@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/verify/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../../src/mcp/verify/digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAczC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC1B;IAArB,YAAqB,QAAgB;QACnC,KAAK,CAAC,+BAA+B,QAAQ,SAAS,CAAC,CAAC;QADrC,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,KAAK,GAAG,mBAAmB,EAAE,CAAC;QAChC,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC;SAC1D,IAAI,EAAE;SACN,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAC3F,CAAC;IACJ,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;KACtC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,GAAG,cAAc,IAAI,GAAG,EAAE,CAAC;AACpC,CAAC"}

package/dist/mcp/verify/factory.js

@@ -0,0 +1,56 @@
+import { PROXY_ENV_PREFIX } from '../proxy/paths.js';
+import { persistedOrganization, resolveBackendAccess } from './backend.js';
+import { createJsonVerifyCache } from './cache.js';
+import { upstreamServerId } from './identity.js';
+import { verifyTokenResolver } from './token.js';
+import { DEFAULT_VERIFY_TIMEOUT_MS, Verifier } from './verifier.js';
+/**
+ * A verifier for `spec`, named `serverName` on every finding.
+ *
+ * `spec` is the STORED spec, never the expanded one: `upstreamServerId`
+ * hashes it, and that hash keys the cache and the user's overrides.
+ */
+export function buildVerifier(spec, serverName, logger, env, overrides = {}) {
+    const serverId = upstreamServerId(spec);
+    const timeoutMs = overrides.timeoutMs ?? positiveMs(env[`${PROXY_ENV_PREFIX}VERIFY_TIMEOUT_MS`]) ?? DEFAULT_VERIFY_TIMEOUT_MS;
+    const resolved = overrides.backend === undefined
+        ? (overrides.resolveBackendAccessFn ?? resolveBackendAccess)({
+            env,
+            warn: (message, fields) => logger.warn(message, fields),
+        })
+        : overrides.backend;
+    const backend = resolved
+        ? {
+            ...resolved,
+            options: {
+                resolveTokenFn: verifyTokenResolver({ env }),
+                ...('options' in resolved ? (resolved.options ?? {}) : {}),
+            },
+        }
+        : null;
+    const verifier = new Verifier({
+        serverId,
+        serverName,
+        spec,
+        cache: overrides.cache ?? createJsonVerifyCache({ env }),
+        logger,
+        timeoutMs,
+        callTimeoutMs: overrides.callTimeoutMs,
+        now: overrides.now,
+        sessionId: overrides.sessionId,
+        env,
+        backend: backend ?? undefined,
+        // With no backend at all, the last known policy of the persisted
+        // organization still applies to what the cache decides.
+        organizationId: backend?.organizationId ?? persistedOrganization()?.id,
+    });
+    return { verifier, serverId, serverName, timeoutMs, backend };
+}
+/** A strictly positive number of milliseconds from an environment value, or nothing. */
+export function positiveMs(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+//# sourceMappingURL=factory.js.map

package/dist/mcp/verify/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../src/mcp/verify/factory.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAsB,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAoB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAsB,MAAM,eAAe,CAAC;AA8BxF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAkB,EAClB,UAAkB,EAClB,MAAc,EACd,GAAsB,EACtB,YAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GACb,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,gBAAgB,mBAAmB,CAAC,CAAC,IAAI,yBAAyB,CAAC;IAC9G,MAAM,QAAQ,GACZ,SAAS,CAAC,OAAO,KAAK,SAAS;QAC7B,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC;YACzD,GAAG;YACH,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;SACxD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;IACxB,MAAM,OAAO,GAAyB,QAAQ;QAC5C,CAAC,CAAC;YACE,GAAG,QAAQ;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC;gBAC5C,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;SACF;QACH,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC;QAC5B,QAAQ;QACR,UAAU;QACV,IAAI;QACJ,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC;QACxD,MAAM;QACN,SAAS;QACT,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,GAAG;QACH,OAAO,EAAE,OAAO,IAAI,SAAS;QAC7B,iEAAiE;QACjE,wDAAwD;QACxD,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,qBAAqB,EAAE,EAAE,EAAE;KACvE,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC"}

package/dist/mcp/verify/identity.js

@@ -0,0 +1,286 @@
+/** Identity of a coordinate, used to deduplicate one server across configs. */
+export function coordinateKey(c) {
+    if (c.url)
+        return `url:${c.url}`;
+    if (c.purl)
+        return `purl:${c.purl}`;
+    return `pkg:${c.ecosystem ?? ''}:${c.packageName ?? ''}:${c.version ?? ''}`;
+}
+// ─── Stable identity of a discovered server ──────────────────────────────────
+/**
+ * Names the identity of a server in a way that is stable across runs. The
+ * discovery layer has already deduplicated by coordinate, so every entry it
+ * yields is one physical server; `source` and `name` only matter for servers
+ * that resolved to no coordinate.
