ucn 5.1.1 → 5.2.1

package/mcp/stdio-server.js

@@ -0,0 +1,296 @@
+'use strict';
+
+/**
+ * Minimal MCP stdio transport for UCN's one-tool, local-only server.
+ *
+ * UCN does not expose HTTP, OAuth, resources, prompts, sampling, or remote
+ * transports. Pulling those facilities into every npm install substantially
+ * widened the production dependency and capability surface. This adapter
+ * implements the MCP base lifecycle plus tools/list, tools/call, and ping over
+ * newline-delimited JSON-RPC, which is the complete surface UCN advertises.
+ */
+
+const MAX_MESSAGE_CHARS = 10 * 1024 * 1024;
+const LATEST_PROTOCOL_VERSION = '2025-11-25';
+const SUPPORTED_PROTOCOL_VERSIONS = new Set([
+    '2024-11-05',
+    '2025-03-26',
+    '2025-06-18',
+    LATEST_PROTOCOL_VERSION,
+]);
+
+const ERROR = Object.freeze({
+    PARSE: -32700,
+    INVALID_REQUEST: -32600,
+    METHOD_NOT_FOUND: -32601,
+    INVALID_PARAMS: -32602,
+    INTERNAL: -32603,
+});
+
+function isObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function isRequestId(value) {
+    return value === null || typeof value === 'string' ||
+        (typeof value === 'number' && Number.isFinite(value));
+}
+
+function toolError(message) {
+    return {
+        content: [{ type: 'text', text: `Error: ${message}` }],
+        isError: true,
+    };
+}
+
+function validateValue(key, value, rule) {
+    if (rule.type === 'string' && typeof value !== 'string') {
+        return `${key} must be a string.`;
+    }
+    if (rule.type === 'boolean' && typeof value !== 'boolean') {
+        return `${key} must be a boolean.`;
+    }
+    if (rule.type === 'number' && (typeof value !== 'number' || !Number.isFinite(value))) {
+        return `${key} must be a finite number.`;
+    }
+    if (rule.type === 'integer' &&
+        (typeof value !== 'number' || !Number.isSafeInteger(value))) {
+        return `${key} must be an integer.`;
+    }
+    if (rule.minLength !== undefined && value.length < rule.minLength) {
+        return `${key} must contain at least ${rule.minLength} character(s).`;
+    }
+    if (rule.minimum !== undefined && value < rule.minimum) {
+        return `${key} must be greater than or equal to ${rule.minimum}.`;
+    }
+    if (rule.exclusiveMinimum !== undefined && value <= rule.exclusiveMinimum) {
+        return `${key} must be greater than ${rule.exclusiveMinimum}.`;
+    }
+    if (rule.maximum !== undefined && value > rule.maximum) {
+        return `${key} must be less than or equal to ${rule.maximum}.`;
+    }
+    if (rule.enum && key !== 'command' && !rule.enum.includes(value)) {
+        return `${key} must be one of: ${rule.enum.join(', ')}.`;
+    }
+    return null;
+}
+
+/**
+ * Validate advertised input constraints without silently stripping unknown
+ * keys. Unknown keys deliberately reach UCN's handler, which returns typo and
+ * applicability guidance to the agent. The command enum is advertised for
+ * discovery but runtime validation remains string-based so retired command
+ * names can receive directive migration guidance.
