sparda-mcp 0.5.2 → 0.5.4

package/src/probe/probe.js

@@ -11,10 +11,10 @@
  * ESM, Node ≥ 18. Zero new dependencies.
  */
 
-import { fork, spawn, spawnSync } from 'node:child_process';
-import { fileURLToPath }           from 'node:url';
+import { fork, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { dirname, resolve, extname } from 'node:path';
-import { platform }                from 'node:process';
+import { platform } from 'node:process';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -26,13 +26,18 @@ const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 
 // ── Public API ─────────────────────────────────────────────────────────────────
 
-export async function probeRoutes({ framework, entryFile, projectRoot, timeoutMs = 8000 }) {
+export async function probeRoutes({
+  framework,
+  entryFile,
+  projectRoot,
+  timeoutMs = 8000,
+}) {
   if (framework === 'express') return probeExpress({ entryFile, projectRoot, timeoutMs });
   if (framework === 'fastapi') return probeFastAPI({ entryFile, projectRoot, timeoutMs });
-  throw Object.assign(
-    new Error(`Unknown framework: ${framework}`),
-    { code: 'USER', hint: 'framework must be "express" or "fastapi"' }
-  );
+  throw Object.assign(new Error(`Unknown framework: ${framework}`), {
+    code: 'USER',
+    hint: 'framework must be "express" or "fastapi"',
+  });
 }
 
 // ── Express probe ─────────────────────────────────────────────────────────────
@@ -42,12 +47,12 @@ async function probeExpress({ entryFile, projectRoot, timeoutMs }) {
 
   if (ext === '.ts' || ext === '.mts' || ext === '.cts') {
     process.stderr.write(
-      '[sparda] --probe skipped: .ts entry needs a runtime loader; static discovery still applied.\n'
+      '[sparda] --probe skipped: .ts entry needs a runtime loader; static discovery still applied.\n',
     );
     return [];
   }
 
-  const isEsm    = ext === '.mjs';
+  const isEsm = ext === '.mjs';
   const shimFlag = isEsm ? ['--import', SHIM_ESM] : ['--require', SHIM_CJS];
 
   const routes = [];
@@ -61,24 +66,30 @@ async function probeExpress({ entryFile, projectRoot, timeoutMs }) {
       if (settled) return;
       settled = true;
       clearTimeout(killTimer);
-      try { child && child.kill('SIGKILL'); } catch {}
+      try {
+        child && child.kill('SIGKILL');
+      } catch {}
       resolve_(result);
     }
 
     killTimer = setTimeout(() => {
-      process.stderr.write('[sparda] --probe: timeout waiting for Express routes; using static floor.\n');
+      process.stderr.write(
+        '[sparda] --probe: timeout waiting for Express routes; using static floor.\n',
+      );
       settle(routes);
     }, timeoutMs);
 
     try {
       child = fork(entryFile, [], {
-        cwd:      projectRoot,
+        cwd: projectRoot,
         execArgv: shimFlag,
-        silent:   true,
-        env:      { ...process.env, SPARDA_PROBE: '1' },
+        silent: true,
+        env: { ...process.env, SPARDA_PROBE: '1' },
       });
     } catch (spawnErr) {
-      process.stderr.write(`[sparda] --probe: failed to spawn child: ${spawnErr.message}\n`);
+      process.stderr.write(
+        `[sparda] --probe: failed to spawn child: ${spawnErr.message}\n`,
+      );
       clearTimeout(killTimer);
       resolve_([]);
       return;
@@ -88,15 +99,18 @@ async function probeExpress({ entryFile, projectRoot, timeoutMs }) {
 
