@descryy/mcp 0.6.0 → 0.7.1

package/dist/cancellation.js

@@ -1,46 +1,16 @@
-/**
- * What a tool does when the caller has already gone.
- *
- * `notifications/cancelled` makes the *server* stop waiting and suppress the
- * response. It cannot make the work stop, and for the tools that hold
- * something real — a browser, an application, a test runner — the work
- * continuing after the reply is discarded is the whole problem: a Chromium
- * nothing will ever close, an application still being driven, a scenario
- * still clicking through a live system on behalf of a caller who cancelled.
- *
- * So `ctx.signal` is checked at the points where a tool is about to *start*
- * something, and whatever the tool already started is released. Three rules
- * hold everywhere it is used:
- *
- * 1. **Release what this call started, and nothing else.** A cancelled verb
- *    does not close the session `browser_start_session` opened, and a
- *    cancelled run does not kill a process it merely attached to. Cancellation
- *    stops the work it was asked to stop; tearing down a caller's own state
- *    because one call was cancelled is a second failure, not a cleanup.
- * 2. **Keep the evidence.** Nothing witnessed before the cancellation is
- *    thrown away. Evidence captured and then dropped is worse than evidence
- *    never captured, because nothing discloses it.
- * 3. **Never let a cancelled run render as a clean one.** A check that stopped
- *    a third of the way through has not passed, and the reply says so even
- *    though nobody is expected to read it — the reply is suppressed only when
- *    the cancellation arrived over the wire, and this same path is reachable
- *    when a signal is aborted for any other reason.
- *
- * The state is `refused`: cancellation is a fact about Descry — it stopped
- * looking — and never a fact about the user's code. `empty` would say the run
- * looked and found nothing, which is the one thing it must not say.
- */
+/** What a tool does when the caller has already gone. `notifications/cancelled` stops the
+ *  server from waiting, not the work itself — a browser or process would keep running
+ *  unless released. Three rules: release only what this call started (never a caller's own
+ *  state), keep evidence already witnessed, never render a cancelled run as clean. State is
+ *  `refused` (a fact about Descry stopping) not `empty` (which would falsely say it looked and found nothing). */
 /** The reply state for a call that stopped because its signal was aborted. */
 export const CANCELLED_STATE = "refused";
 export function cancellationHeadline(what) {
     return `The call was cancelled; ${what}.`;
 }
-/**
- * @param stopped What this call stopped doing, in the caller's terms.
- * @param released What it tore down, when it had started something. Omitted
- * when there was nothing to release — claiming a teardown that did not happen
- * is the same class of false statement as hiding one that did.
- */
+/** @param stopped What this call stopped doing, in the caller's terms.
+ *  @param released What it tore down, if anything — omitted when nothing was released;
+ *  claiming a teardown that didn't happen is as false as hiding one that did. */
 export function cancellationNotes(stopped, released) {
     return [
         `This call was cancelled before it finished. ${stopped} Nothing here is a finding about your ` +
@@ -48,14 +18,9 @@ export function cancellationNotes(stopped, released) {
         ...(released === undefined ? [] : [released]),
     ];
 }
-/**
- * A promise that settles when the signal aborts, and a way to stop listening.
- *
- * The disposal half is the point. `Promise.race` leaves the losing promise
- * pending forever, so a listener added per call and never removed accumulates
- * on a signal that outlives the call — the standard leak this shape exists to
- * avoid. Callers race and then dispose in a `finally`.
- */
+/** A promise that settles when the signal aborts, plus a way to stop listening.
+ *  `Promise.race` leaves the loser pending forever, so an unremoved listener leaks on a
+ *  signal that outlives the call — callers race then dispose in a `finally`. */
 export function whenAborted(signal) {
     if (signal.aborted)
         return { promise: Promise.resolve(), dispose: () => { } };

package/dist/cancellation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cancellation.js","sourceRoot":"","sources":["../src/cancellation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,SAAkB,CAAC;AAElD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAiB;IAClE,OAAO;QACL,+CAA+C,OAAO,wCAAwC;YAC5F,oDAAoD;QACtD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAE7E,IAAI,OAAO,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,OAAO,GAAG,GAAG,EAAE;YACb,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cancellation.js","sourceRoot":"","sources":["../src/cancellation.ts"],"names":[],"mappings":"AAAA;;;;kHAIkH;AAElH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,SAAkB,CAAC;AAElD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAiB;IAClE,OAAO;QACL,+CAA+C,OAAO,wCAAwC;YAC5F,oDAAoD;QACtD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;gFAEgF;AAChF,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IAE7E,IAAI,OAAO,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,OAAO,GAAG,GAAG,EAAE;YACb,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/capped.d.ts

