rebar-mcp 2.2.0 → 2.4.1

package/.claude/settings.json

@@ -1,24 +1,54 @@
 {
-  "permissions": {
-    "allow": [
-      "Bash(npm run build)",
-      "Bash(npm run lint)",
-      "Bash(npm run test *)",
-      "Bash(npm run dev)",
-      "Bash(npx tsc --noEmit)",
-      "Bash(git status)",
-      "Bash(git diff *)",
-      "Bash(git log *)",
-      "Bash(git add *)",
-      "Bash(git commit *)"
-    ],
-    "deny": [
-      "Bash(rm -rf *)",
-      "Read(./.env)",
-      "Read(./.env.*)"
-    ]
-  },
   "hooks": {
+    "PostToolCall": [
+      {
+        "matcher": "Write(*.ts)|Write(*.tsx)|Write(*.js)|Write(*.jsx)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npm run format \"$CLAUDE_FILE_PATH\" 2>/dev/null || true"
+          }
+        ]
+      },
+      {
+        "matcher": "Write(*.ts)|Write(*.tsx)|Write(*.js)|Write(*.jsx)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "RESULT=$(npm run lint \"$CLAUDE_FILE_PATH\" 2>&1); EXITCODE=$?; if [ $EXITCODE -ne 0 ]; then echo \"$RESULT\" | head -20; echo '\\n❌ LINT ERRORS — Fix these before continuing.' >&2; exit 2; fi; exit 0"
+          }
+        ]
+      },
+      {
+        "matcher": "Write(*.ts)|Write(*.tsx)|Write(*.js)|Write(*.jsx)|Edit(*.ts)|Edit(*.tsx)|Edit(*.js)|Edit(*.jsx)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node --test dist/**/*.test.js 2>&1 | tail -10; EXIT_CODE=${PIPESTATUS[0]}; if [ $EXIT_CODE -ne 0 ]; then echo '\\n❌ TESTS FAILED — Fix failing tests before continuing. Do not move to the next task.' >&2; exit 2; fi; exit 0"
+          }
+        ]
+      }
+    ],
+    "PreToolCall": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "BLOCKED='rm -rf|rm -fr|git push --force|git push -f|DROP TABLE|DROP DATABASE|TRUNCATE TABLE|chmod -R 777'; if echo \"$CLAUDE_BASH_COMMAND\" | grep -qiE \"$BLOCKED\"; then echo 'BLOCKED: Destructive command detected. Ask the developer for explicit approval.' >&2; exit 2; fi; exit 0"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash(git commit*)|Bash(git add*)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "STAGED=$(git diff --cached --name-only 2>/dev/null); if [ -z \"$STAGED\" ]; then exit 0; fi; SECRETS=$(git diff --cached | grep -inE '(api[_-]?key|secret|password|token|private[_-]?key|aws_access|AKIA[A-Z0-9]{16})\\s*[:=]\\s*[\"\\x27]?[A-Za-z0-9+/=_-]{8,}' | head -5); if [ -n \"$SECRETS\" ]; then echo \"BLOCKED: Potential secrets in staged files:\" >&2; echo \"$SECRETS\" >&2; exit 2; fi; exit 0"
+          }
+        ]
+      }
+    ],
     "InvalidEvent": [
       {
         "description": "A test hook",

