synartesis 0.6.12 → 0.6.15

package/dist/proxy.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  PROXY_FLAGS,
   canonical,
   cliCommandFrom,
   connectStdioUpstream,
@@ -18,8 +19,11 @@ import {
   refusal,
   runRead,
   toPayload,
-  verifyAgainstServers
-} from "./chunk-FUVEHRJP.js";
+  untested,
+  verifyAgainstServers,
+  warnUntested,
+  withIdempotencyKey
+} from "./chunk-OODDXM36.js";
 import {
   SnapshotError,
   UpstreamError,
@@ -582,14 +586,21 @@ function createProxyServer(options) {
       enter();
       try {
         const wantsGate = policy.gate === "always" || policy.gate === "on_write" && shouldGateOnWrite(args);
-        const granted = wantsGate ? journal.findApproval({
+        const unresolved = policy.class === "readonly" ? void 0 : journal.findPending({
+          runId: activeRun,
+          server: route.upstream.name,
+          tool: route.tool,
+          args
+        });
+        const mustAsk = wantsGate || unresolved !== void 0;
+        const granted = mustAsk ? journal.findApproval({
           server: route.upstream.name,
           tool: route.tool,
           args,
           notBefore: new Date(Date.now() - APPROVAL_WINDOW_MS).toISOString()
         }) : void 0;
         const inherited = granted !== void 0 && granted.runId !== activeRun ? granted : void 0;
-        const waiting = granted === void 0 && wantsGate ? journal.findGated({
+        const waiting = granted === void 0 && mustAsk ? journal.findGated({
           runId: activeRun,
           server: route.upstream.name,
           tool: route.tool,
@@ -673,9 +684,13 @@ function createProxyServer(options) {
             );
           }
         };
-        const askedAlready = wantsGate;
-        if (wantsGate && (granted === void 0 || !spent)) {
-          await decide("this action cannot be undone");
+        const askedAlready = mustAsk;
+        if (mustAsk && (granted === void 0 || !spent)) {
+          const because = [
+            unresolved === void 0 ? void 0 : `an earlier attempt at this exact call, action ${String(unresolved.seq)}, went out and its outcome could never be established, so sending it again may apply the change a second time`,
+            wantsGate ? "this action cannot be undone" : void 0
+          ].filter((one) => one !== void 0);
+          await decide(because.join(", and "));
         }
         let snapshot;
         let verify;
@@ -730,7 +745,11 @@ function createProxyServer(options) {
         }
         const forwarded = {
           method: "tools/call",
-          params: { ...request.params, name: route.tool }
+          params: {
+            ...request.params,
+            name: route.tool,
+            _meta: withIdempotencyKey(request.params._meta, pending.idempotencyKey)
+          }
         };
         try {
           const result = await route.upstream.client.request(forwarded, PassthroughResult, {
@@ -775,6 +794,13 @@ function createProxyServer(options) {
               warnings.push(`inverse could not be resolved: ${describe(error)}`);
             }
           }
+          if (verify === void 0 && policy.verify !== void 0) {
+            try {
+              verify = planRead(policy.verify, context);
+            } catch (error) {
+              warnings.push(`the drift check could not be planned: ${describe(error)}`);
+            }
+          }
           let postSnapshot;
           if (verify !== void 0) {
             try {
@@ -1048,7 +1074,7 @@ function parseArgv(argv) {
     const at = argv.indexOf(flag);
     return at === -1 ? void 0 : argv[at + 1];
   };
-  const known = ["--manifest", "--journal", "--server", "--gate-timeout", "--log-level", "--http", "--http-host", "--http-idle", "--token"];
+  const known = PROXY_FLAGS;
   const unknown = argv.find((token) => token.startsWith("--") && !known.includes(token));
   if (unknown !== void 0) {
     throw new Error(`unknown flag ${unknown}; expected one of ${known.join(", ")}`);
@@ -1109,6 +1135,10 @@ async function main() {
     process.stderr.write(mark());
   }
   const manifest = loadManifest(argv.manifest);
+  const unproven = untested(manifest);
+  if (unproven.length > 0) {
+    log.warn({ servers: unproven }, warnUntested(unproven));
+  }
   const journal = openJournal(argv.journal);
   const declared = Object.entries(manifest.servers);
   const wanted = argv.server === void 0 ? declared : declared.filter(([name]) => name === argv.server);