+ */
+export function serverIdOf(server) {
+    if (server.coordinate)
+        return coordinateKey(server.coordinate);
+    return `local:${server.source}:${server.name}`;
+}
+// ─── purl / server-check coordinate ──────────────────────────────────────────
+/**
+ * Builds a `purl` (package URL) from an npm/pip coordinate.
+ *
+ * The namespace of a SCOPED npm package is a path segment of its own
+ * (`pkg:npm/%40scope/name@version`), not a prefix encoded together with the
+ * name (`pkg:npm/%40scope%2Fname@version`). Encoding `@scope/name` as one
+ * string also encodes the `/` separator, which produced a non-conforming purl
+ * for every `@modelcontextprotocol/server-*` package.
+ */
+export function purlOf(coordinate) {
+    if (coordinate.purl)
+        return coordinate.purl;
+    if (!coordinate.ecosystem || !coordinate.packageName)
+        return undefined;
+    const type = coordinate.ecosystem === 'pip' ? 'pypi' : coordinate.ecosystem;
+    const versionSuffix = coordinate.version ? `@${encodeURIComponent(coordinate.version)}` : '';
+    if (type === 'npm' && coordinate.packageName.startsWith('@')) {
+        const withoutAt = coordinate.packageName.slice(1); // "scope/name"
+        const slashIdx = withoutAt.indexOf('/');
+        if (slashIdx > 0) {
+            const namespace = withoutAt.slice(0, slashIdx);
+            const name = withoutAt.slice(slashIdx + 1);
+            return `pkg:npm/%40${encodeURIComponent(namespace)}/${encodeURIComponent(name)}${versionSuffix}`;
+        }
+    }
+    return `pkg:${type}/${encodeURIComponent(coordinate.packageName)}${versionSuffix}`;
+}
+/** What `POST /mcp/servers/check` accepts for this coordinate, or `null` when nothing applies. */
+export function checkInputOf(coordinate) {
+    if (!coordinate)
+        return null;
+    if (coordinate.url)
+        return { url: coordinate.url };
+    const purl = purlOf(coordinate);
+    return purl ? { purl } : null;
+}
+export function checkInputKey(input) {
+    return input.url ? `url:${input.url}` : `purl:${input.purl ?? ''}`;
+}
+// ─── Identity of an upstream the proxy runs in front of (Phase 3) ────────────
+import { createHash } from 'node:crypto';
+import { canonicalMcpUrl } from '../auth/oauth.js';
+import { HOST_PATTERN, LABEL_PATTERN, NPM_NAME_PATTERN, PACKAGE_VERSION_PATTERN, PYPI_NAME_PATTERN, } from '../report/constants.js';
+/**
+ * Package launchers whose first non-flag argument names a package.
+ *
+ * `npx`, `pnpm dlx` and `bunx` for npm; `uvx` and `pipx` for PyPI. Anything
+ * else — a path to a script, a binary on `PATH`, a shell wrapper — has no
+ * package coordinate to read, and pretending otherwise would file two
+ * unrelated servers under one identity.
