@gmickel/gno 1.28.0 → 1.29.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmickel/gno",
-  "version": "1.28.0",
+  "version": "1.29.0",
   "description": "Local semantic search for your documents. Index Markdown, PDF, and Office files with hybrid BM25 + vector search.",
   "keywords": [
     "embeddings",

package/spec/cli.md

@@ -672,6 +672,44 @@ gno collection clear-embeddings <name> [--all] [--json]
 
 ---
 
+### gno collection policy
+
+Inspect, change, or explain one collection-owned egress boundary.
+
+```bash
+gno collection policy get <name>
+gno collection policy set <name> <local_only|lan|remote> [--confirm-relaxation <current-revision>]
+gno collection policy check --action <action> --destination <zone> --content-class <class> [-c <name>...] [--authenticated] [--authorized] [--partial] [--explain-egress]
+```
+
+`get` returns the configured value, effective value, provenance source, and a
+durable monotonic revision plus a diagnostic version fingerprint. Tightening is
+immediate. Relaxation requires `--confirm-relaxation` with the exact current
+numeric revision returned by `get`; stale, replayed, cross-collection, and
+cross-target confirmation fails without changing config or the index
+projection.
+`check` and `--explain-egress` perform no action. They return the same
+content-free decision, lineage, partial disclosure, audit metadata, and
+remediation contract.
+
+### gno egress-audit
+
+Manage local content-free policy decision receipts:
+
+```bash
+gno egress-audit list [--limit <n>] [--cursor <cursor>]
+gno egress-audit show <audit-id>
+gno egress-audit status
+gno egress-audit delete <audit-id>
+gno egress-audit purge
+```
+
+Pages are newest-first. Delete/purge report truthful SQLite physical cleanup
+status. These local inspection and deletion commands never require a relaxed
+collection policy.
+
+---
+
 ### gno embed
 
 Generate embeddings for indexed chunks.
@@ -3273,7 +3311,9 @@ is blocked.
 - Starts a headless `/mcp` Streamable HTTP listener; it does not serve the Web UI
 - Exposes the same safe REST lifecycle snapshot at `/api/resident/status`;
   resident-aware app status at `/api/status` is loopback-only because it
-  includes local index and configuration details
+  includes local index and configuration details. Non-loopback resident status
+  intersects exact Host/Origin and bearer authentication with the current
+  peer zone and all participating collection policies before returning metadata
 - On `--detach`: forks a detached child with stdio redirected to `--log-file`, writes pid-file JSON including the MCP gateway `port`, prints `{pid}` on stdout, exits 0
 - On `--status`: output matches the [process-status schema](./output-schemas/process-status.schema.json), including the MCP gateway port and a best-effort copy of the live redacted resident snapshot
 - On `--stop`: SIGTERM → 10s poll → SIGKILL → 2s poll; the daemon's own signal handler unlinks the pid-file, `--stop` unlinks as fallback

package/spec/db/schema.sql

@@ -49,6 +49,25 @@ CREATE TABLE IF NOT EXISTS collections (
   exclude TEXT,              -- JSON array of patterns
   update_cmd TEXT,
   language_hint TEXT,        -- BCP-47 or NULL
+  -- Migration 023 backfills existing rows as local_only/legacy_default.
+  -- Config sync without an explicit value remains local_only/config_default;
+  -- only explicit config may persist lan or remote.
+  egress_policy TEXT NOT NULL DEFAULT 'local_only'
+    CHECK (egress_policy IN ('local_only', 'lan', 'remote')),
+  egress_policy_source TEXT NOT NULL DEFAULT 'legacy_default'
+    CHECK (
+      egress_policy_source IN (
+        'explicit',
+        'config_default',
+        'legacy_default'
+      )
+    )
+    CHECK (
+      egress_policy_source = 'explicit'
+      OR egress_policy = 'local_only'
+    ),
+  egress_policy_revision INTEGER NOT NULL DEFAULT 0
+    CHECK (egress_policy_revision >= 0),
   synced_at TEXT NOT NULL DEFAULT (datetime('now'))
 );
 

package/spec/mcp.md

@@ -98,6 +98,26 @@ HTTP MCP remains read-only unless `gateway.enableWrite: true` or
 authorize mutation. Unauthorized calls to write tools fail with HTTP 403 before
 SDK dispatch.
 
