@brunobracaioli/aibrain 0.4.0-beta.7 → 0.4.0-beta.8

package/dist/claude-observation.mjs

@@ -16,7 +16,7 @@ export const MAX_LOG_FILES = 3;
 const LOCK_WAIT_MS = 250;
 const LOCK_STALE_MS = 30_000;
 const ADMISSION_MS = 60 * 60 * 1000;
-export const ADAPTER_VERSION = '0.4.0-beta.7';
+export const ADAPTER_VERSION = '0.4.0-beta.8';
 const MAX_DIAGNOSTIC_COUNT = 10_000_000;
 const MAX_DIAGNOSTIC_BYTES = 128 * 1024 * 1024;
 const CHECKPOINT_BACKENDS = new Set(['native_store', 'private_file']);

package/dist/cli.mjs

@@ -40,7 +40,7 @@ import { extensionsSummary, hooksCommand, mcpCommand } from './extensions-cli.mj
 import { sessionServers } from './mcp-servers.mjs';
 import { anyFormatter } from './guardrails/format.mjs';
 
-const VERSION = '0.4.0-beta.7';
+const VERSION = '0.4.0-beta.8';
 // The command is `aisac`; `aibrain` is an alias installed from the same entry.
 const COMMAND = 'aisac';
 const ENDPOINT = 'https://mcp.ai-brain.aisac.cloud/mcp';

package/dist/extensions-catalog.mjs

@@ -167,6 +167,10 @@ export function hookIds() {
  * @property {Readonly<Record<CatalogLocale, string>>} [loginNote] Why and how this login differs.
  * @property {Readonly<Record<CatalogLocale, string>>} description
  * @property {Readonly<Record<CatalogLocale, string>>} reaches What the server can reach (FR7).
+ * @property {readonly string[]} [blockedTools] Tools that spend money, removed in both
+ *   clients whatever the user's permission mode is (FR7.2). Exact names.
+ * @property {readonly string[]} [blockedToolPrefixes] Name prefixes removed in Claude Code
+ *   only, through a glob deny rule; Codex documents exact names only (FR7.2).
  */
 
 /** Session name of a catalog server, so it never collides with the user's own. */
@@ -215,6 +219,9 @@ export const MCP_CATALOG = Object.freeze([
     source: 'https://github.com/supabase-community/supabase-mcp',
     transport: { type: 'http', url: 'https://mcp.supabase.com/mcp?read_only=true' },
     login: 'host-oauth',
+    // read_only=true should already leave these out; the vendor does not publish
+    // what it removes, so they are blocked as a second layer (FR7.2).
+    blockedTools: ['create_project', 'confirm_cost', 'create_branch'],
     description: {
       en: "Supabase's hosted server, read-only: tables, SQL, logs, advisors and docs.",
       'pt-BR':
@@ -234,15 +241,19 @@ export const MCP_CATALOG = Object.freeze([
     source: 'https://vercel.com/docs/agent-resources/vercel-mcp',
     transport: { type: 'http', url: 'https://mcp.vercel.com' },
     login: 'host-oauth',
+    // buy_domain charges the team after a quote, and its confirm flag is a model
+    // argument; a domain transfer may be charged (FR7.1, FR7.2).
+    blockedTools: ['buy_domain', 'create_or_transfer_domain'],
+    blockedToolPrefixes: ['buy_'],
     description: {
       en: "Vercel's hosted server: projects, deployments, logs, domains and environment variables.",
       'pt-BR':
         'Servidor hospedado da Vercel: projetos, deploys, logs, domínios e variáveis de ambiente.',
     },
     reaches: {
-      en: 'The teams you grant at login, with the access of your Vercel user: projects, deployments, build and runtime logs, domains and DNS, and environment variables, including decrypted values. It also has write tools (deploy, change settings, DNS records) and no read-only mode, so keep the confirmation of each call on.',
+      en: 'The teams you grant at login, with the access of your Vercel user: projects, deployments, build and runtime logs, domains and DNS, and environment variables, including decrypted values. It also has write tools (deployments, environment variables, DNS records, firewall rules, project settings) and no read-only mode, so keep the confirmation of each call on. Buying domains is blocked by AISAC.',
       'pt-BR':
-        'Os times que você liberar no login, com o acesso do seu usuário Vercel: projetos, deploys, logs de build e de execução, domínios e DNS, e variáveis de ambiente, inclusive valores decifrados. Também tem ferramentas de escrita (deploy, configurações, registros DNS) e não tem modo somente leitura, então mantenha a confirmação de cada chamada ligada.',
+        'Os times que você liberar no login, com o acesso do seu usuário Vercel: projetos, deploys, logs de build e de execução, domínios e DNS, e variáveis de ambiente, inclusive valores decifrados. Também tem ferramentas de escrita (deploys, variáveis de ambiente, registros DNS, regras de firewall, configurações de projeto) e não tem modo somente leitura, então mantenha a confirmação de cada chamada ligada. A compra de domínios é bloqueada pela AISAC.',
     },
   },
   {

