@guardbee/mcp-security-proxy 0.3.1 → 1.1.0

package/README.md

@@ -13,22 +13,25 @@ A transparent security layer that sits in front of any MCP server. Blocks prompt
 ```
 Claude ──► MCP Security Proxy ──► Any MCP Server
                 │
-                ├─ Prompt injection detection  (16 attack patterns)
-                ├─ PII masking                 (national ID, IBAN, email, JWT, API key)
+                ├─ Prompt injection detection  (27 rules, EN + TR)
+                ├─ PII + secret masking        (TC, VKN, IBAN, card, phone, 22 key formats)
                 ├─ Block or warn mode
-                └─ Configurable audit log
+                ├─ Toxic-flow (lethal trifecta) blocking
+                └─ Hash-chained audit log
 ```
 
 ---
 
 ## Features
 
-- **Prompt Injection Protection** — 16 attack patterns block requests attempting to override system prompts
+- **Prompt Injection Protection** — 27 rules in English and Turkish; precise ones block, generic phrases only warn
 - **Tool-result injection** — the same patterns applied to tool results, tagged MCP06:2025. Block mode replaces the result; warn mode prepends a warning
 - **Session tool pin** — the first `tools/list` is pinned. A later description or schema change is a rug pull (MCP03:2025). Block mode keeps serving the pinned definition and refuses the drifted call
-- **PII Masking** — national ID numbers, IBAN, email, phone, JWT tokens, API keys are automatically masked in responses
+- **PII Masking** — TC Kimlik No, VKN, IBAN, card and phone numbers (checksum-validated), email, 22 provider key formats, private keys and connection strings are masked in responses
 - **Block / Warn Mode** — each interceptor can independently run in blocking or warning mode
 - **Audit Log** — configurable log written to console or a file
+- **Gateway mode** — several MCP servers behind one proxy, one YAML policy (allow / deny / mask / warn)
+- **Toxic-flow blocking** — tracks the lethal trifecta across servers and blocks the egress call that would complete it
 - **Zero Code Changes** — attaches in front of any existing MCP server
 
 ---
@@ -60,6 +63,75 @@ Add to `claude_desktop_config.json`:
 
 ---
 
+## Gateway Mode: Several Servers, One Policy
+
+Put every MCP server behind one proxy with a `guardbee-proxy.yaml`. `init` does the move for you:
+
+```bash
+npx -y @guardbee/mcp-security-proxy@^1 init --client claude-desktop   # or cursor, claude-code, --file ./mcp.json
+```
+
+It moves each stdio server into `~/.guardbee/guardbee-proxy.yaml` (mode 0600), backs up the client config and points it at the proxy. HTTP servers stay as they are and are reported, because they would bypass the policy. `--dry-run` prints both files without writing. Or by hand:
+
+```json
+{
+  "mcpServers": {
+    "guardbee": {
+      "command": "npx",
+      "args": ["-y", "@guardbee/mcp-security-proxy@^1", "--config", "/path/to/guardbee-proxy.yaml"]
+    }
+  }
+}
+```
+
+```yaml
+version: 1
+upstreams:
+  github:
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-github"]
+    env: { GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_TOKEN}" }   # read from the environment
+  postgres:
+    command: npx
+    args: ["-y", "@guardbee/mcp-db-gateway"]
+
+labels:                       # override the heuristic labels
+  github__get_issue: [untrusted]
+  github__create_pull_request: [egress]
+
+rules:                        # first match wins
+  - id: no-deletes
+    match: { tool: "postgres__delete_*" }
+    action: deny              # allow | deny | mask | warn | approve
+  - match: { tool: "postgres__query", args: { table: "salaries" } }   # dotted path → value, strings are globs
+    action: mask
+    mask: { fields: [salary, iban] }   # blank these JSON keys
+  - match: { label: destructive }
+    action: approve           # ask the person first
+
+taint:
+  mode: strict                # strict | approve | warn | off
+
+audit:
+  sink: file
+  filePath: ./guardbee-audit.jsonl
+```
+
+- Tools and prompts appear as `<upstream>__<tool>`.
+- **Toxic flow (lethal trifecta):** each tool is labeled `untrusted`, `sensitive`, `egress` or `destructive` (name/description heuristics, overridable under `labels`). Once a session has read untrusted content (an `untrusted` tool or any resource) and sensitive data (a `sensitive` tool or any PII in a result), an `egress` call is blocked in `strict` mode and only logged in `warn` mode. The check spans servers: an issue read from GitHub plus a customer record from a CRM blocks a webhook on a third server.
+- **Rules** match on `tool` (glob), `upstream`, `label`, `session` (`clean` | `tainted`) and `args`. `mask` forces PII masking for that tool even when masking is off, and `mask.fields` also blanks the named JSON keys in text and `structuredContent`. A rule's `allow` does not skip the toxic-flow check; relabel the tool instead.
+- **Approval:** `approve` (a rule action, or `taint.mode: approve` for toxic flows) shows the person a yes/no form through MCP elicitation, with the tool, the reason and the arguments. Anything but an explicit yes — decline, cancel, no answer within `approval.timeoutSeconds` (default 120) — blocks the call. A client without elicitation support cannot approve, so the call is blocked with a message saying so.
+- **Tokenize:** with `interceptors.piiMasking.mode: tokenize` the model sees `<pii:tc_kimlik:7f3a9b21>` instead of the value and can still pass it to another tool: the proxy puts the real value back on the way to that server. Tokens live in memory for the session only, and are not turned back into values for an `egress` tool unless `piiMasking.detokenizeForEgress: true`.
+- **Prompts** (`prompts/get`) get the same injection scan and PII masking as tool results.
+- `interceptors.definitionDrift.recheck: on-change` skips the per-call `tools/list` and re-checks only after a server sends `tools/list_changed`, which the proxy also passes on to the agent.
+- **Audit log** is hash-chained. By default it stores a SHA-256 of the arguments instead of the arguments, and no results; set `audit.includePayloads: true` to log them. Check a log with `guardbee-proxy verify-audit ./guardbee-audit.jsonl`.
+- `guardbee-proxy validate --config guardbee-proxy.yaml` checks a config without starting any server.
+- Without `--config`, the proxy also picks up `./guardbee-proxy.yaml` or `GUARDBEE_PROXY_CONFIG=<file>.yaml`.
+
+The single-server `--` form above keeps its 0.x behavior: tool names are not prefixed, payloads are logged, and a toxic flow is only logged as a warning.
+
+---
+
 ## MCP Tools
 