package/.claude/skills/bmmov0lh5xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bmmov0lh5xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+description: A test skill
+invocation: undefined
+context: undefined
+---
+
+# bmmov0lh5xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+A test skill
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/bmmovah7zxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bmmovah7zxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+description: A test skill
+invocation: undefined
+context: undefined
+---
+
+# bmmovah7zxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+A test skill
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/bmmovop8dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bmmovop8dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+description: A test skill
+invocation: undefined
+context: undefined
+---
+
+# bmmovop8dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+A test skill
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/bnd-mmov0lh8/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bnd-mmov0lh8
+description: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+invocation: undefined
+context: undefined
+---
+
+# bnd-mmov0lh8
+
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/bnd-mmovah83/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bnd-mmovah83
+description: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+invocation: undefined
+context: undefined
+---
+
+# bnd-mmovah83
+
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/bnd-mmovop8h/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: bnd-mmovop8h
+description: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+invocation: undefined
+context: undefined
+---
+
+# bnd-mmovop8h
+
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/nl-mmov0lhi/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: nl-mmov0lhi
+description: Line one
+Line two
+Line three
+invocation: undefined
+context: undefined
+---
+
+# nl-mmov0lhi
+
+Line one
+Line two
+Line three
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/nl-mmovah8b/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: nl-mmovah8b
+description: Line one
+Line two
+Line three
+invocation: undefined
+context: undefined
+---
+
+# nl-mmovah8b
+
+Line one
+Line two
+Line three
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.claude/skills/nl-mmovop8r/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: nl-mmovop8r
+description: Line one
+Line two
+Line three
+invocation: undefined
+context: undefined
+---
+
+# nl-mmovop8r
+
+Line one
+Line two
+Line three
+
+## Instructions
+
+<!-- Replace this with your skill instructions.
+Good skill instructions:
+1. Define the agent's role clearly
+2. Specify the exact output format
+3. List what to check/do step by step
+4. Include examples of good output
+-->
+

package/.rebar/prereview.json

@@ -0,0 +1,9 @@
+{
+  "enabled": true,
+  "tier": "pro",
+  "strictness": "strict",
+  "operations": ["write", "edit", "bash"],
+  "customRules": [],
+  "auditEnabled": true,
+  "auditRetentionDays": 90
+}

package/CLAUDE.md

@@ -1,76 +1,26 @@
 # rebar-mcp
 
-## Project Overview
-Reinforcement for AI-generated code. An MCP server that generates, validates, and manages Claude Code configuration artifacts (CLAUDE.md, skills, agents, hooks, commands, MCP configs, knowledge docs) with enforcement hooks that prevent AI coding tools from shipping broken code.
+Reinforcement for AI-generated code. Enforcement hooks, quality audits, and opinionated templates that prevent AI coding tools from shipping broken code.
 
 ## Tech Stack
-- TypeScript (strict mode) targeting ES2022
-- Node.js 18+ runtime
-- @modelcontextprotocol/sdk for MCP server
-- Zod for input validation
-- stdio transport (primary), streamable HTTP (secondary)
+- TypeScript (strict mode)
 
 ## Architecture Rules
-- ALWAYS use server.registerTool() (never deprecated server.tool())
-- All tool names use rebar_ prefix with snake_case
-- All Zod schemas use .strict() enforcement
-- No use of `any` type — use `unknown` or proper types
-- All async functions have explicit Promise<T> return types
-- Log to stderr ONLY (stdout is reserved for MCP protocol)
-- Never use console.log() — use console.error() for debug output
-- All file writes are atomic (write to temp, then rename)
-- Never overwrite files without checking merge_existing flag
-
-## Tool Annotations
-Every tool MUST include annotations:
-- readOnlyHint: true for read operations, false for writes
-- destructiveHint: false (we never delete without explicit request)
-- idempotentHint: true if re-running produces same result
-- openWorldHint: false (we only touch local filesystem)
-
-## File Structure
-- src/index.ts          — Entry point, server init, transport
-- src/types.ts          — Shared TypeScript interfaces
-- src/constants.ts      — Enums, defaults, limits
-- src/tools/*.ts        — Tool implementations (one file per domain)
-- src/services/*.ts     — Shared utilities (file ops, templates, validation)
-- src/schemas/*.ts      — Zod schemas
-- templates/**/*.md     — Raw template files
+- No use of `any` type — use `unknown` with type narrowing or proper generics
+- Prefer `interface` for object shapes, `type` for unions and intersections
+- Never store secrets in code, config files, or version control
+- All external data (user input, API responses, env vars) must be validated before use
 
