-
-```yaml
-- name: Install QA360 MCP
-  run: npm i -g @qa360/mcp
-
-- name: Configure
-  run: qa360-mcp init --non-interactive --force
-
-- name: Health Check
-  run: qa360-mcp doctor --json
-```
-
-## 📊 Telemetry (Opt-In, Privacy-First)
-
-### Privacy Policy
-
-**Default**: Telemetry is **DISABLED** until you explicitly enable it.
-
-**What we collect** (when enabled):
-- CLI version
-- Operating system (platform/arch)
-- Command execution times
-- Anonymous error codes
-
-**What we DO NOT collect**:
-- Personal information
-- File paths or content
-- VS Code settings
-- Project names or URLs
-
-### Commands
-
-```bash
-# Enable telemetry
-qa360-mcp telemetry on
-
-# Disable telemetry
-qa360-mcp telemetry off
-
-# Check status
-qa360-mcp telemetry status
-```
-
-All telemetry data is stored **locally only** in `~/.qa360/telemetry-logs/` and never sent without explicit consent.
-
-## 📚 Documentation
-
-- [Full Documentation](https://github.com/qa360/mcp)
-- [MCP Protocol](https://modelcontextprotocol.io)
-- [ Extension](https://marketplace.visualstudio.com/items?itemName=anthropic.claude-code)
-
-## 🤝 Contributing
-
-```bash
-# Clone repo
-git clone https://github.com/qa360/qa360.git
-cd qa360/packages/qa360-mcp-cli
-
-# Install dependencies
-pnpm install
-
-# Build
-pnpm build
-
-# Test
-pnpm test:dx
-```
-
-## 📝 License
-
-MIT © QA360 Team
-
----
-
-**🎯 From zero to running QA360 tools in < 3 min**

package/packages/mcp/TELEMETRY.md

@@ -1,220 +0,0 @@
-# 📊 QA360 MCP CLI - Telemetry Privacy Policy
-
-## 🔒 Privacy-First Approach
-
-QA360 MCP CLI implements **opt-in telemetry** that respects your privacy and complies with GDPR regulations.
-
-## 🎯 Default State
-
-**Telemetry is DISABLED by default.**
-
-No data is collected unless you explicitly enable it with:
-
-```bash
-qa360-mcp telemetry on
-```
-
-## 📋 What We Collect (When Enabled)
-
-When you opt-in to telemetry, we collect **anonymous, non-personal data** to improve the CLI:
-
-### ✅ Collected Data
-
-| Data Type | Example | Purpose |
-|-----------|---------|---------|
-| CLI Version | `1.0.0` | Track version adoption |
-| Operating System | `darwin`, `linux`, `win32` | Platform-specific improvements |
-| Architecture | `arm64`, `x64` | Compatibility testing |
-| Node.js Version | `v20.19.5` | Version support planning |
-| Command Names | `init`, `up`, `doctor` | Usage patterns |
-| Execution Duration | `1250ms` | Performance optimization |
-| Error Codes | `ERR_NODE_VERSION` | Bug prioritization |
-| Anonymous User ID | `qa360_abc123_xyz789` | Unique session tracking |
-
-### ❌ NOT Collected
-
-We **NEVER** collect:
-
-- ❌ Personal information (name, email, IP address)
-- ❌ File paths or directory structures
-- ❌ VS Code settings content
-- ❌ Project names or URLs
-- ❌ Environment variables
-- ❌ Secrets or credentials
-- ❌ Code snippets or file content
-- ❌ Network requests or API calls
-
-## 🗄️ Data Storage
-
-### Local Storage Only
-
-All telemetry data is stored **locally** on your machine:
-
-```
-~/.qa360/telemetry-logs/
-  ├── telemetry-2025-10-25.jsonl
-  ├── telemetry-2025-10-26.jsonl
-  └── ...
-```
-
-### No External Transmission
-
-**Important**: In the current version, telemetry data is **NOT sent to any external server**. It is stored locally for your review and potential future opt-in sharing.
-
-## 🔧 Managing Telemetry
-
-### Enable Telemetry
-
-```bash
