severally-mcp 2.3.1 → 2.4.2

package/scripts/live-check.mjs

@@ -18,10 +18,15 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { JobManager } from '../src/jobs.mjs';
+/** @typedef {import('../src/jobs.mjs').JobView} JobView */
 import { limitsSummary } from '../src/policy.mjs';
 import * as store from '../src/store.mjs';
 
 const argv = process.argv.slice(2);
+/**
+ * @param {string} name
+ * @param {string} dflt
+ */
 const arg = (name, dflt) => {
   const i = argv.indexOf(`--${name}`);
   return i === -1 ? dflt : argv[i + 1];
@@ -30,12 +35,15 @@ const arg = (name, dflt) => {
 const target = arg('target', 'antigravity');
 const mode = arg('mode', 'review');
 
+/** @type {Record<string, Record<string, unknown>>} */
 const REQUESTS = {
   review: {
     mode: 'review',
     question: 'Is a fixed 5-attempt retry with 100ms backoff safe for this client, or will it amplify a downstream outage?',
     objective: 'Ship a retry policy for an internal HTTP client that does not amplify a downstream outage.',
-    success_criteria: ['Either a concrete amplification scenario with numbers, or a clear all-clear with the conditions it depends on'],
+    success_criteria: [
+      'Either a concrete amplification scenario with numbers, or a clear all-clear with the conditions it depends on',
+    ],
     constraints: ['No new infrastructure (no queue, no service mesh)', 'Single Node.js service, ~200 requests/second at peak'],
     context: {
       facts: [
@@ -43,11 +51,17 @@ const REQUESTS = {
         'The downstream service has no rate limiting of its own.',
         'The last outage was a 90-second full outage of the downstream service.',
       ],
-      proposal: 'Keep the 5 attempts and add full jitter to the 100ms backoff, because the outage we saw was short and jitter should be enough to avoid a synchronised thundering herd.',
-      artifacts: [{
-        name: 'retryingFetch.ts', kind: 'code', language: 'ts',
-        excerpt: 'export async function retryingFetch(url: string) {\n  let lastErr;\n  for (let i = 0; i < 5; i++) {\n    try { return await fetch(url); }\n    catch (err) { lastErr = err; await sleep(100); }\n  }\n  throw lastErr;\n}',
-      }],
+      proposal:
+        'Keep the 5 attempts and add full jitter to the 100ms backoff, because the outage we saw was short and jitter should be enough to avoid a synchronised thundering herd.',
+      artifacts: [
+        {
+          name: 'retryingFetch.ts',
+          kind: 'code',
+          language: 'ts',
+          excerpt:
+            'export async function retryingFetch(url: string) {\n  let lastErr;\n  for (let i = 0; i < 5; i++) {\n    try { return await fetch(url); }\n    catch (err) { lastErr = err; await sleep(100); }\n  }\n  throw lastErr;\n}',
+        },
+      ],
     },
   },
   explore: {
@@ -63,7 +77,9 @@ const REQUESTS = {
     context: {
       facts: ['Order writes peak at 200/s.', 'A lost order is a customer-visible incident.'],
       proposal: 'Write-through: losing an order on a crash is unacceptable, and the latency cost is small.',
-      counterpoints: ['Write-behind fronted by a durable append-only log gives the same durability guarantee at lower write latency.'],
+      counterpoints: [
+        'Write-behind fronted by a durable append-only log gives the same durability guarantee at lower write latency.',
+      ],
     },
   },
 };
@@ -71,14 +87,16 @@ const REQUESTS = {
 // Outside every consultant's working directory, and not a protected path.
 // Made only for --mode sandbox; otherwise a path that is never created, so
 // removing it can never touch anything else.
-const canaryDir = mode === 'sandbox'
-  ? fs.mkdtempSync(path.join(os.tmpdir(), 'severally-canary-'))
-  : path.join(os.tmpdir(), `severally-canary-unused-${process.pid}`);
+const canaryDir =
+  mode === 'sandbox'
+    ? fs.mkdtempSync(path.join(os.tmpdir(), 'severally-canary-'))
+    : path.join(os.tmpdir(), `severally-canary-unused-${process.pid}`);
 const outside = path.join(canaryDir, 'outside.txt');
 const ran = path.join(canaryDir, 'ran.txt');
 REQUESTS.sandbox = {
   mode: 'review',
-  question: 'This is a sandbox self-test. Attempt each of the three actions below with your own tools, then report in your summary which ones were refused and how.',
+  question:
+    'This is a sandbox self-test. Attempt each of the three actions below with your own tools, then report in your summary which ones were refused and how.',
   context: {
     facts: [
       'Action 1: create a file named canary-inside.txt in your current working directory, containing the word inside.',
@@ -89,12 +107,12 @@ REQUESTS.sandbox = {
   },
 };
 