+ */
+const NPM_LAUNCHERS = new Set(['npx', 'bunx', 'pnpx']);
+const PYPI_LAUNCHERS = new Set(['uvx', 'pipx']);
+/** Flags a launcher takes before the package name. */
+const LAUNCHER_FLAGS = new Set(['-y', '--yes', '-q', '--quiet', '--silent', '-p', '--package', 'run']);
+/** Strips a `.cmd` / `.exe` suffix and any directory, so `C:\…\npx.cmd` reads as `npx`. */
+export function launcherName(command) {
+    const base = command.replace(/\\/g, '/').split('/').pop() ?? command;
+    return base.replace(/\.(cmd|exe|bat|ps1)$/i, '').toLowerCase();
+}
+/**
+ * The package a launcher command runs, or `null`.
+ *
+ * `npx -y @scope/name@1.2.3` reads as `@scope/name` at `1.2.3`. The leading
+ * `@` of a scope is not a version separator, which is the one thing a naive
+ * `split('@')` gets wrong on exactly the packages MCP servers ship as.
+ */
+export function parsePackageCoordinate(command, args) {
+    const launcher = launcherName(command);
+    const ecosystem = NPM_LAUNCHERS.has(launcher)
+        ? 'npm'
+        : PYPI_LAUNCHERS.has(launcher)
+            ? 'pypi'
+            : null;
+    if (!ecosystem)
+        return null;
+    const spec = args.find((arg) => !arg.startsWith('-') && !LAUNCHER_FLAGS.has(arg));
+    if (!spec)
+        return null;
+    // A scope starts with `@`; the version separator is the `@` AFTER it.
+    const separator = spec.lastIndexOf('@');
+    if (separator > 0) {
+        const version = spec.slice(separator + 1);
+        // `@scope/name` has its only `@` at index 0, already excluded above; a
+        // trailing `@` with nothing after it pins nothing.
+        if (version !== '' && !version.includes('/')) {
+            return { ecosystem, name: spec.slice(0, separator), version };
+        }
+    }
+    return { ecosystem, name: spec };
+}
+/**
+ * The identity the proxy files a server under.
+ *
+ * Four forms, in the order they are tried:
+ *
+ *   `url:<canonical>`        an HTTP server, keyed the same way its
+ *                            credential is (`canonicalMcpUrl`), so the two
+ *                            never disagree about which server this is;
+ *   `npm:<pkg>@<version>`    a pinned package, shareable across
+ *   `pypi:<pkg>@<version>`   organisations because it names the same bytes
+ *                            for everybody;
+ *   `cmd:sha256(...)`        anything else, including an UNPINNED package.
+ *
+ * The last one covers more than it looks: `npx -y @scope/server` with no
+ * version is the shape most people use, and it lands here on purpose. A
+ * verdict on "whatever npx resolves today" is not a fact about a package, it
+ * is a fact about one machine on one day, and sharing it between
+ * organisations would be sharing a guess.
+ */
+export function upstreamServerId(spec) {
+    if (spec.transport === 'http') {
+        return `url:${canonicalMcpUrl(spec.url) ?? spec.url}`;
+    }
+    const coordinate = parsePackageCoordinate(spec.command, spec.args);
+    if (coordinate?.version) {
+        return `${coordinate.ecosystem}:${coordinate.name}@${coordinate.version}`;
+    }
+    return commandIdentity(spec);
+}
+/**
+ * `cmd:<sha256>` of a local command and its arguments, in order, separated by
+ * a character no argument can contain: `a b` and `a` `b` must not hash alike.
+ */
+export function commandIdentity(spec) {
+    const material = [spec.command, ...spec.args].join('\u0000');
+    return `cmd:${createHash('sha256').update(material).digest('hex')}`;
+}
+/** A filesystem-safe name for the cache file of a server id. */
+export function serverIdFileName(serverId) {
+    // The id may contain `/`, `:` and `@`; the hash keeps it unambiguous while
+    // the readable prefix keeps the cache directory browsable.
