@i4ctime/q-ring 0.16.2 → 0.17.5

package/dist/index.js

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
 import {
   PACKAGE_VERSION,
+  addCanaryAlert,
   checkDecay,
   checkExecPolicy,
   checkSSRF,
+  checkWrapToolPolicy,
   clearMemory,
   collapseEnvironment,
   countLegacyApprovals,
   deleteSecret,
+  describeAlertUrl,
   detectAnomalies,
   disableHook,
   disarmCanary,
@@ -22,10 +25,15 @@ import {
   getExecMaxRuntime,
   getPolicySummary,
   getSecret,
+  getWrapRateLimit,
   grantApproval,
+  hasApproval,
   hasSecret,
+  hashProjectPath,
   httpRequest,
+  listAgentSessions,
   listApprovals,
+  listCanaryAlerts,
   listHooks,
   listMemory,
   listSecrets,
@@ -36,17 +44,23 @@ import {
   registerHook,
   registry,
   remember,
+  removeCanaryAlert,
   removeHook,
   revokeApproval,
+  sendCanaryAlerts,
   serviceForScope,
   setAuditAgentLabel,
+  setCanaryAlertEnabled,
+  setPolicyRoot,
   setSecret,
   tunnelCreate,
   tunnelDestroy,
   tunnelList,
   tunnelRead,
-  verifyAuditChain
-} from "./chunk-SQKTDYSO.js";
+  verifyAuditChain,
+  wrapRedactsResults,
+  wrapToolRequiresApproval
+} from "./chunk-5ZCQSBVS.js";
 
 // src/cli/commands.ts
 import { Command, Help } from "commander";
@@ -2597,7 +2611,7 @@ function registerToolingCommands(program2) {
     }
   });
   program2.command("status").description("Launch the quantum status dashboard in your browser").option("--port <port>", "Port to serve on", "9876").option("--no-open", "Don't auto-open the browser").action(async (cmd) => {
-    const { startDashboardServer } = await import("./dashboard-2MLSJZQR.js");
+    const { startDashboardServer } = await import("./dashboard-ZN3FPR73.js");
     const { exec } = await import("child_process");
     const { platform } = await import("os");
     const port = Number(cmd.port);
@@ -2629,11 +2643,26 @@ ${c.dim("  dashboard stopped")}`);
 
 // src/cli/commands/audit.ts
 import { writeFileSync as writeFileSync3 } from "fs";
+function parseSince(value) {
+  const m = value.trim().match(/^(\d+)\s*([mhd])$/i);
+  if (m) {
+    const unit = { m: 60, h: 3600, d: 86400 }[m[2].toLowerCase()];
+    return new Date(Date.now() - Number(m[1]) * unit * 1e3).toISOString();
+  }
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw new Error(`--since: "${value}" is not an ISO date or a duration like 24h / 7d`);
+  }
+  return date.toISOString();
+}
+function fmtSeconds(seconds) {
+  if (seconds < 60) return `${seconds}s`;
+  if (seconds < 3600) return `${Math.floor(seconds / 60)}m`;
+  if (seconds < 86400) return `${Math.floor(seconds / 3600)}h`;
+  return `${Math.floor(seconds / 86400)}d`;
+}
 function registerAuditCommands(program2) {
-  program2.command("audit").description("View the audit log (observer effect)").option("-k, --key <key>", "Filter by key").option(
-    "-a, --action <action>",
-    "Filter by action (read, write, delete, etc.)"