 ## Build & Test
-- Build: `npm run build` (must pass with zero errors)
-- Lint: `npx tsc --noEmit`
-- Test: `npm run test`
-- Dev: `npx tsx src/index.ts` (for local MCP testing)
-
-## Template Conventions
-- Variables: `{{variable_name}}` (double curly braces)
-- Conditionals: `{{#if condition}}...{{/if}}`
-- Templates are plain markdown with substitution markers
-- All generated YAML must parse cleanly
-- All generated JSON must be valid
-- Skills MUST have name (max 64 chars) and description (max 200 chars)
+- Build: `npm run build` (runs: `tsc`)
+- Test: `npm run test` (runs: `node --test dist/**/*.test.js`)
 
-## Code Quality
-- Extract common functionality into src/services/
-- DRY: if logic appears twice, extract to a function
-- Every tool description includes: purpose, args, return schema, examples
-- Error messages suggest next steps (not just what failed)
-- No hardcoded paths — use path.join() and respect project_path input
-
-## MCP Server Best Practices
-- Use Zod schemas with .describe() on every field for self-documenting APIs
-- Tool descriptions must include: purpose summary, all args with types, return schema with field descriptions, 2-3 usage examples, and error handling notes
-- Support both JSON and Markdown response formats where applicable
-- Paginate list results with has_more, next_offset, total_count
-- Return { isError: true, content: [...] } for recoverable errors with actionable suggestions
-
-## Implementation Priority
-1. src/index.ts + transport setup
-2. src/services/ (file-ops, template-engine, validation)
-3. src/types.ts + src/constants.ts + src/schemas/
-4. src/tools/scaffolding.ts (init_project, generate_claudemd, create_skill, create_agent, create_hook, create_command)
-5. templates/ (CLAUDE.md templates, skill templates, agent templates, hook templates)
-6. src/tools/knowledge.ts (create_knowledge, create_adr)
-7. src/tools/management.ts (list_artifacts, validate_config, audit_context)
-8. src/tools/enterprise.ts (apply_compliance, create_ci_workflow, create_security_hook, generate_mcp_config)
+## File Structure
+- `src/` — Source code
+
+## Code Conventions
+- TypeScript strict mode with no `any` types
+- Prefer named exports over default exports
+- Interface names: `PascalCase` (no `I` prefix)
+- Constants: `UPPER_SNAKE_CASE`
+- Zod schemas for runtime validation of external data

package/README.md

@@ -271,6 +271,193 @@ npx rebar-mcp prereview-rules --add "pattern=TODO" --severity warning
 