+    const readable = serverId.replace(/[^A-Za-z0-9._-]+/g, '-').slice(0, 48).replace(/^-+|-+$/g, '');
+    const fingerprint = createHash('sha256').update(serverId).digest('hex').slice(0, 16);
+    return `${readable || 'server'}.${fingerprint}.json`;
+}
+/**
+ * A package name an advisory list could name: the npm or PyPI characters, of
+ * any case (a legacy npm name such as `JSONStream` is uppercase). Anything
+ * else read from a launcher's arguments (a git URL, a path) is not sent.
+ */
+const PUBLIC_NPM_NAME = /^(@[A-Za-z0-9._~-]+\/)?[A-Za-z0-9._~-]+$/;
+const PUBLIC_PYPI_NAME = /^[A-Za-z0-9._-]+$/;
+/**
+ * What `POST …/servers/check` accepts for an upstream, or `null`.
+ *
+ * A server the report files as `local` sends its `serverKey`, which the
+ * backend matches against organisation blocks. When it still has a public
+ * coordinate — a URL whose host the report refuses (IPv6, an underscore), a
+ * package name the report refuses (uppercase, past 214 characters) — that
+ * coordinate goes with it, so the advisory lookup it had before 1.7.0 stays.
+ * A local command with none sends its key alone.
+ */
+export function upstreamCheckInput(spec) {
+    const identity = reportServerIdentity(spec);
+    if (identity?.kind === 'local') {
+        const coordinate = localPublicCoordinate(spec);
+        return coordinate ? { ...coordinate, serverKey: identity.serverKey } : { serverKey: identity.serverKey };
+    }
+    if (spec.transport === 'http') {
+        const url = canonicalMcpUrl(spec.url);
+        return url ? { url } : null;
+    }
+    const coordinate = parsePackageCoordinate(spec.command, spec.args);
+    if (!coordinate)
+        return null;
+    return checkInputOf({
+        ecosystem: coordinate.ecosystem === 'pypi' ? 'pip' : 'npm',
+        packageName: coordinate.name,
+        version: coordinate.version,
+    });
+}
+/** The URL or the package of a server the report files as local, or `null`. */
+function localPublicCoordinate(spec) {
+    if (spec.transport === 'http') {
+        const url = canonicalMcpUrl(spec.url);
+        return url ? { url } : null;
+    }
+    const coordinate = parsePackageCoordinate(spec.command, spec.args);
+    if (!coordinate)
+        return null;
+    const named = coordinate.ecosystem === 'npm'
+        ? PUBLIC_NPM_NAME.test(coordinate.name)
+        : PUBLIC_PYPI_NAME.test(coordinate.name);
+    if (!named)
+        return null;
+    const purl = purlOf({
+        ecosystem: coordinate.ecosystem === 'pypi' ? 'pip' : 'npm',
+        packageName: coordinate.name,
+        version: coordinate.version && PACKAGE_VERSION_PATTERN.test(coordinate.version) ? coordinate.version : undefined,
+    });
+    return purl ? { purl } : null;
+}
+/**
+ * Whether the upstream has a public coordinate an advisory list can name: a
+ * URL, or an npm/pypi package (pinned or not). A local command has none, so a server record is
+ * never stale for want of an advisory lookup.
+ */
+export function hasPublicCoordinate(spec) {
+    const input = upstreamCheckInput(spec);
+    return input !== null && (input.url !== undefined || input.purl !== undefined);
+}
+const sha256Hex = (value) => createHash('sha256').update(value).digest('hex');
+/** A config entry name as a report label, or `undefined` when nothing safe is left of it. */
+export function reportLabel(raw) {
+    if (!raw)
+        return undefined;
+    const label = raw
+        .replace(/[^A-Za-z0-9._-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 64)
+        .replace(/-+$/g, '');
+    return LABEL_PATTERN.test(label) ? label : undefined;
+}
+/**
+ * The identity a report files a server under, or `null` for an HTTP spec whose
+ * URL does not canonicalise. Does not use `describeUpstream`, which prints
+ * what a report must never carry.