-  ).option("--agent <label>", "Filter by agent label (clientInfo name@version)").option("-n, --limit <n>", "Number of events to show", parseInt, 20).option("--anomalies", "Detect access anomalies").option("--json", "Output as JSON").action((cmd) => {
+  program2.command("audit").description("View the audit log (observer effect)").option("-k, --key <key>", "Filter by key").option("-a, --action <action>", "Filter by action (read, write, delete, etc.)").option("--agent <label>", "Filter by agent label (clientInfo name@version)").option("-n, --limit <n>", "Number of events to show", parseInt, 20).option("--anomalies", "Detect access anomalies").option("--json", "Output as JSON").action((cmd) => {
     if (cmd.anomalies) {
       const anomalies = detectAnomalies(cmd.key);
       if (emitJson(program2, cmd, { anomalies })) return;
@@ -2663,11 +2692,9 @@ ${SYMBOLS.warning} ${c.bold(c.yellow(`${anomalies.length} anomaly/anomalies dete
       console.log(c.dim("No audit events found"));
       return;
     }
-    console.log(
-      c.bold(`
+    console.log(c.bold(`
   ${SYMBOLS.eye} Audit log (${events.length} events)
-`)
-    );
+`));
     for (const event of events) {
       const ts = new Date(event.timestamp).toLocaleString();
       const actionColor = event.action === "read" ? c.blue : event.action === "write" ? c.green : event.action === "delete" ? c.red : c.yellow;
@@ -2698,13 +2725,9 @@ ${SYMBOLS.warning} ${c.bold(c.yellow(`${anomalies.length} anomaly/anomalies dete
         `${SYMBOLS.shield} ${c.green("Audit chain intact")} \u2014 ${result.totalEvents} events verified`
       );
     } else {
+      console.log(`${SYMBOLS.cross} ${c.red("Audit chain BROKEN")} at event #${result.brokenAt}`);
       console.log(
-        `${SYMBOLS.cross} ${c.red("Audit chain BROKEN")} at event #${result.brokenAt}`
-      );
-      console.log(
-        c.dim(
-          `  ${result.validEvents}/${result.totalEvents} events valid before break`
-        )
+        c.dim(`  ${result.validEvents}/${result.totalEvents} events valid before break`)
       );
       if (result.brokenEvent) {
         console.log(
@@ -2729,6 +2752,57 @@ ${SYMBOLS.warning} ${c.bold(c.yellow(`${anomalies.length} anomaly/anomalies dete
       console.log(output);
     }
   });
+  program2.command("audit:sessions").description("Audit activity folded into per-agent sessions (who did what, per MCP client)").option("--agent <label>", "Only sessions for this agent label (clientInfo name@version)").option("--since <when>", "ISO date, or a duration like 24h / 7d (default: 7d)").option("-n, --limit <n>", "Max sessions to show", parseInt, 20).option("-v, --verbose", "Print each session's event lines").option("--json", "Output as JSON").action((cmd) => {
+    const sessions = listAgentSessions({
+      agent: cmd.agent,
+      since: parseSince(cmd.since ?? "7d"),
+      limit: cmd.limit
+    });
+    if (emitJson(program2, cmd, { sessions })) return;
+    if (sessions.length === 0) {
+      console.log(
+        c.dim(
+          "No agent sessions in range. Sessions appear once an MCP client (Cursor, Claude Code, Kiro, or an airlock) has touched the ring."
+        )
+      );
+      return;
+    }
+    console.log(c.bold(`
+  ${SYMBOLS.eye} Agent sessions (${sessions.length})
+`));
+    for (const s of sessions) {
+      const started = new Date(s.startedAt);
+      const ended = new Date(s.endedAt);
+      const seconds = Math.max(0, Math.round((ended.getTime() - started.getTime()) / 1e3));
+      const who = s.wrapLabel ? `airlock: ${s.wrapLabel}` : s.agent;
+      const head = [
+        c.cyan(`\u27E8${who}\u27E9`),
+        c.dim(`[${s.source}]`),
+        c.dim(
+          `${started.toLocaleString()} \u2192 ${ended.toLocaleTimeString()} (${fmtSeconds(seconds)})`
+        ),
+        `${s.eventCount} events`,
+        s.denials > 0 ? c.red(`${s.denials} denied`) : c.green("0 denied"),
+        s.countsByAction.canary ? c.red(`${s.countsByAction.canary} canary trips`) : ""
+      ];
+      console.log(`  ${head.filter(Boolean).join("  ")}`);
+      console.log(c.dim(`    id ${s.id} \xB7 keys: ${s.keys.length ? s.keys.join(", ") : "\u2014"}`));
+      if (cmd.verbose) {
+        for (const e of s.events) {
+          const parts = [
+            c.dim(new Date(e.timestamp).toLocaleTimeString()),
+            (e.action === "policy_deny" || e.action === "canary" ? c.red : c.yellow)(
+              e.action.padEnd(11)
+            ),
+            e.key ? c.bold(e.key) : "",
+            e.detail ? c.dim(e.detail) : ""
+          ];
+          console.log(`      ${parts.filter(Boolean).join("  ")}`);
+        }
+      }
+      console.log();
+    }
+  });
   program2.command("health").description("Check the health of all secrets").option("-g, --global", "Check global scope only").option("-p, --project", "Check project scope only").option("--project-path <path>", "Explicit project path").option("--json", "Output as JSON").action((cmd) => {
     const opts = buildOpts(cmd);
     const entries = listSecrets(opts);
@@ -2769,9 +2843,7 @@ ${SYMBOLS.warning} ${c.bold(c.yellow(`${anomalies.length} anomaly/anomalies dete
   ${SYMBOLS.shield} Secret health report
 `));
     for (const key of expiredKeys) {
-      console.log(
-        `  ${c.red(SYMBOLS.cross)} ${c.bold(key)} ${c.bgRed(c.white(" EXPIRED "))}`
-      );
+      console.log(`  ${c.red(SYMBOLS.cross)} ${c.bold(key)} ${c.bgRed(c.white(" EXPIRED "))}`);
     }
     for (const s of staleKeys) {
       console.log(
@@ -3797,21 +3869,13 @@ var PUSH_TARGETS = ["github", "vercel", "cloudflare"];
 var TARGETS = {
   github: {
     binary: "gh",
-    args: (key, opts) => [
-      ["secret", "set", key, ...opts.repo ? ["--repo", opts.repo] : []]
-    ],
+    args: (key, opts) => [["secret", "set", key, ...opts.repo ? ["--repo", opts.repo] : []]],
     installHint: "install the GitHub CLI: https://cli.github.com (then `gh auth login`)"
   },
   vercel: {
     binary: "vercel",
     // One invocation per environment — `vercel env add` takes a single target.
