@cybedefend/vibedefend 1.4.7 → 1.6.0

package/dist/mcp/verify/identity.js

@@ -0,0 +1,173 @@
+/** Identity of a coordinate, used to deduplicate one server across configs. */
+export function coordinateKey(c) {
+    if (c.url)
+        return `url:${c.url}`;
+    if (c.purl)
+        return `purl:${c.purl}`;
+    return `pkg:${c.ecosystem ?? ''}:${c.packageName ?? ''}:${c.version ?? ''}`;
+}
+// ─── Stable identity of a discovered server ──────────────────────────────────
+/**
+ * Names the identity of a server in a way that is stable across runs. The
+ * discovery layer has already deduplicated by coordinate, so every entry it
+ * yields is one physical server; `source` and `name` only matter for servers
+ * that resolved to no coordinate.
+ */
+export function serverIdOf(server) {
+    if (server.coordinate)
+        return coordinateKey(server.coordinate);
+    return `local:${server.source}:${server.name}`;
+}
+// ─── purl / server-check coordinate ──────────────────────────────────────────
+/**
+ * Builds a `purl` (package URL) from an npm/pip coordinate.
+ *
+ * The namespace of a SCOPED npm package is a path segment of its own
+ * (`pkg:npm/%40scope/name@version`), not a prefix encoded together with the
+ * name (`pkg:npm/%40scope%2Fname@version`). Encoding `@scope/name` as one
+ * string also encodes the `/` separator, which produced a non-conforming purl
+ * for every `@modelcontextprotocol/server-*` package.
+ */
+export function purlOf(coordinate) {
+    if (coordinate.purl)
+        return coordinate.purl;
+    if (!coordinate.ecosystem || !coordinate.packageName)
+        return undefined;
+    const type = coordinate.ecosystem === 'pip' ? 'pypi' : coordinate.ecosystem;
+    const versionSuffix = coordinate.version ? `@${encodeURIComponent(coordinate.version)}` : '';
+    if (type === 'npm' && coordinate.packageName.startsWith('@')) {
+        const withoutAt = coordinate.packageName.slice(1); // "scope/name"
+        const slashIdx = withoutAt.indexOf('/');
+        if (slashIdx > 0) {
+            const namespace = withoutAt.slice(0, slashIdx);
+            const name = withoutAt.slice(slashIdx + 1);
+            return `pkg:npm/%40${encodeURIComponent(namespace)}/${encodeURIComponent(name)}${versionSuffix}`;
+        }
+    }
+    return `pkg:${type}/${encodeURIComponent(coordinate.packageName)}${versionSuffix}`;
+}
+/** What `POST /mcp/servers/check` accepts for this coordinate, or `null` when nothing applies. */
+export function checkInputOf(coordinate) {
+    if (!coordinate)
+        return null;
+    if (coordinate.url)
+        return { url: coordinate.url };
+    const purl = purlOf(coordinate);
+    return purl ? { purl } : null;
+}
+export function checkInputKey(input) {
+    return input.url ? `url:${input.url}` : `purl:${input.purl ?? ''}`;
+}
+// ─── Identity of an upstream the proxy runs in front of (Phase 3) ────────────
+import { createHash } from 'node:crypto';
+import { canonicalMcpUrl } from '../auth/oauth.js';
+/**
+ * Package launchers whose first non-flag argument names a package.
+ *
+ * `npx`, `pnpm dlx` and `bunx` for npm; `uvx` and `pipx` for PyPI. Anything
+ * else — a path to a script, a binary on `PATH`, a shell wrapper — has no
+ * package coordinate to read, and pretending otherwise would file two
+ * unrelated servers under one identity.
+ */
+const NPM_LAUNCHERS = new Set(['npx', 'bunx', 'pnpx']);
+const PYPI_LAUNCHERS = new Set(['uvx', 'pipx']);
+/** Flags a launcher takes before the package name. */
+const LAUNCHER_FLAGS = new Set(['-y', '--yes', '-q', '--quiet', '--silent', '-p', '--package', 'run']);
+/** Strips a `.cmd` / `.exe` suffix and any directory, so `C:\…\npx.cmd` reads as `npx`. */
+function launcherName(command) {
+    const base = command.replace(/\\/g, '/').split('/').pop() ?? command;
+    return base.replace(/\.(cmd|exe|bat|ps1)$/i, '').toLowerCase();
+}
+/**
+ * The package a launcher command runs, or `null`.
+ *
+ * `npx -y @scope/name@1.2.3` reads as `@scope/name` at `1.2.3`. The leading