package/manifests/filesystem.yaml

@@ -14,6 +14,7 @@ servers:
   fs:
     command: node
     args: ["node_modules/@modelcontextprotocol/server-filesystem/dist/index.js", "."]
+    provenance: live
 
 tools:
   # --- reads -------------------------------------------------------------
@@ -105,3 +106,10 @@ tools:
   - match: "fs.create_directory"
     class: irreversible
     gate: always
+
+# This policy is written for the server version named at the top. A later
+# version can keep a tool's name and change what it takes, which would leave
+# the policy above describing something else -- and undo would still produce an
+# answer. `synartesis pin` prints a `pins:` block for the server you actually
+# have; with it pasted in, a tool whose shape has moved stops the proxy at
+# startup instead of being quietly trusted.

package/manifests/git.yaml

@@ -15,6 +15,7 @@ servers:
   git:
     command: uvx
     args: ["--from", "mcp-server-git", "mcp-server-git"]
+    provenance: live
 
 tools:
   # --- reads -------------------------------------------------------------
@@ -75,3 +76,10 @@ tools:
   - match: "git.git_checkout"
     class: irreversible
     gate: never
+
+# This policy is written for the server version named at the top. A later
+# version can keep a tool's name and change what it takes, which would leave
+# the policy above describing something else -- and undo would still produce an
+# answer. `synartesis pin` prints a `pins:` block for the server you actually
+# have; with it pasted in, a tool whose shape has moved stops the proxy at
+# startup instead of being quietly trusted.

package/manifests/github.yaml

@@ -24,6 +24,9 @@ servers:
     # Read from your shell; never written into this file.
     env:
       GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_PERSONAL_ACCESS_TOKEN}"
+    # Nothing here has met a real github; every shape below comes from
+    # documentation. That is a weaker claim than the others make.
+    provenance: documented
 
 tools:
   # --- reads -------------------------------------------------------------
@@ -188,3 +191,10 @@ tools:
   - match: "github.create_release"
     class: irreversible
     gate: always
+
+# This policy is written for the server version named at the top. A later
+# version can keep a tool's name and change what it takes, which would leave
+# the policy above describing something else -- and undo would still produce an
+# answer. `synartesis pin` prints a `pins:` block for the server you actually
+# have; with it pasted in, a tool whose shape has moved stops the proxy at
+# startup instead of being quietly trusted.

package/manifests/memory.yaml

@@ -18,6 +18,7 @@ servers:
     # or the agent will remember into a different file than it reads from.
     env:
       MEMORY_FILE_PATH: "${MEMORY_FILE_PATH}"
+    provenance: live
 
 tools:
   # --- reads -------------------------------------------------------------
@@ -54,6 +55,16 @@ tools:
       tool: "memory.delete_entities"
       args:
         entityNames: "$result.entities[].name"
+    # Deleting an entity takes its observations and its relations with it. So
+    # the compensating delete is only safe while the entity is still the thing
+    # the agent made: if anybody has added to it since, undoing destroys work
+    # nobody recorded. There is no pre-read to compare against -- the entity
+    # did not exist before the call -- so this reads it back afterwards, and
+    # undo halts rather than deleting over somebody.
+    verify:
+      tool: "memory.open_nodes"
+      args:
+        names: "$result.entities[].name"
 
   - match: "memory.create_relations"
     class: compensable
@@ -94,3 +105,10 @@ tools:
   - match: "memory.delete_observations"
     class: irreversible
     gate: always
+
+# This policy is written for the server version named at the top. A later
+# version can keep a tool's name and change what it takes, which would leave
+# the policy above describing something else -- and undo would still produce an
+# answer. `synartesis pin` prints a `pins:` block for the server you actually
+# have; with it pasted in, a tool whose shape has moved stops the proxy at
+# startup instead of being quietly trusted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synartesis",
-  "version": "0.6.12",
+  "version": "0.6.15",
   "description": "An undo layer for AI agents.",
   "type": "module",
   "private": false,
@@ -74,7 +74,8 @@
     "overrides": {
       "fast-uri": "^3.1.7",
       "hono": "^4.13.7",
-      "qs": "^6.16.0"
+      "qs": "^6.16.0",
+      "esbuild": "^0.28.1"
     }
   },
   "devDependencies": {