@@ -1,41 +1,17 @@
-/**
- * `capped(items, limit) → { shown, detail }` — B6's fix, part 2.
- *
- * `render.ts`'s envelope carries a `truncated` field precisely so a caller
- * does not have to guess whether a short list is short because that is all
- * there was, or because the reply was cut. Before this helper existed, three
- * tools computed that cut three different ways: one sliced and remembered to
- * report `shown`/`total` by hand, one sliced and forgot, one never sliced at
- * all but discarded rows anyway. Two of the three left `render.ts` with
- * nothing to report and it filled the gap with a sentinel
- * (`{shown:-1,total:-1}`) that is worse than reporting nothing, because it
- * passes a presence check and then poisons arithmetic.
- *
- * This is the fix: the slice and the fact that a slice happened are computed
- * together, in one call, so a tool cannot hold one without the other. A tool
- * that caps a list calls this instead of `.slice(0, limit)`, and then has a
- * `detail` sitting right next to `shown` with nothing further to remember.
- */
+/** `capped(items, limit) → { shown, detail }`, B6's fix. Three tools used to compute a list cut
+ *  three different ways; two left `render.ts` filling the gap with a `{shown:-1,total:-1}`
+ *  sentinel — worse than nothing, since it passes a presence check and poisons arithmetic. Now the
+ *  slice and the fact it happened are computed together, so a tool can't hold one without the other. */
 import type { TruncationDetail } from "./render.ts";
 export interface Capped<T> {
     /** The first `limit` items, in their original order. */
     readonly shown: readonly T[];
-    /**
-     * `null` when nothing was withheld — `shown` already holds everything
-     * `items` had. Non-null exactly when `shown.length < items.length`, and
-     * carries the same `{shown, total}` shape `render.ts` puts on the wire, so
-     * a tool can pass it straight through as `truncatedDetail`.
-     */
+    /** `null` when nothing was withheld; otherwise the same `{shown, total}` shape `render.ts` puts
+     *  on the wire, so a tool can pass it straight through as `truncatedDetail`. */
     readonly detail: TruncationDetail | null;
 }
-/**
- * Slice `items` to `limit` and report what that cost in the same call.
- *
- * A negative or fractional `limit` is treated as zero rather than thrown —
- * the callers here already validate `limit` as a positive integer at the
- * schema boundary (`optionalInteger(..., 1)`), so a non-positive value
- * reaching this function is defensive, not an expected input to reject
- * loudly.
- */
+/** Slices `items` to `limit` and reports the cost in the same call. A negative/fractional `limit`
+ *  is treated as zero rather than thrown — defensive only, callers already validate at the schema
+ *  boundary. */
 export declare function capped<T>(items: readonly T[], limit: number): Capped<T>;
 //# sourceMappingURL=capped.d.ts.map

package/dist/capped.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capped.d.ts","sourceRoot":"","sources":["../src/capped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAKvE"}
+{"version":3,"file":"capped.d.ts","sourceRoot":"","sources":["../src/capped.ts"],"names":[],"mappings":"AAAA;;;wGAGwG;AAExG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;IAC7B;oFACgF;IAChF,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC1C;AAED;;gBAEgB;AAChB,wBAAgB,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAKvE"}

package/dist/capped.js

@@ -1,30 +1,10 @@
-/**
- * `capped(items, limit) → { shown, detail }` — B6's fix, part 2.
- *
- * `render.ts`'s envelope carries a `truncated` field precisely so a caller
- * does not have to guess whether a short list is short because that is all
- * there was, or because the reply was cut. Before this helper existed, three
- * tools computed that cut three different ways: one sliced and remembered to
- * report `shown`/`total` by hand, one sliced and forgot, one never sliced at
- * all but discarded rows anyway. Two of the three left `render.ts` with
- * nothing to report and it filled the gap with a sentinel
- * (`{shown:-1,total:-1}`) that is worse than reporting nothing, because it
- * passes a presence check and then poisons arithmetic.
- *
- * This is the fix: the slice and the fact that a slice happened are computed
- * together, in one call, so a tool cannot hold one without the other. A tool
- * that caps a list calls this instead of `.slice(0, limit)`, and then has a
- * `detail` sitting right next to `shown` with nothing further to remember.
- */
-/**
- * Slice `items` to `limit` and report what that cost in the same call.
- *
- * A negative or fractional `limit` is treated as zero rather than thrown —
- * the callers here already validate `limit` as a positive integer at the
- * schema boundary (`optionalInteger(..., 1)`), so a non-positive value
- * reaching this function is defensive, not an expected input to reject
- * loudly.
- */
+/** `capped(items, limit) → { shown, detail }`, B6's fix. Three tools used to compute a list cut
+ *  three different ways; two left `render.ts` filling the gap with a `{shown:-1,total:-1}`
+ *  sentinel — worse than nothing, since it passes a presence check and poisons arithmetic. Now the
+ *  slice and the fact it happened are computed together, so a tool can't hold one without the other. */
+/** Slices `items` to `limit` and reports the cost in the same call. A negative/fractional `limit`
+ *  is treated as zero rather than thrown — defensive only, callers already validate at the schema
+ *  boundary. */
 export function capped(items, limit) {
     const bound = Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 0;
     const shown = items.slice(0, bound);

