rovecode 0.4.0-beta.2 → 0.4.0

package/src/mcp/tools.ts

@@ -0,0 +1,131 @@
+/** The lazy-disclosure seam (port #3): exactly TWO house tools are ever
+ *  advertised to the model, regardless of how many MCP servers/tools exist.
+ *  mcp_list returns a compact one-line-per-tool index (schemas on demand via a
+ *  {schema:true} flag); mcp_call executes. Full server schemas never enter the
+ *  system prompt — that is the ~0 idle-token invariant. */
+
+import type { Tool, ToolContext, ToolOutput } from "../core/types.ts";
+import type { McpManager } from "./client.ts";
+
+const DESC_MAX = 60;
+const SCHEMA_MAX = 1_500;
+
+/** First line of a description, hard-capped for the index. */
+function compact(desc: string): string {
+  const line = (desc.split("\n", 1)[0] ?? "").trim();
+  return line.length <= DESC_MAX ? line : `${line.slice(0, DESC_MAX - 1)}…`;
+}
+
+function renderSchema(schema: object): string {
+  const rendered = JSON.stringify(schema);
+  return rendered.length > SCHEMA_MAX ? `${rendered.slice(0, SCHEMA_MAX)}…` : rendered;
+}
+
+interface McpListArgs {
+  server?: string;
+  tool?: string;
+  schema?: boolean;
+}
+
+interface McpCallArgs {
+  server?: string;
+  tool?: string;
+  args?: unknown;
+}
+
+/** Build the two house tools bound to a manager. Always exactly [mcp_list, mcp_call]. */
+export function createMcpTools(manager: McpManager): Tool[] {
+  const list: Tool = {
+    schema: {
+      name: "mcp_list",
+      description:
+        "List tools on connected MCP servers as 'server/tool — description'. " +
+        "With {server, tool, schema:true} returns that one tool's full JSON input schema.",
+      args: {
+        type: "object",
+        properties: {
+          server: { type: "string", description: "only list this server" },
+          tool: { type: "string", description: "tool name (for schema lookup)" },
+          schema: { type: "boolean", description: "return the full input schema for server+tool" },
+        },
+        additionalProperties: false,
+      },
+    },
+    kind: "read",
+    sequential: false,
+    async execute(rawArgs: unknown, ctx: ToolContext): Promise<ToolOutput> {
+      const a = (rawArgs ?? {}) as McpListArgs;
+      const server = typeof a.server === "string" && a.server.length > 0 ? a.server : undefined;
+      const tool = typeof a.tool === "string" && a.tool.length > 0 ? a.tool : undefined;
+
+      // schema mode: full JSON schema for exactly one tool, on demand
+      if (a.schema === true || tool !== undefined) {
+        if (server === undefined || tool === undefined) {
+          return { ok: false, output: "schema lookup needs both server and tool, e.g. {server:\"x\", tool:\"y\", schema:true}" };
+        }
+        const schema = await manager.toolSchema(server, tool, ctx.signal);
+        if (schema === undefined) {
+          return { ok: false, output: `no schema for "${tool}" on "${server}" (unknown tool or server not connected); run mcp_list first` };
+        }
+        return { ok: true, output: `input schema for ${server}/${tool}: ${renderSchema(schema)}`, data: schema };
+      }
+
+      // index mode: compact one-liners only
+      const tools = await manager.listTools(false, ctx.signal);
+      const filtered = server === undefined ? tools : tools.filter((t) => t.server === server);
+      if (filtered.length === 0) {
+        const connected = manager.connectedNames();
+        if (server !== undefined && !connected.includes(server)) {
+          return { ok: false, output: `MCP server "${server}" is not connected. Connected: ${connected.length > 0 ? connected.join(", ") : "(none)"}` };
+        }
+        return { ok: true, output: connected.length === 0 ? "no MCP servers connected" : "no tools advertised by connected MCP servers" };
+      }
+      const lines = filtered.map((t) => `${t.server}/${t.name} — ${compact(t.description)}`);
+      lines.push("", "call with mcp_call {server, tool, args}; arg schema via mcp_list {server, tool, schema:true}");
+      return { ok: true, output: lines.join("\n"), data: filtered };
+    },
+  };
+
+  const call: Tool = {
+    schema: {
+      name: "mcp_call",
+      description:
+        "Call a tool on a connected MCP server. Discover names with mcp_list; " +
+        "on argument errors the tool's input schema is included so you can retry.",
+      args: {
+        type: "object",
+        properties: {
