@aimarket/warden 0.9.0 → 0.13.0

package/dist/scan.d.ts

@@ -1,5 +1,7 @@
 import { type ClientKind, type ConfiguredServer, type DiscoveryEnv } from './scan-config.js';
 import { type FetchedServer } from './mcp-client.js';
+import { type HistorCheck } from './histor.js';
+import { type ToxicFlow } from './toxic-flow.js';
 import { type ClassifierOptions } from './classifier.js';
 import { type ToolChange } from './scan-lock.js';
 import type { Severity, ToolDef, WardenFinding, WardenPolicy, RulesetRef } from './types.js';
@@ -34,6 +36,12 @@ export interface ScanOptions {
 }
 export type ServerStatus = 'scanned' | 'launch-only' | 'blocked-at-launch' | 'error' | 'skipped';
 export interface HistorSummary {
+    /** What was asked about: an endpoint, or a stdio server's `npm:`/`pypi:` package. */
+    package?: string;
+    /** The package version HISTOR last observed in its sandbox. */
+    packageVersion?: string;
+    /** HISTOR's id for the server: what its feed takes in `watch=`. */
+    targetId?: string;
     match?: string;
     note?: string;
     page?: string;
@@ -73,6 +81,8 @@ export interface ScanServerResult {
         model: string;
         flagged: number;
         error?: string;
+        incompleteTools?: string[];
+        retried?: number;
     };
     lock?: {
         state: 'match' | 'drift' | 'missing' | 'updated' | 'unchanged' | 'refused';
@@ -101,6 +111,13 @@ export interface ScanReport {
         stale: string[];
         written: boolean;
     };
+    /**
+     * Per client: private data, outside text and an outbound channel among the servers it starts
+     * (toxic-flow.ts). Advisory: a flow never blocks and never changes the exit code.
+     */
+    flows: ToxicFlow[];
+    /** With --histor: a feed of changes to the servers HISTOR knows among these, for any feed reader. */
+    historWatch?: string;
     summary: {
         servers: number;
         scanned: number;
@@ -126,6 +143,29 @@ export declare function historEndpoint(raw: string): {
     endpoint?: string;
     reason?: string;
 };
+/**
+ * The npm or PyPI package a stdio launch runs, as HISTOR names it (`npm:<name>`,
+ * `pypi:<normalised name>`), or why it is not sent. Only a package from the public
+ * registry is named: a local path, a git or tarball URL, or a private registry
+ * (`--registry`, `--index-url`) stays on this machine. The version is not sent —
+ * the digest already tells HISTOR which of the versions it observed you run.
+ */
+export declare function historPackage(command: string, args: readonly string[]): {
+    package?: string;
+    reason?: string;
+};
+/**
+ * What HISTOR knows about a package beyond its tools: a name made to be taken for a popular one,
+ * and the marks of a stolen publishing token on the version it observed. All advisory.
+ */
+export declare function packageFindings(answer: HistorCheck): WardenFinding[];
+/**
+ * What the package did in HISTOR's sandbox (gVisor's own trace, decoy credentials, canary tool
+ * calls). Reading a decoy or writing where it would persist is the loud part; contacting its own
+ * API during a call is what API servers do and is not a finding, nor is loading .env from the
+ * working directory, which dotenv does for half the ecosystem.