+ */
+export function reportServerIdentity(spec, entryName) {
+    const entryLabel = reportLabel(entryName);
+    if (spec.transport === 'http') {
+        const canonical = canonicalMcpUrl(spec.url);
+        if (!canonical)
+            return null;
+        const serverKey = sha256Hex(`url:${canonical}`);
+        const host = new URL(canonical).hostname;
+        if (!HOST_PATTERN.test(host)) {
+            // An IPv6 literal: no host a report may carry. Same key, reported as local.
+            return {
+                serverKey,
+                kind: 'local',
+                label: entryLabel ?? reportLabel(host.replace(/[[\]]/g, '')) ?? 'local',
+            };
+        }
+        return { serverKey, kind: 'remote', host, ...(entryLabel ? { label: entryLabel } : {}) };
+    }
+    const coordinate = parsePackageCoordinate(spec.command, spec.args);
+    if (coordinate) {
+        const nameOk = coordinate.ecosystem === 'npm'
+            ? NPM_NAME_PATTERN.test(coordinate.name)
+            : PYPI_NAME_PATTERN.test(coordinate.name);
+        if (nameOk) {
+            const version = coordinate.version && PACKAGE_VERSION_PATTERN.test(coordinate.version)
+                ? coordinate.version
+                : undefined;
+            return {
+                serverKey: sha256Hex(`${coordinate.ecosystem}:${coordinate.name}`),
+                kind: 'package',
+                package: {
+                    ecosystem: coordinate.ecosystem,
+                    name: coordinate.name,
+                    ...(version ? { version } : {}),
+                },
+                ...(entryLabel ? { label: entryLabel } : {}),
+            };
+        }
+    }
+    return {
+        serverKey: sha256Hex(commandIdentity(spec)),
+        kind: 'local',
+        label: entryLabel ?? reportLabel(launcherName(spec.command)) ?? 'local',
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/mcp/verify/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/mcp/verify/identity.ts"],"names":[],"mappings":"AAsCA,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,CAAsB;IAClD,IAAI,CAAC,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAA2B;IACpD,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/D,OAAO,SAAS,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CAAC,UAA+B;IACpD,IAAI,UAAU,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;IAC5E,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7F,IAAI,IAAI,KAAK,KAAK,IAAI,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;QAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO,cAAc,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC;QACnG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,IAAI,IAAI,kBAAkB,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,aAAa,EAAE,CAAC;AACrF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAAC,UAA2C;IACtE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAA0B;IACtD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEhD,sDAAsD;AACtD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AASvG,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;IACrE,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,IAAuB;IAEvB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAE,KAAe;QAClB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC5B,CAAC,CAAE,MAAgB;YACnB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC1C,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IACjD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,OAAO,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;QACxB,OAAO,GAAG,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAmD;IACjF,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjG,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,GAAG,QAAQ,IAAI,QAAQ,IAAI,WAAW,OAAO,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,0CAA0C,CAAC;AACnE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,YAAY,CAAC;QAClB,SAAS,EAAE,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;QAC1D,WAAW,EAAE,UAAU,CAAC,IAAI;QAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,IAAkB;IAC/C,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,KAAK,GACT,UAAU,CAAC,SAAS,KAAK,KAAK;QAC5B,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACvC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC;QAClB,SAAS,EAAE,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;QAC1D,WAAW,EAAE,UAAU,CAAC,IAAI;QAC5B,OAAO,EACL,UAAU,CAAC,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KAC1G,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAkB;IACpD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACjF,CAAC;AAuBD,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE9F,6FAA6F;AAC7F,MAAM,UAAU,WAAW,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACjC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAkB,EAClB,SAAkB;IAElB,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,4EAA4E;YAC5E,OAAO;gBACL,SAAS;gBACT,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO;aACxE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GACV,UAAU,CAAC,SAAS,KAAK,KAAK;YAC5B,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GACX,UAAU,CAAC,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACpE,CAAC,CAAC,UAAU,CAAC,OAAO;gBACpB,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO;gBACL,SAAS,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;gBAClE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE;oBACP,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChC;gBACD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,UAAU,IAAI,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO;KACxE,CAAC;AACJ,CAAC"}

package/dist/mcp/verify/policy-store.js

@@ -0,0 +1,63 @@
+/**
+ * The last known policy of each organization, on this machine.