+          server: { type: "string", description: "MCP server name" },
+          tool: { type: "string", description: "tool name on that server" },
+          args: { type: "object", description: "arguments matching the tool's input schema" },
+        },
+        required: ["server", "tool"],
+        additionalProperties: false,
+      },
+    },
+    kind: "custom", // policy maps this to action "tool.mcp_call" (prompt-gated by default)
+    interruptible: true,
+    async execute(rawArgs: unknown, ctx: ToolContext): Promise<ToolOutput> {
+      const a = (rawArgs ?? {}) as McpCallArgs;
+      const server = typeof a.server === "string" && a.server.length > 0 ? a.server : undefined;
+      const tool = typeof a.tool === "string" && a.tool.length > 0 ? a.tool : undefined;
+      if (server === undefined || tool === undefined) {
+        return { ok: false, output: 'mcp_call requires string "server" and "tool" (discover them with mcp_list)' };
+      }
+
+      const res = await manager.callTool(server, tool, a.args, ctx.signal, ctx.onUpdate);
+      if (res.ok) return { ok: true, output: res.output };
+
+      // validation-error path: attach the input schema (cache-hot after the call
+      // above) so the model can self-correct without a discovery round-trip.
+      let output = res.output;
+      if (!ctx.signal.aborted) {
+        const schema = await manager.toolSchema(server, tool, ctx.signal);
+        if (schema !== undefined) output += `\n\ninput schema for ${server}/${tool}: ${renderSchema(schema)}`;
+      }
+      return { ok: false, output };
+    },
+  };
+
+  return [list, call];
+}

package/src/mcp/trust.ts

@@ -0,0 +1,49 @@
+/** Trust for PROJECT MCP files (.rovecode/mcp.json, .mcp.json) — the same store and the same bar as project
+ *  plugins (plugins/state.ts): ~/.rovecode/plugins.json `trusted`, keyed by the file's absolute path, value =
+ *  sha256 of its bytes. The store lives in the USER home, so a repo cannot trust itself; any edit to the file
+ *  changes the digest and the gate asks again. An untrusted file contributes NOTHING (config.ts loadMcpConfig
+ *  skips it with one warning) — absence, not "loaded but marked". Berkay's choice on top of the gate: files
+ *  he writes himself through `mcp add --project` / `mcp remove --project` are trusted the moment he approves
+ *  them (market-install.ts records the digest right after the write); hand-edited and cloned files ask. */
+
+import { existsSync } from "node:fs";
+import { loadState, saveState, trustKey, type PluginState } from "../plugins/state.ts";
+import { fileDigest, mcpConfigFiles } from "./config.ts";
+
+export { fileDigest };
+
+/** the predicate loadMcpConfig takes: is THIS content of THIS file approved on this machine */
+export function trustedPredicate(state: PluginState): (file: string, digest: string) => boolean {
+  return (file, digest) => state.trusted[trustKey(file)] === digest;
+}
+
+export type TrustStatus = "trusted" | "untrusted" | "absent";
+export function mcpTrustStatus(home: string, file: string): TrustStatus {
+  const digest = fileDigest(file);
+  if (digest === undefined) return "absent";
+  return trustedPredicate(loadState(home))(file, digest) ? "trusted" : "untrusted";
+}
+
+/** record the file's CURRENT bytes as approved; an absent file only loses any stale entry */
+export function trustMcpFile(home: string, file: string): { ok: true; digest: string } | { ok: false; reason: string } {
+  const state = loadState(home);
+  const digest = fileDigest(file);
+  if (digest === undefined) { delete state.trusted[trustKey(file)]; saveState(home, state); return { ok: false, reason: `${file}: no such file` }; }
+  state.trusted[trustKey(file)] = digest;
+  saveState(home, state);
+  return { ok: true, digest };
+}
+
+export function untrustMcpFile(home: string, file: string): boolean {
+  const state = loadState(home);
+  const had = trustKey(file) in state.trusted;
+  delete state.trusted[trustKey(file)];
+  saveState(home, state);
+  return had;
+}
+
+/** the project files that exist in this checkout — what `mcp trust` / `mcp show` act on */
+export function projectMcpFiles(cwd: string): string[] {
+  const f = mcpConfigFiles(cwd);
+  return [f.harvest, f.project].filter((p) => existsSync(p));
+}

package/src/memory/blocks.ts

@@ -0,0 +1,175 @@
+/** Bounded markdown memory blocks (hermes pattern): MEMORY.md + USER.md with hard char caps.