+ */
+export declare function behaviourFindings(behaviour: Record<string, unknown> | undefined, version: string): WardenFinding[];
 export interface ScanDeps {
     fetch?: (server: ConfiguredServer, opts: ScanOptions) => Promise<FetchedServer>;
     historFetch?: typeof fetch;

package/dist/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAOA,OAAO,EAAiC,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAqB,MAAM,kBAAkB,CAAC;AAC/I,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGlF,OAAO,EAAkC,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAwG,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACvJ,OAAO,KAAK,EAAY,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAiB,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtH,eAAO,MAAM,UAAU,EAAE,QAAQ,EAAkD,CAAC;AAEpF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,UAAU,CAAC,EAAE,iBAAiB,GAAG;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACrD,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjG,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC9G,kGAAkG;IAClG,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjH,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACtI;AAID,eAAO,MAAM,UAAU,QAyCV,CAAC;AAEd,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,CAsF9G;AAED,qBAAa,cAAe,SAAQ,KAAK;;CAAyC;AAOlF,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAa7D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAU7C;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAelF;AAoBD,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,WAAW,CAAC,EAAE,OAAO,KAAK,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CACnC;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAoLzF;AAOD,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG,MAAM,CAI3F"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAOA,OAAO,EAAiC,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAqB,MAAM,kBAAkB,CAAC;AAC/I,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAElF,OAAO,EAAmC,KAAK,WAAW,EAAyB,MAAM,aAAa,CAAC;AACvG,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAiC,KAAK,iBAAiB,EAA6B,MAAM,iBAAiB,CAAC;AACnH,OAAO,EAAwG,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACvJ,OAAO,KAAK,EAAY,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAiB,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtH,eAAO,MAAM,UAAU,EAAE,QAAQ,EAAkD,CAAC;AAEpF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,UAAU,CAAC,EAAE,iBAAiB,GAAG;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACrD,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjG,MAAM,WAAW,aAAa;IAC5B,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,SAAS,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9G,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC9G,kGAAkG;IAClG,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjH,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3D;;;OAGG;IACH,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACtI;AAID,eAAO,MAAM,UAAU,QA6CV,CAAC;AAEd,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,CA8F9G;AAED,qBAAa,cAAe,SAAQ,KAAK;;CAAyC;AAOlF,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAa7D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAU7C;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAelF;AAOD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA6B7G;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,EAAE,CAoBpE;AAKD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAuBlH;AA0BD,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,WAAW,CAAC,EAAE,OAAO,KAAK,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CACnC;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CA6NzF;AAOD,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG,MAAM,CAI3F"}

package/dist/scan.js

@@ -9,7 +9,8 @@ import { discoverServers, CLIENT_KINDS } from './scan-config.js';
 import { fetchServer, McpClientError } from './mcp-client.js';
 import { mtlToolSetDigest, MtlError } from './mtl.js';
 import { historCheck, DEFAULT_HISTOR_URL } from './histor.js';
-import { classifyTools, ClassifierError } from './classifier.js';
+import { boundCapabilities, toxicFlows } from './toxic-flow.js';
+import { inspectTools, ClassifierError } from './classifier.js';
 import { LockStore, readLock, writeLock, lockEntryFor, diffTools, LOCK_VERSION } from './scan-lock.js';
 export const SEVERITIES = ['info', 'low', 'medium', 'high', 'critical'];
 // ── argument parsing ─────────────────────────────────────────────────────────
@@ -35,18 +36,22 @@ How to connect
 Verdicts
   --fail-on SEVERITY     block at this severity: info|low|medium|high|critical (default high)
   --policy FILE          strict JSON policy, as for wrap
+  --require-approval     require an explicit operator pin/lock covering every field and identity
   --lock FILE            compare with reviewed definitions; a server missing from the lock is blocked
   --update-lock          write what the servers advertise now into --lock (refuses blocked servers)
   --state-dir DIR        where wrap keeps pins (read only here)
   --feed URL --feed-key HEX   signed threat feed, as for wrap
-  --histor               ask the HISTOR log whether remote servers serve you what they serve everyone
+  --histor               ask the HISTOR log whether your servers serve you what they serve everyone
+                         (remote: endpoint + digest; npm/PyPI stdio: package name + digest)
                          (sends the endpoint without query or credentials, and a digest; never tool text)
   --histor-url URL       default ${DEFAULT_HISTOR_URL}
   --classifier-url URL --classifier-model NAME
                          also ask a model you choose (OpenAI-compatible: Ollama, vLLM, a hosted API)
                          whether each tool's text directs the model. Sends tool definitions to that URL.
                          Key, if any, from WARDEN_CLASSIFIER_API_KEY. Advisory unless --classifier-blocks.
