@frockbot/plugin-audit 0.0.0 → 0.1.1

package/src/bot.ts

@@ -0,0 +1,312 @@
+// The Bot half of the Audit Package: the projection, and the bounded outbox
+// that carries its entries across the Bot/User seam.
+//
+// The kernel imports no Package, so nothing here is called from `kernel-do`.
+// The Bot Durable Object projects a *settled* run — one that has already
+// reached a durable terminal state — and hands the entries to a narrow
+// `AuditSinkV1` its host constructs, the same shape the Memory Package reaches
+// the User Durable Object through.
+//
+// WHY AN OUTBOX, when the transcript index is fire-and-forget. Because the
+// parity item is completeness: GrokBot's `agents/audit-outbox.json` is a
+// durable queue of 1028 audited actions (`grokbot-computer.md:193`, `:547`),
+// and an audit surface with silent gaps answers no question anybody asks of
+// it. So entries are appended to a bounded durable key in the Bot Durable
+// Object first and drained after; a drain that fails leaves them pending for
+// the next settlement or the alarm the Bot already has. Overflow drops the
+// oldest and sets a durable `outbox-truncated` marker the UI shows and a
+// rebuild clears — "Failures are observable through durable state" rather than
+// a queue that quietly forgets.
+//
+// It reads the *stored* run rather than the client projection, because the
+// client projection drops `call.input` and the argument digest needs the exact
+// arguments.
+import { auditKindForToolV1 } from "./classify.js";
+import { auditArgumentDigestV1, auditPreviewV1 } from "./redact.js";
+import {
+  AUDIT_MAX_OUTBOX_V1,
+  decodeAuditOccurrenceIdV1,
+  type AuditEntryV1,
+  type AuditOutcomeV1,
+} from "./shared.js";
+
+/** The User-scoped audit table, as a Bot Durable Object calls it. */
+export interface AuditSinkV1 {
+  /** Idempotent on `(botId, runId, occurrenceId)`. */
+  indexEntries(entries: readonly AuditEntryV1[]): Promise<void>;
+}
+
+/**
+ * The decoded run this Package reads: the durable events, and nothing else.
+ *
+ * Structural on purpose, so the Shell Package's stored-run page and a
+ * settlement-time lookup satisfy it without either naming this Package.
+ */
+export interface AuditProjectableRunV1 {
+  runId: string;
+  status: string;
+  events: readonly {
+    type: string;
+    timestamp?: string;
+    occurrenceId?: string;
+    name?: string;
+    input?: unknown;
+    content?: string;
+    isError?: boolean;
+    status?: string;
+  }[];
+  /** Used only when an event carries no timestamp of its own. */
+  acceptedAt?: string;
+}
+
+/** A run is projected once it can no longer change. */
+export function isSettledAuditRunV1(run: { status: string }): boolean {
+  return (
+    run.status === "completed" ||
+    run.status === "failed" ||
+    run.status === "cancelled"
+  );
+}
+
+function outcomeFor(
+  result: { isError?: boolean; status?: string; content?: string } | undefined,
+): AuditOutcomeV1 {
+  // No result at all is `unknown`, never `error`. The durable log does not
+  // know how the effect ended, and inventing an answer here would be the
+  // silent classification the constitution's reconciliation rule forbids.
+  if (!result) return "unknown";
+  if (result.status === "interrupted") return "interrupted";
+  if (result.isError !== true) return "ok";
+  // A tool that declined before doing anything is a refusal, which is a
+  // materially different fact from an effect that ran and failed.
+  return /\brefus|not allowed|denied|blocked while\b/i.test(
+    result.content ?? "",
+  )
+    ? "refused"
+    : "error";
+}
+
+/**
+ * The audit entries one settled run contributes, in a deterministic order.
+ *
+ * Determinism is the whole contract, exactly as it is for the transcript
+ * index: every field is derived from the run's own durable events and from
+ * nothing else, so the entries a Turn writes on settlement and the entries a
+ * rebuild writes months later are byte-for-byte identical, and re-projecting a
+ * run is a no-op rather than a duplicate.
