rebar-mcp 2.2.0 → 2.4.0

package/.claude/settings.json

@@ -1,24 +1,54 @@
 {
-  "permissions": {
-    "allow": [
-      "Bash(npm run build)",
-      "Bash(npm run lint)",
-      "Bash(npm run test *)",
-      "Bash(npm run dev)",
-      "Bash(npx tsc --noEmit)",
-      "Bash(git status)",
-      "Bash(git diff *)",
-      "Bash(git log *)",
-      "Bash(git add *)",
-      "Bash(git commit *)"
-    ],
-    "deny": [
-      "Bash(rm -rf *)",
-      "Read(./.env)",
-      "Read(./.env.*)"
-    ]
-  },
   "hooks": {
+    "PostToolCall": [
+      {
+        "matcher": "Write(*.ts)|Write(*.tsx)|Write(*.js)|Write(*.jsx)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npm run format \"$CLAUDE_FILE_PATH\" 2>/dev/null || true"
+          }
+        ]
+      },
+      {
+        "matcher": "Write(*.ts)|Write(*.tsx)|Write(*.js)|Write(*.jsx)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "RESULT=$(npm run lint \"$CLAUDE_FILE_PATH\" 2>&1); EXITCODE=$?; if [ $EXITCODE -ne 0 ]; then echo \"$RESULT\" | head -20; echo '\\n❌ LINT ERRORS — Fix these before continuing.' >&2; exit 2; fi; exit 0"
+          }
+        ]
+      },
+      {
+        "matcher": "Write(*.ts)|Write(*.tsx)|Write(*.js)|Write(*.jsx)|Edit(*.ts)|Edit(*.tsx)|Edit(*.js)|Edit(*.jsx)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node --test dist/**/*.test.js 2>&1 | tail -10; EXIT_CODE=${PIPESTATUS[0]}; if [ $EXIT_CODE -ne 0 ]; then echo '\\n❌ TESTS FAILED — Fix failing tests before continuing. Do not move to the next task.' >&2; exit 2; fi; exit 0"
+          }
+        ]
+      }
+    ],
+    "PreToolCall": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "BLOCKED='rm -rf|rm -fr|git push --force|git push -f|DROP TABLE|DROP DATABASE|TRUNCATE TABLE|chmod -R 777'; if echo \"$CLAUDE_BASH_COMMAND\" | grep -qiE \"$BLOCKED\"; then echo 'BLOCKED: Destructive command detected. Ask the developer for explicit approval.' >&2; exit 2; fi; exit 0"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash(git commit*)|Bash(git add*)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "STAGED=$(git diff --cached --name-only 2>/dev/null); if [ -z \"$STAGED\" ]; then exit 0; fi; SECRETS=$(git diff --cached | grep -inE '(api[_-]?key|secret|password|token|private[_-]?key|aws_access|AKIA[A-Z0-9]{16})\\s*[:=]\\s*[\"\\x27]?[A-Za-z0-9+/=_-]{8,}' | head -5); if [ -n \"$SECRETS\" ]; then echo \"BLOCKED: Potential secrets in staged files:\" >&2; echo \"$SECRETS\" >&2; exit 2; fi; exit 0"
+          }
+        ]
+      }
+    ],
     "InvalidEvent": [
       {
         "description": "A test hook",

package/.claude/skills/bmmov0lh5xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bmmov0lh5xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+description: A test skill
+invocation: undefined
+context: undefined
+---
+
+# bmmov0lh5xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+A test skill
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/bmmovah7zxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bmmovah7zxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+description: A test skill
+invocation: undefined
+context: undefined
+---
+
+# bmmovah7zxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+A test skill
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/bnd-mmov0lh8/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bnd-mmov0lh8
+description: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+invocation: undefined
+context: undefined
+---
+
+# bnd-mmov0lh8
+
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/bnd-mmovah83/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bnd-mmovah83
+description: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+invocation: undefined
+context: undefined
+---
+
+# bnd-mmovah83
+
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/nl-mmov0lhi/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: nl-mmov0lhi
+description: Line one
+Line two
+Line three
+invocation: undefined
+context: undefined
+---
+
+# nl-mmov0lhi
+
+Line one
+Line two
+Line three
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/nl-mmovah8b/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: nl-mmovah8b
+description: Line one
+Line two
+Line three
+invocation: undefined
+context: undefined
+---
+
+# nl-mmovah8b
+
+Line one
+Line two
+Line three
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.rebar/prereview.json

@@ -0,0 +1,9 @@
+{
+  "enabled": true,
+  "tier": "pro",
+  "strictness": "strict",
+  "operations": ["write", "edit", "bash"],
+  "customRules": [],
+  "auditEnabled": true,
+  "auditRetentionDays": 90
+}

package/CLAUDE.md

@@ -1,76 +1,26 @@
 # rebar-mcp
 
-## Project Overview
-Reinforcement for AI-generated code. An MCP server that generates, validates, and manages Claude Code configuration artifacts (CLAUDE.md, skills, agents, hooks, commands, MCP configs, knowledge docs) with enforcement hooks that prevent AI coding tools from shipping broken code.
+Reinforcement for AI-generated code. Enforcement hooks, quality audits, and opinionated templates that prevent AI coding tools from shipping broken code.
 