-  --classifier-blocks    let the classifier's high/medium verdicts block like a rule
+  --classifier-blocks    enforce model verdicts; incomplete/error/uncertain inspection also refuses admission
+  --classifier-reasoning-effort none|low|medium|high
+                         optional provider-supported budget; omitted uses the provider default
 
 Output
   --json                 JSON report on stdout instead of a table
@@ -62,7 +67,9 @@ export async function parseScanArgs(argv, env = process.env) {
         format: 'table', failOnError: false, color: !!process.stdout.isTTY && !env.NO_COLOR,
     };
     let failOn, policyFile;
+    let requireApproval = false;
     let classifierUrl, classifierModel, classifierBlocks = false;
+    let classifierReasoning;
     const clients = [];
     const value = (flag) => {
         const v = argv.shift();
@@ -148,6 +155,12 @@ export async function parseScanArgs(argv, env = process.env) {
             case '--classifier-model':
                 classifierModel = value(arg);
                 break;
+            case '--classifier-reasoning-effort':
+                classifierReasoning = value(arg);
+                break;
+            case '--require-approval':
+                requireApproval = true;
+                break;
             case '--classifier-blocks':
                 classifierBlocks = true;
                 break;
@@ -188,23 +201,28 @@ export async function parseScanArgs(argv, env = process.env) {
         if (!raw || typeof raw !== 'object' || Array.isArray(raw))
             throw new Error('policy must be an object');
         for (const key of Object.keys(raw))
-            if (!['blockAtSeverity', 'pinToolDefs', 'allowUnknownServers', 'sensitiveToolPatterns'].includes(key))
+            if (!['blockAtSeverity', 'pinToolDefs', 'allowUnknownServers', 'sensitiveToolPatterns', 'requireApproval', 'capabilityBindings'].includes(key))
                 throw new Error(`Unknown policy field ${key}`);
         opts.policy = asPolicy(raw);
     }
+    if (requireApproval)
+        opts.policy.requireApproval = true;
     if (failOn)
         opts.policy = { ...opts.policy, blockAtSeverity: failOn };
     if (!!classifierUrl !== !!classifierModel)
         throw new Error('--classifier-url and --classifier-model go together');
     if (classifierBlocks && !classifierUrl)
         throw new Error('--classifier-blocks needs --classifier-url and --classifier-model');
+    if (classifierReasoning && (!classifierUrl || !['none', 'low', 'medium', 'high'].includes(classifierReasoning)))
+        throw new Error('--classifier-reasoning-effort needs a classifier and must be none, low, medium or high');
     if (classifierUrl && classifierModel) {
         const cu = new URL(classifierUrl);
         if (cu.protocol !== 'https:' && cu.protocol !== 'http:')
             throw new Error('--classifier-url must be http(s)');
         if (cu.username || cu.password)
             throw new Error('--classifier-url must not carry credentials; use WARDEN_CLASSIFIER_API_KEY');
-        opts.classifier = { url: classifierUrl, model: classifierModel, apiKey: env.WARDEN_CLASSIFIER_API_KEY || undefined, blocks: classifierBlocks };
+        opts.classifier = { url: classifierUrl, model: classifierModel, apiKey: env.WARDEN_CLASSIFIER_API_KEY || undefined, blocks: classifierBlocks,
+            ...(classifierReasoning ? { reasoningEffort: classifierReasoning } : {}) };
     }
     const u = new URL(opts.historUrl);
     if (u.protocol !== 'https:' && u.protocol !== 'http:')
@@ -286,6 +304,149 @@ export function historEndpoint(raw) {
         return { reason: 'the path looks like it carries a credential' };
     return { endpoint: `${u.protocol}//${u.host}${u.pathname}` };
 }
+const NPM_PACKAGE = /^(@[a-z0-9][a-z0-9._~-]{0,100}\/)?[a-z0-9][a-z0-9._~-]{0,100}$/;
+const PYPI_PACKAGE = /^[A-Za-z0-9]([A-Za-z0-9._-]{0,126}[A-Za-z0-9])?$/;
+/** Launcher flags that take a value, so the value is not mistaken for the package. */
+const VALUE_FLAGS = new Set(['--python', '-p', '--with', '-w', '--with-requirements', '--cache', '--node-options', '--call', '-c', '--spec', '--pip-args']);
+/**
+ * The npm or PyPI package a stdio launch runs, as HISTOR names it (`npm:<name>`,
+ * `pypi:<normalised name>`), or why it is not sent. Only a package from the public
+ * registry is named: a local path, a git or tarball URL, or a private registry
+ * (`--registry`, `--index-url`) stays on this machine. The version is not sent —
+ * the digest already tells HISTOR which of the versions it observed you run.
