qa360 2.2.1 → 2.2.13

package/packages/mcp/src/tools/vault.ts

@@ -1,164 +0,0 @@
-/**
- * QA360 Vault Tools
- * Read-only access to Evidence Vault via MCP
- */
-
-import { EvidenceVault } from 'qa360-core';
-import { MCPServerConfig, VaultGetRunArgs, VaultGetArtifactsArgs } from '../types/index.js';
-import { SecurityManager } from '../security/manager.js';
-import { AuditLogger } from '../security/audit.js';
-
-export class VaultTools {
-  private config: MCPServerConfig;
-  private security: SecurityManager;
-  private audit: AuditLogger;
-
-  constructor(config: MCPServerConfig, security: SecurityManager, audit: AuditLogger) {
-    this.config = config;
-    this.security = security;
-    this.audit = audit;
-  }
-
-  async execute(toolName: string, args: any): Promise<any> {
-    const vault = await EvidenceVault.open('./.qa360', {
-      enableWAL: true
-    });
-
-    try {
-      switch (toolName) {
-        case 'qa360.vault.get_run':
-          return await this.getRun(vault, args as VaultGetRunArgs);
-        case 'qa360.vault.get_artifacts':
-          return await this.getArtifacts(vault, args as VaultGetArtifactsArgs);
-        default:
-          throw new Error(`Unknown vault tool: ${toolName}`);
-      }
-    } finally {
-      await vault.close();
-    }
-  }
-
-  /**
-   * Get run data from vault
-   */
-  private async getRun(vault: EvidenceVault, args: VaultGetRunArgs) {
-    const { runId } = args;
-
-    const run = await vault.getRun(runId);
-    if (!run) {
-      throw new Error(`Run not found: ${runId}`);
-    }
-
-    // Get associated data
-    const [gates, findings] = await Promise.all([
-      vault.getGates(runId),
-      vault.getFindings(runId)
-    ]);
-
-    return {
-      run: {
-        id: run.id,
-        run_key: run.run_key,
-        started_at: run.started_at,
-        ended_at: run.ended_at,
-        pack_hash: run.pack_hash,
-        pack_path: run.pack_path,
-        status: run.status,
-        trust_score: run.trust_score,
-        weights_json: run.weights_json,
-        sign_alg: run.sign_alg,
-        signature_hex: run.signature_hex ? '***REDACTED***' : null, // Never expose signatures
-        proof_pdf_path: run.proof_pdf_path,
-        pinned: run.pinned,
-        created_at: run.created_at,
-        updated_at: run.updated_at
-      },
-      gates: gates.map(gate => ({
-        name: gate.name,
-        status: gate.status,
-        duration_ms: gate.duration_ms,
-        metrics: gate.metrics_json ? JSON.parse(gate.metrics_json) : {},
-        budgets: gate.budgets_json ? JSON.parse(gate.budgets_json) : {},
-        created_at: gate.created_at
-      })),
-      findings: findings.map(finding => ({
-        gate: finding.gate,
-        severity: finding.severity,
-        rule: finding.rule,
-        location: finding.location,
-        message: this.security.redactSensitiveData(finding.message),
-        fingerprint: finding.fingerprint,
-        created_at: finding.created_at
-      })),
-      metadata: {
-        total_gates: gates.length,
-        total_findings: findings.length,
-        passed_gates: gates.filter(g => g.status === 'passed').length,
-        failed_gates: gates.filter(g => g.status === 'failed').length,
-        critical_findings: findings.filter(f => f.severity === 'critical').length,
-        high_findings: findings.filter(f => f.severity === 'high').length
-      }
-    };
-  }
-
-  /**
-   * Get artifacts for a run
-   */
-  private async getArtifacts(vault: EvidenceVault, args: VaultGetArtifactsArgs) {
-    const { runId } = args;
-
-    const run = await vault.getRun(runId);
-    if (!run) {
-      throw new Error(`Run not found: ${runId}`);
-    }
-
-    const artifacts = await vault.getRunArtifacts(runId);
-
-    return {
-      run_id: runId,
-      total_artifacts: artifacts.length,
-      artifacts: artifacts.map(artifact => ({
-        label: artifact.label,
-        sha256: artifact.sha256,
-        mime_type: artifact.mime_type,
-        size_bytes: artifact.size_bytes,
-        original_name: artifact.original_name,
-        cas_path: artifact.cas_path,
-        created_at: artifact.created_at,
-        last_accessed: artifact.last_accessed,
-        // Note: We don't include the actual file content for security
-        // and performance reasons. Use the CAS path to access files directly.