 ## Tech Stack
-- TypeScript (strict mode) targeting ES2022
-- Node.js 18+ runtime
-- @modelcontextprotocol/sdk for MCP server
-- Zod for input validation
-- stdio transport (primary), streamable HTTP (secondary)
+- TypeScript (strict mode)
 
 ## Architecture Rules
-- ALWAYS use server.registerTool() (never deprecated server.tool())
-- All tool names use rebar_ prefix with snake_case
-- All Zod schemas use .strict() enforcement
-- No use of `any` type — use `unknown` or proper types
-- All async functions have explicit Promise<T> return types
-- Log to stderr ONLY (stdout is reserved for MCP protocol)
-- Never use console.log() — use console.error() for debug output
-- All file writes are atomic (write to temp, then rename)
-- Never overwrite files without checking merge_existing flag
-
-## Tool Annotations
-Every tool MUST include annotations:
-- readOnlyHint: true for read operations, false for writes
-- destructiveHint: false (we never delete without explicit request)
-- idempotentHint: true if re-running produces same result
-- openWorldHint: false (we only touch local filesystem)
-
-## File Structure
-- src/index.ts          — Entry point, server init, transport
-- src/types.ts          — Shared TypeScript interfaces
-- src/constants.ts      — Enums, defaults, limits
-- src/tools/*.ts        — Tool implementations (one file per domain)
-- src/services/*.ts     — Shared utilities (file ops, templates, validation)
-- src/schemas/*.ts      — Zod schemas
-- templates/**/*.md     — Raw template files
+- No use of `any` type — use `unknown` with type narrowing or proper generics
+- Prefer `interface` for object shapes, `type` for unions and intersections
+- Never store secrets in code, config files, or version control
+- All external data (user input, API responses, env vars) must be validated before use
 
 ## Build & Test
-- Build: `npm run build` (must pass with zero errors)
-- Lint: `npx tsc --noEmit`
-- Test: `npm run test`
-- Dev: `npx tsx src/index.ts` (for local MCP testing)
-
-## Template Conventions
-- Variables: `{{variable_name}}` (double curly braces)
-- Conditionals: `{{#if condition}}...{{/if}}`
-- Templates are plain markdown with substitution markers
-- All generated YAML must parse cleanly
-- All generated JSON must be valid
-- Skills MUST have name (max 64 chars) and description (max 200 chars)
+- Build: `npm run build` (runs: `tsc`)
+- Test: `npm run test` (runs: `node --test dist/**/*.test.js`)
 
-## Code Quality
-- Extract common functionality into src/services/
-- DRY: if logic appears twice, extract to a function
-- Every tool description includes: purpose, args, return schema, examples
-- Error messages suggest next steps (not just what failed)
-- No hardcoded paths — use path.join() and respect project_path input
-
-## MCP Server Best Practices
-- Use Zod schemas with .describe() on every field for self-documenting APIs
-- Tool descriptions must include: purpose summary, all args with types, return schema with field descriptions, 2-3 usage examples, and error handling notes
-- Support both JSON and Markdown response formats where applicable
-- Paginate list results with has_more, next_offset, total_count
-- Return { isError: true, content: [...] } for recoverable errors with actionable suggestions
-
-## Implementation Priority
-1. src/index.ts + transport setup
-2. src/services/ (file-ops, template-engine, validation)
-3. src/types.ts + src/constants.ts + src/schemas/
-4. src/tools/scaffolding.ts (init_project, generate_claudemd, create_skill, create_agent, create_hook, create_command)
-5. templates/ (CLAUDE.md templates, skill templates, agent templates, hook templates)
-6. src/tools/knowledge.ts (create_knowledge, create_adr)
-7. src/tools/management.ts (list_artifacts, validate_config, audit_context)
-8. src/tools/enterprise.ts (apply_compliance, create_ci_workflow, create_security_hook, generate_mcp_config)
+## File Structure
+- `src/` — Source code
+
+## Code Conventions
+- TypeScript strict mode with no `any` types
+- Prefer named exports over default exports
+- Interface names: `PascalCase` (no `I` prefix)
+- Constants: `UPPER_SNAKE_CASE`
+- Zod schemas for runtime validation of external data