+ * `@` of a scope is not a version separator, which is the one thing a naive
+ * `split('@')` gets wrong on exactly the packages MCP servers ship as.
+ */
+export function parsePackageCoordinate(command, args) {
+    const launcher = launcherName(command);
+    const ecosystem = NPM_LAUNCHERS.has(launcher)
+        ? 'npm'
+        : PYPI_LAUNCHERS.has(launcher)
+            ? 'pypi'
+            : null;
+    if (!ecosystem)
+        return null;
+    const spec = args.find((arg) => !arg.startsWith('-') && !LAUNCHER_FLAGS.has(arg));
+    if (!spec)
+        return null;
+    // A scope starts with `@`; the version separator is the `@` AFTER it.
+    const separator = spec.lastIndexOf('@');
+    if (separator > 0) {
+        const version = spec.slice(separator + 1);
+        // `@scope/name` has its only `@` at index 0, already excluded above; a
+        // trailing `@` with nothing after it pins nothing.
+        if (version !== '' && !version.includes('/')) {
+            return { ecosystem, name: spec.slice(0, separator), version };
+        }
+    }
+    return { ecosystem, name: spec };
+}
+/**
+ * The identity the proxy files a server under.
+ *
+ * Four forms, in the order they are tried:
+ *
+ *   `url:<canonical>`        an HTTP server, keyed the same way its
+ *                            credential is (`canonicalMcpUrl`), so the two
+ *                            never disagree about which server this is;
+ *   `npm:<pkg>@<version>`    a pinned package, shareable across
+ *   `pypi:<pkg>@<version>`   organisations because it names the same bytes
+ *                            for everybody;
+ *   `cmd:sha256(...)`        anything else, including an UNPINNED package.
+ *
+ * The last one covers more than it looks: `npx -y @scope/server` with no
+ * version is the shape most people use, and it lands here on purpose. A
+ * verdict on "whatever npx resolves today" is not a fact about a package, it
+ * is a fact about one machine on one day, and sharing it between
+ * organisations would be sharing a guess.
+ */
+export function upstreamServerId(spec) {
+    if (spec.transport === 'http') {
+        return `url:${canonicalMcpUrl(spec.url) ?? spec.url}`;
+    }
+    const coordinate = parsePackageCoordinate(spec.command, spec.args);
+    if (coordinate?.version) {
+        return `${coordinate.ecosystem}:${coordinate.name}@${coordinate.version}`;
+    }
+    // Every argument, in order, separated by a character no argument can
+    // contain: `a b` and `a` `b` must not hash alike.
+    const material = [spec.command, ...spec.args].join('\u0000');
+    return `cmd:${createHash('sha256').update(material).digest('hex')}`;
+}
+/** A filesystem-safe name for the cache file of a server id. */
+export function serverIdFileName(serverId) {
+    // The id may contain `/`, `:` and `@`; the hash keeps it unambiguous while
+    // the readable prefix keeps the cache directory browsable.
+    const readable = serverId.replace(/[^A-Za-z0-9._-]+/g, '-').slice(0, 48).replace(/^-+|-+$/g, '');
+    const fingerprint = createHash('sha256').update(serverId).digest('hex').slice(0, 16);
+    return `${readable || 'server'}.${fingerprint}.json`;
+}
+/**
+ * What `POST /mcp/servers/check` accepts for an upstream, or `null`.
+ *
+ * A `cmd:` identity has nothing to send: there is no public coordinate to
+ * look up, and posting the hash would tell the backend a server exists
+ * without letting it say anything useful about it.
+ */
+export function upstreamCheckInput(spec) {
+    if (spec.transport === 'http') {
+        const url = canonicalMcpUrl(spec.url);
+        return url ? { url } : null;
+    }
+    const coordinate = parsePackageCoordinate(spec.command, spec.args);
+    if (!coordinate)
+        return null;
+    return checkInputOf({
+        ecosystem: coordinate.ecosystem === 'pypi' ? 'pip' : 'npm',
+        packageName: coordinate.name,
+        version: coordinate.version,
+    });
+}
+//# sourceMappingURL=identity.js.map