package/dist/extensions-cli.mjs

@@ -273,6 +273,11 @@ export function serverInfo(entry, locale, item) {
             note: 'Hosted by the vendor: its tools can change without a client release, so keep the confirmation of each call on.',
           },
     reaches: entry.reaches[locale],
+    // Tools that spend money, removed whatever the permission mode is (FR7.2).
+    blockedTools: [...(entry.blockedTools ?? [])],
+    ...(entry.blockedToolPrefixes === undefined
+      ? {}
+      : { blockedToolPrefixes: [...entry.blockedToolPrefixes] }),
     login,
     ...(variable === undefined ? {} : { tokenVariable: variable }),
     ...(entry.loginNote === undefined ? {} : { loginNote: entry.loginNote[locale] }),
@@ -293,6 +298,16 @@ function printInfo(info) {
   const where = info.transport.type === 'local' ? info.transport.command : info.transport.url;
   console.log(`Transport: ${info.transport.type}, ${where}. ${info.transport.note}`);
   console.log(`Reaches: ${info.reaches}`);
+  if (info.blockedTools.length > 0) {
+    const prefixes = info.blockedToolPrefixes ?? [];
+    const claudeOnly =
+      prefixes.length === 0
+        ? ''
+        : ` In Claude Code, also any tool whose name starts with ${prefixes.join(', ')}.`;
+    console.log(
+      `Blocked by AISAC, because they spend money: ${info.blockedTools.join(', ')}.${claudeOnly} They stay blocked even if you allow every tool or skip permission prompts.`,
+    );
+  }
   if (info.loginNote !== undefined) console.log(`Login: ${info.loginNote}`);
   console.log(`Log in from Claude Code: ${info.login.claude}`);
   console.log(`Log in from Codex: ${info.login.codex}`);

package/dist/launch.mjs

@@ -19,7 +19,13 @@ import {
   writeLaunchMarker,
 } from './engineering-pack.mjs';
 import { prepareGuardrails } from './guardrails-plugin.mjs';
-import { CODEX_MCP_ENV, claudeMcpEntries, mcpLaunchLines, sessionServers } from './mcp-servers.mjs';
+import {
+  CODEX_MCP_ENV,
+  claudeDenyRules,
+  claudeMcpEntries,
+  mcpLaunchLines,
+  sessionServers,
+} from './mcp-servers.mjs';
 import { enabledServerIds, readPreferences } from './extensions-preferences.mjs';
 import {
   CODEX_ENGINEERING_ENV,
@@ -561,6 +567,14 @@ export async function launchClaude(config, root, args, dependencies = {}) {
   for (const rule of [...userAllow, ...requiredAllow]) {
     if (!mergedAllow.includes(rule)) mergedAllow.push(rule);
   }
+  // Catalog tools that spend money stay denied whatever the user allows or the
+  // permission mode is (spec aisac-engineering-extensions FR7.2).
+  const userDeny = Array.isArray(userPermissions.deny) ? userPermissions.deny : [];
+  /** @type {unknown[]} */
+  const mergedDeny = [];
+  for (const rule of [...userDeny, ...claudeDenyRules()]) {
+    if (!mergedDeny.includes(rule)) mergedDeny.push(rule);
+  }
   const settings = {
     ...(launchArgs.settings?.sandbox === undefined ? {} : { sandbox: launchArgs.settings.sandbox }),
     pluginConfigs: {
@@ -570,6 +584,7 @@ export async function launchClaude(config, root, args, dependencies = {}) {
     permissions: {
       ...userPermissions,
       allow: mergedAllow,
+      deny: mergedDeny,
     },
   };
   try {