+Every `tools/call`, `resources/list`, `resources/templates/list`, and
+`resources/read` request is also checked against the current socket peer zone
+and the effective policy of every referenced collection before SDK dispatch.
+The check is per request, including batch members and requests that reuse an
+existing session; a session's original peer zone is never reused as authority.
+Non-loopback access therefore requires both a valid bearer token and a
+compatible collection policy. Policy denial returns HTTP 403 with stable
+`EGRESS_DENIED` data and a redacted evaluator audit. Write authorization remains
+an independent additional requirement.
+
+The MCP tool and resource registry is paired with a callsite-level
+network-boundary inventory. A TypeScript AST scan covers shipped TS, TSX, JS,
+and JSX and recognizes direct, qualified, bracketed, imported, and aliased
+fetch, EventSource, WebSocket, Bun listener/DNS/socket, HTTP inference, and
+external-process primitives. Every detected invocation has its own stable
+inventory key, so adding a second call in an already-listed file still fails
+the contract test. Browser same-origin calls are classified as client
+transport and name the server route that performs the actual egress check; the
+client scan itself is not treated as content authorization.
+
 Boundary failures use the closed
 [`mcp-http-error`](./output-schemas/mcp-http-error.schema.json) body with stable,
 redacted statuses: 401 (authentication), 403 (peer/Host/Origin/write), 413
@@ -2346,6 +2366,52 @@ MCP Server Status
 
 ---
 
+## Collection Egress Policy and Audit Tools
+
+Read tools:
+
+- `gno_egress_policy_get { collection }` returns configured/effective policy,
+  provenance source, current monotonic revision, and diagnostic version.
+- `gno_egress_check` accepts exact collection scope, action, destination zone,
+  caller authentication/authorization, content class, and partial mode. It
+  performs no action and returns the canonical decision/explanation contract.
+  An explicit scope is a non-empty, duplicate-free list of at most 64 canonical
+  collection names; omitted scope means all configured collections.
+- `gno_egress_audit_list`, `gno_egress_audit_show`, and
+  `gno_egress_audit_status` expose only content-free local receipts.
+
+Write-enabled tools:
+
+- `gno_egress_policy_set` requires confirmation
+  `{ collection, currentPolicy, currentRevision, targetPolicy, acknowledged: true }`
+  for relaxation. The revision is durable and one-use; replayed, stale,
+  cross-collection, and cross-target confirmations fail closed.
+- `gno_egress_audit_delete` deletes exactly one receipt.
+- `gno_egress_audit_purge { confirm: true }` deletes only audit receipts.
+
+Policy does not replace transport authentication or `enableWrite`. Local audit
+inspection remains available when outbound content is denied. Retrieval-trace
+export resolves exact trace lineage and checks policy before creating or
+reusing an export receipt; missing traces return `NOT_FOUND` before policy
+evaluation.
+
+All collection-policy and audit tool inputs are closed objects. Unknown
+top-level fields are rejected by MCP input validation before any handler,
+mutation, invalidation, or audit operation runs.
+
+Active resident requests retain their admission authorization epoch. A policy
+mutation may advance its own request to the new epoch, but older REST and MCP
+responses are replaced by a content-free `EGRESS_POLICY_CHANGED` retry
+response/event before protected bytes are emitted, including streaming
+responses. `/api/events` binds each SSE subscriber to its admission epoch and
+rechecks it before every document event and heartbeat; a stale subscriber
+receives only the retry event and is then unsubscribed.
+
+Schemas: `collection-egress-policy.schema.json`,
+`collection-egress-policy-set.schema.json`,
+`collection-egress-check.schema.json`, and
+`egress-audit-management.schema.json`.
+
 ## See Also
 
 - [CLI Specification](./cli.md)

package/spec/output-schemas/ask.schema.json

@@ -95,6 +95,35 @@
     }
   ],
   "$defs": {
+    "egressLineage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["effectivePolicy", "digest", "sources"],
+      "properties": {
+        "effectivePolicy": { "enum": ["local_only", "lan", "remote"] },
+        "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "sources": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["collection", "policy", "source"],
+            "properties": {
+              "collection": {
+                "type": "string",
+                "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$"
+              },
+              "policy": { "enum": ["local_only", "lan", "remote"] },
+              "source": {
+                "enum": ["explicit", "config_default", "legacy_default"]
+              }
+            }
+          }
+        }
+      }
+    },
     "searchResult": {
       "type": "object",
       "required": ["docid", "score", "uri", "snippet", "source"],
@@ -127,6 +156,7 @@
           "type": "string",
           "description": "Resolved user-configured retrieval guidance, ordered from global to collection to matching path prefixes"
         },
+        "egressLineage": { "$ref": "#/$defs/egressLineage" },
         "snippet": {
           "type": "string",
           "description": "Matching text snippet from document mirror"
@@ -431,7 +461,7 @@
         "schemaVersion": { "const": "1.0" },
         "mode": { "const": "closed_capsule" },
         "capsule": {
-          "$ref": "gno://schemas/context-capsule-v1@1.0"
+          "$ref": "gno://schemas/context-capsule-v1@1.1"
         },
         "freshness": {
           "$ref": "gno://schemas/context-capsule-verification@1.0"