-    args: (key, opts) => (opts.vercelEnvs ?? ["production"]).map((env) => [
-      "env",
-      "add",
-      key,
-      env,
-      "--force"
-    ]),
+    args: (key, opts) => (opts.vercelEnvs ?? ["production"]).map((env) => ["env", "add", key, env, "--force"]),
     installHint: "install the Vercel CLI: npm i -g vercel (then `vercel link` in the project)"
   },
   cloudflare: {
@@ -3843,7 +3907,8 @@ function pushSecrets(opts) {
   }
   const result = { target: opts.target, pushed: [], failed: [], missing: [] };
   for (const key of keys) {
-    const value = resolveRef(
+    const preset = opts.presetValues?.[key];
+    const value = preset !== void 0 ? preset : resolveRef(
       { key, raw: `push:${key}` },
       {
         projectPath: opts.projectPath,
@@ -3884,7 +3949,7 @@ function pushSecrets(opts) {
         key,
         env: opts.env,
         source: opts.source ?? "cli",
-        detail: `pushed to ${opts.target}${opts.repo ? ` (${opts.repo})` : ""}`
+        detail: `${opts.canaryKeys?.includes(key) ? "canary honeytoken " : ""}pushed to ${opts.target}${opts.repo ? ` (${opts.repo})` : ""}`
       });
     }
   }
@@ -4043,32 +4108,77 @@ ${SYMBOLS.check} ${prefix}${c.bold(verb)}: ${c.cyan(result.configPath)} ${c.dim(
 }
 
 // src/core/canary.ts
-var ALPHA_UPPER_NUM = () => generateSecret({ format: "alphanumeric", length: 16 }).toUpperCase();
+import { randomInt as randomInt2 } from "crypto";
+var ALNUM = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+var UPPER_NUM = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+var BASE64 = ALNUM + "+/";
+var URLSAFE = ALNUM + "_-";
+var DIGITS = "0123456789";
+function pick(charset, length) {
+  let out = "";
+  for (let i = 0; i < length; i++) out += charset[randomInt2(charset.length)];
+  return out;
+}
 var CANARY_FORMATS = {
   aws: {
     name: "aws",
     description: "AWS access key id (AKIA\u2026)",
-    generate: () => `AKIA${ALPHA_UPPER_NUM()}`
+    generate: () => `AKIA${pick(UPPER_NUM, 16)}`
+  },
+  "aws-secret": {
+    name: "aws-secret",
+    description: "AWS secret access key (40-char base64)",
+    generate: () => pick(BASE64, 40)
   },
   github: {
     name: "github",
-    description: "GitHub personal access token (ghp_\u2026)",
-    generate: () => generateSecret({ format: "api-key", prefix: "ghp_", length: 36 })
+    description: "GitHub classic personal access token (ghp_\u2026)",
+    generate: () => `ghp_${pick(ALNUM, 36)}`
+  },
+  "github-pat": {
+    name: "github-pat",
+    description: "GitHub fine-grained personal access token (github_pat_\u2026)",
+    generate: () => `github_pat_${pick(ALNUM, 22)}_${pick(ALNUM, 59)}`
   },
   openai: {
     name: "openai",
     description: "OpenAI API key (sk-\u2026)",
-    generate: () => generateSecret({ format: "api-key", prefix: "sk-", length: 48 })
+    generate: () => `sk-${pick(ALNUM, 48)}`
+  },
+  "openai-project": {
+    name: "openai-project",
+    description: "OpenAI project API key (sk-proj-\u2026)",
+    generate: () => `sk-proj-${pick(URLSAFE, 74)}T3BlbkFJ${pick(URLSAFE, 74)}`
   },
   anthropic: {
     name: "anthropic",
-    description: "Anthropic API key (sk-ant-\u2026)",
-    generate: () => generateSecret({ format: "api-key", prefix: "sk-ant-api03-", length: 80 })
+    description: "Anthropic API key (sk-ant-api03-\u2026)",
+    generate: () => `sk-ant-api03-${pick(URLSAFE, 91)}AA`
   },
   stripe: {
     name: "stripe",
     description: "Stripe live secret key (sk_live_\u2026)",
-    generate: () => generateSecret({ format: "api-key", prefix: "sk_live_", length: 24 })
+    generate: () => `sk_live_${pick(ALNUM, 24)}`
+  },
+  gitlab: {