+ */
+function validateToolArguments(value, schema) {
+    if (!isObject(value)) return 'arguments must be an object.';
+    for (const key of schema.required || []) {
+        if (!Object.prototype.hasOwnProperty.call(value, key)) {
+            return `${key} is required.`;
+        }
+    }
+    if (typeof value.project_dir === 'string' && value.project_dir.trim().length === 0) {
+        return 'project_dir is required and must be a non-empty path.';
+    }
+    for (const [key, input] of Object.entries(value)) {
+        const rule = schema.properties?.[key];
+        if (!rule) continue;
+        const error = validateValue(key, input, rule);
+        if (error) return error;
+    }
+    return null;
+}
+
+class StdioMcpServer {
+    constructor(serverInfo) {
+        this.serverInfo = { ...serverInfo };
+        this.tools = new Map();
+        this.initialized = false;
+        this.inputBuffer = '';
+        this.discardOversizedLine = false;
+    }
+
+    registerTool(name, definition, handler) {
+        if (this.tools.has(name)) throw new Error(`Tool already registered: ${name}`);
+        this.tools.set(name, {
+            definition: {
+                name,
+                description: definition.description,
+                inputSchema: definition.inputSchema,
+                annotations: definition.annotations,
+                execution: { taskSupport: 'forbidden' },
+            },
+            handler,
+        });
+    }
+
+    connect() {
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', chunk => this._receive(chunk));
+        process.stdin.on('end', () => {
+            if (this.inputBuffer.trim()) this._consumeLine(this.inputBuffer);
+            this.inputBuffer = '';
+        });
+        process.stdin.resume();
+    }
+
+    _receive(chunk) {
+        let remaining = chunk;
+        while (remaining.length > 0) {
+            const newline = remaining.indexOf('\n');
+            const part = newline === -1 ? remaining : remaining.slice(0, newline);
+            remaining = newline === -1 ? '' : remaining.slice(newline + 1);
+
+            if (!this.discardOversizedLine) {
+                this.inputBuffer += part;
+                if (this.inputBuffer.length > MAX_MESSAGE_CHARS) {
+                    this.inputBuffer = '';
+                    this.discardOversizedLine = true;
+                    this._sendError(null, ERROR.INVALID_REQUEST,
+                        `MCP message exceeds ${MAX_MESSAGE_CHARS} characters.`);
+                }
+            }
+            if (newline !== -1) {
+                if (!this.discardOversizedLine) this._consumeLine(this.inputBuffer);
+                this.inputBuffer = '';
+                this.discardOversizedLine = false;
+            }
+        }
+    }
+
+    _consumeLine(rawLine) {
+        const line = rawLine.endsWith('\r') ? rawLine.slice(0, -1) : rawLine;
+        if (!line.trim()) return;
+        let message;
+        try {
+            message = JSON.parse(line);
+        } catch (_) {
+            this._sendError(null, ERROR.PARSE, 'Parse error');
+            return;
+        }
+        void this._handleMessage(message);
+    }
+
+    async _handleMessage(message) {
+        if (!isObject(message) || message.jsonrpc !== '2.0' ||
+            typeof message.method !== 'string') {
+            const id = isObject(message) && isRequestId(message.id)
+                ? message.id : null;
+            this._sendError(id, ERROR.INVALID_REQUEST, 'Invalid Request');
+            return;
+        }
+
+        const hasId = Object.prototype.hasOwnProperty.call(message, 'id');
+        if (hasId && !isRequestId(message.id)) {
+            this._sendError(null, ERROR.INVALID_REQUEST, 'Invalid Request');
+            return;
+        }
+        const isRequest = hasId;
+        if (!isRequest) {
+            if (message.method === 'notifications/initialized') this.initialized = true;
+            // Cancellation may be ignored when synchronous work cannot be
+            // interrupted; unknown notifications are also fire-and-forget.