+ *
+ * `~/.cybedefend/mcp/policy.json`, keyed by organization id. It exists for
+ * the degraded session — backend unreachable, or no credential — which must
+ * still decide under the policy the organization actually has rather than
+ * under the default: an organization that set `block` last week has set it
+ * for the day the network is down too. Keyed by organization so a machine
+ * that moves between two of them never carries one's `block` into the
+ * other.
+ *
+ * Written by the verifier every time a response carries a policy, and by
+ * `GET …/policy`. Never a lever: nothing on this machine reads it as a
+ * setting, only as a memory of what the server said.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeFileAtomic } from '../config/atomicWrite.js';
+import { mcpHomeDir } from '../proxy/paths.js';
+import { isPolicyMode } from './policy.js';
+export function policyFile(env = process.env) {
+    return join(mcpHomeDir(env), 'policy.json');
+}
+function readAll(env) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(policyFile(env), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+}
+function toStoredPolicy(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const shape = raw;
+    if (!isPolicyMode(shape.mode) || typeof shape.strictIssuer !== 'boolean')
+        return null;
+    return {
+        mode: shape.mode,
+        strictIssuer: shape.strictIssuer,
+        learnedAt: typeof shape.learnedAt === 'string' ? shape.learnedAt : new Date(0).toISOString(),
+    };
+}
+/** What was last learned about this organization, or `null`. A corrupt entry is nothing known. */
+export function readStoredPolicy(organizationId, options = {}) {
+    const env = options.env ?? process.env;
+    return toStoredPolicy(readAll(env)[organizationId]);
+}
+/** Records the policy for this organization, leaving every other organization's entry as it is. */
+export function writeStoredPolicy(organizationId, policy, options = {}) {
+    const env = options.env ?? process.env;
+    const all = readAll(env);
+    const entry = {
+        mode: policy.mode,
+        strictIssuer: policy.strictIssuer,
+        learnedAt: (options.now ?? new Date()).toISOString(),
+    };
+    all[organizationId] = entry;
+    writeFileAtomic(policyFile(env), `${JSON.stringify(all, null, 2)}\n`, { mode: 0o600 });
+}
+//# sourceMappingURL=policy-store.js.map

package/dist/mcp/verify/policy-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-store.js","sourceRoot":"","sources":["../../../src/mcp/verify/policy-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AAY3D,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,GAAsB;IACrC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KAC7F,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,UAA8B,EAAE;IACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,cAAsB,EAAE,MAAiB,EAAE,UAA8B,EAAE;IAC3G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAiB;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACrD,CAAC;IACF,GAAG,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC;IAC5B,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/dist/mcp/verify/policy.js

@@ -0,0 +1,160 @@
+export const SERVER_ACTIONS = ['allow', 'ask', 'warn', 'block', 'pending'];
+export function isServerAction(value) {
+    return typeof value === 'string' && SERVER_ACTIONS.includes(value);
+}
+export function isPolicyMode(value) {
+    return value === 'warn' || value === 'block';
+}
+/**
+ * Used ONLY when nothing was ever learned from the backend — the same
+ * fallback global-management applies to an organization that never set a
+ * policy. Not a lever: nothing on this machine can change it.
+ */
+/**
+ * Used only when this machine never learned any policy for the organization —
+ * the same fallback global-management serves for an organization that never
+ * set one (`block` since 2026-09-15): a verdict nobody chose to relax is refused.
+ */
+export const DEFAULT_ORG_POLICY = Object.freeze({ mode: 'block', strictIssuer: false });
+/**
+ * The backend's table, recomputed for a record that has no fresh answer.
+ *
+ * `docs/mcp-verify-integration.md` §1, in our verdict vocabulary: not
+ * verified ⇒ `pending`; CLEAN ⇒ `allow`; SUSPICIOUS ⇒ `ask` in every mode
+ * (the user decides, at the call); MALICIOUS ⇒ the mode. A `contract-error`
+ * is not a verdict about the server and stays undecided. A fresh action from
+ * a response always wins over this — see `Verifier`; this is for the cache.