+    name: "gitlab",
+    description: "GitLab personal access token (glpat-\u2026)",
+    generate: () => `glpat-${pick(URLSAFE, 20)}`
+  },
+  slack: {
+    name: "slack",
+    description: "Slack bot token (xoxb-\u2026)",
+    generate: () => `xoxb-${pick(DIGITS, 12)}-${pick(DIGITS, 13)}-${pick(ALNUM, 24)}`
+  },
+  google: {
+    name: "google",
+    description: "Google API key (AIza\u2026)",
+    generate: () => `AIza${pick(URLSAFE, 35)}`
+  },
+  npm: {
+    name: "npm",
+    description: "npm access token (npm_\u2026)",
+    generate: () => `npm_${pick(ALNUM, 36)}`
   },
   generic: {
     name: "generic",
@@ -4133,27 +4243,65 @@ function registerCanaryCommands(program2) {
     "-f, --format <format>",
     `Token shape to imitate (${Object.keys(CANARY_FORMATS).join(", ")})`,
     DEFAULT_CANARY_FORMAT
-  ).option("--value <value>", "Plant this exact value instead of generating one").option("--description <text>", "Cover description (none by default \u2014 no tell)").option("--force", "Overwrite an existing non-canary secret at this key").option("--json", "Output the plant result as JSON").option("-g, --global", "Global scope (default)").option("-p, --project", "Project scope").option("--team <id>", "Team scope").option("--org <id>", "Org scope").option("--project-path <path>", "Project path (defaults to cwd)").action((key, cmd) => {
+  ).option("--value <value>", "Plant this exact value instead of generating one").option("--description <text>", "Cover description (none by default \u2014 no tell)").option("--force", "Overwrite an existing non-canary secret at this key").option(
+    "--push <target>",
+    `Also push the planted value to a deployment platform (${PUSH_TARGETS.join(", ")}) so a leaked CI/deploy environment carries a tripwire`
+  ).option("--repo <owner/name>", "GitHub repository (with --push github)").option("--vercel-env <envs>", "Comma-separated Vercel environments (with --push vercel)").option("--json", "Output the plant result as JSON").option("-g, --global", "Global scope (default)").option("-p, --project", "Project scope").option("--team <id>", "Team scope").option("--org <id>", "Org scope").option("--project-path <path>", "Project path (defaults to cwd)").action((key, cmd) => {
+    const pushTarget = cmd.push;
+    if (pushTarget && !PUSH_TARGETS.includes(pushTarget)) {
+      console.error(
+        c.red(
+          `${SYMBOLS.cross} Unknown push target "${pushTarget}" \u2014 expected one of: ${PUSH_TARGETS.join(", ")}`
+        )
+      );
+      process.exit(1);
+    }
+    const opts = buildOpts(cmd);
     const result = plantCanary(key, {
-      ...buildOpts(cmd),
+      ...opts,
       format: cmd.format,
       value: cmd.value,
       description: cmd.description,
       force: cmd.force === true
     });
-    if (emitJson(program2, cmd, result)) return;
+    const push = pushTarget ? pushSecrets({
+      target: pushTarget,
+      keys: [key],
+      presetValues: { [key]: result.value },
+      canaryKeys: [key],
+      projectPath: opts.projectPath ?? process.cwd(),
+      repo: cmd.repo,
+      vercelEnvs: cmd.vercelEnv?.split(",").map((e) => e.trim()),
+      source: "cli"
+    }) : void 0;
+    if (emitJson(program2, cmd, { ...result, push })) {
+      if (push && push.failed.length > 0) process.exit(1);
+      return;
+    }
     console.log(
       `${SYMBOLS.sparkle} ${c.yellow("canary planted")} ${c.bold(result.key)} ${c.dim(`(${result.format}, ${result.scope} scope)`)}`
     );
     console.log(c.dim(`  value: ${result.value}`));
     console.log(
-      c.dim(
-        "  Reads return this fake value and fire a desktop alert + a 'canary' audit event."
