@i4ctime/q-ring 0.14.1 → 0.16.0

package/dist/mcp.js

@@ -32,6 +32,7 @@ import {
   registry,
   remember,
   removeHook,
+  setAuditAgentLabel,
   setPolicyRoot,
   setSecret,
   tunnelCreate,
@@ -39,7 +40,7 @@ import {
   tunnelList,
   tunnelRead,
   verifyAuditChain
-} from "./chunk-NNIEXAW5.js";
+} from "./chunk-NCM5GHNW.js";
 
 // src/mcp.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -805,6 +806,79 @@ var ProviderRegistry = class {
     return [...this.providers.values()];
   }
 };
+function livenessProvider(cfg) {
+  return {
+    name: cfg.name,
+    description: cfg.description,
+    prefixes: cfg.prefixes,
+    async validate(value) {
+      const start = Date.now();
+      try {
+        const { statusCode } = await makeRequest(cfg.url, {
+          "User-Agent": "q-ring-validator/1.0",
+          ...cfg.headers(value)
+        });
+        const latencyMs = Date.now() - start;
+        if (statusCode === 200)
+          return { valid: true, status: "valid", message: "API key is valid", latencyMs, provider: cfg.name };
+        if (statusCode === 401 || statusCode === 403)
+          return { valid: false, status: "invalid", message: `Invalid or revoked API key (${statusCode})`, latencyMs, provider: cfg.name };
+        if (statusCode === 429)
+          return { valid: true, status: "error", message: "Rate limited \u2014 key may be valid", latencyMs, provider: cfg.name };
+        return { valid: false, status: "error", message: `Unexpected status ${statusCode}`, latencyMs, provider: cfg.name };
+      } catch (err) {
+        return { valid: false, status: "error", message: `${err instanceof Error ? err.message : "Network error"}`, latencyMs: Date.now() - start, provider: cfg.name };
+      }
+    }
+  };
+}
+var anthropicProvider = livenessProvider({
+  name: "anthropic",
+  description: "Anthropic API key validation",
+  prefixes: ["sk-ant-"],
+  url: "https://api.anthropic.com/v1/models?limit=1",
+  headers: (value) => ({ "x-api-key": value, "anthropic-version": "2023-06-01" })
+});
+var openrouterProvider = livenessProvider({
+  name: "openrouter",
+  description: "OpenRouter API key validation",
+  prefixes: ["sk-or-"],
+  url: "https://openrouter.ai/api/v1/key",
+  headers: (value) => ({ Authorization: `Bearer ${value}` })
+});
+var googleAiProvider = livenessProvider({
+  name: "google-ai",
+  description: "Google AI (Gemini) API key validation",
+  prefixes: ["AIza"],
+  url: "https://generativelanguage.googleapis.com/v1beta/models?pageSize=1",
+  headers: (value) => ({ "x-goog-api-key": value })
+});
+var groqProvider = livenessProvider({
+  name: "groq",
+  description: "Groq API key validation",
+  prefixes: ["gsk_"],
+  url: "https://api.groq.com/openai/v1/models",
+  headers: (value) => ({ Authorization: `Bearer ${value}` })
+});
+var huggingfaceProvider = livenessProvider({
+  name: "huggingface",
+  description: "Hugging Face token validation",
+  prefixes: ["hf_"],
+  url: "https://huggingface.co/api/whoami-v2",
+  headers: (value) => ({ Authorization: `Bearer ${value}` })
+});
+var elevenlabsProvider = livenessProvider({
+  name: "elevenlabs",
+  description: "ElevenLabs API key validation (explicit-only \u2014 set provider on the secret)",
+  url: "https://api.elevenlabs.io/v1/user",
+  headers: (value) => ({ "xi-api-key": value })
+});
+var vercelProvider = livenessProvider({
+  name: "vercel",
+  description: "Vercel token validation (explicit-only \u2014 set provider on the secret)",
+  url: "https://api.vercel.com/v2/user",
+  headers: (value) => ({ Authorization: `Bearer ${value}` })