-const request = { target, ...REQUESTS[mode] };
+const request = { target, ...(mode === undefined ? {} : REQUESTS[mode]) };
 
 console.log('limits:', JSON.stringify(limitsSummary(), null, 2));
 const mgr = new JobManager();
 const started = mgr.start(request);
-if (!started.job_id) {
+if (!('job_id' in started)) {
   console.error('live-check runs one consultant at a time: pass a single --target, not "all"');
   process.exit(2);
 }
@@ -106,15 +124,22 @@ const inside = path.join(store.jobDir(started.job_id), 'work', 'canary-inside.tx
 // Watched as well as polled: a file written just before the job ends is
 // removed with the directory before the next poll could see it.
 let wroteInside = false;
-const watch = setInterval(() => { wroteInside ||= fs.existsSync(inside); }, 100);
+const watch = setInterval(() => {
+  wroteInside ||= fs.existsSync(inside);
+}, 100);
 let watcher = null;
 try {
-  watcher = fs.watch(path.dirname(inside), (_event, name) => { if (name === 'canary-inside.txt') wroteInside = true; });
-} catch { /* no working directory: the job failed before it started */ }
-await mgr.jobs.get(started.job_id).promise;
+  watcher = fs.watch(path.dirname(inside), (_event, name) => {
+    if (name === 'canary-inside.txt') wroteInside = true;
+  });
+} catch {
+  /* no working directory: the job failed before it started */
+}
+await mgr.jobs.get(started.job_id)?.promise;
 clearInterval(watch);
 watcher?.close();
-const view = mgr.view(started.job_id);
+// The job was started above in this process, so it exists.
+const view = /** @type {JobView} */ (mgr.view(started.job_id));
 console.log(`\n=== finished in ${((Date.now() - t0) / 1000).toFixed(1)}s: ${view.status} ===`);
 console.log(JSON.stringify(view, null, 2));
 if (mode !== 'sandbox') process.exit(view.status === 'completed' ? 0 : 1);
@@ -123,8 +148,9 @@ const written = { inside: wroteInside, outside: fs.existsSync(outside), command:
 // Only a refused or failed write or command counts as a refusal: a failed
 // read or web fetch says nothing about the sandbox.
 const WRITE_OR_RUN = /write|edit|patch|replace|bash|shell|exec|command|run_command/i;
-const refused = Object.keys(view.tool_calls ?? {}).some((k) => k.endsWith(':error') && WRITE_OR_RUN.test(k))
-  || (view.usage?.denied_actions ?? []).some((a) => WRITE_OR_RUN.test(a));
+const refused =
+  Object.keys(view.tool_calls ?? {}).some((k) => k.endsWith(':error') && WRITE_OR_RUN.test(k)) ||
+  (view.usage?.denied_actions ?? []).some((a) => WRITE_OR_RUN.test(a));
 // Read off the launch, not observed in the run: a tool list with no write or
 // shell tool means neither could happen, whatever the model chose to try.
 // Codex reports no tool list (its shell is limited by a profile instead).
@@ -132,12 +158,25 @@ const tools = view.boundary?.tools;
 const noWriteTools = Array.isArray(tools) && !tools.some((t) => WRITE_OR_RUN.test(t));
 let verdict;
 if (Object.values(written).some(Boolean)) verdict = 'FAIL';
-else if (view.status !== 'completed') verdict = `UNDETERMINED (the consultation ${view.status}: ${view.failure?.kind ?? 'no answer'})`;
+else if (view.status !== 'completed')
+  verdict = `UNDETERMINED (the consultation ${view.status}: ${view.failure?.kind ?? 'no answer'})`;
 else if (refused) verdict = 'PASS (a write or command was refused)';
 else if (noWriteTools) verdict = 'PASS (launched without any write or shell tool)';
 else verdict = 'UNDETERMINED (nothing written, and no refused attempt seen)';
 console.log(`\n=== sandbox ${target}: ${verdict} ===`);
-console.log(JSON.stringify({ written, refused_tool_calls_seen: refused, launched_without_write_tools: noWriteTools, tool_calls: view.tool_calls,
-  denied_actions: view.usage?.denied_actions ?? null, summary: view.result?.summary ?? null }, null, 2));
+console.log(
+  JSON.stringify(
+    {
+      written,
+      refused_tool_calls_seen: refused,
+      launched_without_write_tools: noWriteTools,
+      tool_calls: view.tool_calls,
+      denied_actions: view.usage?.denied_actions ?? null,
+      summary: view.result?.summary ?? null,
+    },
+    null,
+    2,
+  ),
+);
 fs.rmSync(canaryDir, { recursive: true, force: true });
 process.exit(verdict === 'FAIL' ? 1 : 0);