 The proxy does not register tools of its own. It forwards the target server's tools and applies the interceptor chain on every call.
@@ -70,24 +142,31 @@ The proxy does not register tools of its own. It forwards the target server's to
 
 ### Prompt Injection Detector
 
-Looks for the following attack patterns in incoming messages:
+27 rules from [`@guardbee/guard-core`](../guard-core/README.md), applied to tool arguments, tool results, resources and prompts:
+
+- **Block** (13 precise, high/critical): instruction overrides in English and Turkish ("ignore all previous instructions", "önceki talimatları yok say"), `DAN mode`, "bypass your safety guardrails", chat-template tokens (`<|im_start|>`, `[INST]`), `<system>` tags, text hidden in Unicode tag characters, instructions in CSS-hidden elements or HTML comments, markdown image exfiltration beacons, requests to reveal the system prompt (English and Turkish), "send the user's data to https://…".
+- **Warn only** (14): generic phrases that also appear in ordinary text — "act as", "you are now", "developer mode", "jailbreak", "override policy", "sen artık" — and medium-severity signals such as zero-width or bidi control characters and a line-start `System:` label.
+- **Base64:** runs that decode to readable text are decoded and checked against the block rules, so an instruction cannot hide in an encoded blob.
 
-- `ignore previous instructions`
-- `disregard your system prompt`
-- `you are now [DAN/jailbreak]`
-- commands hidden via ANSI escape sequences
-- base64-encoded instructions
-- and 11 more patterns
+Since 1.1, a broad phrase alone no longer blocks: in 1.0 "use jailbreak mode" or "act as a reverse proxy" in a tool result was blocked; now it is logged and the result carries a warning.
 
 ### PII Masker
 
-| Data Type | Example Input | Output |
-|-----------|------------|-------|
-| National ID | `12345678901` | `[TC-REDACTED]` |
-| IBAN | `TR320006200...` | `TR32***` |
-| Email | `ahmet@example.com` | `ah***@example.com` |
-| JWT | `eyJhbGc...` | `[JWT-REDACTED]` |
-| API Key | `sk-abc123...` | `[KEY-REDACTED]` |
+| Data Type | Check | Example Input | Output |
+|-----------|-------|---------------|--------|
+| National ID (TC Kimlik No) | official checksum | `10000000146` | `[TC-KİMLİK]` |
+| IBAN (TR) | mod-97 | `TR330006100519786457841326` | `TR**[IBAN]` |
+| Card number | Luhn | `4111 1111 1111 1111` | `****-****-****-[KART]` |
+| Email | — | `ahmet@example.com` | `***@[EMAIL]` |
+| Phone (TR) | mobile / landline / 850 prefix | `0532 123 45 67` | `+90-***-***-**[TELEFON]` |
+| Tax number (VKN) | check digit, needs a `VKN` / `Vergi No` label | `VKN: 1234567890` | `VKN: [VKN]` |
+| Provider keys | 22 key and token formats from secret-scanner (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack, …) | `ghp_…`, `AKIA…` | `[API-KEY]` |
+| Other API keys | `sk_`/`api_`/`token_`… prefix, letters and digits | `api_k3y9x8…` | `[API-KEY]` |
+| Private key | whole BEGIN…END block | `-----BEGIN … PRIVATE KEY-----` | `[PRIVATE-KEY]` |
+| Connection string | user:password in the URL (localhost excluded) | `postgres://app:pw@db/prod` | `[CONNECTION-STRING]` |
+| JWT | — | `eyJhbGc...` | `[JWT-TOKEN]` |
+
+A number that fails its checksum (an order number, a tracking code) is left as is.
 