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAg2BA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAmH5D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAshCA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgI5D"}

package/dist/cli.js

@@ -21,7 +21,10 @@ import { generateCodexConfig } from "./services/codex-generator.js";
 import { atomicWrite } from "./services/file-ops.js";
 import { CONTEXT_WINDOW_TOKENS } from "./constants.js";
 import { runPrereview, loadPrereviewConfig, } from "./services/prereview-engine.js";
-const VERSION = "2.0.0";
+import { runHybridPrereview } from "./services/prereview-llm.js";
+import { loadLicense, loadUsage, canUseLLMReview } from "./services/license.js";
+import { loadMemory, clearMemory, learnFromHistory, exportMemorySummary, } from "./services/prereview-memory.js";
+const VERSION = "2.4.0";
 function parseArgs(args) {
     const options = {
         path: ".",
@@ -555,8 +558,20 @@ async function cmdPrereview(options, operation, filePath, command) {
     if (!content) {
         return 0;
     }
-    // Run pre-review
-    const result = runPrereview(content, op, filePath, config);
+    // Run local pre-review first
+    const localResult = runPrereview(content, op, filePath, config);
+    // Try hybrid review (LLM + local) if tier supports it
+    let result = localResult;
+    let engine = "local";
+    if (config.tier !== "free") {
+        const hybridResult = await runHybridPrereview(projectPath, op, filePath || "", content, undefined, // existingContent for diffs
+        localResult);
+        // Check if LLM was actually used
+        if ("engine" in hybridResult && hybridResult.engine === "llm") {
+            engine = "hybrid";
+            result = hybridResult;
+        }
+    }
     // Write to audit trail
     if (config.auditEnabled) {
         const now = new Date();
@@ -578,7 +593,7 @@ async function cmdPrereview(options, operation, filePath, command) {
             decision: result.decision,
             severity: result.severity,
             tier: config.tier,
-            engine: "local",
+            engine,
             latencyMs: result.latencyMs,
             patterns: result.patterns.map((p) => ({
                 id: p.id,
@@ -686,9 +701,143 @@ async function cmdPrereviewStats(options) {
                 console.log(`  • ${name}: ${count}`);
             }
         }
+        // Show LLM usage info
+        const license = await loadLicense(projectPath);
+        const usage = await loadUsage(projectPath);
+        console.log();
+        console.log("LLM Review Usage");
+        console.log("----------------");
+        console.log(`Tier: ${license.tier}`);
+        console.log(`LLM reviews this month: ${usage.llmReviews}/${license.monthlyLimit || "∞"}`);
+        const llmCheck = await canUseLLMReview(projectPath);
+        if (!llmCheck.allowed) {
+            console.log(`Status: ${llmCheck.reason}`);
+        }
+        else {
+            console.log(`Remaining: ${llmCheck.remaining}`);
+        }
     }
     return 0;
 }
+async function cmdLicense(options) {
+    const projectPath = resolveProjectPath(options.path);
+    const license = await loadLicense(projectPath);
+    const usage = await loadUsage(projectPath);
+    const llmCheck = await canUseLLMReview(projectPath);
+    if (options.format === "json") {
+        console.log(JSON.stringify({
+            tier: license.tier,
+            features: license.features,
+            usage: {
+                llmReviews: usage.llmReviews,
+                localReviews: usage.localReviews,
+                blockedCount: usage.blockedCount,
+                month: usage.month,
+            },
+            limits: {
+                monthlyLimit: license.monthlyLimit,
+                remaining: llmCheck.remaining,
+            },
+            llmAvailable: llmCheck.allowed,
+            reason: llmCheck.reason,
+        }, null, 2));
+    }
+    else {
+        console.log("Rebar License Status");
+        console.log("====================");
+        console.log();
+        console.log(`Tier: ${license.tier.toUpperCase()}`);
+        console.log();
+        console.log("Features:");
+        console.log(`  • LLM Review: ${license.features.llmReview ? "✓" : "✗"}`);
+        console.log(`  • Cross-session Memory: ${license.features.crossSessionMemory ? "✓" : "✗"}`);
+        console.log(`  • Audit Retention: ${license.features.auditRetentionDays} days`);
+        console.log();
+        console.log(`Usage (${usage.month}):`);
+        console.log(`  • LLM Reviews: ${usage.llmReviews}/${license.monthlyLimit || "N/A"}`);
+        console.log(`  • Local Reviews: ${usage.localReviews}`);
+        console.log(`  • Blocked: ${usage.blockedCount}`);
+        console.log();
+        if (llmCheck.allowed) {