package/dist/capped.js.map

@@ -1 +1 @@
-{"version":3,"file":"capped.js","sourceRoot":"","sources":["../src/capped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgBH;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CAAI,KAAmB,EAAE,KAAa;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC"}
+{"version":3,"file":"capped.js","sourceRoot":"","sources":["../src/capped.ts"],"names":[],"mappings":"AAAA;;;wGAGwG;AAYxG;;gBAEgB;AAChB,MAAM,UAAU,MAAM,CAAI,KAAmB,EAAE,KAAa;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC"}

package/dist/disclosure-ledger.d.ts

@@ -1,35 +1,11 @@
 /**
- * Which standing disclosures this connection has already been given in full.
- *
- * The tax it removes was measured, not supposed: the R0/class-C reliability
- * sentence is 354 characters — ~88 tokens — and appeared byte-for-byte
- * identical on the large majority of one session's thirty-odd tool calls.
- * Nothing about it was wrong; it was simply the same paragraph, re-billed to
- * the caller's context window every call, and the loop this server is built
- * for (edit, re-check, edit again) is the one that pays it most.
- *
- * ## What the ledger is allowed to shorten, and what it is not
- *
- * Only the *argument* for a cap. The floor and the class it caps to stay on
- * every reply, first or fiftieth, in `graph.resolutionFloor` /
- * `graph.reliabilityCap` and in the short disclosure itself. Rule 7 is about
- * what reaches the user, and a reply that stopped naming its own cap after
- * the first call would be a reply that silently does less.
- *
- * ## Per connection, deliberately not per process
- *
- * "Already disclosed" is a fact about one conversation. A ledger shared across
- * connections would let the *second* client's first call inherit the first
- * client's history — that client would receive the short form of a sentence it
- * has never seen, which is the exact failure this is supposed to avoid, only
- * harder to notice. So one ledger is created per `createMcpServer`, and it
- * lives as long as that server does.
- */
+ * Tracks disclosures this connection has already seen in full. Measured: the
+ * R0/class-C sentence is ~354 chars (~88 tokens), repeated on most of a 30-call
+ * session. Only the *argument* shortens — floor/cap stay on every reply (rule 7).
+ * Per connection, not per process — a second client can't inherit the first's history. */
 export interface DisclosureLedger {
-    /**
-     * `true` the first time this key is seen on this connection, `false` after.
-     * Records the sighting — calling it is what marks the key as disclosed.
-     */
+    /** `true` the first time this key is seen on this connection, `false` after —
+     *  calling it is what marks the key as disclosed. */
     firstSighting(key: string): boolean;
     /** Keys disclosed in full so far. For tests and diagnostics. */
     disclosed(): readonly string[];

package/dist/disclosure-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"disclosure-ledger.d.ts","sourceRoot":"","sources":["../src/disclosure-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,gEAAgE;IAChE,SAAS,IAAI,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAUzD"}
+{"version":3,"file":"disclosure-ledger.d.ts","sourceRoot":"","sources":["../src/disclosure-ledger.ts"],"names":[],"mappings":"AAAA;;;;0FAI0F;AAE1F,MAAM,WAAW,gBAAgB;IAC/B;yDACqD;IACrD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,gEAAgE;IAChE,SAAS,IAAI,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAUzD"}