     child.on('message', (msg) => {
       if (!msg || typeof msg !== 'object') return;
-      if (msg.type === '__done__') { settle(routes); return; }
+      if (msg.type === '__done__') {
+        settle(routes);
+        return;
+      }
       if (msg.type === 'route') {
         const method = normalizeMethod(msg.method);
-        const path   = normalizePath(msg.path);
+        const path = normalizePath(msg.path);
         routes.push({
           method,
           path,
           pathParams: extractPathParams(path),
-          source:     'dynamic',
+          source: 'dynamic',
           writeClass: WRITE_METHODS.has(method) ? 'write' : 'read',
         });
       }
@@ -116,7 +130,9 @@ async function probeExpress({ entryFile, projectRoot, timeoutMs }) {
 async function probeFastAPI({ entryFile, projectRoot, timeoutMs }) {
   const python = await resolvePython();
   if (!python) {
-    process.stderr.write('[sparda] --probe: python3/python not found; static discovery still applied.\n');
+    process.stderr.write(
+      '[sparda] --probe: python3/python not found; static discovery still applied.\n',
+    );
     return [];
   }
 
@@ -129,21 +145,25 @@ async function probeFastAPI({ entryFile, projectRoot, timeoutMs }) {
       if (settled) return;
       settled = true;
       clearTimeout(killTimer);
-      try { child && child.kill(); } catch {}
+      try {
+        child && child.kill();
+      } catch {}
       resolve_(result);
     }
 
     killTimer = setTimeout(() => {
-      process.stderr.write('[sparda] --probe: FastAPI probe timeout; using static floor.\n');
+      process.stderr.write(
+        '[sparda] --probe: FastAPI probe timeout; using static floor.\n',
+      );
       settle(parsePythonOutput(Buffer.concat(stdoutChunks).toString('utf8')));
     }, timeoutMs);
 
     let child;
     try {
       child = spawn(python, [PY_PROBE, entryFile], {
-        cwd:   projectRoot,
+        cwd: projectRoot,
         stdio: ['ignore', 'pipe', 'pipe'],
-        env:   { ...process.env, PYTHONIOENCODING: 'utf-8' },
+        env: { ...process.env, PYTHONIOENCODING: 'utf-8' },
       });
     } catch (err) {
       process.stderr.write(`[sparda] --probe: failed to spawn python: ${err.message}\n`);
@@ -169,10 +189,10 @@ function parsePythonOutput(raw) {
     const arr = JSON.parse(raw.trim());
     if (!Array.isArray(arr)) return [];
     return arr.map((r) => ({
-      method:     normalizeMethod(r.method),
-      path:       normalizeFastAPIParams(r.path ?? '/'),
+      method: normalizeMethod(r.method),
+      path: normalizeFastAPIParams(r.path ?? '/'),
       pathParams: extractPathParams(r.path ?? '/'),
-      source:     'dynamic',
+      source: 'dynamic',
       writeClass: WRITE_METHODS.has(normalizeMethod(r.method)) ? 'write' : 'read',
     }));
   } catch {
@@ -187,9 +207,7 @@ function parsePythonOutput(raw) {
 // §A.6:   1500 ms timeout kills MS Store stub that never returns.
 
 async function resolvePython() {
-  const candidates = platform === 'win32'
-    ? ['python', 'python3']
-    : ['python3', 'python'];
+  const candidates = platform === 'win32' ? ['python', 'python3'] : ['python3', 'python'];
   for (const cmd of candidates) {
     if (await checkCommand(cmd)) return cmd;
   }
@@ -201,7 +219,9 @@ function checkCommand(cmd) {
     let child;
     // §A.6: 1500 ms timeout — kills Microsoft Store python stub that hangs
     const timer = setTimeout(() => {
-      try { child && child.kill(); } catch {}
+      try {
+        child && child.kill();
+      } catch {}
       res(false);
     }, 1500);
 