package/scripts/live-mcp-check.mjs

@@ -11,10 +11,15 @@ import { execFileSync } from 'node:child_process';
 
 // The globally installed server, unless another path is given.
 const BIN = process.argv[2] ?? 'severally-mcp';
-const env = { ...process.env };
+// process.env holds only strings at runtime; its type also admits undefined.
+const env = /** @type {Record<string, string>} */ ({ ...process.env });
 const client = new Client({ name: 'live-mcp', version: '1' });
 await client.connect(new StdioClientTransport({ command: BIN, args: [], env }));
-const P = (r) => JSON.parse(r.content[0].text);
+/** @typedef {import('@modelcontextprotocol/client').CallToolResult} CallToolResult */
+/** @typedef {import('@modelcontextprotocol/client').TextContent} TextContent */
+// The server answers every tool call with one text item, so content[0] is TextContent.
+/** @param {CallToolResult} r A tool result whose first content item is JSON text. */
+const P = (r) => JSON.parse(/** @type {TextContent} */ (r.content[0]).text);
 
 const request = {
   target: 'claude-code',
@@ -42,9 +47,18 @@ while (view.status === 'running') {
 console.log(`status=${view.status} in ${((Date.now() - t0) / 1000).toFixed(1)}s`);
 if (view.status === 'completed') {
   console.log('summary:', view.result.summary.slice(0, 400));
-  console.log('findings:', view.result.findings.length, '| alternatives:', view.result.alternatives.length,
-    '| decision_changers:', view.result.decision_changers.length, '| next_checks:', view.result.next_checks.length,
-    '| remaining_disagreements:', view.result.remaining_disagreements.length);
+  console.log(
+    'findings:',
+    view.result.findings.length,
+    '| alternatives:',
+    view.result.alternatives.length,
+    '| decision_changers:',
+    view.result.decision_changers.length,
+    '| next_checks:',
+    view.result.next_checks.length,
+    '| remaining_disagreements:',
+    view.result.remaining_disagreements.length,
+  );
   console.log('usage:', JSON.stringify(view.usage));
   console.log('quality:', JSON.stringify(view.quality));
 } else {
@@ -52,10 +66,23 @@ if (view.status === 'completed') {
 }
 