-      )
-    );
-    console.log(
-      c.dim("  Watch trips with: qring canary list \xB7 qring audit --action canary")
+      c.dim("  Reads return this fake value and fire a desktop alert + a 'canary' audit event.")
     );
+    console.log(c.dim("  Watch trips with: qring canary list \xB7 qring audit --action canary"));
+    if (push) {
+      if (push.pushed.length > 0) {
+        console.log(
+          `${SYMBOLS.link} ${c.yellow("pushed")} ${c.bold(key)} ${c.dim(`to ${push.target}${cmd.repo ? ` (${cmd.repo})` : ""}`)}`
+        );
+        console.log(
+          c.dim(
+            "  Caveat: q-ring only sees reads that go through q-ring. Someone using the leaked value on the platform side is not observable here \u2014 pair it with the provider's own alerting if you need that."
+          )
+        );
+      }
+      for (const { error } of push.failed) {
+        console.error(c.red(`${SYMBOLS.cross} push to ${push.target} failed \u2014 ${error}`));
+      }
+      if (push.failed.length > 0) process.exit(1);
+    }
   });
   canary.command("disarm <key>").description("Clear the canary flag so reads stop alarming (value stays fake)").option("-g, --global", "Global scope").option("-p, --project", "Project scope").option("--team <id>", "Team scope").option("--org <id>", "Org scope").option("--project-path <path>", "Project path (defaults to cwd)").action((key, cmd) => {
     if (disarmCanary2(key, buildOpts(cmd))) {
@@ -4169,7 +4317,11 @@ function registerCanaryCommands(program2) {
     const canaries = listCanaries(buildOpts(cmd));
     if (emitJson(program2, cmd, { canaries })) return;
     if (canaries.length === 0) {
-      console.log(c.dim("No canaries planted. Plant one: qring canary plant AWS_SECRET_ACCESS_KEY --format aws"));
+      console.log(
+        c.dim(
+          "No canaries planted. Plant one: qring canary plant AWS_SECRET_ACCESS_KEY --format aws"
+        )
+      );
       return;
     }
     console.log(c.bold(`
@@ -4190,6 +4342,95 @@ function registerCanaryCommands(program2) {
     }
     console.log();
   });
+  const alert = canary.command("alert").description("Webhook channels that receive canary trips (Discord, Slack, ntfy, generic JSON)");
+  alert.command("add").description("Register a webhook channel for canary trips").option("--discord <url>", "Discord webhook URL").option("--slack <url>", "Slack incoming-webhook URL").option("--ntfy <url>", "ntfy topic URL (e.g. https://ntfy.sh/my-topic)").option("--url <url>", "Generic endpoint \u2014 receives a JSON POST").option("--description <text>", "Human-readable label").option("--json", "Output as JSON").action((cmd) => {
+    const picked = [
+      ["discord", cmd.discord],
+      ["slack", cmd.slack],
+      ["ntfy", cmd.ntfy],
+      ["generic", cmd.url]
+    ];
+    const chosen = picked.filter(([, url2]) => typeof url2 === "string");
+    if (chosen.length !== 1) {
+      console.error(
+        c.red(`${SYMBOLS.cross} Specify exactly one of --discord, --slack, --ntfy, or --url`)
+      );
+      process.exit(1);
+    }
+    const [type, url] = chosen[0];
+    const channel = addCanaryAlert({ type, url, description: cmd.description });
+    if (emitJson(program2, cmd, channel)) return;
+    console.log(
+      `${SYMBOLS.check} ${c.green("registered")} canary alert ${c.bold(channel.id)} (${type}) ${c.dim(describeAlertUrl(channel.url))}`
+    );
+    console.log(c.dim(`  Send a drill: qring canary alert test ${channel.id}`));
+  });