+ */
+export function actionFor(verdict, policy) {
+    switch (verdict) {
+        case 'ok':
+            return 'allow';
+        case 'suspicious':
+            return 'ask';
+        case 'malicious':
+            return policy.mode;
+        default:
+            return 'pending';
+    }
+}
+/**
+ * The worst of a set of actions, `block` first. `pending` ranks above
+ * `allow` so that a list with anything unverified in it is not called clean.
+ */
+const ACTION_SEVERITY = {
+    block: 5,
+    warn: 4,
+    ask: 3,
+    pending: 2,
+    allow: 1,
+};
+export function worstAction(actions) {
+    let worst = 'allow';
+    for (const action of actions) {
+        if (ACTION_SEVERITY[action] > ACTION_SEVERITY[worst])
+            worst = action;
+    }
+    return worst;
+}
+/**
+ * The worst of a set of verdicts.
+ *
+ * "Worst" is not the same as "most recent": a server whose ten tools are
+ * clean and whose eleventh is malicious is a malicious server, and averaging
+ * would be a way of losing exactly the finding that matters.
+ */
+const SEVERITY = {
+    malicious: 5,
+    suspicious: 4,
+    // ⚠️ Above `pending`, below `suspicious`, and both halves matter.
+    //
+    // Above, because a server whose tools are all unverified BECAUSE the backend
+    // refuses our requests is not in the same state as one we simply have not
+    // got to yet — and only the aggregate is rendered.
+    //
+    // Below, because a contract error must never MASK a real security verdict.
+    // If it outranked `malicious`, breaking the contract would become a way of
+    // erasing a blacklist.
+    'contract-error': 3,
+    pending: 2,
+    unknown: 1,
+    ok: 0,
+};
+export function worstVerdict(verdicts) {
+    let worst = 'ok';
+    for (const verdict of verdicts) {
+        if (SEVERITY[verdict] > SEVERITY[worst])
+            worst = verdict;
+    }
+    return worst;
+}
+export function serverVerdict(server, tools) {
+    return worstVerdict([server.verdict, ...tools.map((tool) => tool.verdict)]);
+}
+/**
+ * Decides — that is, executes.
+ *
+ * The user's own decision comes first, in both directions: an `allow` on a
+ * server the backend calls malicious is a decision they were shown the reason
+ * for and made anyway, and overriding it would be telling them they were
+ * wrong every session. A `deny` blocks whatever the backend says, including
+ * `allow`.
+ *
+ * Then the server's action, verbatim: `block` blocks, `warn` alerts and lets
+ * the call through, `ask` alerts and has the user confirm the call. The
+ * rationale names the verdict the action came from, which is what the agent
+ * and the user are told.
+ */
+export function decide(input) {
+    if (input.organizationBlock)
+        return { action: 'block', rationale: 'blocked-by-organization' };
+    if (input.override === 'deny')
+        return { action: 'block', rationale: 'denied-by-user' };
+    if (input.override === 'allow')
+        return { action: 'pass', rationale: 'allowed-by-user' };
+    if (input.action === 'block')
+        return { action: 'block', rationale: 'malicious' };
+    if (input.action === 'warn')
+        return { action: 'alert', rationale: 'malicious' };
+    if (input.action === 'ask')
+        return { action: 'alert', rationale: 'suspicious' };
+    // Our own machinery, not this server. It ALERTS and never blocks: blocking
+    // on a contract disagreement would be a fail-closed triggered by a bug of
+    // ours, on servers we know strictly nothing about — the most expensive
+    // possible mistake, where the product becomes the incident. And it only
+    // speaks once it has survived a restart; see `contractErrorPersisted`.
+    if (input.verdict === 'contract-error') {
+        return input.contractErrorPersisted
+            ? { action: 'alert', rationale: 'contract-error' }
+            : { action: 'pass', rationale: 'not-verified' };
+    }
+    // A list that changed under us is worth a word even when the new content
+    // reads clean: the change itself is the signal, and it is the shape a
+    // rug-pull takes.