@@ -213,8 +233,14 @@ function checkCommand(cmd) {
       return;
     }
 
-    child.on('error', () => { clearTimeout(timer); res(false); });
-    child.on('exit',  (code) => { clearTimeout(timer); res(code === 0); });
+    child.on('error', () => {
+      clearTimeout(timer);
+      res(false);
+    });
+    child.on('exit', (code) => {
+      clearTimeout(timer);
+      res(code === 0);
+    });
   });
 }
 

package/src/probe/reconcile.js

@@ -37,9 +37,9 @@ export function reconcile(staticRoutes, probedRoutes) {
   if (!probedRoutes || probedRoutes.length === 0) {
     const sorted = sortRoutes([...staticRoutes]);
     return {
-      routes:       sorted,
-      gaps:         [],
-      staticCount:  staticRoutes.length,
+      routes: sorted,
+      gaps: [],
+      staticCount: staticRoutes.length,
       dynamicCount: 0,
     };
   }
@@ -66,11 +66,11 @@ export function reconcile(staticRoutes, probedRoutes) {
     } else {
       // Gap: probe found something the AST missed
       const gap = {
-        method:     (dyn.method ?? 'GET').toUpperCase(),
-        path:       normalizeFastAPIParams(dyn.path ?? '/'),
+        method: (dyn.method ?? 'GET').toUpperCase(),
+        path: normalizeFastAPIParams(dyn.path ?? '/'),
         pathParams: extractPathParams(dyn.path ?? '/'),
-        source:     'dynamic',
-        confirmed:  false,
+        source: 'dynamic',
+        confirmed: false,
         writeClass: dyn.writeClass ?? inferWriteClass(dyn.method),
       };
       gaps.push(gap);
@@ -82,9 +82,9 @@ export function reconcile(staticRoutes, probedRoutes) {
   const sorted = sortRoutes(union);
 
   return {
-    routes:       sorted,
+    routes: sorted,
     gaps,
-    staticCount:  staticRoutes.length,
+    staticCount: staticRoutes.length,
     dynamicCount: gaps.length,
   };
 }
@@ -97,7 +97,7 @@ export function reconcile(staticRoutes, probedRoutes) {
  */
 function routeKey(route) {
   const method = (route.method ?? 'GET').toUpperCase();
-  const path   = normalizePath(route.path ?? '/');
+  const path = normalizePath(route.path ?? '/');
   return `${method} ${path}`;
 }
 
@@ -106,14 +106,15 @@ function routeKey(route) {
  * Used only for comparison (key generation).
  */
 function normalizePath(path) {
-  return (path ?? '/')
-    .replace(/\{[^}]+\}/g,    ':param')   // FastAPI {id}
-    .replace(/:[a-zA-Z_]\w*/g, ':param')  // Express :id
-    .replace(/\*\*[^/]*/g,    ':wildcard') // FastAPI **rest
-    .replace(/\/+/g, '/')
-    .replace(/\/$/, '') // strip trailing slash (except root)
-    .toLowerCase()
-    || '/';
+  return (
+    (path ?? '/')
+      .replace(/\{[^}]+\}/g, ':param') // FastAPI {id}
+      .replace(/:[a-zA-Z_]\w*/g, ':param') // Express :id
+      .replace(/\*\*[^/]*/g, ':wildcard') // FastAPI **rest
+      .replace(/\/+/g, '/')
+      .replace(/\/$/, '') // strip trailing slash (except root)
+      .toLowerCase() || '/'
+  );
 }
 
 /**
@@ -121,10 +122,11 @@ function normalizePath(path) {
  * Express :param style is already canonical.
  */
 function normalizeFastAPIParams(path) {
-  return (path ?? '/')
-    .replace(/\{([^}]+)\}/g, ':$1')  // {id} → :id
-    .replace(/\/+/g, '/')
-    || '/';
+  return (
+    (path ?? '/')
+      .replace(/\{([^}]+)\}/g, ':$1') // {id} → :id
+      .replace(/\/+/g, '/') || '/'
+  );
 }
 
