vibe-gate-mcp 0.1.3 → 0.1.5

package/.env.example

@@ -1,13 +1,13 @@
 # =============================================================================
 # Vibe-Gate — copy to `.env` next to this package (or set the same keys in MCP env)
-# NEVER commit real keys. Required: pick ONE provider + its API key.
+# NEVER commit real keys. Pick one API provider with a key OR a signed-in local CLI.
 # =============================================================================
 
 # --- Required: Critic provider ---
-# One of: openai | anthropic | google | minimax | opencode
+# One of: openai | anthropic | google | minimax | opencode | codex-cli | claude-code | cursor-agent | opencode-cli
 CRITIC_PROVIDER=openai
 
-# --- Required: API key for the chosen provider (uncomment ONE block) ---
+# --- API key for direct API providers (uncomment ONE block when needed) ---
 
 # OpenAI
 OPENAI_API_KEY=
@@ -25,6 +25,20 @@ OPENAI_API_KEY=
 # OPENCODE_API_KEY=
 # OPENCODE_PLAN=go
 
+# --- Local CLI providers (no separate API key; install and sign in first) ---
+# CRITIC_PROVIDER=codex-cli
+# CRITIC_PROVIDER=claude-code
+# CRITIC_PROVIDER=cursor-agent
+# CRITIC_PROVIDER=opencode-cli
+# For opencode-cli, set CRITIC_MODEL to a provider/model ID from `opencode models`
+
+# Optional executable paths when the MCP host PATH cannot find the CLI
+# CODEX_CLI_PATH=/absolute/path/to/codex
+# CLAUDE_CODE_CLI_PATH=/absolute/path/to/claude
+# CURSOR_AGENT_CLI_PATH=/absolute/path/to/cursor-agent
+# OPENCODE_CLI_PATH=/absolute/path/to/opencode
+# CRITIC_CLI_TIMEOUT_MS=120000
+
 # --- Optional: model / persona ---
 # CRITIC_MODEL=gpt-5.4
 # CRITIC_PERSONA=clean-code-monk

package/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.1.5] - 2026-09-23
+
+### Fixed
+
+- Enforce bounded review inputs, close the conflict loop as deadlocked after a rejected third round, and avoid duplicating or persisting source payloads between rounds.
+- Load Critic `REQUEST:` paths from the workspace with path, file-count, file-size, line-count, and total-context limits; reject traversal and symlink escapes in changed-file reads.
+- Use the OpenAI Responses API so current reasoning models work without model-specific request parameters or a Vibe-Gate model allowlist.
+
+### Docs
+
+- Document the review limits and requested-context behavior, and add a release checklist and scope review.
+
+## [0.1.4] - 2026-09-21
+
+### Added
+
+- Add local Critic providers for Codex CLI, Claude Code, Cursor Agent, and OpenCode CLI, reusing existing CLI sign-ins without requiring separate API keys.
+- Add CLI path overrides, bounded execution time, and temporary per-run working directories.
+- Isolate OpenCode CLI config, deny agent tools, and remove OpenCode sessions after each request.
+- Document CLI provider setup, authentication, process restrictions, and researched adapter candidates.
+
+### Fixed
+
+- Reject malformed CLI JSON and JSONL responses instead of accepting partial output, and preserve provider errors if OpenCode session cleanup also fails.
+- Send Cursor Agent's review conversation through stdin in the form expected by its CLI.
+
+### Tests
+
+- Add coverage for CLI authentication reuse, process isolation, output parsing, malformed streams, and OpenCode session cleanup.
+
 ## [0.1.3] - 2026-09-04
 
 ### Added

package/README.md

@@ -4,17 +4,26 @@ An **Adversarial Quality Gate** for AI-assisted IDEs: the IDE agent and a Critic
 
 ## Quick start (npm / npx)
 
-### 1. Critic API key
+### 1. Choose a Critic provider
 
-Create a `.env` where you run vibe-gate **or** put the same keys in MCP `env`.
+Use a direct API provider with its key, or use a local CLI that is already installed and signed in. Local CLI providers do not need a separate provider API key.
 