+ */
+export function historPackage(command, args) {
+    const base = (command.split(/[\\/]/).pop() ?? '').toLowerCase().replace(/\.(cmd|exe|ps1)$/, '');
+    let rest = [...args];
+    let kind;
+    if (base === 'npx' || base === 'bunx')
+        kind = 'npm';
+    else if ((base === 'npm' && rest[0] === 'exec') || ((base === 'pnpm' || base === 'yarn') && rest[0] === 'dlx') || (base === 'bun' && rest[0] === 'x')) {
+        kind = 'npm';
+        rest = rest.slice(1);
+    }
+    else if (base === 'uvx')
+        kind = 'pypi';
+    else if (base === 'uv' && rest[0] === 'tool' && rest[1] === 'run') {
+        kind = 'pypi';
+        rest = rest.slice(2);
+    }
+    else if (base === 'pipx' && rest[0] === 'run') {
+        kind = 'pypi';
+        rest = rest.slice(1);
+    }
+    else
+        return { reason: 'not started from a package manager (npx, uvx …)' };
+    let spec;
+    for (let i = 0; i < rest.length; i++) {
+        const a = rest[i];
+        if (/^--(registry|index-url|index|extra-index-url|find-links)(=|$)|^-i$|^-f$/.test(a))
+            return { reason: 'a private registry' };
+        if (a === '--') {
+            spec = rest[i + 1];
+            break;
+        }
+        if (a === '--package' || a === '--from' || (kind === 'npm' && a === '-p')) {
+            spec = rest[i + 1];
+            break;
+        }
+        if (a.startsWith('--package=') || a.startsWith('--from=')) {
+            spec = a.slice(a.indexOf('=') + 1);
+            break;
+        }
+        if (a.startsWith('-')) {
+            if (VALUE_FLAGS.has(a))
+                i++;
+            continue;
+        }
+        spec = a;
+        break;
+    }
+    if (!spec)
+        return { reason: 'no package in the launch line' };
+    if (spec.includes('://') || /^(file:|git[+:]|github:|link:|workspace:|\.|\/|~|[A-Za-z]:\\)/.test(spec))
+        return { reason: 'not a registry package' };
+    if (kind === 'npm') {
+        const at = spec.indexOf('@', 1);
+        const name = at > 0 ? spec.slice(0, at) : spec;
+        return NPM_PACKAGE.test(name) ? { package: `npm:${name}` } : { reason: 'not a registry package' };
+    }
+    const name = spec.split(/[[=<>!~@; ]/)[0];
+    return PYPI_PACKAGE.test(name) ? { package: `pypi:${name.toLowerCase().replace(/[-_.]+/g, '-')}` } : { reason: 'not a registry package' };
+}
+/**
+ * What HISTOR knows about a package beyond its tools: a name made to be taken for a popular one,
+ * and the marks of a stolen publishing token on the version it observed. All advisory.
+ */
+export function packageFindings(answer) {
+    const out = [];
+    const look = answer.packageLookalike;
+    if (look && typeof look.of === 'string') {
+        out.push({ gate: 'histor', severity: 'medium', code: 'HISTOR_PACKAGE_LOOKALIKE', advisory: true,
+            message: `This package is named like ${displaySafe(look.of, 120)} (${Number(look.weekly ?? 0).toLocaleString('en')} downloads a week; this one: ${Number(look.ownWeekly ?? 0).toLocaleString('en')}) — ${displaySafe(String(look.how ?? 'a similar name'), 80)}. Make sure it is the one you meant to install.` });
+    }
+    const sig = answer.target?.packageSignals;
+    const flags = Array.isArray(sig?.flags) ? sig.flags.filter((f) => typeof f === 'string') : [];
+    const v = displaySafe(String(sig?.version ?? '?'), 40), pv = displaySafe(String(sig?.previousVersion ?? '?'), 40);
+    if (flags.includes('provenance-lost'))
+        out.push({ gate: 'histor', severity: 'medium', code: 'HISTOR_PACKAGE_PROVENANCE_LOST', advisory: true,
+            message: `Version ${v} has no attested build, though ${pv} had one: it was not published by the project's CI. A stolen publishing token looks like this.` });
+    if (flags.includes('install-scripts-added'))
+        out.push({ gate: 'histor', severity: 'medium', code: 'HISTOR_PACKAGE_INSTALL_SCRIPTS', advisory: true,
+            message: `Version ${v} runs install scripts (${(sig?.installScripts ?? []).map(s => displaySafe(String(s), 20)).join(', ')}) that ${pv} did not: they run on install, before any check.` });
+    if (flags.includes('publisher-changed'))
+        out.push({ gate: 'histor', severity: 'low', code: 'HISTOR_PACKAGE_PUBLISHER_CHANGED', advisory: true,
+            message: `Version ${v} was published by ${displaySafe(String(sig?.publisher ?? '?'), 60)}, ${pv} by ${displaySafe(String(sig?.previousPublisher ?? '?'), 60)}.` });
+    if (flags.includes('new-dependencies'))
+        out.push({ gate: 'histor', severity: 'low', code: 'HISTOR_PACKAGE_NEW_DEPENDENCIES', advisory: true,
+            message: `Version ${v} added dependencies ${pv} did not have: ${(sig?.newDependencies ?? []).slice(0, 8).map(d => displaySafe(String(d), 60)).join(', ')}.` });
+    out.push(...behaviourFindings(sig?.behaviour, v));
+    return out;
+}
+const list = (xs, n = 6, len = 80) => (Array.isArray(xs) ? xs : []).filter((x) => typeof x === 'string').slice(0, n).map(x => displaySafe(x, len)).join(', ');
+const arr = (xs) => (Array.isArray(xs) ? xs.filter((x) => typeof x === 'string') : []);
+/**
+ * What the package did in HISTOR's sandbox (gVisor's own trace, decoy credentials, canary tool
+ * calls). Reading a decoy or writing where it would persist is the loud part; contacting its own
+ * API during a call is what API servers do and is not a finding, nor is loading .env from the
+ * working directory, which dotenv does for half the ecosystem.