package/dist/mcp/verify/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/mcp/verify/identity.ts"],"names":[],"mappings":"AAsCA,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,CAAsB;IAClD,IAAI,CAAC,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAA2B;IACpD,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/D,OAAO,SAAS,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CAAC,UAA+B;IACpD,IAAI,UAAU,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;IAC5E,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7F,IAAI,IAAI,KAAK,KAAK,IAAI,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;QAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO,cAAc,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC;QACnG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,IAAI,IAAI,kBAAkB,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,aAAa,EAAE,CAAC;AACrF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAAC,UAA2C;IACtE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAA0B;IACtD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEhD,sDAAsD;AACtD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AASvG,2FAA2F;AAC3F,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;IACrE,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,IAAuB;IAEvB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAE,KAAe;QAClB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC5B,CAAC,CAAE,MAAgB;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC1C,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IACjD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,OAAO,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;QACxB,OAAO,GAAG,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC;IACD,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjG,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,GAAG,QAAQ,IAAI,QAAQ,IAAI,WAAW,OAAO,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;QAC1D,WAAW,EAAE,UAAU,CAAC,IAAI;QAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/verify/policy-store.js

@@ -0,0 +1,63 @@
+/**
+ * The last known policy of each organization, on this machine.
+ *
+ * `~/.cybedefend/mcp/policy.json`, keyed by organization id. It exists for
+ * the degraded session — backend unreachable, or no credential — which must
+ * still decide under the policy the organization actually has rather than
+ * under the default: an organization that set `block` last week has set it
+ * for the day the network is down too. Keyed by organization so a machine
+ * that moves between two of them never carries one's `block` into the
+ * other.
+ *
+ * Written by the verifier every time a response carries a policy, and by
+ * `GET …/policy`. Never a lever: nothing on this machine reads it as a
+ * setting, only as a memory of what the server said.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeFileAtomic } from '../config/atomicWrite.js';
+import { mcpHomeDir } from '../proxy/paths.js';
+import { isPolicyMode } from './policy.js';
+export function policyFile(env = process.env) {
+    return join(mcpHomeDir(env), 'policy.json');
+}
+function readAll(env) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(policyFile(env), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+}
+function toStoredPolicy(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const shape = raw;
+    if (!isPolicyMode(shape.mode) || typeof shape.strictIssuer !== 'boolean')
+        return null;
+    return {
+        mode: shape.mode,
+        strictIssuer: shape.strictIssuer,
+        learnedAt: typeof shape.learnedAt === 'string' ? shape.learnedAt : new Date(0).toISOString(),
+    };
+}
+/** What was last learned about this organization, or `null`. A corrupt entry is nothing known. */
+export function readStoredPolicy(organizationId, options = {}) {
+    const env = options.env ?? process.env;
+    return toStoredPolicy(readAll(env)[organizationId]);
+}
+/** Records the policy for this organization, leaving every other organization's entry as it is. */
+export function writeStoredPolicy(organizationId, policy, options = {}) {
+    const env = options.env ?? process.env;
+    const all = readAll(env);
+    const entry = {
+        mode: policy.mode,
+        strictIssuer: policy.strictIssuer,
+        learnedAt: (options.now ?? new Date()).toISOString(),
+    };
+    all[organizationId] = entry;
+    writeFileAtomic(policyFile(env), `${JSON.stringify(all, null, 2)}\n`, { mode: 0o600 });
+}
+//# sourceMappingURL=policy-store.js.map

package/dist/mcp/verify/policy-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-store.js","sourceRoot":"","sources":["../../../src/mcp/verify/policy-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AAY3D,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,GAAsB;IACrC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KAC7F,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,UAA8B,EAAE;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,cAAsB,EAAE,MAAiB,EAAE,UAA8B,EAAE;IAC3G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAiB;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,GAAG,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;IAC5B,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/dist/mcp/verify/policy.js