+            return;
+        }
+
+        try {
+            switch (message.method) {
+            case 'initialize':
+                this._initialize(message.id, message.params);
+                return;
+            case 'ping':
+                this._sendResult(message.id, {});
+                return;
+            case 'tools/list':
+                this._listTools(message.id, message.params);
+                return;
+            case 'tools/call':
+                await this._callTool(message.id, message.params);
+                return;
+            default:
+                this._sendError(message.id, ERROR.METHOD_NOT_FOUND,
+                    `Method not found: ${message.method}`);
+            }
+        } catch (error) {
+            this._sendError(message.id, ERROR.INTERNAL,
+                error?.message || 'Internal error');
+        }
+    }
+
+    _initialize(id, params) {
+        if (!isObject(params) || typeof params.protocolVersion !== 'string' ||
+            !isObject(params.capabilities) || !isObject(params.clientInfo) ||
+            typeof params.clientInfo.name !== 'string' ||
+            typeof params.clientInfo.version !== 'string') {
+            this._sendError(id, ERROR.INVALID_PARAMS, 'Invalid initialize parameters.');
+            return;
+        }
+        const protocolVersion = SUPPORTED_PROTOCOL_VERSIONS.has(params.protocolVersion)
+            ? params.protocolVersion : LATEST_PROTOCOL_VERSION;
+        this._sendResult(id, {
+            protocolVersion,
+            capabilities: { tools: { listChanged: false } },
+            serverInfo: this.serverInfo,
+        });
+    }
+
+    _listTools(id, params) {
+        if (params !== undefined && !isObject(params)) {
+            this._sendError(id, ERROR.INVALID_PARAMS, 'tools/list params must be an object.');
+            return;
+        }
+        if (params?.cursor !== undefined) {
+            this._sendError(id, ERROR.INVALID_PARAMS,
+                'Invalid tools/list cursor: UCN exposes one deterministic page.');
+            return;
+        }
+        this._sendResult(id, {
+            tools: [...this.tools.values()].map(tool => tool.definition),
+        });
+    }
+
+    async _callTool(id, params) {
+        if (!isObject(params) || typeof params.name !== 'string') {
+            this._sendError(id, ERROR.INVALID_PARAMS,
+                'tools/call requires a string name and object arguments.');
+            return;
+        }
+        const tool = this.tools.get(params.name);
+        if (!tool) {
+            this._sendError(id, ERROR.INVALID_PARAMS, `Unknown tool: ${params.name}`);
+            return;
+        }
+        const validationError = validateToolArguments(params.arguments, tool.definition.inputSchema);
+        if (validationError) {
+            this._sendResult(id, toolError(`Input validation error: ${validationError}`));
+            return;
+        }
+        try {
+            const result = await tool.handler(params.arguments);
+            this._sendResult(id, result);
+        } catch (error) {
+            this._sendResult(id, toolError(error?.message || 'Tool execution failed.'));
+        }
+    }
+
+    _sendResult(id, result) {
+        this._write({ jsonrpc: '2.0', id, result });
+    }
+
+    _sendError(id, code, message) {
+        this._write({ jsonrpc: '2.0', id, error: { code, message } });
+    }
+
+    _write(message) {
+        process.stdout.write(`${JSON.stringify(message)}\n`);
+    }
+}
+
+module.exports = {
+    ERROR,
+    LATEST_PROTOCOL_VERSION,
+    MAX_MESSAGE_CHARS,
+    StdioMcpServer,
+    SUPPORTED_PROTOCOL_VERSIONS,
+    validateToolArguments,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucn",
-  "version": "5.1.1",
+  "version": "5.2.1",
   "mcpName": "io.github.mleoca/ucn",
   "description": "Auditable AST code intelligence for AI agents: 18 task-oriented commands through one MCP tool, CLI, or agent skill. Supports JS/TS, Python, Go, Rust, Java, C, C++, C#, and HTML.",
   "main": "index.js",
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "version": "node scripts/sync-server-version.js && git add server.json",