+ */
+export function behaviourFindings(behaviour, version) {
+    if (!behaviour || typeof behaviour !== 'object')
+        return [];
+    const out = [];
+    const phase = (k) => (behaviour[k] && typeof behaviour[k] === 'object' ? behaviour[k] : {});
+    const names = { installScripts: 'its install scripts', startup: 'at startup', calls: 'when its tools were called' };
+    for (const key of ['installScripts', 'startup', 'calls']) {
+        const b = phase(key);
+        const secrets = arr(b.decoys).filter(d => !d.startsWith('.env'));
+        if (secrets.length)
+            out.push({ gate: 'histor', severity: 'high', code: 'HISTOR_PACKAGE_READS_SECRETS', advisory: true,
+                message: `In HISTOR's sandbox, version ${version} opened decoy credentials ${names[key]}: ${list(secrets)}.` });
+        if (arr(b.writes).length)
+            out.push({ gate: 'histor', severity: 'high', code: 'HISTOR_PACKAGE_PERSISTENCE', advisory: true,
+                message: `In HISTOR's sandbox, version ${version} wrote ${names[key]} where it would outlive the session: ${list(b.writes)}.` });
+    }
+    const start = phase('startup');
+    if (arr(start.network).length || arr(start.lookups).length)
+        out.push({ gate: 'histor', severity: 'medium', code: 'HISTOR_PACKAGE_STARTUP_NETWORK', advisory: true,
+            message: `In HISTOR's sandbox, version ${version} reached out at startup, before any tool was called: ${list(arr(start.network).length ? start.network : start.lookups)}.` });
+    const spawned = [...arr(start.exec), ...arr(phase('calls').exec)];
+    if (spawned.length)
+        out.push({ gate: 'histor', severity: 'low', code: 'HISTOR_PACKAGE_STARTS_PROGRAMS', advisory: true,
+            message: `In HISTOR's sandbox, version ${version} started programs: ${list(spawned, 6, 100)}.` });
+    const scripts = phase('installScripts');
+    if (arr(scripts.network).length || arr(scripts.lookups).length || arr(scripts.exec).length)
+        out.push({ gate: 'histor', severity: 'medium', code: 'HISTOR_PACKAGE_INSTALL_BEHAVIOUR', advisory: true,
+            message: `Installing version ${version} runs scripts (${list(scripts.packages, 4, 60)}) that ${arr(scripts.network).length || arr(scripts.lookups).length ? `reach ${list(arr(scripts.network).length ? scripts.network : scripts.lookups)}` : `start ${list(scripts.exec, 4, 100)}`} — before any check can run.` });
+    return out;
+}
+function historWatchUrl(opts, servers) {
+    if (!opts.histor)
+        return {};
+    const ids = [...new Set(servers.map(s => s.histor?.targetId).filter((x) => !!x))].sort().slice(0, 100);
+    return ids.length ? { historWatch: `${opts.historUrl.replace(/\/+$/, '')}/feed.xml?watch=${ids.join(',')}` } : {};
+}
 // ── the scan ─────────────────────────────────────────────────────────────────
 async function pool(items, n, fn) {
     const out = new Array(items.length);
@@ -329,6 +490,7 @@ export async function runScan(opts, deps = {}) {
     const lockStore = opts.lock ? new LockStore(lockFile?.servers ?? {}) : undefined;
     const wrapPins = READ_ONLY(new FilePinStore(join(opts.stateDir, 'pins')));
     const now = (deps.now ?? (() => new Date()))().toISOString();
+    const semanticReviews = new Map();
     const all = results.flatMap(r => r.servers);
     // The same server listed by two clients is checked once per entry: they are separate launches.