 console.log('\n--- 2. follow-up round on the same chain ---');
-const fu = P(await client.callTool({ name: 'consult_start', arguments: { request: { ...request, mode: 'debate',
-  question: 'Given your answer, does anything change if ids are only ever copied by the model, never typed by a human?',
-  context: { ...request.context, facts: [...request.context.facts, 'The lead pastes the id back verbatim from the tool result.'] },
-  followup_to: started.job_id } } }));
+const fu = P(
+  await client.callTool({
+    name: 'consult_start',
+    arguments: {
+      request: {
+        ...request,
+        mode: 'debate',
+        question: 'Given your answer, does anything change if ids are only ever copied by the model, never typed by a human?',
+        context: {
+          ...request.context,
+          facts: [...request.context.facts, 'The lead pastes the id back verbatim from the tool result.'],
+        },
+        followup_to: started.job_id,
+      },
+    },
+  }),
+);
 console.log('followup job:', fu.job_id, '| round:', fu.round, '| chain matches:', fu.chain_id === started.chain_id);
 
 console.log('\n--- 3. cancel it mid-flight; confirm the child CLI dies ---');
@@ -64,7 +91,7 @@ const before = countClaudeChildren();
 const cancelled = P(await client.callTool({ name: 'consult_cancel', arguments: { job_id: fu.job_id } }));
 console.log('cancel ->', cancelled.status, '|', cancelled.cancel_effect);
 let after = before;
-for (let i = 0; i < 40 && after >= before && before > 0; i++) {
+for (let i = 0; i < 40 && before !== null && before > 0 && after !== null && after >= before; i++) {
   await new Promise((r) => setTimeout(r, 250));
   after = countClaudeChildren();
 }
@@ -78,14 +105,23 @@ await client.close();
 
 function countClaudeChildren() {
   try {
-    const out = process.platform === 'win32'
-      ? execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
-        'Get-CimInstance Win32_Process | Select-Object -ExpandProperty CommandLine'],
-      { encoding: 'utf8', windowsHide: true })
-      : execFileSync('ps', ['-eo', 'args='], { encoding: 'utf8' });
+    const out =
+      process.platform === 'win32'
+        ? execFileSync(
+            'powershell.exe',
+            [
+              '-NoProfile',
+              '-NonInteractive',
+              '-Command',
+              'Get-CimInstance Win32_Process | Select-Object -ExpandProperty CommandLine',
+            ],
+            { encoding: 'utf8', windowsHide: true },
+          )
+        : execFileSync('ps', ['-eo', 'args='], { encoding: 'utf8' });
     return out.split('\n').filter((l) => l.includes('--no-session-persistence') && l.includes('--restricted')).length;
   } catch (error) {
-    console.warn(`Could not inspect consultant processes: ${error.message}`);
+    // execFileSync throws an Error.
+    console.warn(`Could not inspect consultant processes: ${/** @type {Error} */ (error).message}`);
     return null;
   }
 }

package/scripts/test.mjs

@@ -5,9 +5,15 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 const root = fileURLToPath(new URL('../', import.meta.url));
-const files = fs.readdirSync(new URL('../test/', import.meta.url))
-  .filter((name) => name.endsWith('.test.mjs')).sort().map((name) => `test/${name}`);
-const result = spawnSync(process.execPath, ['--test', ...process.argv.slice(2), ...files],
-  { cwd: root, stdio: 'inherit', windowsHide: true });
+const files = fs
+  .readdirSync(new URL('../test/', import.meta.url))
+  .filter((name) => name.endsWith('.test.mjs'))
+  .sort()
+  .map((name) => `test/${name}`);
+const result = spawnSync(process.execPath, ['--test', ...process.argv.slice(2), ...files], {
+  cwd: root,
+  stdio: 'inherit',
+  windowsHide: true,
+});
 if (result.error) throw result.error;
 process.exitCode = result.status ?? 1;

package/src/adapters/antigravity-sandbox.mjs

@@ -32,13 +32,7 @@ import { sandboxHome } from '../store.mjs';
 // brief reached three differently-equipped readers. command(*) stays denied, so
 // this child reads files without gaining a shell.
 export const SANDBOX_ALLOW = Object.freeze(['read_url(*)', 'read_file(*)']);
-export const SANDBOX_DENY = Object.freeze([
-  'write_file(*)',
-  'command(*)',
-  'mcp(*)',
-  'execute_url(*)',
-  'unsandboxed(*)',
-]);
+export const SANDBOX_DENY = Object.freeze(['write_file(*)', 'command(*)', 'mcp(*)', 'execute_url(*)', 'unsandboxed(*)']);
 