package/spec/output-schemas/browser-clip-preview.schema.json

@@ -18,6 +18,7 @@
         "destination": {
           "$ref": "gno://schemas/browser-clip@1.0#/properties/destination"
         },
+        "egressLineage": { "$ref": "#/definitions/egressLineage" },
         "tags": {
           "type": "array",
           "items": { "type": "string" }
@@ -48,6 +49,35 @@
     }
   },
   "definitions": {
+    "egressLineage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["effectivePolicy", "digest", "sources"],
+      "properties": {
+        "effectivePolicy": { "enum": ["local_only", "lan", "remote"] },
+        "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "sources": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["collection", "policy", "source"],
+            "properties": {
+              "collection": {
+                "type": "string",
+                "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$"
+              },
+              "policy": { "enum": ["local_only", "lan", "remote"] },
+              "source": {
+                "enum": ["explicit", "config_default", "legacy_default"]
+              }
+            }
+          }
+        }
+      }
+    },
     "source": {
       "type": "object",
       "additionalProperties": false,

package/spec/output-schemas/collection-egress-check.schema.json

@@ -0,0 +1,91 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://gno.sh/schemas/collection-egress-check.schema.json",
+  "title": "Collection egress check and explanation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "mode",
+    "allowedCollections",
+    "omittedCollections",
+    "disclosure",
+    "lineage",
+    "decision",
+    "remediation"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "mode": { "enum": ["complete", "partial", "denied"] },
+    "allowedCollections": {
+      "type": "array",
+      "items": { "type": "string" },
+      "uniqueItems": true
+    },
+    "omittedCollections": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["collection", "reason"],
+        "properties": {
+          "collection": { "type": "string" },
+          "reason": { "type": "string" }
+        }
+      }
+    },
+    "disclosure": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["code", "omittedCount", "omittedCollections"],
+          "properties": {
+            "code": { "const": "EGRESS_PARTIAL_RESULT" },
+            "omittedCount": { "type": "integer", "minimum": 1 },
+            "omittedCollections": {
+              "type": "array",
+              "items": { "type": "string" },
+              "minItems": 1,
+              "uniqueItems": true
+            }
+          }
+        }
+      ]
+    },
+    "lineage": {
+      "type": "object",
+      "required": ["effectivePolicy", "digest", "sources"],
+      "properties": {
+        "effectivePolicy": { "enum": ["local_only", "lan", "remote"] },
+        "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "sources": { "type": "array", "minItems": 1 }
+      }
+    },
+    "decision": {
+      "type": "object",
+      "required": ["allowed", "code", "reason", "audit"],
+      "properties": {
+        "allowed": { "type": "boolean" },
+        "code": { "enum": ["EGRESS_ALLOWED", "EGRESS_DENIED"] },
+        "reason": { "type": "string" },
+        "audit": { "type": "object" }
+      }
+    },
+    "remediation": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["code", "message"],
+          "properties": {
+            "code": { "type": "string" },
+            "message": { "type": "string", "minLength": 1 }
+          }
+        }
+      ]
+    }
+  }
+}

package/spec/output-schemas/collection-egress-policy-set.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://gno.sh/schemas/collection-egress-policy-set.schema.json",
+  "title": "Collection egress policy mutation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "previous",
+    "current",
+    "change",
+    "invalidation"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "previous": {
+      "$ref": "collection-egress-policy.schema.json"
+    },
+    "current": {
+      "$ref": "collection-egress-policy.schema.json"
+    },
+    "change": {
+      "enum": ["tightened", "relaxed", "source_changed", "unchanged"]
+    },
+    "invalidation": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "policyEpoch",
+            "queuedJobsInvalidated",
+            "sessionsInvalidated",
+            "staleWorkMustRetry"
+          ],
+          "properties": {
+            "policyEpoch": {
+              "type": "string",
+              "pattern": "^egress-epoch-v1:[a-f0-9]{64}$"
+            },
+            "queuedJobsInvalidated": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "sessionsInvalidated": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "staleWorkMustRetry": { "const": true }
+          }
+        }
+      ]
+    }
+  }
+}