     const servers = await pool(all, opts.concurrency, async (server) => {
@@ -353,8 +515,11 @@ export async function runScan(opts, deps = {}) {
         }
         if (server.ref.transport === 'stdio' && !opts.launch) {
             const findings = [...launchVerdict.findings, ...(lockMissing ? [lockMissing] : [])];
-            return { ...base, status: 'launch-only', allow: !lockMissing, score: launchVerdict.score, findings,
-                ...(lockMissing ? { decidedBy: 'lock' } : {}), lock: lockStore ? { state: lockEntry ? 'match' : 'missing' } : undefined };
+            if (opts.policy.requireApproval)
+                findings.push({ gate: 'pinning', severity: 'high', code: 'TOOL_DEF_INSPECTION_REQUIRED',
+                    message: 'Strict admission cannot verify the approved definitions without tools/list; launch-only inspection is incomplete.' });
+            return { ...base, status: 'launch-only', allow: !lockMissing && !opts.policy.requireApproval, score: launchVerdict.score, findings,
+                ...(lockMissing ? { decidedBy: 'lock' } : opts.policy.requireApproval ? { decidedBy: 'pinning' } : {}), lock: lockStore ? { state: lockEntry ? 'match' : 'missing' } : undefined };
         }
         let fetched;
         try {
@@ -365,7 +530,20 @@ export async function runScan(opts, deps = {}) {
             const msg = err instanceof McpClientError ? err.message : err instanceof Error ? err.message : String(err);
             return { ...base, status: 'error', error: displaySafe(msg, 400), findings: lockMissing ? [lockMissing] : [], allow: lockMissing ? false : null, ...(lockMissing ? { decidedBy: 'lock' } : {}) };
         }
-        const verdict = await warden.vet(server.ref, fetched.tools);
+        let inspection, inspectionError;
+        if (opts.classifier && fetched.tools.length) {
+            try {
+                inspection = await inspectTools(fetched.tools, { ...opts.classifier, requireComplete: opts.classifier.blocks });
+                if (opts.classifier.blocks)
+                    semanticReviews.set(fetched.tools, inspection);
+            }
+            catch (err) {
+                inspectionError = err;
+            }
+        }
+        const reviewedWarden = Warden.create({ policy: opts.policy, threatFeed: feed, store,
+            semanticReview: semanticReviews.get(fetched.tools) });
+        const verdict = await reviewedWarden.vet(server.ref, fetched.tools);
         const findings = [...verdict.findings];
         let allow = verdict.allow, decidedBy = verdict.decidedBy, score = verdict.score;
         if (fetched.instructions) {
@@ -395,21 +573,33 @@ export async function runScan(opts, deps = {}) {
             mtlError = err instanceof MtlError ? err.code : String(err);
         }
         let histor;
-        if (opts.histor && server.ref.url) {
-            const target = historEndpoint(server.ref.url);
-            if (!target.endpoint)
+        if (opts.histor) {
+            const target = server.ref.url
+                ? historEndpoint(server.ref.url)
+                : historPackage(server.ref.command ?? '', server.ref.args ?? []);
+            if (!target.endpoint && !target.package)
                 histor = { notSent: target.reason };
             else {
                 try {
-                    const answer = await historCheck(opts.historUrl, { endpoint: target.endpoint, ...(mtlDigest ? { toolSetDigest: mtlDigest } : {}) }, { fetchImpl: deps.historFetch, userAgent: `warden-scan/${version}` });
-                    histor = { match: String(answer.match), note: typeof answer.note === 'string' ? displaySafe(answer.note, 400) : undefined,
+                    const query = target.endpoint ? { endpoint: target.endpoint } : { package: target.package };
+                    const answer = await historCheck(opts.historUrl, { ...query, ...(mtlDigest ? { toolSetDigest: mtlDigest } : {}) }, { fetchImpl: deps.historFetch, userAgent: `warden-scan/${version}` });
+                    const seenVersion = typeof answer.target?.packageVersion === 'string' ? displaySafe(answer.target.packageVersion, 64) : undefined;
+                    const targetId = typeof answer.target?.id === 'string' && /^[0-9a-f]{16}$/.test(answer.target.id) ? answer.target.id : undefined;
+                    histor = { ...(target.package ? { package: target.package } : {}), ...(seenVersion ? { packageVersion: seenVersion } : {}), ...(targetId ? { targetId } : {}),
+                        match: String(answer.match), note: typeof answer.note === 'string' ? displaySafe(answer.note, 400) : undefined,
                         page: answer.target?.page, unchangedSince: answer.observed?.unchangedSince, changes: answer.observed?.changes };
                     if (answer.match === 'different')
                         findings.push({ gate: 'histor', severity: 'medium', code: 'HISTOR_UNSEEN_TOOLSET', advisory: true,
-                            message: `HISTOR has never observed the tool set this server served you (${mtlDigest}). Either it changed after the last crawl, or it serves you something it does not serve the public crawler.` });
+                            message: target.package
+                                ? `HISTOR has never observed the tool set this package gave you (${mtlDigest}) in any version it ran${seenVersion ? ` (latest it ran: ${seenVersion})` : ''}. Either you run a version HISTOR has not reached yet, or the package on this machine is not the one published.`
+                                : `HISTOR has never observed the tool set this server served you (${mtlDigest}). Either it changed after the last crawl, or it serves you something it does not serve the public crawler.` });
+                    if (target.package)
+                        findings.push(...packageFindings(answer));
                     if (answer.match === 'previously-observed')
                         findings.push({ gate: 'histor', severity: 'low', code: 'HISTOR_OLDER_TOOLSET', advisory: true,
-                            message: 'HISTOR observed this tool set earlier, but the server now serves the public a different one.' });
+                            message: target.package
+                                ? `You run an older version of this package: HISTOR observed this tool set before${seenVersion ? `, and version ${seenVersion} serves a different one` : ''}.`
+                                : 'HISTOR observed this tool set earlier, but the server now serves the public a different one.' });
                     // The log's own classifier verdict on the set you were served, when it holds one: advisory, never a block.