package/dist/disclosure-ledger.js

@@ -1,30 +1,8 @@
 /**
- * Which standing disclosures this connection has already been given in full.
- *
- * The tax it removes was measured, not supposed: the R0/class-C reliability
- * sentence is 354 characters — ~88 tokens — and appeared byte-for-byte
- * identical on the large majority of one session's thirty-odd tool calls.
- * Nothing about it was wrong; it was simply the same paragraph, re-billed to
- * the caller's context window every call, and the loop this server is built
- * for (edit, re-check, edit again) is the one that pays it most.
- *
- * ## What the ledger is allowed to shorten, and what it is not
- *
- * Only the *argument* for a cap. The floor and the class it caps to stay on
- * every reply, first or fiftieth, in `graph.resolutionFloor` /
- * `graph.reliabilityCap` and in the short disclosure itself. Rule 7 is about
- * what reaches the user, and a reply that stopped naming its own cap after
- * the first call would be a reply that silently does less.
- *
- * ## Per connection, deliberately not per process
- *
- * "Already disclosed" is a fact about one conversation. A ledger shared across
- * connections would let the *second* client's first call inherit the first
- * client's history — that client would receive the short form of a sentence it
- * has never seen, which is the exact failure this is supposed to avoid, only
- * harder to notice. So one ledger is created per `createMcpServer`, and it
- * lives as long as that server does.
- */
+ * Tracks disclosures this connection has already seen in full. Measured: the
+ * R0/class-C sentence is ~354 chars (~88 tokens), repeated on most of a 30-call
+ * session. Only the *argument* shortens — floor/cap stay on every reply (rule 7).
+ * Per connection, not per process — a second client can't inherit the first's history. */
 export function createDisclosureLedger() {
     const seen = new Set();
     return {