 /** Extract ordered param names from a path (Express or FastAPI style). */

package/src/security/sanitize.js

@@ -8,7 +8,11 @@ const DANGEROUS = [
 ];
 
 export function sanitizeDescription(raw, fallback) {
-  let text = String(raw ?? '').replace(/[\r\n]+/g, ' ').replace(/\s{2,}/g, ' ').trim().slice(0, 300);
+  let text = String(raw ?? '')
+    .replace(/[\r\n]+/g, ' ')
+    .replace(/\s{2,}/g, ' ')
+    .trim()
+    .slice(0, 300);
   const flagged = DANGEROUS.some((rx) => rx.test(text));
   if (flagged) text = '';
   text = text.replace(/[<>{}]/g, '');

package/src/server/condenser.js

@@ -6,11 +6,11 @@
 import fs from 'node:fs';
 import { writeManifestSync } from './persistence.js';
 
-const WINDOW = 20;       // calls remembered per session (ring)
-const MAX_VALUES = 50;   // scalars kept per payload
-const MAX_NODES = 200;   // payload walk budget — nothing heavy, ever
+const WINDOW = 20; // calls remembered per session (ring)
+const MAX_VALUES = 50; // scalars kept per payload
+const MAX_NODES = 200; // payload walk budget — nothing heavy, ever
 const MAX_DEPTH = 4;
-const MAX_CHAIN = 5;     // a circuit longer than this is noise, not a workflow
+const MAX_CHAIN = 5; // a circuit longer than this is noise, not a workflow
 const MAX_LINKS = 10;
 const MAX_CIRCUITS = 30; // bounded memory, same philosophy as antibodies (ADR-010)
 // an emergent capability is a suggestion only after N observations (survival rule)
@@ -35,8 +35,7 @@ export function createSequenceRecorder({ manifest, manifestPath, harvester, onCi
     const argEntries = extractArgEntries(args);
     let link = null;
     // most recent producer wins: the freshest output is the likeliest source
-    outer:
-    for (let i = ring.length - 1; i >= 0; i--) {
+    outer: for (let i = ring.length - 1; i >= 0; i--) {
       for (const [argName, value] of argEntries) {
         if (ring[i].outValues.has(value)) {
           // fromKey = where the value lived in the producer's output — the structure
@@ -54,12 +53,29 @@ export function createSequenceRecorder({ manifest, manifestPath, harvester, onCi
     const sig = chain.join('>');
     const now = new Date().toISOString();
     const circuits = manifest.labs.circuits;
-    const c = circuits[sig] ?? (circuits[sig] = { steps: chain, links: [], seen: 0, firstSeen: now, lastSeen: now });
+    const c =
+      circuits[sig] ??
+      (circuits[sig] = {
+        steps: chain,
+        links: [],
+        seen: 0,
+        firstSeen: now,
+        lastSeen: now,
+      });
     c.seen += 1;
     c.lastSeen = now;
-    if (c.links.length < MAX_LINKS &&
-        !c.links.some((l) => l.from === link.from.tool && l.to === tool && l.arg === link.arg)) {
-      c.links.push({ from: link.from.tool, to: tool, arg: link.arg, fromKey: link.fromKey });
+    if (
+      c.links.length < MAX_LINKS &&
+      !c.links.some(
+        (l) => l.from === link.from.tool && l.to === tool && l.arg === link.arg,
+      )
+    ) {
+      c.links.push({
+        from: link.from.tool,
+        to: tool,
+        arg: link.arg,
+        fromKey: link.fromKey,
+      });
     }
     evict(circuits);
     persist();
@@ -71,7 +87,11 @@ export function createSequenceRecorder({ manifest, manifestPath, harvester, onCi
     const keys = Object.keys(circuits);
     if (keys.length <= MAX_CIRCUITS) return;
     keys
-      .sort((a, b) => (circuits[a].seen - circuits[b].seen) || circuits[a].lastSeen.localeCompare(circuits[b].lastSeen))
+      .sort(
+        (a, b) =>
+          circuits[a].seen - circuits[b].seen ||
+          circuits[a].lastSeen.localeCompare(circuits[b].lastSeen),
+      )
       .slice(0, keys.length - MAX_CIRCUITS)
       .forEach((k) => delete circuits[k]);
   }
@@ -82,7 +102,9 @@ export function createSequenceRecorder({ manifest, manifestPath, harvester, onCi
       const onDisk = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
       onDisk.labs = { ...onDisk.labs, circuits: manifest.labs.circuits };
       writeManifestSync(manifestPath, onDisk);
-    } catch { /* disk briefly unavailable — circuits stay in memory */ }
+    } catch {
+      /* disk briefly unavailable — circuits stay in memory */
+    }
   }
 