                     const cls = answer.classifier;
                     if (answer.match === 'same' && cls && cls.status === 'classified' && Array.isArray(cls.findings)) {
@@ -430,11 +620,26 @@ export async function runScan(opts, deps = {}) {
         let classifier;
         if (opts.classifier && fetched.tools.length) {
             try {
-                const verdicts = await classifyTools(fetched.tools, opts.classifier);
-                classifier = { model: opts.classifier.model, flagged: verdicts.length };
+                if (!inspection)
+                    throw inspectionError ?? new ClassifierError("inspection unavailable");
+                const verdicts = inspection.findings;
+                classifier = { model: opts.classifier.model, flagged: verdicts.length, ...(inspection.retried ? { retried: inspection.retried } : {}) };
+                if (inspection.incomplete.length) {
+                    classifier.error = inspection.incomplete.map(r => r.error).join("; ").slice(0, 400);
+                    classifier.incompleteTools = inspection.incomplete.map(r => r.tool);
+                    for (const r of inspection.incomplete)
+                        findings.push({ gate: "classifier", code: "CLASSIFIER_INCOMPLETE", severity: "high", tool: r.tool,
+                            message: `Semantic inspection incomplete: ${displaySafe(r.error, 200)}. This is not an attack verdict.`, ...(!opts.classifier.blocks ? { advisory: true } : {}) });
+                    if (opts.classifier.blocks) {
+                        if (allow)
+                            decidedBy = "classifier";
+                        allow = false;
+                        score = 0;
+                    }
+                }
                 for (const v of verdicts) {
                     const f = { gate: 'classifier', code: 'TOOL_DEF_CLASSIFIER', severity: v.severity, tool: v.tool,
-                        message: `Model ${displaySafe(opts.classifier.model, 60)} reads this tool as ${v.categories.join(', ')}: ${displaySafe(v.reason, 300)} — at "${displaySafe(v.quote, 200)}"` };
+                        message: `Model ${displaySafe(opts.classifier.model, 60)} reads this tool as ${v.categories.join(', ')}: ${displaySafe(v.reason, 300)} — ${v.evidenceFields ? "source fields " + v.evidenceFields.map(x => displaySafe(x, 60)).join(", ") + "; preview" : "at"} "${displaySafe(v.quote, 200)}"` };
                     if (!opts.classifier.blocks)
                         f.advisory = true;
                     findings.push(f);
@@ -447,6 +652,15 @@ export async function runScan(opts, deps = {}) {
             }
             catch (err) {
                 classifier = { model: opts.classifier.model, flagged: 0, error: displaySafe(err instanceof ClassifierError ? err.message : String(err), 200) };
+                findings.push({ gate: 'classifier', code: 'CLASSIFIER_INCOMPLETE', severity: 'high',
+                    message: `Semantic inspection incomplete: ${classifier.error}. This is not an attack verdict.`,
+                    ...(!opts.classifier.blocks ? { advisory: true } : {}) });
+                if (opts.classifier.blocks) {
+                    if (allow)
+                        decidedBy = 'classifier';
+                    allow = false;
+                    score = 0;
+                }
             }
         }
         let lock;
@@ -455,10 +669,13 @@ export async function runScan(opts, deps = {}) {
             const drift = findings.some(f => f.code === 'TOOL_DEF_DRIFT' || f.code === 'SERVER_IDENTITY_DRIFT' || f.code === 'PIN_FORMAT_UPGRADE_REQUIRED' || (f.code === 'TOOL_DEF_UNCANONICAL' && !!lockEntry));
             lock = { state: !lockEntry ? 'missing' : drift ? 'drift' : 'match', ...(changes.length && lockEntry ? { changes } : !lockEntry ? { changes } : {}) };
         }
+        const classifierBlocked = new Set(opts.classifier?.blocks
+            ? [...(classifier?.error ? classifier.incompleteTools ?? fetched.tools.map(t => t.name) : []),