+ */
+export async function auditEntriesFromStoredRunV1(
+  botId: string,
+  run: AuditProjectableRunV1,
+): Promise<AuditEntryV1[]> {
+  if (!isSettledAuditRunV1(run)) return [];
+  const results = new Map<
+    string,
+    { isError?: boolean; status?: string; content?: string }
+  >();
+  for (const event of run.events) {
+    if (event.type !== "tool/result" || !event.occurrenceId) continue;
+    results.set(event.occurrenceId, {
+      ...(event.isError === undefined ? {} : { isError: event.isError }),
+      ...(event.status === undefined ? {} : { status: event.status }),
+      ...(event.content === undefined ? {} : { content: event.content }),
+    });
+  }
+  const entries: AuditEntryV1[] = [];
+  for (const event of run.events) {
+    if (event.type !== "tool/call") continue;
+    const { occurrenceId, name } = event;
+    if (!occurrenceId || !name) continue;
+    const classification = auditKindForToolV1(name, event.input);
+    if (!classification) continue;
+    let coordinates: { turn: number; step: number; ordinal: number };
+    try {
+      coordinates = decodeAuditOccurrenceIdV1(occurrenceId);
+    } catch {
+      // An occurrence id this schema cannot place is an entry with no
+      // coordinates; the run is still readable, and a row that lied about
+      // where it came from would be worse than its absence.
+      continue;
+    }
+    const result = results.get(occurrenceId);
+    const at = event.timestamp ?? run.acceptedAt;
+    if (!at) continue;
+    entries.push({
+      schemaVersion: 1,
+      botId,
+      runId: run.runId,
+      occurrenceId,
+      ...coordinates,
+      // `plugin-shell` writes `occurrenceId: context.effectId`, so the
+      // Computer envelope's `effectId` and this string are the same key.
+      effectId: occurrenceId,
+      at,
+      kind: classification.kind,
+      target: classification.target,
+      toolName: name,
+      argumentDigest: await auditArgumentDigestV1(event.input),
+      preview: auditPreviewV1(classification.kind, name, event.input),
+      outcome: outcomeFor(result),
+      ...(result?.content === undefined
+        ? {}
+        : { bytesOut: new TextEncoder().encode(result.content).byteLength }),
+    });
+  }
+  return entries;
+}
+
+// ---------------------------------------------------------------------------
+// The outbox.
+// ---------------------------------------------------------------------------
+
+/** The durable key the Bot Durable Object's outbox lives under. */
+export const AUDIT_OUTBOX_KEY_V1 = "audit:outbox";
+
+/** Exactly the Durable Object storage surface the outbox uses. */
+export interface AuditOutboxStorageV1 {
+  get<T>(key: string): Promise<T | undefined>;
+  put<T>(key: string, value: T): Promise<void>;
+  delete(key: string): Promise<boolean>;
+}
+
+export interface AuditOutboxStateV1 {
+  pending: number;
+  /** Entries were dropped to stay inside the bound; a rebuild clears it. */
+  truncated: boolean;
+}
+
+interface StoredOutbox {
+  schemaVersion: 1;
+  entries: AuditEntryV1[];
+  truncated: boolean;
+}
+
+function decodeStoredOutbox(value: unknown): StoredOutbox {
+  if (
+    typeof value !== "object" ||
+    value === null ||
+    (value as StoredOutbox).schemaVersion !== 1 ||
+    !Array.isArray((value as StoredOutbox).entries)
+  ) {
+    return { schemaVersion: 1, entries: [], truncated: false };
+  }
+  const stored = value as StoredOutbox;
+  return {
+    schemaVersion: 1,
+    entries: stored.entries.slice(0, AUDIT_MAX_OUTBOX_V1),
+    truncated: stored.truncated === true,
+  };
+}
+
+/**
+ * A bounded, durable, at-least-once queue of audit entries.
+ *
+ * At-least-once, never at-most-once: an entry stays in the outbox until the
+ * User Durable Object has accepted it, and acceptance is idempotent on
+ * `(botId, runId, occurrenceId)`, so a redelivery costs a no-op insert. That
+ * pairing is the whole reason a queue is safe here.