+ *  The snapshot is frozen at session start (constructor) so the system prompt stays
+ *  cache-stable; tools mutate live state + disk only. A threat-scan neutralizes injection
+ *  lines in the rendered view — raw text on disk is never rewritten by the scan. */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { VersionLedger } from "../skills/versioned.ts";
+
+export type BlockName = "memory" | "user";
+
+export interface BlockCaps { memory: number; user: number }
+
+export const defaultCaps: BlockCaps = { memory: 2_200, user: 1_375 };
+
+export interface BlockEditResult {
+  ok: boolean;
+  reason?: string;
+  /** present on cap failures: current chars / cap */
+  current?: number;
+  limit?: number;
+  /** present on version conflicts: ledger numbers for logs/data surfaces only —
+   *  the model-facing `reason` stays generic (ouroboros: no ledger internals). */
+  conflict?: { baseVersion: number; currentVersion: number };
+}
+
+/** Model-facing conflict reason — deliberately free of ledger internals. */
+export const CONFLICT_REASON = "memory changed since it was read — re-read and retry";
+
+const THREAT = /(?:ignore previous|disregard above|system prompt)/i;
+
+function scan(text: string): string {
+  return text.split("\n").map((l) => (THREAT.test(l) ? "[BLOCKED]" : l)).join("\n");
+}
+
+function occurrences(haystack: string, needle: string): number {
+  if (!needle) return 0;
+  let n = 0;
+  let i = 0;
+  while ((i = haystack.indexOf(needle, i)) !== -1) { n++; i += needle.length; }
+  return n;
+}
+
+export class BlockStore {
+  private live: Record<BlockName, string> = { memory: "", user: "" };
+  private readonly frozen: Record<BlockName, string>;
+  /** port #16: versioned edits — every commit lands through a sidecar ledger
+   *  (<file>.versions.jsonl), enabling one-call rollback + drift detection. */
+  private readonly ledgers: Record<BlockName, VersionLedger>;
+  /** Optimistic-concurrency baseline (prime baselineState, refinement.ts:735-749):
+   *  the version THIS store last saw. Passing ledger.version() to commit would
+   *  compare the guard to itself and silently drop a concurrent store's edit. */
+  private readonly baseVersions: Record<BlockName, number>;
+
+  constructor(
+    private readonly dir: string,
+    private readonly caps: BlockCaps = defaultCaps,
+  ) {
+    // no mkdir here: reads tolerate a missing directory and the ledger creates it on the first commit
+    // (skills/versioned.ts). Creating `<session>/memory` at construction was what made every session
+    // directory non-empty before anyone had said anything (core/session.ts materialize()).