-        access_note: 'Use CAS path to access file content directly'
-      })),
-      summary: {
-        total_size_bytes: artifacts.reduce((sum, a) => sum + a.size_bytes, 0),
-        mime_types: [...new Set(artifacts.map(a => a.mime_type))],
-        labels: [...new Set(artifacts.map(a => a.label))],
-        oldest_artifact: artifacts.length > 0 ? Math.min(...artifacts.map(a => a.created_at)) : null,
-        newest_artifact: artifacts.length > 0 ? Math.max(...artifacts.map(a => a.created_at)) : null
-      }
-    };
-  }
-
-  /**
-   * Get vault statistics (bonus method)
-   */
-  async getVaultStats(): Promise<any> {
-    const vault = await EvidenceVault.open('./.qa360', {
-      enableWAL: true
-    });
-
-    try {
-      const stats = await vault.getStats();
-      return {
-        vault_stats: stats,
-        health: 'healthy',
-        location: './.qa360/vault.db',
-        mode: 'WAL',
-        timestamp: Date.now()
-      };
-    } finally {
-      await vault.close();
-    }
-  }
-}

package/packages/mcp/src/tools/verify.ts

@@ -1,166 +0,0 @@
-/**
- * QA360 Verify Tool
- * Verify proof integrity and signatures via MCP
- */
-
-import { EvidenceVault } from 'qa360-core';
-import { existsSync, readFileSync } from 'fs';
-import { MCPServerConfig, VerifyArgs, VerifyResult } from '../types/index.js';
-import { SecurityManager } from '../security/manager.js';
-import { AuditLogger } from '../security/audit.js';
-
-export class VerifyTool {
-  private config: MCPServerConfig;
-  private security: SecurityManager;
-  private audit: AuditLogger;
-
-  constructor(config: MCPServerConfig, security: SecurityManager, audit: AuditLogger) {
-    this.config = config;
-    this.security = security;
-    this.audit = audit;
-  }
-
-  async execute(toolName: string, args: VerifyArgs): Promise<VerifyResult> {
-    const { runId, proofPath } = args;
-
-    if (!runId && !proofPath) {
-      throw new Error('Either runId or proofPath must be provided');
-    }
-
-    try {
-      if (runId) {
-        return await this.verifyRunId(runId);
-      } else if (proofPath) {
-        return await this.verifyProofFile(proofPath);
-      } else {
-        throw new Error('No verification target provided');
-      }
-    } catch (error) {
-      return {
-        verified: false,
-        algorithm: 'unknown',
-        message: `Verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
-        runId
-      };
-    }
-  }
-
-  /**
-   * Verify a run by ID from the vault
-   */
-  private async verifyRunId(runId: string): Promise<VerifyResult> {
-    // Initialize vault
-    const vault = await EvidenceVault.open('./.qa360', {
-      enableWAL: true
-    });
-
-    try {
-      // Get run data
-      const run = await vault.getRun(runId);
-      if (!run) {
-        throw new Error(`Run not found: ${runId}`);
-      }
-
-      if (!run.signature_hex) {
-        return {
-          verified: false,
-          algorithm: 'none',
-          message: 'Run is not signed',
-          runId
-        };
-      }
-
-      // Get run details for verification
-      const [gates, findings, artifacts] = await Promise.all([
-        vault.getGates(runId),
-        vault.getFindings(runId),
-        vault.getRunArtifacts(runId)
-      ]);
-
-      // Reconstruct proof data
-      const proofData = {
-        run_id: runId,
-        timestamp: run.started_at,
-        pack_hash: run.pack_hash,