@@ -0,0 +1,158 @@
+export const SERVER_ACTIONS = ['allow', 'ask', 'warn', 'block', 'pending'];
+export function isServerAction(value) {
+    return typeof value === 'string' && SERVER_ACTIONS.includes(value);
+}
+export function isPolicyMode(value) {
+    return value === 'warn' || value === 'block';
+}
+/**
+ * Used ONLY when nothing was ever learned from the backend — the same
+ * fallback global-management applies to an organization that never set a
+ * policy. Not a lever: nothing on this machine can change it.
+ */
+/**
+ * Used only when this machine never learned any policy for the organization —
+ * the same fallback global-management serves for an organization that never
+ * set one (`block` since 2026-09-15): a verdict nobody chose to relax is refused.
+ */
+export const DEFAULT_ORG_POLICY = Object.freeze({ mode: 'block', strictIssuer: false });
+/**
+ * The backend's table, recomputed for a record that has no fresh answer.
+ *
+ * `docs/mcp-verify-integration.md` §1, in our verdict vocabulary: not
+ * verified ⇒ `pending`; CLEAN ⇒ `allow`; SUSPICIOUS ⇒ `ask` in every mode
+ * (the user decides, at the call); MALICIOUS ⇒ the mode. A `contract-error`
+ * is not a verdict about the server and stays undecided. A fresh action from
+ * a response always wins over this — see `Verifier`; this is for the cache.
+ */
+export function actionFor(verdict, policy) {
+    switch (verdict) {
+        case 'ok':
+            return 'allow';
+        case 'suspicious':
+            return 'ask';
+        case 'malicious':
+            return policy.mode;
+        default:
+            return 'pending';
+    }
+}
+/**
+ * The worst of a set of actions, `block` first. `pending` ranks above
+ * `allow` so that a list with anything unverified in it is not called clean.
+ */
+const ACTION_SEVERITY = {
+    block: 5,
+    warn: 4,
+    ask: 3,
+    pending: 2,
+    allow: 1,
+};
+export function worstAction(actions) {
+    let worst = 'allow';
+    for (const action of actions) {
+        if (ACTION_SEVERITY[action] > ACTION_SEVERITY[worst])
+            worst = action;
+    }
+    return worst;
+}
+/**
+ * The worst of a set of verdicts.
+ *
+ * "Worst" is not the same as "most recent": a server whose ten tools are
+ * clean and whose eleventh is malicious is a malicious server, and averaging
+ * would be a way of losing exactly the finding that matters.
+ */
+const SEVERITY = {
+    malicious: 5,
+    suspicious: 4,
+    // ⚠️ Above `pending`, below `suspicious`, and both halves matter.
+    //
+    // Above, because a server whose tools are all unverified BECAUSE the backend
+    // refuses our requests is not in the same state as one we simply have not
+    // got to yet — and only the aggregate is rendered.
+    //
+    // Below, because a contract error must never MASK a real security verdict.
+    // If it outranked `malicious`, breaking the contract would become a way of
+    // erasing a blacklist.
+    'contract-error': 3,
+    pending: 2,
+    unknown: 1,
+    ok: 0,
+};
+export function worstVerdict(verdicts) {
+    let worst = 'ok';
+    for (const verdict of verdicts) {
+        if (SEVERITY[verdict] > SEVERITY[worst])
+            worst = verdict;
+    }
+    return worst;
+}
+export function serverVerdict(server, tools) {
+    return worstVerdict([server.verdict, ...tools.map((tool) => tool.verdict)]);
+}
+/**
+ * Decides — that is, executes.
+ *
+ * The user's own decision comes first, in both directions: an `allow` on a
+ * server the backend calls malicious is a decision they were shown the reason
+ * for and made anyway, and overriding it would be telling them they were
+ * wrong every session. A `deny` blocks whatever the backend says, including
+ * `allow`.
+ *
+ * Then the server's action, verbatim: `block` blocks, `warn` alerts and lets
+ * the call through, `ask` alerts and has the user confirm the call. The
+ * rationale names the verdict the action came from, which is what the agent
+ * and the user are told.
+ */
+export function decide(input) {
+    if (input.override === 'deny')
+        return { action: 'block', rationale: 'denied-by-user' };
+    if (input.override === 'allow')
+        return { action: 'pass', rationale: 'allowed-by-user' };
+    if (input.action === 'block')
+        return { action: 'block', rationale: 'malicious' };
+    if (input.action === 'warn')
+        return { action: 'alert', rationale: 'malicious' };
+    if (input.action === 'ask')
+        return { action: 'alert', rationale: 'suspicious' };
+    // Our own machinery, not this server. It ALERTS and never blocks: blocking
+    // on a contract disagreement would be a fail-closed triggered by a bug of
+    // ours, on servers we know strictly nothing about — the most expensive
+    // possible mistake, where the product becomes the incident. And it only
+    // speaks once it has survived a restart; see `contractErrorPersisted`.
+    if (input.verdict === 'contract-error') {
+        return input.contractErrorPersisted
+            ? { action: 'alert', rationale: 'contract-error' }
+            : { action: 'pass', rationale: 'not-verified' };
+    }
+    // A list that changed under us is worth a word even when the new content
+    // reads clean: the change itself is the signal, and it is the shape a
+    // rug-pull takes.
+    if (input.changedDuringSession)
+        return { action: 'alert', rationale: 'changed-mid-session' };
+    if (input.action === 'pending')
+        return { action: 'pass', rationale: 'not-verified' };
+    return { action: 'pass', rationale: 'clean' };
+}
+/**
+ * Whether to refuse a server the backend cannot be asked about right now.
+ *
+ * Section 0: fail-open by default, fail-closed only for a server the LOCAL
+ * cache already calls malicious and that the user has not allowed. The
+ * asymmetry is the point — an outage must not turn every server off, and it
+ * must not turn a known-bad one back on either.
+ *
+ * It takes the AGGREGATE verdict, not the server record's own: a server whose
+ * ten tools are clean and whose eleventh is known malicious is a malicious
+ * server, and the record on the server itself is often `unknown` — a local
+ * command has no public coordinate for the advisory list to be about.
+ */
+export function failClosed(verdict, override) {
+    if (override === 'allow')
+        return false;
+    if (override === 'deny')
+        return true;
+    return verdict === 'malicious';
+}
+//# sourceMappingURL=policy.js.map