package/spec/output-schemas/collection-egress-policy.schema.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://gno.sh/schemas/collection-egress-policy.schema.json",
+  "title": "Collection egress policy state",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "collection",
+    "configuredPolicy",
+    "effectivePolicy",
+    "source",
+    "revision",
+    "version"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "collection": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$"
+    },
+    "configuredPolicy": {
+      "type": ["string", "null"],
+      "enum": ["local_only", "lan", "remote", null]
+    },
+    "effectivePolicy": {
+      "enum": ["local_only", "lan", "remote"]
+    },
+    "source": {
+      "enum": ["explicit", "config_default"]
+    },
+    "revision": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^egress-policy-v1:[a-f0-9]{64}$"
+    }
+  }
+}

package/spec/output-schemas/context-capsule-v1.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "gno://schemas/context-capsule-v1@1.0",
+  "$id": "gno://schemas/context-capsule-v1@1.1",
   "title": "GNO Context Capsule V1",
   "description": "Deterministic, extractive evidence compiled under one canonical JSON budget.",
   "type": "object",
@@ -25,6 +25,65 @@
     "capsuleId"
   ],
   "allOf": [
+    {
+      "if": {
+        "properties": { "schemaVersion": { "const": "1.1" } },
+        "required": ["schemaVersion"]
+      },
+      "then": {
+        "required": ["egressLineage"],
+        "properties": {
+          "egressLineage": { "$ref": "#/definitions/egressLineage" },
+          "evidence": {
+            "type": "array",
+            "items": {
+              "allOf": [
+                { "$ref": "#/definitions/evidence" },
+                {
+                  "type": "object",
+                  "required": ["egressLineage"],
+                  "properties": {
+                    "egressLineage": {
+                      "$ref": "#/definitions/egressLineage"
+                    }
+                  }
+                }
+              ]
+            }
+          }
+        }
+      },
+      "else": {
+        "not": {
+          "type": "object",
+          "required": ["egressLineage"],
+          "properties": {
+            "egressLineage": { "$ref": "#/definitions/egressLineage" }
+          }
+        },
+        "properties": {
+          "evidence": {
+            "type": "array",
+            "items": {
+              "allOf": [
+                { "$ref": "#/definitions/evidence" },
+                {
+                  "not": {
+                    "type": "object",
+                    "required": ["egressLineage"],
+                    "properties": {
+                      "egressLineage": {
+                        "$ref": "#/definitions/egressLineage"
+                      }
+                    }
+                  }
+                }
+              ]
+            }
+          }
+        }
+      }
+    },
     {
       "if": {
         "properties": {
@@ -84,9 +143,10 @@
     }
   ],
   "properties": {
-    "schemaVersion": { "const": "1.0" },
+    "schemaVersion": { "enum": ["1.0", "1.1"] },
     "coordinateSpace": { "const": "canonical_mirror" },
     "capsuleId": { "$ref": "#/definitions/sha256" },
+    "egressLineage": { "$ref": "#/definitions/egressLineage" },
     "goal": { "type": "string", "minLength": 1, "maxLength": 16384 },
     "query": { "type": "string", "minLength": 1, "maxLength": 16384 },
     "scope": {
@@ -446,6 +506,32 @@
       "maxLength": 64,
       "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$"
     },
+    "egressLineage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["effectivePolicy", "digest", "sources"],
+      "properties": {
+        "effectivePolicy": { "enum": ["local_only", "lan", "remote"] },
+        "digest": { "$ref": "#/definitions/sha256" },
+        "sources": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["collection", "policy", "source"],
+            "properties": {
+              "collection": { "$ref": "#/definitions/collection" },
+              "policy": { "enum": ["local_only", "lan", "remote"] },
+              "source": {
+                "enum": ["explicit", "config_default", "legacy_default"]
+              }
+            }
+          }
+        }
+      }
+    },
     "filterValues": {
       "type": "array",
       "maxItems": 128,
@@ -670,6 +756,7 @@
         "egress": {
           "enum": ["local_only", "lan", "remote", "unclassified", "unavailable"]
         },
+        "egressLineage": { "$ref": "#/definitions/egressLineage" },
         "record": { "$ref": "#/definitions/recordEvidenceMetadata" }
       }
     },

package/spec/output-schemas/context-capsule-verification.schema.json

@@ -21,7 +21,7 @@
     "evidence"
   ],
   "properties": {
-    "schemaVersion": { "const": "1.0" },
+    "schemaVersion": { "enum": ["1.0", "1.1"] },
     "coordinateSpace": { "const": "canonical_mirror" },
     "capsuleId": { "$ref": "#/definitions/sha256" },
     "operationStatus": { "const": "completed" },