-    "test": "node --test test/parser-unit.test.js test/integration.test.js test/cache.test.js test/formatter.test.js test/interactive.test.js test/feature.test.js test/regression-js.test.js test/regression-py.test.js test/regression-go.test.js test/regression-java.test.js test/regression-rust.test.js test/regression-c-family.test.js test/regression-cross.test.js test/regression-mcp.test.js test/regression-parser.test.js test/regression-commands.test.js test/regression-fixes.test.js test/regression-bugfixes.test.js test/release-surface-regressions.test.js test/prerelease-audit.test.js test/release-readiness-audit.test.js test/cross-language.test.js test/accuracy.test.js test/command-coverage.test.js test/perf-optimizations.test.js test/performance-gate-policy.test.js test/oracle-gate-policy.test.js test/consistency-eval.test.js test/agent-public-surface-benchmark.test.js test/command-contracts.test.js test/language-adapter.test.js test/systematic-test.js test/mcp-edge-cases.js test/conservation.test.js test/parity-test.js test/trust-matrix.test.js",
+    "test": "node --test test/parser-unit.test.js test/integration.test.js test/cache.test.js test/formatter.test.js test/interactive.test.js test/feature.test.js test/regression-js.test.js test/regression-py.test.js test/regression-go.test.js test/regression-java.test.js test/regression-rust.test.js test/regression-c-family.test.js test/regression-cross.test.js test/regression-mcp.test.js test/mcp-protocol.test.js test/mcp-sdk-compat.test.js test/dependency-security.test.js test/regression-parser.test.js test/regression-commands.test.js test/regression-fixes.test.js test/regression-bugfixes.test.js test/release-surface-regressions.test.js test/prerelease-audit.test.js test/release-readiness-audit.test.js test/cross-language.test.js test/accuracy.test.js test/command-coverage.test.js test/perf-optimizations.test.js test/performance-gate-policy.test.js test/oracle-gate-policy.test.js test/outcome-policy.test.js test/consistency-eval.test.js test/agent-public-surface-benchmark.test.js test/command-contracts.test.js test/language-adapter.test.js test/systematic-test.js test/mcp-edge-cases.js test/conservation.test.js test/parity-test.js test/trust-matrix.test.js",
     "benchmark:agent": "node test/agent-public-surface-benchmark.js",
     "benchmark:agent:gate": "node test/agent-public-surface-benchmark.js --gate",
     "benchmark:agent:legacy": "node test/agent-understanding-benchmark.js",
@@ -21,7 +21,7 @@
     "eval:host-calibration": "node eval/lib/host-calibration.js --pin",
     "eval:consistency": "node eval/run-consistency-eval.js --project .",
     "profile:callers": "node eval/profile-callers.js",
-    "lint": "eslint core/ cli/ mcp/ languages/ eval/run-*.js eval/*-gate-policy.js eval/profile-callers.js eval/oracles/*.js",
+    "lint": "eslint core/ cli/ mcp/ languages/ eval/run-*.js eval/*-gate-policy.js eval/outcome-policy.js eval/profile-callers.js eval/oracles/*.js",
     "verify": "npm run lint && npm test",
     "trust:gate:semantic": "node eval/run-oracle-eval.js --release --min-precision 0.98 --max-unscored-ratio 0.10",
     "trust:gate:deadcode": "node eval/run-deadcode-eval.js --release --sample 100 --arm default",
@@ -30,7 +30,9 @@
     "trust:gate:consistency": "node eval/run-consistency-eval.js --release --sample 40",
     "trust:gate:agent": "node test/agent-public-surface-benchmark.js --gate",
     "trust:gate:fast": "node --expose-gc eval/run-performance-gate.js --repo preact-signals,httpx --queries 20 && node eval/run-oracle-eval.js --repo preact-signals,httpx --min-precision 0.98 && node eval/run-consistency-eval.js --repo preact-signals,httpx --sample 20 --gate",
-    "trust:gate": "npm run trust:gate:performance && npm run trust:gate:semantic && npm run trust:gate:deadcode && npm run trust:gate:consistency && npm run trust:gate:agent"
+    "trust:gate": "npm run trust:gate:performance && npm run trust:gate:semantic && npm run trust:gate:deadcode && npm run trust:gate:consistency && npm run trust:gate:agent",
+    "eval:outcome": "node eval/run-outcome-eval.js",
+    "eval:census": "node eval/run-unverified-census.js"
   },
   "keywords": [
     "mcp",
@@ -83,7 +85,10 @@
     "node": ">=20"
   },
   "dependencies": {
+    "node-addon-api": "8.9.2",
+    "node-gyp-build": "4.8.4",
     "re2js": "2.8.6",
+    "ret": "0.5.0",
     "safe-regex2": "5.1.1",
     "tree-sitter": "0.21.1",
     "tree-sitter-c": "0.23.2",
@@ -97,11 +102,8 @@
     "tree-sitter-rust": "0.23.1",
     "tree-sitter-typescript": "0.23.2"
   },
-  "optionalDependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "zod": "^4.4.3"
-  },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "1.30.0",
     "@eslint/js": "^10.0.1",
     "eslint": "^10.8.1",
     "pyright": "1.1.411",