sparda-mcp 0.7.0 → 0.7.1

package/README.md

@@ -105,6 +105,8 @@ What we *don't* promise: the honest limits in [docs/SECURITY.md](./docs/SECURITY
 2. Tool calls run **inside your live app process** — warm DB pools, real auth chain, real data. SPARDA adds no infrastructure: compute comes from your host process, intelligence from your AI client's own model (MCP sampling), storage from `sparda.json` + git.
 3. Write tools (POST/PUT/DELETE) are **disabled by default**. You opt in per tool in `sparda.json` — your choices survive re-runs.
 4. Suspicious docstrings are sanitized before they ever reach the AI (prompt-injection defense).
+5. `npx sparda-mcp doctor --app` audits your codebase for drift: it detects stale tools (IA seeing ghosts), unsynced routes, schema drift via fingerprints, and zombie configurations. High severity issues trigger a non-zero exit code for your CI pipeline.
+6. `npx sparda-mcp seed export/import` lets you package and share your app's "genome" (semantic memory, workflows, antibodies) securely, transferring immune memory between environments or across similar stacks with zero data leak.
 
 ## What SPARDA gives your AI
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "mcpName": "io.github.zyx77550/sparda-mcp",
   "description": "Turn any codebase into an MCP server with one command. Express & FastAPI → Claude-ready in 3 minutes.",
   "type": "module",

package/src/server/crystallize.js

@@ -32,6 +32,112 @@ export function fallbackComposite(circuit) {
   };
 }
 
+// ── R2.4: nothing disappears, x becomes y ──────────────────────────────────
+// Tool names derive from method+path, so a renamed route means a vanished step
+// name. Instead of letting the composite die silently at wake-up, we look for
+// the step's UNIQUE deterministic successor: an enabled GET whose name keeps
+// the old name's segments in order (api_users ⊂ api_v2_users) and ends on the
+// same resource segment. One candidate → re-map; zero or many → dormant with a
+// recorded reason. Never a guess: ambiguity is a reason, not a coin flip.
+
+function nameSegments(toolName) {
+  const parts = String(toolName).split('_');
+  return ['get', 'post', 'put', 'patch', 'delete'].includes(parts[0])
+    ? parts.slice(1)
+    : parts;
+}
+
+function isSubsequence(small, big) {
+  let i = 0;
+  for (const seg of big) if (seg === small[i]) i++;
+  return i === small.length;
+}
+
+export function successorFor(oldName, toolSpecs, exclude = new Set()) {
+  const oldSegs = nameSegments(oldName);
+  if (!oldSegs.length) return null;
+  const last = oldSegs[oldSegs.length - 1];
+  const candidates = Object.entries(toolSpecs)
+    .filter(([name, t]) => {
+      if (exclude.has(name) || !t.enabled || t.method !== 'GET') return false;
+      const segs = nameSegments(name);
+      return segs[segs.length - 1] === last && isSubsequence(oldSegs, segs);
+    })
+    .map(([name]) => name);
+  return candidates.length === 1 ? candidates[0] : null;
+}
+
+// (circuits map, today's tools) → what survives, what becomes, what sleeps.
+// Pure: never mutates the input; the caller decides what to persist.
+export function remapComposites(circuits, toolSpecs) {
+  const remapped = [];
+  const dormant = [];
+  for (const [oldKey, circuit] of Object.entries(circuits ?? {})) {
+    if (!circuit?.composite?.name) continue;
+    if (eligibleForCrystallization(circuit, toolSpecs)) continue; // alive as-is
+
+    const disabled = (circuit.steps ?? []).filter(
+      (s) => toolSpecs[s] && !toolSpecs[s].enabled,
+    );
+    if (disabled.length) {
+      // the user disabled a step on purpose — respect it, do not re-route around it
+      dormant.push({
+        composite: circuit.composite.name,
+        key: oldKey,
+        reason: `step disabled by the user: ${disabled.join(', ')} — composite sleeps until re-enabled`,
+      });
+      continue;
+    }
+
+    const renames = {};
+    const newSteps = [];
+    let resolvable = true;
+    for (const step of circuit.steps ?? []) {
+      if (toolSpecs[step]?.enabled && toolSpecs[step].method === 'GET') {
+        newSteps.push(step);
+        continue;
+      }
+      const successor = successorFor(step, toolSpecs, new Set(newSteps));
+      if (!successor) {
+        resolvable = false;
+        dormant.push({
+          composite: circuit.composite.name,
+          key: oldKey,
+          reason: `step vanished with no unique successor: ${step} — structure kept, waiting for a sync that brings it back`,
+        });
+        break;
+      }
+      renames[step] = successor;
+      newSteps.push(successor);
+    }
+    if (!resolvable) continue;
+
+    const next = structuredClone(circuit);
+    next.steps = newSteps;
+    next.links = (next.links ?? []).map((l) => ({
+      ...l,
+      from: renames[l.from] ?? l.from,
+      to: renames[l.to] ?? l.to,
+    }));
+    if (!eligibleForCrystallization(next, toolSpecs)) {
+      dormant.push({
+        composite: circuit.composite.name,
+        key: oldKey,
+        reason:
+          'successor found but the re-mapped circuit is not crystallizable — kept dormant',
+      });
+      continue;
+    }
+    remapped.push({
+      oldKey,
+      newKey: next.steps.join('>'),
+      circuit: next,
+      renames,
+    });
+  }
+  return { remapped, dormant };
+}
+
 // a sampled name is untrusted input: normalize hard, reject anything shapeless
 export function normalizeCompositeName(raw) {
   const n = String(raw ?? '')