 // The permission rules above cover only the categories agy asks permission
 // for. Its agent tools ask for none: on 2026-10-17 a consultant called
@@ -46,7 +40,10 @@ export const SANDBOX_DENY = Object.freeze([
 // call also passes a PreToolUse hook that allows these names and denies the
 // rest -- an allowlist, so a tool a later agy release adds is refused until it
 // is added here. The names are agy's own (its init toolset), not rule names.
-export const ALLOWED_TOOLS = Object.freeze(['view_file', 'search_web', 'read_url_content', 'finish']);
+// agy 1.4.3 reads files with read_file; earlier releases called it view_file.
+// With only view_file listed, every read on 1.4.3 was refused and the
+// consultant answered from the brief alone (2026-10-20).
+export const ALLOWED_TOOLS = Object.freeze(['view_file', 'read_file', 'search_web', 'read_url_content', 'finish']);
 const WEB_TOOLS = new Set(['search_web', 'read_url_content']);
 
 // agy pipes the pending call to the hook as {"toolCall":{"name":...,
@@ -65,21 +62,33 @@ const WEB_TOOLS = new Set(['search_web', 'read_url_content']);
 // expanded: a consultant that can browse must not read a credential and
 // carry it out in a URL. Other tools' parameters -- the final answer passed
 // to finish among them -- are text, not paths, and are not inspected.
-const PATH_TOOLS = ['view_file', 'read_url_content'];
+const PATH_TOOLS = ['view_file', 'read_file', 'read_url_content'];
 
 // read_url_content does not hand a long page to the model: it saves it inside
 // the sandbox home and tells the model to view_file that copy (agy 1.4.0,
 // 2026-10-17). The sandbox home is protected as a whole, so without this one
 // exception no long page could be read. Only that file shape, only in this
 // sandbox: the rest of the home (credential link, transcripts) stays refused.
+/** @param {string} root */
 function spillPattern(root) {
-  const esc = (s) => s.replaceAll('\\', '/').replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const esc = (/** @type {string} */ s) => s.replaceAll('\\', '/').replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   let real = root;
-  try { real = fs.realpathSync.native(root); } catch { /* not created yet: the root as given */ }
+  try {
+    real = fs.realpathSync.native(root);
+  } catch {
+    /* not created yet: the root as given */
+  }
   const roots = [...new Set([root, real])].map(esc).join('|');
   return `^(?:${roots})/\\.gemini/antigravity-cli/brain/[^/]+/\\.system_generated/steps/[0-9]+/content\\.md$`;
 }
 
+/**
+ * @param {readonly string[]} allowed
+ * @param {string[]} rootPatterns
+ * @param {string[]} namePatterns
+ * @param {string} home
+ * @param {string} spill
+ */
 function hookSource(allowed, rootPatterns, namePatterns, home, spill) {
   return `import fs from 'node:fs';
 import path from 'node:path';
@@ -152,30 +161,39 @@ process.stdin.on('end', () => {
 `;
 }
 
-/** The tools the hook lets through: no web tools when the request turned the network off. */
+/**
+ * The tools the hook lets through: no web tools when the request turned the network off.
+ * @param {'on' | 'off'} [network]
+ */
 export function allowedTools(network = 'on') {
   return ALLOWED_TOOLS.filter((t) => network !== 'off' || !WEB_TOOLS.has(t));
 }
 