 ---
 

package/TR.md

@@ -13,22 +13,25 @@ Herhangi bir MCP sunucusunun önüne oturan şeffaf güvenlik katmanı. Prompt i
 ```
 Claude ──► MCP Security Proxy ──► Herhangi bir MCP Sunucu
                 │
-                ├─ Prompt injection tespiti  (16 saldırı deseni)
-                ├─ PII maskeleme             (TC kimlik, IBAN, e-posta, JWT, API key)
+                ├─ Prompt injection tespiti  (27 kural, EN + TR)
+                ├─ PII + secret maskeleme    (TC, VKN, IBAN, kart, telefon, 22 anahtar formatı)
                 ├─ Block veya warn modu
-                └─ Yapılandırılabilir audit log
+                ├─ Toxic-flow (lethal trifecta) engelleme
+                └─ Hash zincirli audit log
 ```
 
 ---
 
 ## Özellikler
 
-- **Prompt Injection Koruması** — 16 saldırı deseni ile sistem prompt'larını geçersiz kılmaya çalışan istekler engellenir
+- **Prompt Injection Koruması** — İngilizce ve Türkçe 27 kural; kesin kurallar engeller, genel ifadeler sadece uyarır
 - **Tool sonucu enjeksiyonu** — aynı kalıplar tool sonucuna uygulanır (MCP06:2025). Block modu sonucu değiştirir; warn modu uyarı ekler
 - **Oturum tool sabitlemesi** — ilk `tools/list` sabitlenir. Sonraki description veya şema değişikliği rug pull'dur (MCP03:2025). Block modu sabit tanımı sunmaya devam eder ve kaymış çağrıyı reddeder
-- **PII Maskeleme** — TC kimlik no, IBAN, e-posta, telefon, JWT token, API key yanıtlarda otomatik maskelenir
+- **PII Maskeleme** — TC kimlik no, VKN, IBAN, kart ve telefon numaraları (checksum doğrulamalı), e-posta, 22 sağlayıcı anahtar formatı, özel anahtarlar ve bağlantı dizeleri yanıtlarda maskelenir
 - **Block / Warn Modu** — Her interceptor bağımsız olarak engelleyici veya uyarı modunda çalışabilir
 - **Audit Log** — Console veya dosyaya yazılan yapılandırılabilir log
+- **Gateway modu** — birden fazla MCP sunucusu tek proxy'nin arkasında, tek YAML politikası (allow / deny / mask / warn)
+- **Toxic-flow engelleme** — lethal trifecta'yı sunucular arasında izler ve onu tamamlayacak egress çağrısını engeller
 - **Sıfır Kod Değişikliği** — Mevcut herhangi bir MCP sunucusunun önüne takılır
 