+});
 var openaiProvider = {
   name: "openai",
   description: "OpenAI API key validation",
@@ -931,7 +1005,14 @@ var httpProvider = {
   }
 };
 var registry2 = new ProviderRegistry();
+registry2.register(anthropicProvider);
+registry2.register(openrouterProvider);
 registry2.register(openaiProvider);
+registry2.register(googleAiProvider);
+registry2.register(groqProvider);
+registry2.register(huggingfaceProvider);
+registry2.register(elevenlabsProvider);
+registry2.register(vercelProvider);
 registry2.register(stripeProvider);
 registry2.register(githubProvider);
 registry2.register(awsProvider);
@@ -1569,7 +1650,9 @@ function registerAuditTools(server2) {
         "entangle",
         "tunnel",
         "teleport",
-        "collapse"
+        "collapse",
+        "canary",
+        "wrap"
       ]).optional().describe(
         "Limit to a single action verb (e.g. 'read' to see only reads). Omit for all actions."
       ),
@@ -2148,10 +2231,9 @@ var RedactionTransform = class extends Transform {
     callback();
   }
 };
-async function execCommand(opts2) {
-  const profile = getProfile(opts2.profile);
-  const fullCommand = [opts2.command, ...opts2.args].join(" ");
-  const policyDecision = checkExecPolicy(fullCommand, opts2.projectPath);
+function enforceExecPolicy(profile, command, args, projectPath8) {
+  const fullCommand = [command, ...args].join(" ");
+  const policyDecision = checkExecPolicy(fullCommand, projectPath8);
   if (!policyDecision.allowed) {
     throw new Error(`Policy Denied: ${policyDecision.reason}`);
   }
@@ -2167,9 +2249,13 @@ async function execCommand(opts2) {
   if (profile.allowCommands) {
     const allowed = profile.allowCommands.some((a) => fullCommand.startsWith(a));
     if (!allowed) {
-      throw new Error(`Exec profile "${profile.name}" does not allow command "${opts2.command}"`);
+      throw new Error(`Exec profile "${profile.name}" does not allow command "${command}"`);
     }
   }
+}
+async function execCommand(opts2) {
+  const profile = getProfile(opts2.profile);
+  enforceExecPolicy(profile, opts2.command, opts2.args, opts2.projectPath);
   const envMap = {};
   for (const [k, v] of Object.entries(process.env)) {
     if (v !== void 0) envMap[k] = v;
@@ -2216,6 +2302,18 @@ async function execCommand(opts2) {
       }
     }
   }
+  return spawnRedacted({
+    profile,
+    command: opts2.command,
+    args: opts2.args,
+    envMap,
+    secretsToRedact: [...secretsToRedact],
+    captureOutput: opts2.captureOutput,
+    projectPath: opts2.projectPath
+  });
+}
+function spawnRedacted(opts2) {
+  const { profile, secretsToRedact, envMap } = opts2;
   const maxRuntime = profile.maxRuntimeSeconds ?? getExecMaxRuntime(opts2.projectPath);
   return new Promise((resolve, reject) => {
     const networkTools = /* @__PURE__ */ new Set([
@@ -2700,7 +2798,7 @@ ${result.stderr}`);
           `Dashboard already running at ${dashboardInstance.url}`
         );
       }
-      const { startDashboardServer } = await import("./dashboard-KAUEPLXO.js");
+      const { startDashboardServer } = await import("./dashboard-R3FWTFFW.js");
       dashboardInstance = startDashboardServer({ port: params.port });
       return text(
         `Dashboard started at ${dashboardInstance.url}
@@ -2899,6 +2997,10 @@ function createMcpServer() {
     version: PACKAGE_VERSION
   });
   registerMcpTools(server2);
+  server2.server.oninitialized = () => {
+    const info = server2.server.getClientVersion();
+    if (info) setAuditAgentLabel(`${info.name}@${info.version}`);
+  };
   return server2;
 }