+ */
+export class AuditOutboxV1 {
+  private readonly maximum: number;
+
+  constructor(
+    private readonly storage: AuditOutboxStorageV1,
+    options: { maximum?: number } = {},
+  ) {
+    this.maximum = options.maximum ?? AUDIT_MAX_OUTBOX_V1;
+  }
+
+  private async read(): Promise<StoredOutbox> {
+    return decodeStoredOutbox(
+      await this.storage.get<unknown>(AUDIT_OUTBOX_KEY_V1),
+    );
+  }
+
+  private async write(outbox: StoredOutbox): Promise<void> {
+    if (outbox.entries.length === 0 && !outbox.truncated) {
+      await this.storage.delete(AUDIT_OUTBOX_KEY_V1);
+      return;
+    }
+    await this.storage.put(AUDIT_OUTBOX_KEY_V1, outbox);
+  }
+
+  async state(): Promise<AuditOutboxStateV1> {
+    const outbox = await this.read();
+    return { pending: outbox.entries.length, truncated: outbox.truncated };
+  }
+
+  /**
+   * Appends entries, dropping the oldest when the bound is reached.
+   *
+   * Dropping the oldest rather than refusing the newest: an audit surface that
+   * stopped recording because it was full would go quiet exactly when a Bot
+   * was busiest. The loss is durable and named instead.
+   */
+  async append(entries: readonly AuditEntryV1[]): Promise<AuditOutboxStateV1> {
+    if (entries.length === 0) return this.state();
+    const outbox = await this.read();
+    const seen = new Set(
+      outbox.entries.map((entry) => `${entry.runId}${entry.occurrenceId}`),
+    );
+    for (const entry of entries) {
+      const key = `${entry.runId}${entry.occurrenceId}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      outbox.entries.push(entry);
+    }
+    if (outbox.entries.length > this.maximum) {
+      outbox.entries = outbox.entries.slice(
+        outbox.entries.length - this.maximum,
+      );
+      outbox.truncated = true;
+    }
+    await this.write(outbox);
+    return { pending: outbox.entries.length, truncated: outbox.truncated };
+  }
+
+  /**
+   * Hands everything pending to the sink and clears what it accepted.
+   *
+   * A throwing sink leaves the outbox exactly as it was: nothing is cleared
+   * that was not delivered, which is the only property that makes the queue
+   * worth having. The truncation marker survives a drain — it describes what
+   * was lost, not what is pending — and only a rebuild clears it.
+   */
+  async drain(
+    sink: AuditSinkV1,
+  ): Promise<{ delivered: number; state: AuditOutboxStateV1 }> {
+    const outbox = await this.read();
+    if (outbox.entries.length === 0) {
+      return {
+        delivered: 0,
+        state: { pending: 0, truncated: outbox.truncated },
+      };
+    }
+    await sink.indexEntries(outbox.entries);
+    const delivered = outbox.entries.length;
+    const remaining = await this.read();
+    // Anything appended while the sink was in flight stays pending.
+    const deliveredKeys = new Set(
+      outbox.entries.map((entry) => `${entry.runId}${entry.occurrenceId}`),
+    );
+    const next: StoredOutbox = {
+      schemaVersion: 1,
+      entries: remaining.entries.filter(
+        (entry) => !deliveredKeys.has(`${entry.runId}${entry.occurrenceId}`),
+      ),
+      truncated: remaining.truncated || outbox.truncated,
+    };
+    await this.write(next);
+    return {
+      delivered,
+      state: { pending: next.entries.length, truncated: next.truncated },
+    };
+  }
+
+  /** Clears the truncation marker. Only a completed rebuild may do this. */
+  async clearTruncation(): Promise<void> {
+    const outbox = await this.read();
+    if (!outbox.truncated) return;
+    await this.write({ ...outbox, truncated: false });
+  }
+}

package/src/classify.test.ts

@@ -0,0 +1,174 @@
+import { describe, expect, test } from "bun:test";
+import { auditKindForToolV1 } from "./classify.ts";
+import {
+  decodeAuditOccurrenceIdV1,
+  isAuditTargetV1,
+  type AuditKindV1,
+} from "./shared.ts";
+
+describe("the classifier table", () => {
+  const table: Array<[string, unknown, AuditKindV1 | undefined, string?]> = [
+    ["computer_exec", { command: "ls" }, "shell", "computer"],
+    [
+      "computer_exec",
+      { command: "npm run dev", background: true },
+      "process",
+      "computer",
+    ],
+    ["computer_screenshot", {}, undefined],
+    ["computer_process_check", { processId: "p1" }, "process", "computer"],
+    ["computer_process_logs", { processId: "p1" }, "process", "computer"],
+    ["computer_process_stop", { processId: "p1" }, "process", "computer"],
+    ["computer_browser", { action: "navigate" }, "browser", "computer"],
+    [
+      "computer_process_start",
+      { command: "npm run dev" },
+      "process",
+      "computer",
+    ],
+    ["computer_process_poll", { processId: "p1" }, "process", "computer"],
+    ["memory_write", { text: "a fact" }, "file", "computer"],
+    ["skill_write", { path: "a.md" }, "file", "computer"],
+    ["package_author", { packageId: "x" }, "file", "computer"],
+    ["mcp__example__echo", { message: "hi" }, "mcp", "remote:example"],
+    ["mcp__beeper__send_message", {}, "mcp", "remote:beeper"],
+    // Read-only and product tools perform no audited effect at all. An audit
+    // surface that logged them would be a transcript.