 ---
@@ -60,6 +63,75 @@ npm install -g @guardbee/mcp-security-proxy
 
 ---
 
+## Gateway Modu: Birden Fazla Sunucu, Tek Politika
+
+Tüm MCP sunucularını bir `guardbee-proxy.yaml` ile tek proxy'nin arkasına koyun. `init` taşımayı sizin için yapar:
+
+```bash
+npx -y @guardbee/mcp-security-proxy@^1 init --client claude-desktop   # veya cursor, claude-code, --file ./mcp.json
+```
+
+Her stdio sunucusunu `~/.guardbee/guardbee-proxy.yaml` dosyasına (izin 0600) taşır, istemci config'inin yedeğini alır ve config'i proxy'ye yönlendirir. HTTP sunucuları olduğu gibi kalır ve raporlanır, çünkü politikayı atlarlar. `--dry-run` iki dosyayı da yazmadan gösterir. Elle yapmak için:
+
+```json
+{
+  "mcpServers": {
+    "guardbee": {
+      "command": "npx",
+      "args": ["-y", "@guardbee/mcp-security-proxy@^1", "--config", "/path/to/guardbee-proxy.yaml"]
+    }
+  }
+}
+```
+
+```yaml
+version: 1
+upstreams:
+  github:
+    command: npx
+    args: ["-y", "@modelcontextprotocol/server-github"]
+    env: { GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_TOKEN}" }   # ortam değişkeninden okunur
+  postgres:
+    command: npx
+    args: ["-y", "@guardbee/mcp-db-gateway"]
+
+labels:                       # sezgisel etiketleri ezer
+  github__get_issue: [untrusted]
+  github__create_pull_request: [egress]
+
+rules:                        # ilk eşleşen kural kazanır
+  - id: no-deletes
+    match: { tool: "postgres__delete_*" }
+    action: deny              # allow | deny | mask | warn | approve
+  - match: { tool: "postgres__query", args: { table: "salaries" } }   # noktalı yol → değer, string'ler glob
+    action: mask
+    mask: { fields: [salary, iban] }   # bu JSON anahtarlarını boşalt
+  - match: { label: destructive }
+    action: approve           # önce kişiye sor
+
+taint:
+  mode: strict                # strict | approve | warn | off
+
+audit:
+  sink: file
+  filePath: ./guardbee-audit.jsonl
+```
+
+- Tool'lar ve prompt'lar `<upstream>__<tool>` adıyla görünür.
+- **Toxic flow (lethal trifecta):** her tool `untrusted`, `sensitive`, `egress` veya `destructive` olarak etiketlenir (ad/açıklama sezgileriyle; `labels` altında ezilebilir). Oturum güvenilmeyen içerik (`untrusted` bir tool veya herhangi bir resource) ve hassas veri (`sensitive` bir tool veya bir sonuçtaki herhangi bir PII) gördükten sonra, `egress` çağrısı `strict` modda engellenir, `warn` modda sadece loglanır. Kontrol sunucular arasında çalışır: GitHub'dan okunan bir issue ile CRM'den gelen bir müşteri kaydı, üçüncü bir sunucudaki webhook çağrısını engeller.
+- **Kurallar** `tool` (glob), `upstream`, `label`, `session` (`clean` | `tainted`) ve `args` alanlarıyla eşleşir. `mask`, maskeleme kapalı olsa bile o tool için PII maskelemeyi zorunlu kılar; `mask.fields` ayrıca adı verilen JSON anahtarlarını metinde ve `structuredContent`'te boşaltır. Bir kuraldaki `allow` toxic-flow kontrolünü atlatmaz; bunun yerine tool'un etiketini değiştirin.
+- **Onay:** `approve` (kural aksiyonu olarak ya da toxic flow için `taint.mode: approve`) kişiye MCP elicitation üzerinden tool'u, gerekçeyi ve argümanları gösteren bir evet/hayır formu açar. Açık bir "evet" dışındaki her cevap (red, iptal, `approval.timeoutSeconds` içinde cevap gelmemesi; varsayılan 120) çağrıyı engeller. Elicitation desteklemeyen istemci onay veremez; çağrı bunu söyleyen bir mesajla engellenir.
+- **Tokenize:** `interceptors.piiMasking.mode: tokenize` ile model değerin yerine `<pii:tc_kimlik:7f3a9b21>` görür ve bu token'ı başka bir tool'a yine verebilir; proxy gerçek değeri o sunucuya giderken geri koyar. Token'lar sadece oturum boyunca bellekte tutulur ve `piiMasking.detokenizeForEgress: true` olmadıkça `egress` tool'lar için geri çevrilmez.
+- **Prompt'lar** (`prompts/get`) tool sonuçlarıyla aynı injection taramasından ve PII maskelemeden geçer.
+- `interceptors.definitionDrift.recheck: on-change` her çağrıdaki `tools/list`'i atlar ve sadece sunucu `tools/list_changed` gönderdiğinde yeniden kontrol eder; proxy bu bildirimi ajana da iletir.
+- **Audit log** hash zincirlidir. Varsayılan olarak argümanların kendisi yerine SHA-256'sını tutar, sonuçları hiç yazmaz; yazmak için `audit.includePayloads: true`. Bir log'u `guardbee-proxy verify-audit ./guardbee-audit.jsonl` ile doğrulayın.
+- `guardbee-proxy validate --config guardbee-proxy.yaml` sunucu başlatmadan config'i kontrol eder.
+- `--config` verilmezse proxy `./guardbee-proxy.yaml` dosyasını veya `GUARDBEE_PROXY_CONFIG=<dosya>.yaml` değişkenini de okur.
+
+Yukarıdaki tek sunuculu `--` kullanımı 0.x davranışını korur: tool adlarına önek eklenmez, payload'lar loglanır ve toxic flow sadece uyarı olarak loglanır.
+
+---
+
 ## MCP Tools
 