package/src/server/stdio.js

@@ -15,6 +15,7 @@ import { createIdleHarvester } from './idle.js';
 import { createSequenceRecorder, sequenceRecordingEnabled } from './condenser.js';
 import {
   eligibleForCrystallization,
+  remapComposites,
   fallbackComposite,
   normalizeCompositeName,
   compositeSchema,
@@ -228,11 +229,59 @@ export async function startStdioBridge({ cwd, portOverride }) {
   // composites born in past sessions wake up with the bridge — re-validated
   // against today's tools (a route may have changed or been disabled since)
   if (recorder) {
+    // R2.4 — nothing disappears, x becomes y: a step whose route was renamed is
+    // re-mapped to its UNIQUE deterministic successor instead of killing the
+    // composite silently; the unmappable go dormant WITH a recorded lesson.
+    const { remapped, dormant } = remapComposites(
+      manifest.labs?.circuits ?? {},
+      toolSpecs,
+    );
     for (const [sig, c] of Object.entries(manifest.labs?.circuits ?? {})) {
       if (c.composite?.name && eligibleForCrystallization(c, toolSpecs)) {
         composites.set(uniqueCompositeName(c.composite.name), { sig, circuit: c });
       }
     }
+    for (const r of remapped) {
+      delete manifest.labs.circuits[r.oldKey];
+      manifest.labs.circuits[r.newKey] = r.circuit;
+      composites.set(uniqueCompositeName(r.circuit.composite.name), {
+        sig: r.newKey,
+        circuit: r.circuit,
+      });
+      manifest.sparding ??= {};
+      manifest.sparding.events ??= [];
+      manifest.sparding.events.push({
+        ts: new Date().toISOString(),
+        tool: r.circuit.composite.name,
+        decision: 'audit',
+        risk: 'low',
+        reasons: [
+          `composite re-mapped (R2.4): ${Object.entries(r.renames)
+            .map(([a, b]) => `${a} → ${b}`)
+            .join(', ')}`,
+        ],
+      });
+      if (manifest.sparding.events.length > 100) manifest.sparding.events.shift();
+      console.error(
+        `[sparda] R2.4: composite '${r.circuit.composite.name}' re-mapped (${Object.entries(
+          r.renames,
+        )
+          .map(([a, b]) => `${a} → ${b}`)
+          .join(', ')})`,
+      );
+    }
+    for (const d of dormant) {
+      manifest.sparding ??= {};
+      manifest.sparding.failures ??= {};
+      const fsig = `composite|${d.composite}|dormant`;
+      const prev = manifest.sparding.failures[fsig] ?? { count: 0, lesson: '' };
+      manifest.sparding.failures[fsig] = { count: prev.count + 1, lesson: d.reason };
+      console.error(`[sparda] R2.4: composite '${d.composite}' dormant — ${d.reason}`);
+    }
+    if (remapped.length || dormant.length) {
+      mergeManifestKeySync(manifestPath, 'labs', manifest.labs);
+      mergeManifestKeySync(manifestPath, 'sparding', manifest.sparding);
+    }
   }
 
   const descFor = (name, t) => {