 Copy from the package’s [`.env.example`](.env.example):
 
 ```bash
-# Minimal OpenAI example
+# Direct API example
 CRITIC_PROVIDER=openai
 OPENAI_API_KEY=YOUR_OPENAI_API_KEY
 
+# Or use the signed-in Codex CLI account (no API key)
+# CRITIC_PROVIDER=codex-cli
+
+# Or another signed-in local CLI (no separate API key)
+# CRITIC_PROVIDER=claude-code
+# CRITIC_PROVIDER=cursor-agent
+# CRITIC_PROVIDER=opencode-cli
+# CRITIC_MODEL=provider/model  # required for opencode-cli; see `opencode models`
+
 # Or OpenCode (https://opencode.ai/auth)
 # CRITIC_PROVIDER=opencode
 # OPENCODE_API_KEY=...
@@ -22,19 +31,27 @@ OPENAI_API_KEY=YOUR_OPENAI_API_KEY
 # CRITIC_MODEL=minimax-m3
 ```
 
-| Provider      | `CRITIC_PROVIDER` | Required key env                                |
+| Provider      | `CRITIC_PROVIDER` | Authentication                                  |
 | ------------- | ----------------- | ----------------------------------------------- |
 | OpenAI        | `openai`          | `OPENAI_API_KEY`                                |
 | Anthropic     | `anthropic`       | `ANTHROPIC_API_KEY`                             |
 | Google Gemini | `google`          | `GOOGLE_GENERATIVE_AI_API_KEY`                  |
 | MiniMax       | `minimax`         | `MINIMAX_API_KEY`                               |
 | OpenCode      | `opencode`        | `OPENCODE_API_KEY` (+ optional `OPENCODE_PLAN`) |
+| Codex CLI     | `codex-cli`       | Existing `codex login` session                  |
+| Claude Code   | `claude-code`     | Existing Claude Code account session            |
+| Cursor Agent  | `cursor-agent`    | Existing `cursor-agent login` session           |
+| OpenCode CLI  | `opencode-cli`    | Saved `opencode auth login` credentials + model |
+
+`opencode` is still the separate Zen/Go HTTP provider and needs `OPENCODE_API_KEY`. `opencode-cli` runs the local CLI and requires a `provider/model` value in `CRITIC_MODEL`; see the CLI guide for details.
+
+`CRITIC_MODEL` is passed to the selected provider or CLI without a Vibe-Gate model allowlist; the provider must support that model ID. The OpenAI API provider uses the Responses API. See [provider configuration](docs/USAGE.md#configuration--providers).
 
-Full list: [docs/project/VARIABLES.md](docs/project/VARIABLES.md).
+See [CLI provider setup and alternatives](docs/CLI_PROVIDERS.md) for CLI installation, login, configuration, OpenCode session details, and other candidates we evaluated. Full variable list: [docs/project/VARIABLES.md](docs/project/VARIABLES.md).
 
-### 2. Cursor MCP (any consumer repo)
+### 2. Configure Cursor MCP (any consumer repo)
 
-Project or user [`.cursor/mcp.json`](examples/cursor-mcp.project.json):
+Project or user [`.cursor/mcp.json`](examples/cursor-mcp.codex-cli.json) for Codex CLI (or use the [API-key example](examples/cursor-mcp.project.json)):
 
 ```json
 {
@@ -44,15 +61,14 @@ Project or user [`.cursor/mcp.json`](examples/cursor-mcp.project.json):
       "args": ["-y", "vibe-gate-mcp"],
       "env": {
         "VIBE_WORKSPACE_ROOT": "${workspaceFolder}",
-        "CRITIC_PROVIDER": "openai",
-        "OPENAI_API_KEY": "YOUR_OPENAI_API_KEY"
+        "CRITIC_PROVIDER": "codex-cli"
       }
     }
   }
 }
 ```
 
-Prefer keys in a local `.env` next to the package or in the consumer project under `VIBE_WORKSPACE_ROOT` (never commit secrets). MCP `env` overrides `.env`.
+For direct providers, prefer keys in a local `.env` next to the package or in the consumer project under `VIBE_WORKSPACE_ROOT` (never commit secrets). MCP `env` overrides `.env`. For a CLI provider, install and sign in to that CLI as the same OS user running the MCP server.
 
 ### 3. Call the tool (agents)
 
@@ -105,8 +121,10 @@ Probes: `updateStatus: false` or `phaseId` prefixes `mcp-smoke-` / `vibe-gate-pr
 | Doc                                                            | Description               |
 | -------------------------------------------------------------- | ------------------------- |
 | [docs/INSTALLATION.md](docs/INSTALLATION.md)                   | Install + multi-repo MCP  |
-| [docs/USAGE.md](docs/USAGE.md)                                 | First run                 |
+| [docs/USAGE.md](docs/USAGE.md)                                 | First run and providers   |
+| [docs/CLI_PROVIDERS.md](docs/CLI_PROVIDERS.md)                 | Local CLI providers       |
 | [docs/SEMANTIC_DIFF_PAYLOAD.md](docs/SEMANTIC_DIFF_PAYLOAD.md) | `files[]` contract        |
+| [docs/ROADMAP.md](docs/ROADMAP.md)                             | Release checklist         |
 | [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md)             | Stale MCP, path errors    |
 | [docs/project/VARIABLES.md](docs/project/VARIABLES.md)         | Env SSoT                  |
 | [examples/](examples/)                                         | Cursor mcp.json templates |