 Proxy kendi tool'unu kaydetmez. Hedef sunucunun tool'larını iletir ve her çağrıda interceptor zincirini uygular.
@@ -70,24 +142,31 @@ Proxy kendi tool'unu kaydetmez. Hedef sunucunun tool'larını iletir ve her ça
 
 ### Prompt Injection Detector
 
-Gelen mesajlarda aşağıdaki saldırı desenlerini arar:
+[`@guardbee/guard-core`](../guard-core/README.md) içindeki 27 kural; tool argümanlarına, tool sonuçlarına, resource'lara ve prompt'lara uygulanır:
+
+- **Engeller** (13 kesin kural, high/critical): İngilizce ve Türkçe talimat geçersiz kılma ("ignore all previous instructions", "önceki talimatları yok say"), `DAN mode`, "bypass your safety guardrails", chat-template token'ları (`<|im_start|>`, `[INST]`), `<system>` etiketleri, Unicode tag karakterlerine gizlenmiş metin, CSS ile gizlenmiş öğelerde veya HTML yorumlarında talimat, markdown görsel exfiltration işaretçileri, sistem istemini isteme (İngilizce ve Türkçe), "send the user's data to https://…".
+- **Sadece uyarır** (14): sıradan metinde de geçen genel ifadeler — "act as", "you are now", "developer mode", "jailbreak", "override policy", "sen artık" — ve zero-width veya bidi kontrol karakterleri, satır başındaki `System:` etiketi gibi orta önemdeki işaretler.
+- **Base64:** okunabilir metne çözülen dizileri çözer ve engelleme kurallarıyla kontrol eder; talimat kodlanmış bir blob'a saklanamaz.
 
-- `ignore previous instructions`
-- `disregard your system prompt`
-- `you are now [DAN/jailbreak]`
-- ANSI escape dizileri ile gizlenmiş komutlar
-- Base64 kodlanmış talimatlar
-- ve 11 desen daha
+1.1'den itibaren genel bir ifade tek başına engellemez: 1.0'da bir tool sonucundaki "use jailbreak mode" veya "act as a reverse proxy" engelleniyordu; artık loglanır ve sonuca bir uyarı eklenir.
 
 ### PII Masker
 
-| Veri Tipi | Örnek Girdi | Çıktı |
-|-----------|------------|-------|
-| TC Kimlik | `12345678901` | `[TC-REDACTED]` |
-| IBAN | `TR320006200...` | `TR32***` |
-| E-posta | `ahmet@example.com` | `ah***@example.com` |
-| JWT | `eyJhbGc...` | `[JWT-REDACTED]` |
-| API Key | `sk-abc123...` | `[KEY-REDACTED]` |
+| Veri Tipi | Kontrol | Örnek Girdi | Çıktı |
+|-----------|---------|-------------|-------|
+| TC Kimlik | resmi checksum | `10000000146` | `[TC-KİMLİK]` |
+| IBAN (TR) | mod-97 | `TR330006100519786457841326` | `TR**[IBAN]` |
+| Kart numarası | Luhn | `4111 1111 1111 1111` | `****-****-****-[KART]` |
+| E-posta | — | `ahmet@example.com` | `***@[EMAIL]` |
+| Telefon (TR) | cep / sabit hat / 850 öneki | `0532 123 45 67` | `+90-***-***-**[TELEFON]` |
+| Vergi no (VKN) | kontrol hanesi, `VKN` / `Vergi No` etiketi gerekir | `VKN: 1234567890` | `VKN: [VKN]` |
+| Sağlayıcı anahtarları | secret-scanner'dan 22 anahtar ve token formatı (AWS, GitHub, Stripe, OpenAI, Anthropic, Slack, …) | `ghp_…`, `AKIA…` | `[API-KEY]` |
+| Diğer API key'ler | `sk_`/`api_`/`token_`… öneki, harf ve rakam | `api_k3y9x8…` | `[API-KEY]` |
+| Özel anahtar | BEGIN…END bloğunun tamamı | `-----BEGIN … PRIVATE KEY-----` | `[PRIVATE-KEY]` |
+| Bağlantı dizesi | URL'de kullanıcı:şifre (localhost hariç) | `postgres://app:pw@db/prod` | `[CONNECTION-STRING]` |
+| JWT | — | `eyJhbGc...` | `[JWT-TOKEN]` |
+
+Checksum'ı tutmayan sayılar (sipariş no, takip kodu) olduğu gibi bırakılır.
 