package/dist/disclosure-ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"disclosure-ledger.js","sourceRoot":"","sources":["../src/disclosure-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAYH,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO;QACL,aAAa,CAAC,GAAG;YACf,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"disclosure-ledger.js","sourceRoot":"","sources":["../src/disclosure-ledger.ts"],"names":[],"mappings":"AAAA;;;;0FAI0F;AAU1F,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO;QACL,aAAa,CAAC,GAAG;YACf,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,10 +1,6 @@
-/**
- * `@descryy/mcp` — the agent-facing front door.
- *
- * A thin wrapper over the query layer, as DEC-002 requires: every consumer goes
- * through here and **nothing touches storage directly**. That is why the tools
- * hold a `Session` and not a driver.
- */
+/** `@descryy/mcp` — the agent-facing front door. A thin wrapper over the query layer
+ *  (DEC-002): every consumer goes through here and nothing touches storage directly —
+ *  which is why tools hold a `Session`, not a driver. */
 export { createMcpServer } from "./server.ts";
 export type { McpServer, McpServerOptions } from "./server.ts";
 export { Session, loadConfig, writeConfig, writeSources, ConfigError, CONFIG_RELATIVE_PATH, DEFAULT_GRAPH_RELATIVE_PATH, } from "./session.ts";
@@ -15,29 +11,17 @@ export { renderAnswer, renderFailed, renderHandshake, renderTimedOut, renderTool
 export type { AnswerEnvelope, CallToolResult, Provenance, ResultState, ToolAnswer, ToolTier, TruncationDetail, } from "./render.ts";
 export { TOOLS, TOOLS_BY_NAME, ToolInputError, resolveOneNode } from "./tools/index.ts";
 export type { BriefNode, NodeCandidates, Progress, ToolContext, ToolDefinition, } from "./tools/index.ts";
-/**
- * The shape each tool puts in `AnswerEnvelope.data`.
- *
- * `data` is `unknown` in the envelope by design — it differs per tool — but
- * "read the handler" is not a contract, and an AI caller cannot rely on a
- * shape nobody wrote down. Each of these describes what its tool returns
- * **today**; where a tool's payload is genuinely conditional the type is a
- * union that says so rather than a widening to `unknown`.
- */
+/** The shape each tool puts in `AnswerEnvelope.data`. `data` is `unknown` in the envelope
+ *  by design, but an AI caller can't rely on an unwritten shape — each type here describes
+ *  what its tool returns today; genuinely conditional payloads are unions, not `unknown`. */
 export type { AffectedRef, AnalyzeData, BlockedCheck, CoChangedFile, ConfigDependencyReport, ContractPathFinding, ContractShapeMismatchReport, ContractShapeStatus, ContractsData, CrossPrData, CrossPrEmptyDiff, CrossPrGitFailure, CrossPrReport, EnvFindingReport, HiddenDependencyCheck, HiddenDependencyFinding, HistoryData, HistoryFile, HistoryFileResolved, HistoryFileUnresolved, HistoryReport, ImpactData, ImpactReport, ImpactedNode, LinkWorkspaceData, MarkIncidentData, LinkedRepo, OverlapCheck, OverlapReportChecked, PrAnalysisData, PrAnalysisEmptyDiff, PrAnalysisGitFailure, PrAnalysisLists, PrAnalysisRange, PrAnalysisReport, PrAnalysisUnresolved, PropagationData, PropagationReport, QuestionsData, ReachedNode, RelatedNode, ScopeData, ScopeNotSeeded, ScopeReport, ScopeTierCount, ScopedNodeReport, SimilarIncidentReport, SimilarIncidentSignalReport, SimilarIncidentsData, SourceRun, SupersededCheck, TracedPath, ValidateData, } from "./tools/index.ts";
 export { serveStdio, guardStdout, createLineReader } from "./transport.ts";
 export type { Transport, StdioOptions } from "./transport.ts";
 export { PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, negotiateVersion, parseMessage, ProtocolError, } from "./protocol.ts";
 export type { RpcRequest, RpcNotification, RpcResponse, RpcMessage, RpcId } from "./protocol.ts";
-/**
- * The scenario format — storage, schema and the refusals.
- *
- * Re-exported here because `descry check` reads saved scenarios through this
- * module and must not reach past the package boundary to do it. A CLI that
- * imported `./scenarios/storage.ts` by relative path would be a second reader
- * of the format, free to drift from this one the day the schema changes; the
- * whole argument for a format module is that there is exactly one.
- */
-export { SCENARIO_SCHEMA_VERSION, isUnverifying, parseScenario, serializeScenario, scenariosDirectory, scenarioPath, listScenarios, readScenario, writeScenario, } from "./scenarios/index.ts";
+/** The scenario format — storage, schema, refusals. Re-exported here so `descry check`
+ *  doesn't reach past the package boundary — a second reader importing the relative path
+ *  could drift from this one the day the schema changes. */
+export { SCENARIO_SCHEMA_VERSION, isUnverifying, parseScenario, serializeScenario, scenariosDirectory, scenarioPath, listScenarios, ScenarioListError, readScenario, writeScenario, } from "./scenarios/index.ts";
 export type { Scenario, ScenarioStep, ScenarioAssertion, ScenarioAssertionKind, ScenarioActionKind, ScenarioParseResult, TargetDescriptor, } from "./scenarios/index.ts";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC1E,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,cAAc,EACd,UAAU,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,cAAc,EACd,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;GAQG;AACH,YAAY,EACV,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,WAAW,EACX,SAAS,EACT,cAAc,EACd,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,SAAS,EACT,eAAe,EACf,UAAU,EACV,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEjG;;;;;;;;GAQG;AACH,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;yDAEyD;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC1E,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEjG,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,cAAc,EACd,cAAc,EACd,UAAU,EACV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,cAAc,EACd,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B;;6FAE6F;AAC7F,YAAY,EACV,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,WAAW,EACX,SAAS,EACT,cAAc,EACd,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,SAAS,EACT,eAAe,EACf,UAAU,EACV,YAAY,GACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEjG;;4DAE4D;AAC5D,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -1,10 +1,6 @@
-/**
- * `@descryy/mcp` — the agent-facing front door.
- *
- * A thin wrapper over the query layer, as DEC-002 requires: every consumer goes
- * through here and **nothing touches storage directly**. That is why the tools
- * hold a `Session` and not a driver.
- */
+/** `@descryy/mcp` — the agent-facing front door. A thin wrapper over the query layer
+ *  (DEC-002): every consumer goes through here and nothing touches storage directly —
+ *  which is why tools hold a `Session`, not a driver. */
 export { createMcpServer } from "./server.js";
 export { Session, loadConfig, writeConfig, writeSources, ConfigError, CONFIG_RELATIVE_PATH, DEFAULT_GRAPH_RELATIVE_PATH, } from "./session.js";
 export { loadSources, detectSources, normaliseSpec } from "./registry.js";
@@ -12,14 +8,8 @@ export { renderAnswer, renderFailed, renderHandshake, renderTimedOut, renderTool
 export { TOOLS, TOOLS_BY_NAME, ToolInputError, resolveOneNode } from "./tools/index.js";
 export { serveStdio, guardStdout, createLineReader } from "./transport.js";
 export { PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, negotiateVersion, parseMessage, ProtocolError, } from "./protocol.js";
-/**
- * The scenario format — storage, schema and the refusals.
- *
- * Re-exported here because `descry check` reads saved scenarios through this
- * module and must not reach past the package boundary to do it. A CLI that
- * imported `./scenarios/storage.ts` by relative path would be a second reader
- * of the format, free to drift from this one the day the schema changes; the
- * whole argument for a format module is that there is exactly one.
- */
-export { SCENARIO_SCHEMA_VERSION, isUnverifying, parseScenario, serializeScenario, scenariosDirectory, scenarioPath, listScenarios, readScenario, writeScenario, } from "./scenarios/index.js";
+/** The scenario format — storage, schema, refusals. Re-exported here so `descry check`
+ *  doesn't reach past the package boundary — a second reader importing the relative path
+ *  could drift from this one the day the schema changes. */
+export { SCENARIO_SCHEMA_VERSION, isUnverifying, parseScenario, serializeScenario, scenariosDirectory, scenarioPath, listScenarios, ScenarioListError, readScenario, writeScenario, } from "./scenarios/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG1E,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AAWrB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0ExF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAG3E,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AAGvB;;;;;;;;GAQG;AACH,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,GACd,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;yDAEyD;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EACL,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG1E,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AAWrB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAoExF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAG3E,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AAGvB;;4DAE4D;AAC5D,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,aAAa,GACd,MAAM,sBAAsB,CAAC"}