 ---
 
+## LLM-Powered Semantic Analysis (Pro/Team)
+
+Local regex patterns catch obvious issues. LLM review catches the hard stuff:
+
+| Issue Type | Local (Free) | LLM (Paid) |
+|------------|--------------|------------|
+| Hardcoded secrets | ✓ | ✓ |
+| Dangerous commands | ✓ | ✓ |
+| N+1 query patterns | ✗ | ✓ |
+| Race conditions | ✗ | ✓ |
+| Business logic violations | ✗ | ✓ |
+| Architecture drift | ✗ | ✓ |
+| Context-aware review | ✗ | ✓ |
+
+### Setup
+
+```bash
+# Set your Anthropic API key
+export REBAR_API_KEY=sk-ant-...
+
+# Choose your tier
+export REBAR_TIER=pro   # 1,000 LLM reviews/month
+# or
+export REBAR_TIER=team  # 5,000 LLM reviews/month
+```
+
+### How It Works
+
+1. **Context Building** — Extracts CLAUDE.md rules, recent blocks, and project conventions
+2. **Hybrid Review** — Runs local patterns first, then LLM for deeper analysis
+3. **Learning** — Records blocked patterns for future reference
+4. **Fallback** — Gracefully falls back to local if LLM unavailable
+
+```bash
+# Check license status
+npx rebar-mcp license
+```
+
+---
+
+## Cross-Session Memory
+
+Rebar learns from your project's decision history and applies that knowledge to future reviews.
+
+### What Gets Learned
+
+- **Pattern Frequency** — Patterns blocked 5+ times escalate from warning to critical
+- **Project Insights** — Common issues in specific directories
+- **Review Statistics** — Block rates, latency metrics
+
+### Commands
+
+```bash
+# View current memory
+npx rebar-mcp memory show
+
+# Learn from decision history
+npx rebar-mcp memory learn
+
+# Clear memory (start fresh)
+npx rebar-mcp memory clear
+
+# Export memory as JSON
+npx rebar-mcp memory export
+```
+
+### Memory Storage
+
+Memory is persisted to `.rebar/memory.json`:
+
+```json
+{
+  "version": 1,
+  "learnedPatterns": [
+    {
+      "id": "aws-key",
+      "name": "AWS Access Key",
+      "blockCount": 12,
+      "severity": "critical",
+      "lastSeen": "2024-01-15T14:30:00Z"
+    }
+  ],
+  "projectInsights": [
+    {
+      "id": "api-dir-issues",
+      "description": "src/api/ frequently has SQL injection patterns",
+      "affectedFiles": ["src/api/users.ts", "src/api/orders.ts"],
+      "confidence": 0.85
+    }
+  ]
+}
+```
+
+---
+
+## Analytics Dashboard
+
+Analyze trends and generate insights from your pre-review history.
+
+```bash
+# Last 30 days (default)
+npx rebar-mcp analytics
+
+# Last 7 days
+npx rebar-mcp analytics 7
+
+# JSON export for dashboards
+npx rebar-mcp analytics --format json
+```
+
+### Sample Output
+
+```
+Pre-Review Analytics Report
+===========================
+
+Period: 2024-01-01 to 2024-01-31 (30 days)
+
+Summary
+-------
+Total reviews: 247
+Blocked: 23 (9.3%)
+Warned: 41 (16.6%)
+Approved: 183
+
+Performance
+-----------
+Avg latency: 45ms
+P50 latency: 32ms
+P95 latency: 156ms
+
+Top Patterns
+------------
+  ↑ AWS Access Key: 12x (0.4/day)
+  → Empty Catch Block: 8x (0.3/day)
+  ↓ any Type Usage: 5x (0.2/day)
+
+Recent Activity (last 7 days)
+-----------------------------
+  2024-01-25: ████ 4 (1B/0W)
+  2024-01-26: ██████████ 10 (2B/3W)
+  2024-01-27: ████████ 8 (1B/2W)
+
+Insights
+--------
+  • Low block rate (9.3%) - code quality is good!
+  • "AWS Access Key" is trending upward - review recent code
+  • Excellent review speed: 45ms average
+```
+
+---
+
+## Pricing Tiers
+
+| Feature | Free | Pro ($19/mo) | Team ($49/user/mo) |
+|---------|------|--------------|-------------------|
+| Regex patterns | Unlimited | Unlimited | Unlimited |
+| LLM reviews | 0 | 1,000/month | 5,000/month |
+| Cross-session memory | ✗ | ✓ | ✓ |
+| Analytics | Basic | Full | Full |
+| Audit retention | 7 days | 90 days | 1 year |
+| Support | Community | Email | Priority |
+
+---
+
+## CLI Reference
+
+```bash
+rebar init [options]          # Initialize Rebar enforcement
+rebar audit [options]         # Run quality audit
+rebar doctor [options]        # Check setup health
+rebar set-strictness <level>  # Change enforcement level
+rebar metrics [options]       # View quality score history
+rebar badge [options]         # Generate quality badge SVG
+
+# Pre-Review
+rebar prereview [options]     # Run pre-review (invoked by hooks)
+rebar prereview-stats         # View decision statistics
+
+# LLM & Memory
+rebar license                 # View license and usage
+rebar memory [action]         # Manage cross-session memory
+rebar analytics [days]        # View trends and insights
+```
+
+---
+
 ## License
 
 MIT

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAg2BA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAmH5D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAijCA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwI5D"}