+  alert.command("list").alias("ls").description("List canary alert channels").option("--json", "Output as JSON").action((cmd) => {
+    const channels = listCanaryAlerts();
+    if (emitJson(program2, cmd, { channels })) return;
+    if (channels.length === 0) {
+      console.log(
+        c.dim("No alert channels. Add one: qring canary alert add --discord <webhook-url>")
+      );
+      return;
+    }
+    console.log(c.bold(`
+  ${SYMBOLS.eye} Canary alert channels (${channels.length})
+`));
+    for (const ch of channels) {
+      const state = ch.enabled ? c.green("enabled") : c.dim("disabled");
+      const desc = ch.description ? c.dim(` \u2014 ${ch.description}`) : "";
+      console.log(
+        `  ${c.bold(ch.id)}  ${ch.type.padEnd(7)} ${state}  ${c.dim(describeAlertUrl(ch.url))}${desc}`
+      );
+    }
+    console.log();
+  });
+  alert.command("remove <id>").alias("rm").description("Remove an alert channel").action((id) => {
+    if (removeCanaryAlert(id)) {
+      console.log(`${SYMBOLS.check} ${c.green("removed")} canary alert ${c.bold(id)}`);
+    } else {
+      console.error(c.red(`${SYMBOLS.cross} No alert channel with id "${id}"`));
+      process.exit(1);
+    }
+  });
+  for (const [verb, enabled2] of [
+    ["enable", true],
+    ["disable", false]
+  ]) {
+    alert.command(`${verb} <id>`).description(`${verb === "enable" ? "Enable" : "Disable"} an alert channel`).action((id) => {
+      if (setCanaryAlertEnabled(id, enabled2)) {
+        console.log(`${SYMBOLS.check} ${c.green(`${verb}d`)} canary alert ${c.bold(id)}`);
+      } else {
+        console.error(c.red(`${SYMBOLS.cross} No alert channel with id "${id}"`));
+        process.exit(1);
+      }
+    });
+  }
+  alert.command("test [id]").description("Send a clearly-labelled test message to every enabled channel (or one id)").option("--json", "Output as JSON").action(async (id, cmd) => {
+    const results = await sendCanaryAlerts(
+      {
+        key: "EXAMPLE_CANARY",
+        scope: "global",
+        source: "cli",
+        agent: null,
+        detail: "test message",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        test: true
+      },
+      id
+    );
+    if (emitJson(program2, cmd, { results })) return;
+    if (results.length === 0) {
+      console.log(c.dim(id ? `No channel with id "${id}"` : "No enabled alert channels"));
+      process.exit(1);
+    }
+    for (const r of results) {
+      const mark = r.success ? c.green(SYMBOLS.check) : c.red(SYMBOLS.cross);
+      console.log(`  ${mark} ${c.bold(r.channelId)} ${r.type} ${c.dim(r.message)}`);
+    }
+    if (results.some((r) => !r.success)) process.exit(1);
+  });
 }
 
 // src/core/wrap.ts
@@ -4198,24 +4439,136 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import {
   ListToolsRequestSchema,
   CallToolRequestSchema,
   ToolListChangedNotificationSchema,
+  ListResourcesRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ReadResourceRequestSchema,
+  SubscribeRequestSchema,
+  UnsubscribeRequestSchema,
+  ResourceListChangedNotificationSchema,
+  ResourceUpdatedNotificationSchema,
+  ListPromptsRequestSchema,
+  GetPromptRequestSchema,
+  PromptListChangedNotificationSchema,
   McpError
 } from "@modelcontextprotocol/sdk/types.js";
+
+// src/core/wrap-redact.ts
+var REDACTED = "[QRING:REDACTED]";
+var REFRESH_MS = 60 * 1e3;
+var MIN_LENGTH = 6;
+function collectSecretValues(opts = {}) {
+  const values = /* @__PURE__ */ new Set();
+  for (const entry of listSecrets({ ...opts, source: "cli", silent: true })) {
+    if (entry.envelope && checkDecay(entry.envelope).isExpired) continue;
