monitor MCP 0.3.0: deployment-insights leg + lint leg (closes two Claude-only matrix gaps on Codex)

[sethconvex]

What

Two new legs in fix_errors_automatically, closing two of the three Claude-only rows in the plugin capability matrix (docs: /ai/plugins):

• Leg 5 — insights (kind occ): polls npx convex insights on the served cadence (default 600s, tunable from the anteater's monitors.json without a plugin release), snapshot-diffs, and surfaces only NEW OCC write-conflict / read-limit findings with the fix playbook. Self-guards: only cloud, non-anonymous CONVEX_DEPLOYMENT; silent on any poll failure. Same semantics as the Claude convex-occ-insights shell monitor (first poll = silent baseline).
• Leg 6 — lint (kind lint_error): the Claude plugin's 12 PreToolUse hard-deny rules (convex-backend-skill hooks/convex-lint.mjs), ported to a pure module convex-lint-rules.mjs, run on a debounced convex/*.ts watch. Codex has no pre-tool-use hook to block the write, so the anti-pattern surfaces as the next event seconds after it lands — before a convex dev push cycle is wasted. Per-file signature dedupe; pre-existing findings are baselined silently on first arm (hook parity: only new writes fire).

Server 0.2.1 → 0.3.0, plugin 0.4.6 → 0.4.7. Tool name and input schema unchanged (no review-triggering surface change).

Tests

• lint-rules.test.mjs (new): 23 unit cases — every rule fires on its target pattern, plus false-positive discipline (JS array .filter, "use node" + crypto, wrapped httpAction, non-convex paths, _generated/, .d.ts all stay clean).
• test.mjs: 10 new integration scenarios (lint fire / dedupe / pre-existing baseline; insights baseline→new-line fire, playbook note, anonymous-deployment self-guard). 45/45 pass.

Notes

• Rules module carries a provenance note: source of truth stays the Claude hook until the rules are extracted/served from convex-agents content — port changes there first.
• specToConfig now also captures raw intervalSecByKind (additive; older specs unaffected).
• Companion source-repo change (convex-agents): lint servedOnly kind in content/machinery/monitors.json + KIND_ALIASES so the machinery drift gate tracks coverage.

🤖 Generated with Claude Code