+    ["current_time", {}, undefined],
+    ["memory_search", { query: "gym" }, undefined],
+    ["skill_load", { skill: "a" }, undefined],
+    ["send_to_user", { text: "hi" }, undefined],
+    ["mcp__", {}, undefined],
+  ];
+
+  for (const [name, input, kind, target] of table) {
+    test(`${name} → ${kind ?? "not audited"}`, () => {
+      const classification = auditKindForToolV1(name, input);
+      if (kind === undefined) {
+        expect(classification).toBeUndefined();
+        return;
+      }
+      expect(classification?.kind).toBe(kind);
+      expect(classification?.target).toBe(target!);
+      expect(isAuditTargetV1(classification!.target)).toBe(true);
+    });
+  }
+
+  test("the registered machine's tools audit against the machine they named", () => {
+    // Register rows 48 and 49. Every `machine_*` tool carries `machineId` on
+    // its input verbatim, which is what lets the table answer `machine:<id>`
+    // without knowing anything about the Package that produced the call.
+    expect(
+      auditKindForToolV1("machine_exec", {
+        machineId: "994dc2ee-1",
+        command: "git status",
+      }),
+    ).toEqual({ kind: "shell", target: "machine:994dc2ee-1" });
+    for (const name of [
+      "machine_read",
+      "machine_copy_to_computer",
+      "machine_copy_from_computer",
+    ]) {
+      expect(
+        auditKindForToolV1(name, { machineId: "994dc2ee-1", path: "/tmp/x" }),
+      ).toEqual({ kind: "file", target: "machine:994dc2ee-1" });
+    }
+    // Reading the registry and reading a command's own result perform no
+    // external effect, so they are not audited at all: an audit surface that
+    // logged every tool call would be a transcript.
+    for (const name of ["machine_list", "machine_command_check"]) {
+      expect(auditKindForToolV1(name, { commandId: "c1" })).toBeUndefined();
+    }
+    // Row 57g. Every one of the seven Messages verbs is an `mcp` row against
+    // the Mac it named — reaching a service on somebody's laptop, which is the
+    // shape §4.2 gives them — and the send is audited exactly like the reads.
+    for (const name of [
+      "machine_messages_check_permissions",
+      "machine_messages_find_chats",
+      "machine_messages_chat_items",
+      "machine_messages_search",
+      "machine_messages_activity",
+      "machine_messages_fetch_attachment",
+      "machine_messages_send",
+    ]) {
+      expect(auditKindForToolV1(name, { machineId: "994dc2ee-1" })).toEqual({
+        kind: "mcp",
+        target: "machine:994dc2ee-1",
+      });
+    }
+    // A machine tool that named no machine could not have run; the row says
+    // so by falling back to the target it did name.
+    expect(auditKindForToolV1("machine_exec", { command: "ls" })).toEqual({
+      kind: "shell",
+      target: "computer",
+    });
+  });
+
+  test("a call naming a registered machine is audited against that machine", () => {
+    expect(
+      auditKindForToolV1("computer_exec", {
+        command: "ls",
+        machineId: "994dc2ee-1",
+      }),
+    ).toEqual({ kind: "shell", target: "machine:994dc2ee-1" });
+    // A malformed machine id is the Bot's own Computer, not a target the row
+    // would be lying about.