+    const value = getSecret(entry.key, {
+      scope: entry.scope,
+      projectPath: opts.projectPath,
+      env: opts.env,
+      source: "cli",
+      silent: true
+    });
+    if (value && value.length >= MIN_LENGTH) values.add(value);
+  }
+  return [...values].sort((a, b) => b.length - a.length);
+}
+function scrubUnknown(node, scrub) {
+  if (typeof node === "string") return scrub(node);
+  if (Array.isArray(node)) return node.map((n) => scrubUnknown(n, scrub));
+  if (node && typeof node === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(node)) {
+      out[k] = k === "blob" || k === "data" ? v : scrubUnknown(v, scrub);
+    }
+    return out;
+  }
+  return node;
+}
+function createRedactor(opts = {}) {
+  let values = [];
+  let builtAt = 0;
+  const ensure = () => {
+    const now = Date.now();
+    if (now - builtAt < REFRESH_MS) return;
+    try {
+      values = collectSecretValues(opts);
+    } catch {
+    }
+    builtAt = now;
+  };
+  const text = (input) => {
+    ensure();
+    let out = input;
+    for (const v of values) {
+      if (out.includes(v)) out = out.split(v).join(REDACTED);
+    }
+    return out;
+  };
+  return {
+    text,
+    result: (payload) => scrubUnknown(payload, text),
+    invalidate: () => {
+      builtAt = 0;
+    }
+  };
+}
+var NOOP_REDACTOR = {
+  text: (s) => s,
+  result: (p) => p,
+  invalidate: () => {
+  }
+};
+
+// src/core/wrap.ts
 var DEFAULT_DOWNSTREAM_TIMEOUT_MS = 10 * 60 * 1e3;
 function downstreamTimeoutMs() {
   const raw = Number(process.env.QRING_WRAP_TIMEOUT_MS);
   return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_DOWNSTREAM_TIMEOUT_MS;
 }
-function createAirlockServer(downstream, session) {
+var WRAP_APPROVAL_SCOPE = "wrap";
+function wrapApprovalService(projectPath) {
+  return `q-ring:wrap:${hashProjectPath(projectPath)}`;
+}
+var RateLimiter = class {
+  calls = /* @__PURE__ */ new Map();
+  /** Record a call; returns false when the window is already full. */
+  take(tool, limit, now = Date.now()) {
+    const windowStart = now - limit.perSeconds * 1e3;
+    const recent = (this.calls.get(tool) ?? []).filter((t) => t > windowStart);
+    if (recent.length >= limit.maxCalls) {
+      this.calls.set(tool, recent);
+      return false;
+    }
+    recent.push(now);
+    this.calls.set(tool, recent);
+    return true;
+  }
+};
+function truncate(s, max = 200) {
+  return s.length > max ? `${s.slice(0, max)}\u2026` : s;
+}
+function createAirlockServer(downstream, session, options = {}) {
+  const projectPath = options.projectPath ?? process.cwd();
+  const redactor = options.redactor ?? NOOP_REDACTOR;
+  const approvalService = wrapApprovalService(projectPath);
+  const limiter = new RateLimiter();
   const downstreamInfo = downstream.getServerVersion();
+  const dsCaps = downstream.getServerCapabilities() ?? {};
   const name = downstreamInfo ? `${downstreamInfo.name} (q-ring airlock)` : "q-ring-airlock";
+  const capabilities = {};
+  if (dsCaps.tools) capabilities.tools = { listChanged: true };
+  if (dsCaps.resources) {
+    capabilities.resources = { listChanged: true, subscribe: !!dsCaps.resources.subscribe };
+  }
+  if (dsCaps.prompts) capabilities.prompts = { listChanged: true };
   const proxy = new Server(
     { name, version: PACKAGE_VERSION },
     {
-      capabilities: { tools: { listChanged: true } },
+      capabilities,
       // Servers ship usage guidance in `instructions`; hosts inject it into
       // the system prompt. Losing it would degrade the wrapped server.