package/dist/mcp/verify/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/mcp/verify/policy.ts"],"names":[],"mappings":"AA4CA,MAAM,CAAC,MAAM,cAAc,GAA4B,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAEpG,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AASD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AAU7G;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,MAAiB;IAC3D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,IAAI;YACP,OAAO,OAAO,CAAC;QACjB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC;QACf,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAAiC;IACpD,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,OAAgC;IAC1D,IAAI,KAAK,GAAiB,OAAO,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAkCD;;;;;;GAMG;AACH,MAAM,QAAQ,GAA4B;IACxC,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,kEAAkE;IAClE,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,mDAAmD;IACnD,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,uBAAuB;IACvB,gBAAgB,EAAE,CAAC;IACnB,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,CAAC;IACV,EAAE,EAAE,CAAC;CACN,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,QAA4B;IACvD,IAAI,KAAK,GAAY,IAAI,CAAC;IAC1B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,OAAO,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,KAA4B;IAC9E,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,MAAM,CAAC,KAAkB;IACvC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAExF,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACjF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IAEhF,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,sBAAsB;YACjC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE;YAClD,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,kBAAkB;IAClB,IAAI,KAAK,CAAC,oBAAoB;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IAE7F,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IACrF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,QAA8B;IACzE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,KAAK,WAAW,CAAC;AACjC,CAAC"}

package/dist/mcp/verify/pool.js

@@ -0,0 +1,27 @@
+/**
+ * A few things at a time, and no dependency to do it.
+ *
+ * Used where a list of independent calls would otherwise run one after the
+ * other — the slices of an audit, the servers of a scan — and where running
+ * them all at once would be as wrong: a backend has a request cap, and a
+ * hundred stdio servers spawned together is a fork bomb with a security
+ * label on it.
+ */
+/**
+ * Runs `worker` over `items`, at most `concurrency` at a time, in order of
+ * start. Resolves when every item is done; a worker that throws fails the
+ * whole run, so a worker that must not takes care of its own errors.
+ */
+export async function runPool(items, concurrency, worker) {
+    const width = Math.max(1, Math.min(Math.floor(concurrency), items.length));
+    let next = 0;
+    const lane = async () => {
+        while (next < items.length) {
+            const index = next;
+            next += 1;
+            await worker(items[index], index);
+        }
+    };
+    await Promise.all(Array.from({ length: width }, () => lane()));
+}
+//# sourceMappingURL=pool.js.map

package/dist/mcp/verify/pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.js","sourceRoot":"","sources":["../../../src/mcp/verify/pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,KAAmB,EACnB,WAAmB,EACnB,MAAiD;IAEjD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,IAAI,IAAI,CAAC,CAAC;YACV,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/mcp/verify/token-refresh.js