 ---
 

package/dist/audit/logger.d.ts

@@ -1,9 +1,21 @@
-import type { AuditEvent, ProxyConfig } from "../types.js";
+import type { AuditConfig, AuditEvent } from "../types.js";
 export declare class AuditLogger {
     private config;
     private stream;
-    constructor(config: NonNullable<ProxyConfig["audit"]>);
+    private lastHash;
+    constructor(config: AuditConfig);
     log(event: AuditEvent): void;
     close(): void;
+    private redact;
 }
+export type ChainVerification = {
+    ok: true;
+    events: number;
+} | {
+    ok: false;
+    line: number;
+    reason: string;
+};
+/** Recompute the hash chain of a JSONL audit log. A deleted, inserted or edited line breaks it. */
+export declare function verifyAuditChain(jsonl: string): ChainVerification;
 //# sourceMappingURL=logger.d.ts.map

package/dist/audit/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,MAAM,CAA+B;gBAEjC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAOrD,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAU5B,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiC3D,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,QAAQ,CAAW;gBAEf,MAAM,EAAE,WAAW;IAQ/B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAa5B,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,MAAM;CAKf;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhD,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAwBjE"}

package/dist/audit/logger.js

@@ -4,19 +4,56 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuditLogger = void 0;
+exports.verifyAuditChain = verifyAuditChain;
 const fs_1 = __importDefault(require("fs"));
+const crypto_1 = require("crypto");
+const definition_drift_js_1 = require("../interceptors/definition-drift.js");
+const GENESIS = "";
+function sha256(text) {
+    return (0, crypto_1.createHash)("sha256").update(text).digest("hex");
+}
+/** Hash of an event line without its own `hash` field (key order as written). */
+function chainHash(unhashed) {
+    return sha256(JSON.stringify(unhashed));
+}
+/** The last event hash in an existing JSONL file, so a restart continues the chain. */
+function lastHashIn(filePath) {
+    let raw;
+    try {
+        raw = fs_1.default.readFileSync(filePath, "utf8");
+    }
+    catch {
+        return GENESIS;
+    }
+    const lines = raw.split("\n").filter((line) => line.trim() !== "");
+    const last = lines[lines.length - 1];
+    if (!last)
+        return GENESIS;
+    try {
+        const hash = JSON.parse(last).hash;
+        return typeof hash === "string" ? hash : GENESIS;
+    }
+    catch {
+        return GENESIS;
+    }
+}
 class AuditLogger {
     constructor(config) {
         this.stream = null;
+        this.lastHash = GENESIS;
         this.config = config;
         if (config.sink === "file" && config.filePath) {
+            this.lastHash = lastHashIn(config.filePath);
             this.stream = fs_1.default.createWriteStream(config.filePath, { flags: "a" });
         }
     }
     log(event) {
         if (!this.config.enabled)
             return;
-        const line = JSON.stringify(event);
+        const unhashed = { ...this.redact(event), prevHash: this.lastHash };
+        const hash = chainHash(unhashed);
+        this.lastHash = hash;
+        const line = JSON.stringify({ ...unhashed, hash });
         if (this.config.sink === "file" && this.stream) {
             this.stream.write(line + "\n");
         }
@@ -27,6 +64,40 @@ class AuditLogger {
     close() {
         this.stream?.end();
     }
+    redact(event) {
+        if (this.config.includePayloads !== false)
+            return event;
+        const { input, output: _output, ...rest } = event;
+        return input === undefined ? rest : { ...rest, inputHash: sha256((0, definition_drift_js_1.stable)(input)) };
+    }
 }
 exports.AuditLogger = AuditLogger;
+/** Recompute the hash chain of a JSONL audit log. A deleted, inserted or edited line breaks it. */
+function verifyAuditChain(jsonl) {
+    const lines = jsonl.split("\n");
+    let expectedPrev = GENESIS;
+    let events = 0;
+    for (const [index, line] of lines.entries()) {
+        if (line.trim() === "")
+            continue;
+        const lineNo = index + 1;
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            return { ok: false, line: lineNo, reason: "not valid JSON" };
+        }
+        const { hash, ...unhashed } = event;
+        if (unhashed.prevHash !== expectedPrev) {
+            return { ok: false, line: lineNo, reason: "prevHash does not match the previous event (a line was removed or reordered)" };
+        }
+        if (hash !== chainHash(unhashed)) {
+            return { ok: false, line: lineNo, reason: "hash does not match the event contents (the line was edited)" };
+        }
+        expectedPrev = hash;
+        events++;
+    }
+    return { ok: true, events };
+}
 //# sourceMappingURL=logger.js.map