-        status: run.status,
-        trust_score: run.trust_score,
-        gates: gates.map(gate => ({
-          name: gate.name,
-          status: gate.status,
-          duration_ms: gate.duration_ms,
-          metrics: gate.metrics_json ? JSON.parse(gate.metrics_json) : {}
-        })),
-        findings: findings.map(finding => ({
-          gate: finding.gate,
-          severity: finding.severity,
-          rule: finding.rule,
-          location: finding.location,
-          message: finding.message
-        })),
-        artifacts: artifacts.map(artifact => ({
-          label: artifact.label,
-          sha256: artifact.sha256,
-          size_bytes: artifact.size_bytes
-        }))
-      };
-
-      // Verify signature
-      const isValid = this.verifySignature(proofData, run.signature_hex, run.sign_alg || 'ed25519');
-
-      return {
-        verified: isValid,
-        algorithm: run.sign_alg || 'ed25519',
-        message: isValid ? 'Signature verification successful' : 'Signature verification failed',
-        runId
-      };
-
-    } finally {
-      await vault.close();
-    }
-  }
-
-  /**
-   * Verify a proof file
-   */
-  private async verifyProofFile(proofPath: string): Promise<VerifyResult> {
-    if (!existsSync(proofPath)) {
-      throw new Error(`Proof file not found: ${proofPath}`);
-    }
-
-    try {
-      // For PDF files, we would need to extract the proof data
-      // For now, simulate verification
-      const fileContent = readFileSync(proofPath);
-      
-      // Basic file integrity check
-      const isValid = fileContent.length > 0;
-
-      return {
-        verified: isValid,
-        algorithm: 'file-integrity',
-        message: isValid ? 'File integrity check passed' : 'File appears to be corrupted'
-      };
-
-    } catch (error) {
-      throw new Error(`Failed to read proof file: ${error instanceof Error ? error.message : 'Unknown error'}`);
-    }
-  }
-
-  /**
-   * Verify signature (simulated)
-   * In a real implementation, this would use actual Ed25519 verification
-   */
-  private verifySignature(data: any, signature: string, algorithm: string): boolean {
-    if (algorithm !== 'ed25519') {
-      return false;
-    }
-
-    // Simulate signature verification
-    const crypto = require('crypto');
-    const content = JSON.stringify(data, null, 2);
-    const expectedHash = crypto.createHash('sha256').update(content).digest('hex');
-    const expectedSignature = `ed25519_sim_${expectedHash.substring(0, 32)}`;
-
-    return signature === expectedSignature;
-  }
-}

package/packages/mcp/src/types/index.ts

@@ -1,311 +0,0 @@
-/**
- * QA360 MCP Server Types
- * Type definitions for MCP tools and responses
- */
-
-export interface QA360Error {
-  code: string;
-  message: string;
-  hint?: string;
-}
-
-export interface QA360Response<T = any> {
-  success: boolean;
-  data?: T;
-  error?: QA360Error;
-}
-
-// Tool argument types
-export interface RunArgs {
-  packPath: string;
-  runKey?: string;
-  strict?: boolean;
-  weights?: Record<string, number>;
-}
-
-export interface ReportSignArgs {
-  runId: string;
-}
-
-export interface VerifyArgs {
-  runId?: string;
-  proofPath?: string;
-}
-
-export interface HistoryListArgs {
-  limit?: number;
-  status?: 'passed' | 'failed' | 'error' | 'cancelled' | 'any';
-  gate?: string;
-  since?: string; // ISO date
-}
-
-export interface HistoryGetArgs {
-  runId: string;
-}
-