-qa360-mcp telemetry on
-```
-
-**Output**:
-```
-✅ Telemetry enabled
-
-What we collect (anonymously):
-  • CLI version
-  • Operating system
-  • Command execution times
-  • Anonymous error reports
-
-What we DO NOT collect:
-  • Personal information
-  • File paths or content
-  • VS Code settings
-  • Project names or URLs
-
-Your anonymous ID: qa360_1729865432_abc123xyz
-This helps us improve QA360 MCP for everyone. Thank you! 🙏
-```
-
-### Disable Telemetry
-
-```bash
-qa360-mcp telemetry off
-```
-
-**Output**:
-```
-✅ Telemetry disabled
-
-No data will be collected.
-```
-
-### Check Status
-
-```bash
-qa360-mcp telemetry status
-```
-
-**Output** (when enabled):
-```
-Status: Enabled ✓
-Anonymous ID: qa360_1729865432_abc123xyz
-Last updated: 2025-10-25 14:30:00
-```
-
-**Output** (when disabled):
-```
-Status: Disabled ✗
-```
-
-## 🧹 Data Purge
-
-### Delete All Telemetry Data
-
-To completely remove all telemetry data from your machine:
-
-```bash
-# Remove telemetry configuration
-rm ~/.qa360/telemetry.json
-
-# Remove all telemetry logs
-rm -rf ~/.qa360/telemetry-logs/
-```
-
-After this, telemetry will be disabled and all collected data will be permanently deleted.
-
-## 📊 Example Telemetry Event
-
-When telemetry is enabled, events are logged in JSONL format:
-
-```json
-{
-  "event": "command_executed",
-  "userId": "qa360_1729865432_abc123xyz",
-  "timestamp": "2025-10-25T14:30:00.000Z",
-  "version": "1.0.0",
-  "platform": "darwin",
-  "arch": "arm64",
-  "nodeVersion": "v20.19.5",
-  "data": {
-    "command": "init",
-    "duration": 1250,
-    "success": true
-  }
-}
-```
-
-**Note**: No personal or sensitive information is included.
-
-## 🔐 Security & Compliance
-
-### GDPR Compliance
-
-QA360 MCP CLI telemetry is designed to comply with GDPR:
-
-- ✅ **Opt-in by default** (Article 6)
-- ✅ **Explicit consent** required
-- ✅ **Data minimization** (only essential data)
-- ✅ **Right to erasure** (easy data deletion)
-- ✅ **Transparency** (clear documentation)
-- ✅ **Local storage** (no third-party sharing)
-
-### Data Retention
-
-- Telemetry logs are stored **indefinitely** on your local machine
-- You can delete them at any time
-- No automatic cleanup (you control your data)
-
-## 🤝 Why Telemetry?
-
-Telemetry helps us:
-
-1. **Prioritize Features**: Understand which commands are most used
-2. **Fix Bugs Faster**: Identify common error patterns
-3. **Improve Performance**: Detect slow operations
-4. **Support Platforms**: Know which OS/Node versions to prioritize
-5. **Validate DX**: Measure actual installation times
-
-## 📞 Questions or Concerns?
-
-If you have questions about telemetry or privacy:
-
-- **GitHub Issues**: [qa360/qa360/issues](https://github.com/qa360/qa360/issues)
-- **Email**: privacy@qa360.io
-- **Documentation**: [qa360.io/privacy](https://qa360.io/privacy)
-
-## 📝 Changes to This Policy
-
-We may update this privacy policy. Changes will be:
-
-- Documented in `CHANGELOG.md`
-- Announced in release notes
-- Require re-consent if data collection changes
-
-## 🏆 Transparency Commitment
-
-We believe in **radical transparency**:
-
-- All telemetry code is open source
-- You can inspect what data is collected
-- You control your data at all times
-- We never sell or share your data
-
----
-
-**Last Updated**: 2025-10-25  
-**Version**: 1.0.0  
-**Status**: ✅ GDPR Compliant, Privacy-First, Opt-In Only