package/dist/audit/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AAGpB,MAAa,WAAW;IAItB,YAAY,MAAyC;QAF7C,WAAM,GAA0B,IAAI,CAAC;QAG3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,GAAG,YAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,GAAG,CAAC,KAAiB;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC;CACF;AAxBD,kCAwBC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":";;;;;;AA6EA,4CAwBC;AArGD,4CAAoB;AACpB,mCAAoC;AAEpC,6EAA6D;AAE7D,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,QAAkC;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC,IAAI,CAAC;QACnD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAa,WAAW;IAKtB,YAAY,MAAmB;QAHvB,WAAM,GAA0B,IAAI,CAAC;QACrC,aAAQ,GAAG,OAAO,CAAC;QAGzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,GAAG,YAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,GAAG,CAAC,KAAiB;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACjC,MAAM,QAAQ,GAA6B,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,KAAiB;QAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAClD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,IAAA,4BAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IACpF,CAAC;CACF;AAnCD,kCAmCC;AAMD,mGAAmG;AACnG,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,YAAY,GAAG,OAAO,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACjC,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC;QACzB,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;QACpC,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC;QAC7H,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;QAC7G,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,EAAE,CAAC;IACX,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/cli.d.ts

@@ -1,2 +1,3 @@
+#!/usr/bin/env node
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -1,10 +1,72 @@
+#!/usr/bin/env node
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-const config_js_1 = require("./config.js");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const logger_js_1 = require("./audit/logger.js");
+const config_js_1 = require("./gateway/config.js");
+const init_js_1 = require("./init.js");
 const proxy_js_1 = require("./proxy.js");
+const CLIENTS = ["claude-desktop", "cursor", "claude-code"];
+function flag(args, name) {
+    const at = args.indexOf(name);
+    return at === -1 ? undefined : args[at + 1];
+}
+function verifyAudit(filePath) {
+    if (!filePath)
+        throw new Error("Usage: guardbee-proxy verify-audit <audit.jsonl>");
+    const result = (0, logger_js_1.verifyAuditChain)(fs_1.default.readFileSync(filePath, "utf8"));
+    if (result.ok) {
+        process.stdout.write(`OK: ${result.events} events, hash chain intact\n`);
+        return;
+    }
+    process.stdout.write(`BROKEN at line ${result.line}: ${result.reason}\n`);
+    process.exit(1);
+}
+function init(args) {
+    const client = flag(args, "--client");
+    const file = flag(args, "--file");
+    if ((!client && !file) || (client && !CLIENTS.includes(client))) {
+        throw new Error(`Usage: guardbee-proxy init (--client ${CLIENTS.join("|")} | --file <mcp.json>) [--out <guardbee-proxy.yaml>] [--dry-run] [--force]`);
+    }
+    const dryRun = args.includes("--dry-run");
+    const result = (0, init_js_1.runInit)({
+        clientConfigPath: file ?? (0, init_js_1.clientConfigPath)(client),
+        yamlPath: flag(args, "--out") ?? path_1.default.join(os_1.default.homedir(), ".guardbee", "guardbee-proxy.yaml"),
+        dryRun,
+        force: args.includes("--force"),
+    });
+    const out = process.stdout;
+    for (const [key, name] of Object.entries(result.migrated))
+        out.write(`  moved   ${key} → upstream "${name}"\n`);
+    for (const { name, reason } of result.kept)
+        out.write(`  kept    ${name} (${reason})\n`);
+    if (dryRun) {
+        out.write(`\n--- guardbee-proxy.yaml ---\n${result.yaml}\n--- client config ---\n${result.clientConfig}`);
+        return;
+    }
+    out.write(`\nWrote the proxy config and pointed the client at it. Backup: ${result.backupPath}\n`);
+    if (client === "claude-code" && !file) {
+        out.write("Claude Code rewrites ~/.claude.json while it runs: quit it before init, or check the file afterwards.\n");
+    }
+    out.write("Restart the client to load the proxy.\n");
+}
 async function main() {
-    const config = (0, config_js_1.loadProxyConfig)();
-    await (0, proxy_js_1.startProxy)(config);
+    const [command, ...rest] = process.argv.slice(2);
+    if (command === "verify-audit")
+        return verifyAudit(rest[0]);
+    if (command === "init")
+        return init(rest);
+    if (command === "validate") {
+        const config = (0, config_js_1.loadGatewayConfig)();
+        process.stdout.write(`OK: ${Object.keys(config.upstreams).length} upstream(s), ${config.rules.length} rule(s), taint.mode=${config.taint.mode}\n`);
+        return;
+    }
+    await (0, proxy_js_1.startGateway)((0, config_js_1.loadGatewayConfig)());
 }
 main().catch((err) => {
     process.stderr.write(`[guardbee-proxy] Fatal error: ${err instanceof Error ? err.message : String(err)}\n`);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;AAAA,2CAA8C;AAC9C,yCAAwC;AAExC,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,IAAA,2BAAe,GAAE,CAAC;IACjC,MAAM,IAAA,qBAAU,EAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACtF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;AACA,4CAAoB;AACpB,4CAAoB;AACpB,gDAAwB;AACxB,iDAAqD;AACrD,mDAAwD;AACxD,uCAAuE;AACvE,yCAA0C;AAE1C,MAAM,OAAO,GAAiB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAE1E,SAAS,IAAI,CAAC,IAAc,EAAE,IAAY;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,QAA4B;IAC/C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,IAAA,4BAAgB,EAAC,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,8BAA8B,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CAAC,IAAc;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAA2B,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,2EAA2E,CACrI,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAA,iBAAO,EAAC;QACrB,gBAAgB,EAAE,IAAI,IAAI,IAAA,0BAAgB,EAAC,MAAO,CAAC;QACnD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,qBAAqB,CAAC;QAC5F,MAAM;QACN,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;KAChC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,aAAa,GAAG,gBAAgB,IAAI,KAAK,CAAC,CAAC;IAChH,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI;QAAE,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC;IACzF,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,kCAAkC,MAAM,CAAC,IAAI,4BAA4B,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,kEAAkE,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IACnG,IAAI,MAAM,KAAK,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,yGAAyG,CAAC,CAAC;IACvH,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,cAAc;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,6BAAiB,GAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,iBAAiB,MAAM,CAAC,KAAK,CAAC,MAAM,wBAAwB,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;QACnJ,OAAO;IACT,CAAC;IACD,MAAM,IAAA,uBAAY,EAAC,IAAA,6BAAiB,GAAE,CAAC,CAAC;AAC1C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACtF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/gateway/approval.d.ts