-export interface HistoryDiffArgs {
-  runA: string;
-  runB: string;
-}
-
-export interface HistoryTrendArgs {
-  gate?: 'perf' | 'ui' | 'api' | 'a11y' | 'sast' | 'dast' | 'deps' | 'secrets';
-  window?: number;
-}
-
-export interface HistoryExportArgs {
-  runId: string;
-  bundlePath: string;
-}
-
-export interface HistoryGCArgs {
-  keepLast?: number;
-  maxBytes?: string;
-  dryRun?: boolean;
-}
-
-export interface HistoryPinArgs {
-  runId: string;
-}
-
-export interface PackAskArgs {
-  query: string;
-  context?: {
-    targets?: Record<string, any>;
-  };
-}
-
-export interface PackValidateArgs {
-  pack?: string; // YAML content
-  path?: string; // File path
-}
-
-export interface SecretsAddArgs {
-  name: string;
-  value: string;
-  description?: string;
-}
-
-export interface SecretsListArgs {
-  // No args needed
-}
-
-export interface SecretsRemoveArgs {
-  name: string;
-}
-
-export interface ServeDiagArgs {
-  // No args needed
-}
-
-export interface VaultGetRunArgs {
-  runId: string;
-}
-
-export interface VaultGetArtifactsArgs {
-  runId: string;
-}
-
-export interface TriageExplainArgs {
-  code: string; // SG|ZAP|GL|OSV|PA|PU|K6###
-  context?: Record<string, any>;
-}
-
-// Tool result types
-export interface RunResult {
-  runId: string;
-  status: 'passed' | 'failed' | 'cancelled' | 'error';
-  trust: {
-    score: number;
-    weights?: Record<string, number>;
-  };
-  proof?: {
-    pdf?: {
-      sha256: string;
-      path: string;
-    };
-  };
-  gates: Array<{
-    name: string;
-    status: 'passed' | 'failed' | 'skipped' | 'warn';
-    duration_ms: number;
-    key_metrics?: Record<string, any>;
-  }>;
-}
-
-export interface ReportSignResult {
-  signature: string;
-  algorithm: string;
-  runId: string;
-}
-
-export interface VerifyResult {
-  verified: boolean;
-  algorithm: string;
-  message: string;
-  runId?: string;
-}
-
-export interface HistoryListResult {
-  runs: Array<{
-    id: string;
-    started_at: number;
-    status: string;
-    trust_score?: number;
-    gates_summary?: Record<string, string>;
-  }>;
-}
-
-export interface HistoryGetResult {
-  run: {
-    id: string;
-    started_at: number;
-    ended_at?: number;
-    status: string;
-    trust_score?: number;
-    pack_path: string;
-    pack_hash: string;
-    run_key?: string;
-  };
-  gates: Array<{
-    name: string;
-    status: string;
-    duration_ms: number;
-    metrics?: Record<string, any>;
-  }>;
-  findings: Array<{
-    gate: string;
-    severity: string;
-    rule: string;
-    location?: string;
-    message: string;
-  }>;
-  artifacts: Array<{
-    label: string;
-    sha256: string;
-    mime_type: string;
-    size_bytes: number;
-  }>;
-}
-
-export interface HistoryDiffResult {
-  delta: {
-    trust: number;
-    gates: Record<string, {
-      status_change?: string;
-      duration_change?: number;
-    }>;
-    findings: {
-      added: Array<any>;
-      removed: Array<any>;
-      regressed: Array<any>;
-    };
-  };
-}
-
-export interface HistoryTrendResult {
-  series: Array<{
-    timestamp: number;
-    value: number;
-    metadata?: Record<string, any>;
-  }>;
-  summary: {
-    average: number;
-    trend: 'up' | 'down' | 'stable';
-    window_size: number;
-  };
-}
-
-export interface HistoryExportResult {
-  bundlePath: string;
-  size_bytes: number;
-  contents: string[];
-}
-
-export interface HistoryGCResult {
-  removed: {