+    expect(
+      auditKindForToolV1("computer_exec", { command: "ls", machineId: "../x" }),
+    ).toEqual({ kind: "shell", target: "computer" });
+  });
+
+  test("is pure: the same call always classifies the same way", () => {
+    const first = auditKindForToolV1("computer_exec", { command: "ls" });
+    const second = auditKindForToolV1("computer_exec", { command: "ls" });
+    expect(first).toEqual(second!);
+  });
+
+  test("is total: no input throws", () => {
+    for (const input of [undefined, null, 1, "text", [], { machineId: 7 }]) {
+      expect(() => auditKindForToolV1("computer_exec", input)).not.toThrow();
+    }
+  });
+});
+
+describe("occurrence-id decoding", () => {
+  test("names the turn, step and ordinal already in the durable event", () => {
+    expect(decodeAuditOccurrenceIdV1("tool:3:2:0")).toEqual({
+      turn: 3,
+      step: 2,
+      ordinal: 0,
+    });
+    expect(decodeAuditOccurrenceIdV1("tool:1:1:11")).toEqual({
+      turn: 1,
+      step: 1,
+      ordinal: 11,
+    });
+  });
+
+  test("refuses anything the kernel would not have written", () => {
+    for (const value of [
+      "tool:0:1:0",
+      "tool:1:0:0",
+      "tool:1:1",
+      "tool:1:1:0:0",
+      "call:1:1:0",
+      "tool:-1:1:0",
+      "",
+      42,
+    ]) {
+      expect(() => decodeAuditOccurrenceIdV1(value)).toThrow();
+    }
+  });
+});
+
+describe("target shapes", () => {
+  test("accepts exactly the three the schema declares", () => {
+    expect(isAuditTargetV1("computer")).toBe(true);
+    expect(isAuditTargetV1("machine:Tims-M5")).toBe(true);
+    expect(isAuditTargetV1("remote:mcp.example.test")).toBe(true);
+    expect(isAuditTargetV1("remote:mcp.example.test:8443")).toBe(true);
+    expect(isAuditTargetV1("box")).toBe(false);
+    expect(isAuditTargetV1("machine:")).toBe(false);
+    expect(isAuditTargetV1("remote:/etc/passwd")).toBe(false);
+  });
+});

package/src/classify.ts

@@ -0,0 +1,151 @@
+// The classifier: one pure table from a tool call to an audit kind and target.
+//
+// PURITY IS THE CONTRACT. A settlement-time projection and a rebuild months
+// later must produce byte-identical rows, or the index stops being a
+// projection and starts being a second authority that can disagree with the
+// first. This function therefore reads only its arguments — never the clock,
+// never a registry, never the Bot's mounted Composition — exactly as
+// `searchRowsFromClientRunV1` does for the transcript index.
+//
+// The MCP target is the one thing a tool name cannot answer on its own: the
+// name carries the Connection's *slug* (`mcp__<slug>__<tool>`,
+// `plugin-mcp/src/agent.ts`), and the host lives in the Connection's settings,
+// which the User Durable Object owns. So this answers `remote:<slug>` and the
+// User object — the authority for Connections — resolves it to `remote:<host>`
+// on the one code path both projection and rebuild go through
+// (`resolveAuditTargetV1` in `user.ts`). One resolution point, in the object
+// that holds the registry, is the only arrangement where the two cannot drift.
+import {
+  AUDIT_TARGET_COMPUTER_V1,
+  AUDIT_TARGET_MACHINE_PREFIX_V1,
+  AUDIT_TARGET_REMOTE_PREFIX_V1,
+  type AuditKindV1,
+} from "./shared.js";
+
+/** What one tool call is, for audit. */
+export interface AuditClassificationV1 {
+  kind: AuditKindV1;
+  /**
+   * `computer`, `machine:<id>`, or the provisional `remote:<slug>` an MCP call
+   * carries until the Connection registry resolves its host.
+   */
+  target: string;
+}
+
+/**
+ * Tools whose effect is a write to the Workspace rather than a command.
+ *
+ * `AGENTS.md` § Memory notes the parity gap this closes: GrokBot audits
+ * neither Memory writes nor Routine edits (`grokbot-computer.md:194-195`).
+ * They already carry their own intent and result events here, so auditing them
+ * costs one table row and no new authority.