+    if (input.changedDuringSession)
+        return { action: 'alert', rationale: 'changed-mid-session' };
+    if (input.action === 'pending')
+        return { action: 'pass', rationale: 'not-verified' };
+    return { action: 'pass', rationale: 'clean' };
+}
+/**
+ * Whether to refuse a server the backend cannot be asked about right now.
+ *
+ * Section 0: fail-open by default, fail-closed only for a server the LOCAL
+ * cache already calls malicious and that the user has not allowed. The
+ * asymmetry is the point — an outage must not turn every server off, and it
+ * must not turn a known-bad one back on either.
+ *
+ * It takes the AGGREGATE verdict, not the server record's own: a server whose
+ * ten tools are clean and whose eleventh is known malicious is a malicious
+ * server, and the record on the server itself is often `unknown` — a local
+ * command has no public coordinate for the advisory list to be about.
+ */
+export function failClosed(verdict, override) {
+    if (override === 'allow')
+        return false;
+    if (override === 'deny')
+        return true;
+    return verdict === 'malicious';
+}
+//# sourceMappingURL=policy.js.map

package/dist/mcp/verify/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/mcp/verify/policy.ts"],"names":[],"mappings":"AA4CA,MAAM,CAAC,MAAM,cAAc,GAA4B,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAEpG,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AASD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AAU7G;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,MAAiB;IAC3D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,IAAI;YACP,OAAO,OAAO,CAAC;QACjB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC;QACf,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAAiC;IACpD,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,OAAgC;IAC1D,IAAI,KAAK,GAAiB,OAAO,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAyCD;;;;;;GAMG;AACH,MAAM,QAAQ,GAA4B;IACxC,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,kEAAkE;IAClE,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,mDAAmD;IACnD,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,uBAAuB;IACvB,gBAAgB,EAAE,CAAC;IACnB,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,CAAC;IACV,EAAE,EAAE,CAAC;CACN,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,QAA4B;IACvD,IAAI,KAAK,GAAY,IAAI,CAAC;IAC1B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,OAAO,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,KAA4B;IAC9E,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,MAAM,CAAC,KAAkB;IACvC,IAAI,KAAK,CAAC,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;IAC9F,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAExF,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACjF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IAEhF,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,sBAAsB;YACjC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE;YAClD,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,kBAAkB;IAClB,IAAI,KAAK,CAAC,oBAAoB;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IAE7F,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IACrF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,QAA8B;IACzE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,KAAK,WAAW,CAAC;AACjC,CAAC"}

package/dist/mcp/verify/pool.js

@@ -0,0 +1,27 @@
+/**
+ * A few things at a time, and no dependency to do it.
+ *
+ * Used where a list of independent calls would otherwise run one after the
+ * other — the slices of an audit, the servers of a scan — and where running
+ * them all at once would be as wrong: a backend has a request cap, and a
+ * hundred stdio servers spawned together is a fork bomb with a security
+ * label on it.
+ */
+/**
+ * Runs `worker` over `items`, at most `concurrency` at a time, in order of
+ * start. Resolves when every item is done; a worker that throws fails the
+ * whole run, so a worker that must not takes care of its own errors.
+ */
+export async function runPool(items, concurrency, worker) {
+    const width = Math.max(1, Math.min(Math.floor(concurrency), items.length));
+    let next = 0;
+    const lane = async () => {
+        while (next < items.length) {
+            const index = next;
+            next += 1;
+            await worker(items[index], index);
+        }
+    };
+    await Promise.all(Array.from({ length: width }, () => lane()));
+}
+//# sourceMappingURL=pool.js.map

package/dist/mcp/verify/pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.js","sourceRoot":"","sources":["../../../src/mcp/verify/pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,KAAmB,EACnB,WAAmB,EACnB,MAAiD;IAEjD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,IAAI,IAAI,CAAC,CAAC;YACV,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC"}