   return { record, circuits: () => manifest.labs.circuits };

package/src/server/confirmation.js

@@ -49,9 +49,15 @@ export function initiateWrite({ token, label } = {}) {
   sweep();
   if (pendingWrites.has(token)) return; // dialog already armed for this token
   if (pendingWrites.size >= MAX_PENDING) evictOldest();
-  pendingWrites.set(token, { state: S1, expiresAt: Date.now() + TIMEOUT_MS, label: String(label ?? token.slice(0, 12)) });
+  pendingWrites.set(token, {
+    state: S1,
+    expiresAt: Date.now() + TIMEOUT_MS,
+    label: String(label ?? token.slice(0, 12)),
+  });
   // Signal 2 runs in parallel — it NEVER blocks the MCP response.
-  setImmediate(() => { requestSignal2(token).catch(() => markDenied(token)); });
+  setImmediate(() => {
+    requestSignal2(token).catch(() => markDenied(token));
+  });
 }
 
 // ── Pre-approval: the human already said yes out-of-band via native elicitation (client UI). ──
@@ -60,7 +66,11 @@ export function preapproveWrite(token) {
   if (typeof token !== 'string' || !token) return;
   sweep();
   if (!pendingWrites.has(token) && pendingWrites.size >= MAX_PENDING) evictOldest();
-  pendingWrites.set(token, { state: S2, expiresAt: Date.now() + TIMEOUT_MS, label: 'elicitation' });
+  pendingWrites.set(token, {
+    state: S2,
+    expiresAt: Date.now() + TIMEOUT_MS,
+    label: 'elicitation',
+  });
 }
 
 async function requestSignal2(token) {
@@ -71,7 +81,10 @@ async function requestSignal2(token) {
     : await openOSDialog(entry.label, token);
   const e = pendingWrites.get(token);
   if (!e || e.state !== S1) return; // consumed, expired, or pre-approved meanwhile
-  if (Date.now() > e.expiresAt) { pendingWrites.delete(token); return; }
+  if (Date.now() > e.expiresAt) {
+    pendingWrites.delete(token);
+    return;
+  }
   e.state = approved ? S2 : DENIED;
 }
 
@@ -88,12 +101,22 @@ export function confirmWrite(token) {
   sweep();
   const entry = pendingWrites.get(token);
   if (!entry) return { ok: false, reason: 'unknown_token' };
-  if (Date.now() > entry.expiresAt) { pendingWrites.delete(token); return { ok: false, reason: 'expired' }; }
+  if (Date.now() > entry.expiresAt) {
+    pendingWrites.delete(token);
+    return { ok: false, reason: 'expired' };
+  }
   switch (entry.state) {
-    case S1: return { ok: false, reason: 'awaiting_human' }; // keep — the AI must retry after the click
-    case DENIED: pendingWrites.delete(token); return { ok: false, reason: 'human_denied' };
-    case S2: pendingWrites.delete(token); return { ok: true }; // burn — single use
-    default: pendingWrites.delete(token); return { ok: false, reason: 'invalid_state' };
+    case S1:
+      return { ok: false, reason: 'awaiting_human' }; // keep — the AI must retry after the click
+    case DENIED:
+      pendingWrites.delete(token);
+      return { ok: false, reason: 'human_denied' };
+    case S2:
+      pendingWrites.delete(token);
+      return { ok: true }; // burn — single use
+    default:
+      pendingWrites.delete(token);
+      return { ok: false, reason: 'invalid_state' };
   }
 }
 