package/packages/mcp/package.json

@@ -1,91 +0,0 @@
-{
-  "name": "qa360-mcp",
-  "version": "2.2.1",
-  "description": "QA360 MCP - Zero-friction CLI + Full MCP Server (23 tools) for  integration with industrial DX compliance",
-  "type": "module",
-  "main": "dist/index.js",
-  "bin": {
-    "qa360-mcp": "dist/cli/cli.js",
-    "qa360-mcp-server": "dist/server/full-server.js"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "build:pkg": "tsc",
-    "check": "tsc -p tsconfig.json --noEmit",
-    "dev": "tsc --watch",
-    "start": "node dist/cli/cli.js",
-    "test": "vitest run --passWithNoTests",
-    "test:watch": "vitest",
-    "test:dx": "vitest run tests/dx.test.ts",
-    "lint": "eslint src --ext .ts",
-    "lint:fix": "eslint src --ext .ts --fix",
-    "pre-sbom": "mkdir -p dist && npm i --package-lock-only 2>/dev/null || true",
-    "sbom:real": "npx @cyclonedx/cyclonedx-npm --package-lock-only --output-format JSON --output-file dist/qa360-sbom.json 2>/dev/null || node scripts/generate-sbom-fallback.cjs",
-    "sbom:verify": "node -e \"const f='dist/qa360-sbom.json';const fs=require('fs');if(!fs.existsSync(f)){console.error('❌ SBOM not found');process.exit(1);}const s=fs.statSync(f).size;if(s<500){console.error('❌ SBOM too small:',s,'bytes');process.exit(2);}console.log('✅ SBOM verified:',s,'bytes');\"",
-    "sbom": "npm run pre-sbom && npm run sbom:real && npm run sbom:verify",
-    "audit:ci": "npm audit --audit-level=high --json > dist/security-audit.json || exit 1",
-    "verify:settings": "node dist/scripts/verify-settings.js",
-    "e2e": "node dist/scripts/e2e-local.js",
-    "ci:pre": "npm run check && npm run build",
-    "ci:security": "npm run sbom && npm run audit:ci",
-    "ci:e2e": "qa360-mcp init --non-interactive --force && qa360-mcp doctor --json",
-    "ci:all": "npm run ci:pre && npm run ci:security && npm run ci:e2e",
-    "prepublishOnly": "npm run check && npm run build && npm run sbom && npm run audit:ci",
-    "publish:dry": "npm publish --access public --provenance --dry-run",
-    "publish:real": "npm publish --access public --provenance",
-    "postinstall": "node scripts/safe-postinstall.cjs"
-  },
-  "keywords": [
-    "qa360",
-    "mcp",
-    "model-context-protocol",
-    "claude",
-    "vscode",
-    "cli",
-    "dx",
-    "testing",
-    "ai"
-  ],
-  "author": "QA360 Team",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/xyqotech/qa360.git",
-    "directory": "packages/mcp"
-  },
-  "homepage": "https://github.com/xyqotech/qa360",
-  "bugs": {
-    "url": "https://github.com/xyqotech/qa360/issues"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^0.4.0",
-    "qa360-core": "workspace:*",
-    "ajv": "^8.12.0",
-    "chalk": "^5.3.0",
-    "commander": "^11.1.0",
-    "execa": "^8.0.1",
-    "fs-extra": "^11.2.0",
-    "inquirer": "^9.2.12",
-    "jsonc-parser": "^3.2.0",
-    "ora": "^8.0.1",
-    "semver": "^7.5.4"
-  },
-  "devDependencies": {
-    "@cyclonedx/cyclonedx-npm": "1.20.0",
-    "@types/fs-extra": "^11.0.4",
-    "@types/inquirer": "^9.0.7",
-    "@types/node": "^20.10.0",
-    "@types/semver": "^7.5.6",
-    "@typescript-eslint/eslint-plugin": "^6.13.0",
-    "@typescript-eslint/parser": "^6.13.0",
-    "eslint": "^8.55.0",
-    "typescript": "^5.3.0",
-    "vitest": "^1.0.4"
-  },
-  "files": [
-    "dist/**/*",
-    "scripts/**/*",
-    "README.md",
-    "LICENSE"
-  ]
-}

package/packages/mcp/scripts/generate-sbom-fallback.cjs

@@ -1,84 +0,0 @@
-#!/usr/bin/env node
-/**
- * SBOM Fallback Generator
- * Génère une SBOM CycloneDX 1.5 complète depuis package.json
- * Utilisé quand cyclonedx-npm échoue (environnements pnpm)
- */
-
-const fs = require('fs');
-const path = require('path');
-
-const packageJsonPath = path.join(__dirname, '..', 'package.json');
-const outputPath = path.join(__dirname, '..', 'dist', 'qa360-sbom.json');
-
-try {
-  const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-  
-  const components = [];
-  
-  // Production dependencies
-  if (pkg.dependencies) {
-    Object.entries(pkg.dependencies).forEach(([name, version]) => {
-      components.push({
-        type: 'library',
-        name,
-        version: version.replace(/^[\^~]/, ''), // Remove ^ or ~
-        scope: 'required'
-      });
-    });
-  }
-  
-  // Dev dependencies (optional scope)
-  if (pkg.devDependencies) {
-    Object.entries(pkg.devDependencies).forEach(([name, version]) => {
-      components.push({
-        type: 'library',
-        name,
-        version: version.replace(/^[\^~]/, ''),
-        scope: 'optional'
-      });
-    });
-  }
-  
-  const sbom = {
-    bomFormat: 'CycloneDX',
-    specVersion: '1.5',
-    version: 1,
-    serialNumber: `urn:uuid:${generateUUID()}`,
-    metadata: {
-      timestamp: new Date().toISOString(),
-      tools: [
-        {
-          vendor: 'QA360',
-          name: 'sbom-fallback-generator',
-          version: '1.0.0'
-        }
-      ],
-      component: {
-        type: 'application',
-        'bom-ref': `pkg:npm/${pkg.name}@${pkg.version}`,
-        name: pkg.name,
-        version: pkg.version,
-        description: pkg.description || '',
-        licenses: pkg.license ? [{ license: { id: pkg.license } }] : []
-      }
-    },
-    components
-  };
-  
-  fs.writeFileSync(outputPath, JSON.stringify(sbom, null, 2));
-  console.log(`✅ SBOM fallback generated: ${outputPath} (${components.length} components)`);
-  process.exit(0);
-  
-} catch (error) {
-  console.error('❌ SBOM fallback generation failed:', error.message);
-  process.exit(1);
-}
-
-function generateUUID() {
-  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
-    const r = Math.random() * 16 | 0;
-    const v = c === 'x' ? r : (r & 0x3 | 0x8);
-    return v.toString(16);
-  });
-}