@@ -0,0 +1,44 @@
+/**
+ * The verify token for a command a HUMAN typed — renewed when it expired.
+ *
+ * Kept apart from `token.ts` on purpose: that module reads exactly two
+ * sources (the environment and our own store) and a guard test holds it to
+ * that. The renewal goes through `getValidAccessToken`, which talks to Logto;
+ * a module the proxy imports must not.
+ */
+import { getValidAccessToken } from '../../auth/auth.js';
+import { TOKEN_ENV_VARS, resolveVerifyToken } from './token.js';
+/**
+ * A usable token for a command a HUMAN typed (`scan`, `connect`, `org`),
+ * renewed when it expired.
+ *
+ * `resolveVerifyToken` reads and never refreshes, which is right for the
+ * proxy (see `verifyTokenResolver`) and wrong at the keyboard: on 2026-09-16
+ * a scan started two seconds before the stored token's expiry, and every row
+ * after the second read `unverified` while a good refresh token sat in the
+ * store. The hooks already refresh through the same path; this is the CLI
+ * catching up.
+ *
+ * The environment still wins, and a refresh that cannot happen — nothing
+ * stored, no refresh token, a rejected one, a network failure — degrades to
+ * the plain read: a still-valid token is still worth sending, and `null`
+ * stays an ordinary outcome, never an exception.
+ */
+export async function resolveVerifyTokenWithRefresh(mcpName, deps = {}) {
+    const env = deps.env ?? process.env;
+    for (const name of TOKEN_ENV_VARS) {
+        const value = env[name];
+        if (value && value.trim() !== '')
+            return value.trim();
+    }
+    try {
+        const fresh = await (deps.refreshFn ?? getValidAccessToken)(mcpName);
+        if (fresh)
+            return fresh;
+    }
+    catch {
+        /* login required, or the renewal failed: what the store holds decides */
+    }
+    return resolveVerifyToken(mcpName, deps);
+}
+//# sourceMappingURL=token-refresh.js.map

package/dist/mcp/verify/token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../../src/mcp/verify/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAwB,MAAM,YAAY,CAAC;AAWtF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAe,EACf,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/mcp/verify/token.js

@@ -0,0 +1,67 @@
+/**
+ * The proxy's own CybeDefend token, and where it refuses to look for it.
+ *
+ * `api.ts` came off the legacy branch with `resolveTokenWithRefresh` as its
+ * default resolver, and that function's fallback reads the keychains of
+ * Claude Code and Codex. The plan forbids the proxy from reading another
+ * client's credential store — the entries are theirs, the user consented to
+ * them for that client, and a proxy that helps itself to them is exactly what
+ * this product exists to stop other people doing.
+ *
+ * So the proxy injects this instead. Two places, both ours:
+ *
+ *   1. the environment (`CYBEDEFEND_TOKEN`, then `VIBEDEFEND_TOKEN`), which
+ *      is how CI supplies one;
+ *   2. `~/.cybedefend/`, written by `vibedefend login`.
+ *
+ * No refresh, and none is missing: a token that expired means verification
+ * degrades to `unknown` for this session, which is a fail-open the plan
+ * already provides for, and `vibedefend login` is a command the user runs
+ * when they choose to.
+ */
+import { loadAuth } from '../../auth/auth-store.js';
+/** Read before the store, so CI can override without a login. */
+export const TOKEN_ENV_VARS = ['CYBEDEFEND_TOKEN', 'VIBEDEFEND_TOKEN'];
+/**
+ * A usable token, or `null`.
+ *
+ * `null` is an ordinary outcome, not an error: most of the time it means
+ * nobody has run `vibedefend login` yet, and the caller turns it into
+ * "unverified" rather than into a failure.
+ */
+export function resolveVerifyToken(mcpName, deps = {}) {
+    const env = deps.env ?? process.env;
+    for (const name of TOKEN_ENV_VARS) {
+        const value = env[name];
+        if (value && value.trim() !== '')
+            return value.trim();
+    }
+    try {
+        const stored = (deps.loadAuthFn ?? loadAuth)(mcpName);
+        if (!stored)
+            return null;
+        const now = (deps.now ?? Date.now)();
+        // `expiresAt` already carries its own margin. An expired token would cost
+        // a round trip and come back 401, which the caller cannot repair without
+        // a login it must not start on its own.
+        if (typeof stored.expiresAt === 'number' && stored.expiresAt <= now)
+            return null;
+        return stored.accessToken || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What `api.ts` calls after a 401.
+ *
+ * It re-reads the same two places rather than refreshing. The proxy has no
+ * business running an OAuth refresh against our own gateway from inside an
+ * agent session: if `vibedefend login` ran in another terminal in the
+ * meantime, this picks the new token up; if not, the 401 stands and
+ * verification degrades.
+ */
+export function verifyTokenResolver(deps = {}) {
+    return async (mcpName) => resolveVerifyToken(mcpName, deps);
+}
+//# sourceMappingURL=token.js.map

package/dist/mcp/verify/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/mcp/verify/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAU,CAAC;AAShF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,OAAwB,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,0EAA0E;QAC1E,yEAAyE;QACzE,wCAAwC;QACxC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACjF,OAAO,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EAAE;IAE1B,OAAO,KAAK,EAAE,OAAe,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC"}