+            console.log(`LLM Status: Available (${llmCheck.remaining} reviews remaining)`);
+        }
+        else {
+            console.log(`LLM Status: ${llmCheck.reason}`);
+        }
+        if (license.tier === "free") {
+            console.log();
+            console.log("Upgrade to Pro for LLM-powered semantic analysis:");
+            console.log("  export REBAR_API_KEY=your_anthropic_key");
+            console.log("  export REBAR_TIER=pro");
+        }
+    }
+    return 0;
+}
+async function cmdMemory(options, action) {
+    const projectPath = resolveProjectPath(options.path);
+    switch (action) {
+        case "show":
+        case "": {
+            const memory = await loadMemory(projectPath);
+            if (options.format === "json") {
+                console.log(await exportMemorySummary(projectPath));
+            }
+            else {
+                console.log("Pre-Review Memory");
+                console.log("=================");
+                console.log();
+                console.log(`Last updated: ${memory.updatedAt}`);
+                console.log();
+                console.log("Statistics:");
+                console.log(`  • Total reviews: ${memory.stats.totalReviews}`);
+                console.log(`  • Blocks: ${memory.stats.totalBlocks}`);
+                console.log(`  • Warnings: ${memory.stats.totalWarns}`);
+                console.log(`  • Avg latency: ${memory.stats.avgLatencyMs.toFixed(0)}ms`);
+                console.log();
+                if (memory.learnedPatterns.length > 0) {
+                    console.log("Learned Patterns:");
+                    const topPatterns = memory.learnedPatterns
+                        .sort((a, b) => b.blockCount - a.blockCount)
+                        .slice(0, 5);
+                    for (const p of topPatterns) {
+                        console.log(`  • ${p.name} (${p.blockCount}x, ${p.severity})`);
+                    }
+                    console.log();
+                }
+                if (memory.projectInsights.length > 0) {
+                    console.log("Project Insights:");
+                    const topInsights = memory.projectInsights
+                        .filter((i) => i.confidence >= 0.7)
+                        .slice(0, 3);
+                    for (const i of topInsights) {
+                        console.log(`  • ${i.description}`);
+                    }
+                }
+            }
+            return 0;
+        }
+        case "learn": {
+            console.log("Learning from decision history...");
+            const result = await learnFromHistory(projectPath);
+            console.log(`✓ Learned ${result.patternsLearned} patterns`);
+            console.log(`✓ Generated ${result.insightsGenerated} insights`);
+            return 0;
+        }
+        case "clear": {
+            await clearMemory(projectPath);
+            console.log("✓ Memory cleared");
+            return 0;
+        }
+        case "export": {
+            console.log(await exportMemorySummary(projectPath));
+            return 0;
+        }
+        default:
+            console.error(`Unknown memory action: ${action}`);
+            console.error("Usage: rebar memory [show|learn|clear|export]");
+            return 1;
+    }
+}
 async function cmdBadge(options) {
     const projectPath = resolveProjectPath(options.path);
     // Run audit to get current score
@@ -825,6 +974,10 @@ export async function runCLI(args) {
         }
         case "prereview-stats":
             return cmdPrereviewStats(options);
+        case "license":
+            return cmdLicense(options);
+        case "memory":
+            return cmdMemory(options, positional[0] || "show");
         case "version":
         case "--version":
         case "-v":
@@ -845,6 +998,8 @@ Usage:
   rebar badge [options]         Generate quality score badge SVG
   rebar prereview [options]     Run pre-review analysis (invoked by hooks)
   rebar prereview-stats         View pre-review decision statistics
+  rebar license                 View license status and LLM usage
+  rebar memory [action]         Manage cross-session memory (show|learn|clear|export)
   rebar version                 Print version
   rebar help                    Show this help
 
@@ -870,7 +1025,12 @@ Examples:
 Strictness Levels:
   standard  - Notify on issues (tests, lint, secrets)
   strict    - Block on test/lint failures
-  paranoid  - Block + file size limits + TODO guards`);
+  paranoid  - Block + file size limits + TODO guards
+
+LLM Review (Pro/Team tier):
+  export REBAR_API_KEY=your_anthropic_key
+  export REBAR_TIER=pro   # 1,000 LLM reviews/month
+  export REBAR_TIER=team  # 5,000 LLM reviews/month`);
             return 0;
         default:
             console.error(`Unknown command: ${command}`);