package/dist/mcp-servers.mjs

@@ -8,7 +8,7 @@
  * third-party credential: logins live in the host's own store, and a token
  * variable is only named, never read here.
  */
-import { MCP_SERVER_PREFIX, mcpById } from './extensions-catalog.mjs';
+import { MCP_CATALOG, MCP_SERVER_PREFIX, mcpById } from './extensions-catalog.mjs';
 import { tomlBasicString } from './codex-engineering.mjs';
 
 /** @typedef {import('./extensions-catalog.mjs').McpEntry} McpEntry */
@@ -80,7 +80,27 @@ export function claudeMcpEntries(entries) {
 }
 
 /**
- * Session-only `-c` overrides for the owned Codex app-server.
+ * Claude Code deny rules for the tools that spend money (FR7.2). They cover every
+ * catalog server, loaded or not, so the settings file can be written before the
+ * license is confirmed; a rule for a server that is not loaded matches nothing.
+ * Claude evaluates deny rules before allow rules, in every permission mode, and a
+ * deny rule removes the tool from the model's context (measured M1, Claude 2.1.318).
+ * @param {readonly McpEntry[]} [entries]
+ * @returns {string[]}
+ */
+export function claudeDenyRules(entries = MCP_CATALOG) {
+  return entries.flatMap((entry) => {
+    const prefix = `mcp__${serverName(entry.id)}__`;
+    return [
+      ...(entry.blockedTools ?? []).map((tool) => `${prefix}${tool}`),
+      ...(entry.blockedToolPrefixes ?? []).map((start) => `${prefix}${start}*`),
+    ];
+  });
+}
+
+/**
+ * Session-only `-c` overrides for the owned Codex app-server. A server with
+ * blocked tools gets `disabled_tools` (FR7.2; measured M2, Codex 0.164.0).
  * @param {readonly McpEntry[]} entries
  * @returns {string[]}
  */
@@ -88,6 +108,11 @@ export function codexMcpConfigArgs(entries) {
   return entries.flatMap((entry) => {
     const key = `mcp_servers.${serverName(entry.id)}`;
     const { transport } = entry;
+    const blocked = entry.blockedTools ?? [];
+    const disabled =
+      blocked.length === 0
+        ? []
+        : ['-c', `${key}.disabled_tools=[${blocked.map(tomlBasicString).join(',')}]`];
     if (transport.type === 'stdio')
       return [
         '-c',
@@ -96,6 +121,7 @@ export function codexMcpConfigArgs(entries) {
         `${key}.args=[${transport.args.map(tomlBasicString).join(',')}]`,
         '-c',
         `${key}.startup_timeout_sec=${STDIO_STARTUP_TIMEOUT_SEC}`,
+        ...disabled,
       ];
     return [
       '-c',
@@ -103,6 +129,7 @@ export function codexMcpConfigArgs(entries) {
       ...(transport.bearerEnv === undefined
         ? []
         : ['-c', `${key}.bearer_token_env_var=${tomlBasicString(transport.bearerEnv)}`]),
+      ...disabled,
     ];
   });
 }

package/dist/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@brunobracaioli/aibrain",
-  "version": "0.4.0-beta.7",
+  "version": "0.4.0-beta.8",
   "type": "module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunobracaioli/aibrain",
-  "version": "0.4.0-beta.7",
+  "version": "0.4.0-beta.8",
   "private": false,
   "description": "AISAC client for Claude Code and Codex: AI Brain memory, context management and AISAC Engineering",
   "license": "UNLICENSED",