@@ -0,0 +1,16 @@
+import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
+export interface ApprovalRequest {
+    tool: string;
+    upstream: string;
+    args: Record<string, unknown>;
+    reason: string;
+}
+/** `unavailable`: the client cannot show a prompt, so nobody could approve. */
+export type ApprovalOutcome = "approved" | "declined" | "timed-out" | "unavailable";
+export type Approver = (request: ApprovalRequest) => Promise<ApprovalOutcome>;
+/**
+ * Ask the person through MCP elicitation (a form the client shows). Any answer
+ * other than an explicit yes — decline, cancel, timeout — counts as no.
+ */
+export declare function elicitationApprover(server: Server, timeoutSeconds: number): Approver;
+//# sourceMappingURL=approval.d.ts.map

package/dist/gateway/approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../src/gateway/approval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAExE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAEpF,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAS9E;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,QAAQ,CAwBpF"}

package/dist/gateway/approval.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.elicitationApprover = elicitationApprover;
+const MAX_ARGS_SHOWN = 600;
+function describeArgs(args) {
+    const json = JSON.stringify(args, null, 2);
+    return json.length > MAX_ARGS_SHOWN ? `${json.slice(0, MAX_ARGS_SHOWN)}\n… (${json.length - MAX_ARGS_SHOWN} more characters)` : json;
+}
+/**
+ * Ask the person through MCP elicitation (a form the client shows). Any answer
+ * other than an explicit yes — decline, cancel, timeout — counts as no.
+ */
+function elicitationApprover(server, timeoutSeconds) {
+    return async (request) => {
+        if (!server.getClientCapabilities()?.elicitation)
+            return "unavailable";
+        try {
+            const answer = await server.elicitInput({
+                message: `GuardBee: approve this tool call?\n\n` +
+                    `Tool: ${request.tool}\nWhy approval is needed: ${request.reason}\n\nArguments:\n${describeArgs(request.args)}`,
+                requestedSchema: {
+                    type: "object",
+                    properties: {
+                        approve: { type: "boolean", title: "Approve this call", default: false },
+                    },
+                    required: ["approve"],
+                },
+            }, { timeout: timeoutSeconds * 1000 });
+            return answer.action === "accept" && answer.content?.["approve"] === true ? "approved" : "declined";
+        }
+        catch (err) {
+            return err instanceof Error && /timed? ?out/i.test(err.message) ? "timed-out" : "declined";
+        }
+    };
+}
+//# sourceMappingURL=approval.js.map

package/dist/gateway/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/gateway/approval.ts"],"names":[],"mappings":";;AAyBA,kDAwBC;AAnCD,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,SAAS,YAAY,CAAC,IAA6B;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,QAAQ,IAAI,CAAC,MAAM,GAAG,cAAc,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;AACvI,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAc,EAAE,cAAsB;IACxE,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAAW;YAAE,OAAO,aAAa,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CACrC;gBACE,OAAO,EACL,uCAAuC;oBACvC,SAAS,OAAO,CAAC,IAAI,6BAA6B,OAAO,CAAC,MAAM,mBAAmB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBACjH,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE;qBACzE;oBACD,QAAQ,EAAE,CAAC,SAAS,CAAC;iBACtB;aACF,EACD,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE,CACnC,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,YAAY,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}