package/dist/module-trust.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Gates `import()` of caller-named specifiers (A-F1/A-F2, three ungated call sites). Refuses path-like specifiers (exact bytes, no install step) by default.
+ * Also refuses a bare specifier resolved into the scanned repo's own git-tracked `node_modules` (real `npm install` leaves it untracked) — a repo can otherwise ship a payload merely by being cloned.
+ * Escape hatches: `DESCRY_ALLOW_PATH_ADAPTER_MODULES=1`, `DESCRY_ALLOW_TRACKED_NODE_MODULES=1` (server env only, never repo-set).
+ */
+export declare const ALLOW_PATH_MODULES_ENV_VAR = "DESCRY_ALLOW_PATH_ADAPTER_MODULES";
+export declare const ALLOW_TRACKED_NODE_MODULES_ENV_VAR = "DESCRY_ALLOW_TRACKED_NODE_MODULES";
+export type ModuleTrustDecision = {
+    readonly allowed: true;
+} | {
+    readonly allowed: false;
+    readonly reason: string;
+};
+/** Path-like: relative/absolute/drive-absolute/home-relative path, or any URL-scheme specifier (`file:`, `http:`, `data:`, …) — names exact bytes, not an installed package. Everything else resolves normally. */
+export declare function isPathLikeSpecifier(specifier: string): boolean;
+/** Decides if `specifier` may be `import()`-ed; never throws — each call site turns a refusal into its own existing failure channel (`SourceLoadFailure`, etc.). */
+export declare function checkModuleTrust(specifier: string): ModuleTrustDecision;
+/** Follow-up to `checkModuleTrust`: refuses a bare specifier resolved into the scanned repo's own git-tracked `node_modules` (real `npm install` leaves it untracked) — closes a payload-via-commit gap. A `null` git-tracked check (no `.git`) is allowed, not refused: the exploit needs a clone, and a non-git directory is a real workflow this check has no history to verify either way. */
+export declare function checkRepoResolvedModuleTrust(options: {
+    readonly specifier: string;
+    readonly repoPath: string;
+    readonly resolvedAbsolutePath: string;
+}): Promise<ModuleTrustDecision>;
+//# sourceMappingURL=module-trust.d.ts.map

package/dist/module-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-trust.d.ts","sourceRoot":"","sources":["../src/module-trust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,eAAO,MAAM,0BAA0B,sCAAsC,CAAC;AAC9E,eAAO,MAAM,kCAAkC,sCAAsC,CAAC;AAEtF,MAAM,MAAM,mBAAmB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpH,mNAAmN;AACnN,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAK9D;AAOD,oKAAoK;AACpK,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAYvE;AAOD,kYAAkY;AAClY,wBAAsB,4BAA4B,CAAC,OAAO,EAAE;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiB/B"}