@@ -114,17 +137,31 @@ export function buildDialogSpawn(platform, env, msg, title) {
       '[System.Windows.Forms.MessageBoxDefaultButton]::Button2);',
       'if ($r -eq [System.Windows.Forms.DialogResult]::Yes) { exit 0 } else { exit 1 }',
     ].join(' ');
-    return { cmd: 'powershell', args: ['-NoProfile', '-NonInteractive', '-STA', '-Command', ps] };
+    return {
+      cmd: 'powershell',
+      args: ['-NoProfile', '-NonInteractive', '-STA', '-Command', ps],
+    };
   }
   if (platform === 'darwin') {
     // osascript reads the message from the inherited env (system attribute) — no interpolation.
-    const osa = 'display dialog (system attribute "SPARDA_DLG_MSG") with title (system attribute "SPARDA_DLG_TITLE") '
-      + 'buttons {"Deny", "Allow"} default button "Deny" cancel button "Deny" with icon caution';
+    const osa =
+      'display dialog (system attribute "SPARDA_DLG_MSG") with title (system attribute "SPARDA_DLG_TITLE") ' +
+      'buttons {"Deny", "Allow"} default button "Deny" cancel button "Deny" with icon caution';
     return { cmd: 'osascript', args: ['-e', osa] };
   }
   // Linux/BSD: zenity needs an X or Wayland display. Without one, fail closed.
   if (env.DISPLAY || env.WAYLAND_DISPLAY) {
-    return { cmd: 'zenity', args: ['--question', `--title=${title}`, `--text=${msg}`, '--ok-label=Allow', '--cancel-label=Deny', '--width=420'] };
+    return {
+      cmd: 'zenity',
+      args: [
+        '--question',
+        `--title=${title}`,
+        `--text=${msg}`,
+        '--ok-label=Allow',
+        '--cancel-label=Deny',
+        '--width=420',
+      ],
+    };
   }
   return null; // headless → caller denies
 }
@@ -136,7 +173,9 @@ function openOSDialog(label, token) {
     const plan = buildDialogSpawn(process.platform, process.env, msg, title);
     if (!plan) {
       // R2: human log to stderr. Fail closed — no approval channel means no write.
-      process.stderr.write(`[sparda] no desktop display — write auto-denied (Signal 2 unreachable): ${label}\n`);
+      process.stderr.write(
+        `[sparda] no desktop display — write auto-denied (Signal 2 unreachable): ${label}\n`,
+      );
       return resolve(false);
     }
     let proc;
@@ -148,16 +187,33 @@ function openOSDialog(label, token) {
     } catch {
       return resolve(false); // spawner missing → deny
     }
-    const timer = setTimeout(() => { try { proc.kill(); } catch { /* already gone */ } resolve(false); }, TIMEOUT_MS);
-    proc.on('close', (code) => { clearTimeout(timer); resolve(code === 0); });
-    proc.on('error', () => { clearTimeout(timer); resolve(false); }); // binary absent (e.g. no zenity) → deny
+    const timer = setTimeout(() => {
+      try {
+        proc.kill();
+      } catch {
+        /* already gone */
+      }
+      resolve(false);
+    }, TIMEOUT_MS);
+    proc.on('close', (code) => {
+      clearTimeout(timer);
+      resolve(code === 0);
+    });
+    proc.on('error', () => {
+      clearTimeout(timer);
+      resolve(false);
+    }); // binary absent (e.g. no zenity) → deny
   });
 }
 
 // test hooks: inject a fake dialog, inspect/clear the pending map. Never used in production.
 export const _confirmTestHooks = {
-  setDialogProvider: (fn) => { dialogProvider = fn; },
-  clearDialogProvider: () => { dialogProvider = null; },
+  setDialogProvider: (fn) => {
+    dialogProvider = fn;
+  },
+  clearDialogProvider: () => {
+    dialogProvider = null;
+  },
   getPendingCount: () => pendingWrites.size,
   clearAll: () => pendingWrites.clear(),
   TIMEOUT_MS,