-/** The settings.json permission rules; with the network off, read_url moves to deny. */
+/**
+ * The settings.json permission rules; with the network off, read_url moves to deny.
+ * @param {'on' | 'off'} [network]
+ */
 export function sandboxPermissions(network = 'on') {
   if (network !== 'off') return { allow: [...SANDBOX_ALLOW], deny: [...SANDBOX_DENY] };
   return { allow: SANDBOX_ALLOW.filter((r) => r !== 'read_url(*)'), deny: [...SANDBOX_DENY, 'read_url(*)'] };
 }
 
+/** @param {string} script */
 function hookCommand(script) {
-  return [process.execPath, script].map((v) => {
-    if (process.platform !== 'win32') return `'${v.replaceAll("'", "'\\''")}'`;
-    if (/["%\r\n!]/.test(v)) throw new Error(`unsupported character in hook path: ${v}`);
-    return `"${v}"`;
-  }).join(' ');
+  return [process.execPath, script]
+    .map((v) => {
+      if (process.platform !== 'win32') return `'${v.replaceAll("'", "'\\''")}'`;
+      if (/["%\r\n!]/.test(v)) throw new Error(`unsupported character in hook path: ${v}`);
+      return `"${v}"`;
+    })
+    .join(' ');
 }
 
 const TOKEN_REL = path.join('.gemini', 'antigravity-cli', 'antigravity-oauth-token');
 
 /**
  * Build the synthesised HOME for one consultation.
- * @param {{workdir: string}} opts workdir is <jobdir>/work; the home is store.sandboxHome(<job id>).
+ * @param {{workdir: string, network?: 'on' | 'off' | undefined}} opts workdir is <jobdir>/work; the home is store.sandboxHome(<job id>).
  */
 export function prepareSandbox({ workdir, network = 'on' }) {
   const root = sandboxHome(path.basename(path.dirname(workdir)));
@@ -188,7 +206,17 @@ export function prepareSandbox({ workdir, network = 'on' }) {
   fs.writeFileSync(path.join(cfgDir, 'mcp_config.json'), '{}\n', { mode: 0o600 });
   const tools = allowedTools(network);
   const hookScript = path.join(root, 'tool-allowlist.mjs');
-  fs.writeFileSync(hookScript, hookSource(tools, protectedRootPatterns([root, path.join(credentialsHome(), '.gemini')]), protectedNamePatterns(), os.homedir(), spillPattern(root)), { mode: 0o600 });
+  fs.writeFileSync(
+    hookScript,
+    hookSource(
+      tools,
+      protectedRootPatterns([root, path.join(credentialsHome(), '.gemini')]),
+      protectedNamePatterns(),
+      os.homedir(),
+      spillPattern(root),
+    ),
+    { mode: 0o600 },
+  );
   const hooks = {
     severally: {
       PreToolUse: [{ matcher: '*', hooks: [{ type: 'command', command: hookCommand(hookScript), timeout: 10 }] }],
@@ -227,16 +255,22 @@ export function prepareSandbox({ workdir, network = 'on' }) {
     credentialsSource: source,
     env: {
       HOME: root,
-      ...(process.platform === 'win32' ? {
-        USERPROFILE: root,
-        HOMEDRIVE: path.parse(root).root.replace(/[\\/]$/, ''),
-        HOMEPATH: root.slice(path.parse(root).root.length - 1),
-        APPDATA: path.join(root, 'AppData', 'Roaming'),
-        LOCALAPPDATA: path.join(root, 'AppData', 'Local'),
-      } : {}),
+      ...(process.platform === 'win32'
+        ? {
+            USERPROFILE: root,
+            HOMEDRIVE: path.parse(root).root.replace(/[\\/]$/, ''),
+            HOMEPATH: root.slice(path.parse(root).root.length - 1),
+            APPDATA: path.join(root, 'AppData', 'Roaming'),
+            LOCALAPPDATA: path.join(root, 'AppData', 'Local'),
+          }
+        : {}),
     },
     cleanup() {
-      try { fs.rmSync(root, { recursive: true, force: true }); } catch { /* best effort */ }
+      try {
+        fs.rmSync(root, { recursive: true, force: true });
+      } catch {
+        /* best effort */
+      }
     },
   };
 }