package/dist/module-trust.js

@@ -0,0 +1,60 @@
+/**
+ * Gates `import()` of caller-named specifiers (A-F1/A-F2, three ungated call sites). Refuses path-like specifiers (exact bytes, no install step) by default.
+ * Also refuses a bare specifier resolved into the scanned repo's own git-tracked `node_modules` (real `npm install` leaves it untracked) — a repo can otherwise ship a payload merely by being cloned.
+ * Escape hatches: `DESCRY_ALLOW_PATH_ADAPTER_MODULES=1`, `DESCRY_ALLOW_TRACKED_NODE_MODULES=1` (server env only, never repo-set).
+ */
+import { isPathTrackedByGit } from "@descryy/core";
+export const ALLOW_PATH_MODULES_ENV_VAR = "DESCRY_ALLOW_PATH_ADAPTER_MODULES";
+export const ALLOW_TRACKED_NODE_MODULES_ENV_VAR = "DESCRY_ALLOW_TRACKED_NODE_MODULES";
+/** Path-like: relative/absolute/drive-absolute/home-relative path, or any URL-scheme specifier (`file:`, `http:`, `data:`, …) — names exact bytes, not an installed package. Everything else resolves normally. */
+export function isPathLikeSpecifier(specifier) {
+    if (specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("~"))
+        return true;
+    if (/^[a-zA-Z]:[\\/]/.test(specifier))
+        return true;
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(specifier))
+        return true;
+    return false;
+}
+function pathModulesAllowed() {
+    const value = process.env[ALLOW_PATH_MODULES_ENV_VAR];
+    return value === "1" || value === "true";
+}
+/** Decides if `specifier` may be `import()`-ed; never throws — each call site turns a refusal into its own existing failure channel (`SourceLoadFailure`, etc.). */
+export function checkModuleTrust(specifier) {
+    if (!isPathLikeSpecifier(specifier))
+        return { allowed: true };
+    if (pathModulesAllowed())
+        return { allowed: true };
+    return {
+        allowed: false,
+        reason: `"${specifier}" names a file path or URL rather than an installed package. Loading one executes ` +
+            "arbitrary code with no further confirmation, and this specifier can come from a scanned repository's " +
+            "own configuration or from a tool call — neither is necessarily something the operator running this " +
+            `server chose. Refused by default; set ${ALLOW_PATH_MODULES_ENV_VAR}=1 in this server's own environment ` +
+            "to allow it, and only do that for adapters and configuration you, the operator, trust.",
+    };
+}
+function trackedNodeModulesAllowed() {
+    const value = process.env[ALLOW_TRACKED_NODE_MODULES_ENV_VAR];
+    return value === "1" || value === "true";
+}
+/** Follow-up to `checkModuleTrust`: refuses a bare specifier resolved into the scanned repo's own git-tracked `node_modules` (real `npm install` leaves it untracked) — closes a payload-via-commit gap. A `null` git-tracked check (no `.git`) is allowed, not refused: the exploit needs a clone, and a non-git directory is a real workflow this check has no history to verify either way. */
+export async function checkRepoResolvedModuleTrust(options) {
+    if (trackedNodeModulesAllowed())
+        return { allowed: true };
+    const tracked = await isPathTrackedByGit(options.repoPath, options.resolvedAbsolutePath);
+    if (tracked !== true)
+        return { allowed: true };
+    return {
+        allowed: false,
+        reason: `"${options.specifier}" resolved to ${options.resolvedAbsolutePath}, inside ${options.repoPath}'s own ` +
+            "node_modules — but that file is committed to this repository's own git history, not installed by a " +
+            "package manager (a real `npm install` leaves node_modules untracked, almost universally). A " +
+            "repository that commits its own node_modules can deliver arbitrary code to anyone who merely clones " +
+            `it, with no npm install step at all. Refused by default; set ${ALLOW_TRACKED_NODE_MODULES_ENV_VAR}=1 ` +
+            "in this server's own environment to allow it, and only do that for a repository whose committed " +
+            "node_modules you, the operator, trust.",
+    };
+}
+//# sourceMappingURL=module-trust.js.map

package/dist/module-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-trust.js","sourceRoot":"","sources":["../src/module-trust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,CAAC,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,mCAAmC,CAAC;AAItF,mNAAmN;AACnN,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,IAAI,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,oKAAoK;AACpK,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,kBAAkB,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EACJ,IAAI,SAAS,oFAAoF;YACjG,uGAAuG;YACvG,qGAAqG;YACrG,yCAAyC,0BAA0B,sCAAsC;YACzG,wFAAwF;KAC3F,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC9D,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,kYAAkY;AAClY,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAIlD;IACC,IAAI,yBAAyB,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE1D,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE/C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EACJ,IAAI,OAAO,CAAC,SAAS,iBAAiB,OAAO,CAAC,oBAAoB,YAAY,OAAO,CAAC,QAAQ,SAAS;YACvG,qGAAqG;YACrG,8FAA8F;YAC9F,sGAAsG;YACtG,gEAAgE,kCAAkC,KAAK;YACvG,kGAAkG;YAClG,wCAAwC;KAC3C,CAAC;AACJ,CAAC"}

package/dist/path-confinement.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Confines a caller-named path to a set of roots, with a disclosed, operator-set
+ * escape hatch (A-F6). Generalizes two `observe-runtime.ts` call sites with no such
+ * check: `evidencePath` (relative joined onto repo root with no re-check — `..`
+ * escaped it) and `attach.logFilePath` (read in full every poll, unchecked). */
+export type PathConfinementDecision = {
+    readonly allowed: true;
+    readonly resolved: string;
+} | {
+    readonly allowed: false;
+    readonly reason: string;
+};
+export interface PathConfinementOptions {
+    /** The path as configured, absolute or relative. Relative is resolved against `process.cwd()` — callers that mean "relative to the repo" must join it themselves before calling this. */
+    readonly candidate: string;
+    /** Confined when the resolved candidate is under any of these. */
+    readonly allowedRoots: readonly string[];
+    /** Set to `"1"` or `"true"` in this server's own environment to bypass confinement. */
+    readonly envVar: string;
+    /** What the value is, for the refusal message — e.g. `"evidencePath"`. */
+    readonly what: string;
+}
+export declare function checkPathConfinement(options: PathConfinementOptions): PathConfinementDecision;
+export type SensitivePathDecision = {
+    readonly sensitive: false;
+} | {
+    readonly sensitive: true;
+    readonly reason: string;
+};
+export declare function checkNotSensitivePath(candidate: string, envVar: string): SensitivePathDecision;
+//# sourceMappingURL=path-confinement.d.ts.map