-    runs: number;
-    artifacts: number;
-    bytesFreed: number;
-  };
-  dryRun: boolean;
-}
-
-export interface PackAskResult {
-  pack: string; // Generated YAML
-  hints: {
-    tools_needed: string[];
-    estimated_duration: string;
-    complexity: 'simple' | 'medium' | 'complex';
-  };
-}
-
-export interface PackValidateResult {
-  valid: boolean;
-  errors: Array<{
-    code: string;
-    message: string;
-    line?: number;
-    column?: number;
-  }>;
-  warnings: Array<{
-    code: string;
-    message: string;
-    line?: number;
-    column?: number;
-  }>;
-  auto_fixes?: string[]; // For lint
-}
-
-export interface SecretsListResult {
-  secrets: Array<{
-    name: string;
-    description?: string;
-    created_at: number;
-    last_used?: number;
-  }>;
-}
-
-export interface ServeDiagResult {
-  health: 'healthy' | 'degraded' | 'unhealthy';
-  version: string;
-  uptime_ms: number;
-  metrics: Record<string, any>;
-  vault_stats?: Record<string, any>;
-}
-
-export interface TriageExplainResult {
-  explanation: {
-    cause: string;
-    severity: 'low' | 'medium' | 'high' | 'critical';
-    category: string;
-  };
-  actions: Array<{
-    type: 'fix' | 'investigate' | 'ignore';
-    description: string;
-    command?: string;
-  }>;
-  references: Array<{
-    title: string;
-    url: string;
-  }>;
-}
-
-// MCP Server configuration
-export interface MCPServerConfig {
-  allowRun: boolean;
-  allowSecrets: boolean;
-  maxConcurrency: number;
-  rateLimit: {
-    requests: number;
-    window: number; // seconds
-  };
-  sandbox: {
-    allowedPaths: string[];
-    requireQA360Dir: boolean;
-  };
-  audit: {
-    enabled: boolean;
-    logPath: string;
-  };
-}

package/packages/mcp/src/types/mcp-stubs.ts

@@ -1,83 +0,0 @@
-/**
- * MCP SDK Type Stubs
- * Temporary type definitions for @modelcontextprotocol/sdk
- */
-
-// Server types
-export interface ServerCapabilities {
-  tools?: Record<string, any>;
-}
-
-export interface ServerInfo {
-  name: string;
-  version: string;
-}
-
-export interface ServerOptions {
-  capabilities: ServerCapabilities;
-}
-
-export class Server {
-  constructor(info: ServerInfo, options: ServerOptions) {}
-  
-  setRequestHandler(schema: any, handler: (request: any) => Promise<any>): void {}
-  
-  async connect(transport: any): Promise<void> {}
-  
-  async close(): Promise<void> {}
-  
-  onerror?: (error: Error) => void;
-}
-
-export class StdioServerTransport {
-  constructor() {}
-}
-
-// Request/Response types
-export interface CallToolRequest {
-  params: {
-    name: string;
-    arguments: any;
-  };
-}
-
-export interface ListToolsRequest {
-  params?: any;
-}
-
-export const CallToolRequestSchema = Symbol('CallToolRequestSchema');
-export const ListToolsRequestSchema = Symbol('ListToolsRequestSchema');
-
-// Error types
-export enum ErrorCode {
-  InternalError = -32603,
-  InvalidParams = -32602,
-  MethodNotFound = -32601,
-  ParseError = -32700,
-  InvalidRequest = -32600
-}
-
-export class McpError extends Error {
-  constructor(public code: ErrorCode, message: string) {
-    super(message);
-    this.name = 'McpError';
-  }
-}
-
-// Tool types
-export interface Tool {
-  name: string;
-  description: string;
-  inputSchema: {
-    type: string;
-    properties?: Record<string, any>;
-    required?: string[];
-  };
-}
-
-export interface ToolResult {
-  content: Array<{
-    type: string;
-    text: string;
-  }>;
-}