+                ...findings.filter(f => f.gate === 'classifier' && f.tool && !f.advisory && blocking(f, opts.policy)).map(f => f.tool)]
+            : []);
         return { ...base, status: 'scanned', allow, decidedBy: allow ? undefined : decidedBy, score, findings,
-            allowedTools: verdict.allowedTools, blockedTools: verdict.blockedTools, toolCount: fetched.tools.length,
-            serverInfo: fetched.serverInfo, mtlDigest, mtlError, histor, classifier, lock, tools: fetched.tools,
-            ...(classifier && opts.classifier?.blocks ? { blockedTools: [...new Set([...verdict.blockedTools, ...findings.filter(f => f.gate === 'classifier' && !f.advisory && blocking(f, opts.policy)).map(f => f.tool)])] } : {}) };
+            allowedTools: verdict.allowedTools.filter(t => !classifierBlocked.has(t)), blockedTools: [...new Set([...verdict.blockedTools, ...classifierBlocked])], toolCount: fetched.tools.length,
+            serverInfo: fetched.serverInfo, mtlDigest, mtlError, histor, classifier, lock, tools: fetched.tools };
     });
     let lockSummary;
     if (opts.lock && lockStore) {
@@ -479,9 +696,9 @@ export async function runScan(opts, deps = {}) {
                     continue;
                 }
                 // Approve only what the non-pinning gates accept, as `pins approve` does.
-                const fresh = await Warden.create({ policy: opts.policy, threatFeed: feed, store: NO_PINS }).vet(serverRef(s, all), s.tools);
+                const fresh = await Warden.create({ policy: { ...opts.policy, requireApproval: false }, threatFeed: feed, store: NO_PINS, semanticReview: semanticReviews.get(s.tools) }).vet(serverRef(s, all), s.tools);
                 const instructionsBlocked = s.findings.some(f => f.tool === 'initialize.instructions' && blocking(f, opts.policy));
-                if (!fresh.allow || instructionsBlocked) {
+                if (!fresh.allow || instructionsBlocked || (opts.classifier?.blocks && (s.classifier?.error || s.findings.some(f => f.gate === 'classifier' && blocking(f, opts.policy))))) {
                     if (previous)
                         next[s.id] = previous;
                     s.lock = { ...(s.lock ?? { state: 'refused' }), state: 'refused' };
@@ -492,7 +709,7 @@ export async function runScan(opts, deps = {}) {
                 const changed = !previous || previous.toolsHash !== entry.toolsHash || previous.identityHash !== entry.identityHash;
                 s.lock = { ...(s.lock ?? { state: 'updated' }), state: changed ? 'updated' : 'unchanged' };
                 // Once written, the server is reviewed: drop the findings that only said "not reviewed / drifted".
-                s.findings = s.findings.filter(f => !['LOCK_MISSING', 'TOOL_DEF_DRIFT', 'SERVER_IDENTITY_DRIFT', 'PIN_FORMAT_UPGRADE_REQUIRED', 'TOOL_DEF_UNPINNED'].includes(f.code));
+                s.findings = s.findings.filter(f => !['LOCK_MISSING', 'TOOL_DEF_DRIFT', 'SERVER_IDENTITY_DRIFT', 'PIN_FORMAT_UPGRADE_REQUIRED', 'TOOL_DEF_UNPINNED', 'TOOL_DEF_APPROVAL_REQUIRED'].includes(f.code));
                 s.allow = !s.findings.some(f => blocking(f, opts.policy));
                 if (s.allow) {
                     s.decidedBy = undefined;
@@ -517,7 +734,10 @@ export async function runScan(opts, deps = {}) {
     return {
         tool: 'warden-scan', version, scannedAt: now, ruleset: staticScanRulesetRef(), policy: opts.policy, launch: opts.launch,
         sources: results.map(r => ({ path: r.source.path, client: r.source.client, scope: r.source.scope, servers: r.servers.length, ...(r.error ? { error: displaySafe(r.error, 300) } : {}) })),
-        servers, lock: lockSummary, summary,
+        servers, lock: lockSummary,
+        flows: toxicFlows(servers.filter(s => s.status === 'scanned' && s.allow === true).map(s => ({ client: s.client, key: s.key, tools: s.tools?.filter(t => s.allowedTools.includes(t.name)), capabilities: s.tools ? boundCapabilities(serverRef(s, all), s.tools, opts.policy.capabilityBindings) : undefined }))),
+        ...historWatchUrl(opts, servers),
+        summary,
     };
 }
 function serverRef(s, all) {