package/dist/path-confinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.d.ts","sourceRoot":"","sources":["../src/path-confinement.ts"],"names":[],"mappings":"AAAA;;;;gFAIgF;AAIhF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAOzD,MAAM,WAAW,sBAAsB;IACrC,yLAAyL;IACzL,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,sBAAsB,GAAG,uBAAuB,CAe7F;AAQD,MAAM,MAAM,qBAAqB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1H,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAY9F"}

package/dist/path-confinement.js

@@ -0,0 +1,44 @@
+/**
+ * Confines a caller-named path to a set of roots, with a disclosed, operator-set
+ * escape hatch (A-F6). Generalizes two `observe-runtime.ts` call sites with no such
+ * check: `evidencePath` (relative joined onto repo root with no re-check — `..`
+ * escaped it) and `attach.logFilePath` (read in full every poll, unchecked). */
+import { resolve, sep } from "node:path";
+function isWithin(resolvedCandidate, root) {
+    const resolvedRoot = resolve(root);
+    return resolvedCandidate === resolvedRoot || resolvedCandidate.startsWith(resolvedRoot + sep);
+}
+export function checkPathConfinement(options) {
+    const resolved = resolve(options.candidate);
+    if (options.allowedRoots.some((root) => isWithin(resolved, root))) {
+        return { allowed: true, resolved };
+    }
+    if (process.env[options.envVar] === "1" || process.env[options.envVar] === "true") {
+        return { allowed: true, resolved };
+    }
+    return {
+        allowed: false,
+        reason: `"${options.candidate}" (${options.what}) resolves to ${resolved}, outside ` +
+            `${options.allowedRoots.length === 1 ? "" : "every one of "}${options.allowedRoots.join(", ")}. ` +
+            `Refused by default; set ${options.envVar}=1 in this server's own environment to allow it.`,
+    };
+}
+/** Name-based blocklist for logFilePath (can't root-confine — logs live anywhere),
+ *  narrowed to the exploit's shape (`~/.ssh/id_rsa`). NOT primary defence: `redact()`
+ *  unconditionally scans every byte first — this only stops the read itself. */
+const SENSITIVE_PATH_SEGMENT = /(^|[/\\])(\.ssh|\.aws|\.gnupg|\.kube|\.netrc|\.npmrc|\.git-credentials|\.pgpass|shadow|id_rsa|id_dsa|id_ecdsa|id_ed25519|\.env(\..+)?|[^/\\]+\.pem|[^/\\]+\.key)($|[/\\])/i;
+export function checkNotSensitivePath(candidate, envVar) {
+    const resolved = resolve(candidate);
+    if (!SENSITIVE_PATH_SEGMENT.test(resolved))
+        return { sensitive: false };
+    if (process.env[envVar] === "1" || process.env[envVar] === "true")
+        return { sensitive: false };
+    return {
+        sensitive: true,
+        reason: `"${candidate}" names a file shape that is never an application log (an SSH/cloud/credential ` +
+            `location) — refusing to read it as one. This is a narrow, name-based check, not a guarantee that ` +
+            `every sensitive path is caught; set ${envVar}=1 in this server's own environment if this path ` +
+            "genuinely is your application's log.",
+    };
+}
+//# sourceMappingURL=path-confinement.js.map

package/dist/path-confinement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-confinement.js","sourceRoot":"","sources":["../src/path-confinement.ts"],"names":[],"mappings":"AAAA;;;;gFAIgF;AAEhF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAMzC,SAAS,QAAQ,CAAC,iBAAyB,EAAE,IAAY;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,iBAAiB,KAAK,YAAY,IAAI,iBAAiB,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;AAChG,CAAC;AAaD,MAAM,UAAU,oBAAoB,CAAC,OAA+B;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EACJ,IAAI,OAAO,CAAC,SAAS,MAAM,OAAO,CAAC,IAAI,iBAAiB,QAAQ,YAAY;YAC5E,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACjG,2BAA2B,OAAO,CAAC,MAAM,kDAAkD;KAC9F,CAAC;AACJ,CAAC;AAED;;gFAEgF;AAChF,MAAM,sBAAsB,GAC1B,4KAA4K,CAAC;AAI/K,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,MAAc;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC/F,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EACJ,IAAI,SAAS,iFAAiF;YAC9F,mGAAmG;YACnG,uCAAuC,MAAM,mDAAmD;YAChG,sCAAsC;KACzC,CAAC;AACJ,CAAC"}