+ */
+const FILE_TOOLS = new Set([
+  "memory_write",
+  "memory_forget",
+  "skill_write",
+  "package_author",
+  // The registered machine's file verbs (register rows 48, 49). They are file
+  // effects on "a separate filesystem" — the User's own laptop — which is why
+  // their target is `machine:<id>` and never `computer`.
+  "machine_read",
+  "machine_copy_to_computer",
+  "machine_copy_from_computer",
+]);
+
+/**
+ * The registered machine's shell verb.
+ *
+ * It is a `shell` row for the same reason `computer_exec` is: §2.16 says the
+ * machine runs `Shell`, row 30 audits "every shell command … with turn id and
+ * target", and the target is what tells the two apart. It is never
+ * `background`: a machine command outlives its Turn by construction — the
+ * approval ends the Turn before anything runs — so there is no foreground case
+ * for a `process` row to be the exception to.
+ */
+const MACHINE_SHELL_TOOL = "machine_exec";
+
+/**
+ * The registered Mac's Messages verbs (register row 57g).
+ *
+ * They are `mcp` rows and not `file` ones: reading somebody's Messages history
+ * or sending as them is reaching a *service* on that machine — the shape §4.2
+ * itself gives them, beside the connector tools — and the target says which
+ * machine it was. Prefix-matched rather than listed one by one because the
+ * seven names all belong to one Package and one classification, so a Package
+ * that adds an eighth cannot accidentally add an unaudited one.
+ */
+const MACHINE_MESSAGES_PREFIX = "machine_messages_";
+
+const MCP_TOOL = /^mcp__([a-zA-Z0-9_]{1,64})__(.{1,96})$/;
+const MACHINE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * The registered Mac, when the call named one.
+ *
+ * GrokBot reaches Tim's laptop by passing `machineId` to `Shell`, and its
+ * `audit.jsonl` records which target the command ran on
+ * (`grokbot-computer.md:361`). `plugin-user-machine` carries `machineId` on
+ * every one of its tool inputs verbatim, for exactly this reason: the target a
+ * command ran on is read off the call, and this function did not have to learn
+ * anything about the Package to say so.
+ */
+function machineTarget(input: unknown): string | undefined {
+  if (!isObject(input)) return undefined;
+  const machineId = input.machineId;
+  if (typeof machineId !== "string" || !MACHINE_ID.test(machineId)) {
+    return undefined;
+  }
+  return `${AUDIT_TARGET_MACHINE_PREFIX_V1}${machineId}`;
+}
+
+/**
+ * What kind of audited effect a tool call is, or `undefined` when it is none.
+ *
+ * `undefined` is the common answer and deliberately so: a Turn that asks the
+ * time or searches Memory performs no external effect, and an audit surface
+ * that logged every tool call would be a transcript, not an audit.
+ */
+export function auditKindForToolV1(
+  name: string,
+  input: unknown,
+): AuditClassificationV1 | undefined {
+  const onComputer = machineTarget(input) ?? AUDIT_TARGET_COMPUTER_V1;
+  if (name === "computer_exec") {
+    // A background command outlives the Turn that launched it and is acted on
+    // afterwards by the three `computer_process_*` tools, so it is a process
+    // rather than a command that ended with the call. GrokBot draws the same
+    // line, as `shellKind: foreground | background` on its own audit line
+    // (`docs/research/grokbot-computer.md:189`).
+    const background =
+      isObject(input) && input.background === true ? "process" : "shell";
+    return { kind: background, target: onComputer };
+  }
+  if (name === MACHINE_SHELL_TOOL) {
+    // No `machineId` on the input is not a machine command; it is a call that
+    // could not have run, and it is audited against the target it named.
+    return { kind: "shell", target: onComputer };
+  }
+  if (name === "computer_browser") {
+    return { kind: "browser", target: onComputer };
+  }
+  if (name.startsWith("computer_process_")) {
+    return { kind: "process", target: onComputer };
+  }
+  if (name.startsWith(MACHINE_MESSAGES_PREFIX)) {
+    return { kind: "mcp", target: onComputer };
+  }
+  if (FILE_TOOLS.has(name)) return { kind: "file", target: onComputer };
+  const mcp = MCP_TOOL.exec(name);
+  if (mcp) {
+    return {
+      kind: "mcp",
+      target: `${AUDIT_TARGET_REMOTE_PREFIX_V1}${mcp[1]}`,
+    };
+  }
+  return undefined;
+}