+    this.live.memory = this.read("MEMORY.md");
+    this.live.user = this.read("USER.md");
+    // snapshot is the threat-scanned view of what session start loaded
+    this.frozen = { memory: scan(this.live.memory), user: scan(this.live.user) };
+    this.ledgers = {
+      memory: new VersionLedger(this.file("memory")),
+      user: new VersionLedger(this.file("user")),
+    };
+    this.baseVersions = { memory: this.ledgers.memory.version(), user: this.ledgers.user.version() };
+  }
+
+  private read(name: string): string {
+    const p = join(this.dir, name);
+    return existsSync(p) ? readFileSync(p, "utf8") : "";
+  }
+
+  private file(block: BlockName): string {
+    return join(this.dir, block === "memory" ? "MEMORY.md" : "USER.md");
+  }
+
+  add(block: BlockName, text: string): BlockEditResult {
+    const t = text.trim();
+    if (!t) return { ok: false, reason: "empty text" };
+    const next = this.live[block] ? this.live[block] + "\n" + t : t;
+    return this.commit(block, next);
+  }
+
+  replace(block: BlockName, oldText: string, newText: string): BlockEditResult {
+    const found = this.locate(block, oldText);
+    if (!found.ok) return found;
+    const t = newText.trim();
+    const next = t ? this.live[block].replace(oldText, t) : this.live[block].replace(oldText, "");
+    return this.commit(block, next.trim());
+  }
+
+  remove(block: BlockName, oldText: string): BlockEditResult {
+    const found = this.locate(block, oldText);
+    if (!found.ok) return found;
+    const next = this.live[block].replace(oldText, "").replace(/\n{3,}/g, "\n\n").trim();
+    return this.commit(block, next);
+  }
+
+  /** oldText must match exactly once: 0 → not found, >1 → ambiguous. */
+  private locate(block: BlockName, oldText: string): BlockEditResult {
+    if (!oldText) return { ok: false, reason: "oldText required" };
+    const n = occurrences(this.live[block], oldText);
+    if (n === 0) return { ok: false, reason: "oldText not found" };
+    if (n > 1) return { ok: false, reason: `oldText matches ${n} times; must match exactly once` };
+    return { ok: true };
+  }
+
+  /** Char-cap guard shared by commit() and rollback(); runs BEFORE any ledger write. */
+  private capCheck(block: BlockName, next: string): BlockEditResult | null {
+    const limit = this.caps[block];
+    if (next.length <= limit) return null;
+    return {
+      ok: false, reason: `block would exceed cap (${next.length} > ${limit} chars)`,
+      current: this.live[block].length, limit,
+    };
+  }
+
+  private commit(block: BlockName, next: string): BlockEditResult {
+    const capped = this.capCheck(block, next);
+    if (capped) return capped;
+    // ledger-first write (port #16): version record appended, then the target
+    // is written atomically by the ledger — never writeFileSync directly. The
+    // baseline is what THIS store last saw, so a concurrent store's commit is
+    // caught here instead of being silently overwritten.
+    const r = this.ledgers[block].commit(next, "memory_edit", this.baseVersions[block]);
+    if (!r.ok) {
+      // conflict: another store/process advanced the block. Re-read reality so
+      // the next edit builds on the merged state; the reason stays generic —
+      // ledger numbers ride the structured field only.
+      this.live[block] = this.ledgers[block].read();
+      this.baseVersions[block] = r.currentVersion;
+      return {
+        ok: false, reason: CONFLICT_REASON,
+        conflict: { baseVersion: r.baseVersion, currentVersion: r.currentVersion },
+      };
+    }
+    this.baseVersions[block] = r.edit.version;
+    this.live[block] = next;
+    return { ok: true, current: next.length, limit: this.caps[block] };
+  }
+
+  /** port #16: one-call rollback of a block to any retained version.
+   *  Restored content re-enters through the same cap guard as commits. */
+  rollback(block: BlockName, toVersion: number): BlockEditResult {
+    const restored = this.ledgers[block].contentAt(toVersion);
+    const capped = restored !== undefined ? this.capCheck(block, restored) : null;
+    if (capped) return capped;
+    const r = this.ledgers[block].rollback(toVersion, "memory_rollback");
+    if (!r.ok) return { ok: false, reason: r.message };
+    this.baseVersions[block] = r.edit.version;
+    this.live[block] = this.ledgers[block].read();
+    return { ok: true, current: this.live[block].length, limit: this.caps[block] };
+  }
+
+  /** port #16: version history access for status/debug surfaces. */
+  ledger(block: BlockName): VersionLedger { return this.ledgers[block]; }
+
+  /** Session-start snapshot (threat-scanned). Tool writes never change it. */
+  renderForPrompt(): string {
+    const parts: string[] = [];
+    if (this.frozen.memory) parts.push(`# Memory\n${this.frozen.memory}`);
+    if (this.frozen.user) parts.push(`# User\n${this.frozen.user}`);
+    return parts.join("\n\n");
+  }
+
+  /** Live (post-snapshot) raw text — for reads/debug, not for the prompt. */
+  liveText(block: BlockName): string { return this.live[block]; }
+
+  cap(block: BlockName): number { return this.caps[block]; }
+}