       instructions: downstream.getInstructions()
@@ -4225,64 +4578,171 @@ function createAirlockServer(downstream, session) {
     const info = proxy.getClientVersion();
     if (info) setAuditAgentLabel(`${info.name}@${info.version}`);
   };
-  downstream.setNotificationHandler(ToolListChangedNotificationSchema, () => {
-    void proxy.sendToolListChanged().catch(() => {
+  const audit = (detail, action = "wrap") => logAudit({ action, source: "mcp", detail, correlationId: session.correlationId });
+  const denied = (toolName, reason) => {
+    audit(`airlock blocked "${toolName}" \u2192 ${session.label}: ${reason}`, "policy_deny");
+    return {
+      content: [{ type: "text", text: `airlock: policy denied: ${reason}` }],
+      isError: true
+    };
+  };
+  const gate = (toolName) => {
+    try {
+      const decision = checkWrapToolPolicy(toolName, projectPath);
+      if (!decision.allowed) return denied(toolName, decision.reason ?? "denied by policy");
+      if (wrapToolRequiresApproval(toolName, projectPath) && !hasApproval(toolName, WRAP_APPROVAL_SCOPE, approvalService)) {
+        return denied(
+          toolName,
+          `wrapped tool "${toolName}" requires operator approval \u2014 run: qring mcp approve ${toolName} --for 3600 --reason "<why>"`
+        );
+      }
+      const limit = getWrapRateLimit(toolName, projectPath);
+      if (limit && !limiter.take(toolName, limit)) {
+        return denied(
+          toolName,
+          `rate limit exceeded for "${toolName}" (${limit.maxCalls} calls per ${limit.perSeconds}s)`
+        );
+      }
+      return null;
+    } catch (err) {
+      return denied(toolName, err instanceof Error ? err.message : String(err));
+    }
+  };
+  const toolAllowed = (toolName) => {
+    try {
+      return checkWrapToolPolicy(toolName, projectPath).allowed;
+    } catch {
+      return false;
+    }
+  };
+  if (dsCaps.tools) registerToolHandlers();
+  if (dsCaps.resources) registerResourceHandlers();
+  if (dsCaps.prompts) registerPromptHandlers();
+  return proxy;
+  function registerToolHandlers() {
+    downstream.setNotificationHandler(ToolListChangedNotificationSchema, () => {
+      void proxy.sendToolListChanged().catch(() => {
+      });
     });
-  });
-  proxy.setRequestHandler(ListToolsRequestSchema, async (request) => {
-    if (!downstream.getServerCapabilities()?.tools) return { tools: [] };
-    return downstream.listTools(request.params);
-  });
-  proxy.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
-    const toolName = request.params.name;
-    logAudit({
-      action: "wrap",
-      source: "mcp",
-      detail: `tool call "${toolName}" \u2192 ${session.label}`,
-      correlationId: session.correlationId
+    proxy.setRequestHandler(ListToolsRequestSchema, async (request) => {
+      const listed = await downstream.listTools(request.params);
+      return { ...listed, tools: listed.tools.filter((t) => toolAllowed(t.name)) };
+    });
+    proxy.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+      const toolName = request.params.name;
+      const blocked = gate(toolName);
+      if (blocked) return blocked;
+      audit(`tool call "${toolName}" \u2192 ${session.label}`);
+      const hostToken = request.params._meta?.progressToken;
+      const onprogress = hostToken !== void 0 ? (progress) => {
+        void extra.sendNotification({
+          method: "notifications/progress",
+          params: { ...progress, progressToken: hostToken }
+        }).catch(() => {
+        });
+      } : void 0;
+      try {
+        const result = await downstream.callTool(request.params, void 0, {
+          signal: extra.signal,
+          timeout: downstreamTimeoutMs(),
+          resetTimeoutOnProgress: true,
+          onprogress
+        });
+        return redactor.result(result);
+      } catch (err) {
+        if (err instanceof McpError) throw err;
+        const message = err instanceof Error ? err.message : String(err);
+        audit(`tool call "${toolName}" failed: ${message}`);
+        return {
+          content: [{ type: "text", text: `airlock: downstream error: ${message}` }],
+          isError: true
+        };
+      }
     });
-    const hostToken = request.params._meta?.progressToken;
-    const onprogress = hostToken !== void 0 ? (progress) => {
-      void extra.sendNotification({
-        method: "notifications/progress",
-        params: { ...progress, progressToken: hostToken }
-      }).catch(() => {
+  }
+  function registerResourceHandlers() {
+    downstream.setNotificationHandler(ResourceListChangedNotificationSchema, () => {
+      void proxy.sendResourceListChanged().catch(() => {
       });
-    } : void 0;
-    try {
-      return await downstream.callTool(request.params, void 0, {
-        signal: extra.signal,
-        timeout: downstreamTimeoutMs(),
-        resetTimeoutOnProgress: true,
-        onprogress
+    });
+    downstream.setNotificationHandler(ResourceUpdatedNotificationSchema, (n) => {
+      void proxy.sendResourceUpdated(n.params).catch(() => {
       });
-    } catch (err) {
-      if (err instanceof McpError) throw err;
-      const message = err instanceof Error ? err.message : String(err);
-      logAudit({
-        action: "wrap",
-        source: "mcp",
-        detail: `tool call "${toolName}" failed: ${message}`,
-        correlationId: session.correlationId
+    });
+    proxy.setRequestHandler(
+      ListResourcesRequestSchema,
+      (request) => downstream.listResources(request.params)
+    );
+    proxy.setRequestHandler(
+      ListResourceTemplatesRequestSchema,
+      (request) => downstream.listResourceTemplates(request.params)
+    );
+    proxy.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => {
+      audit(`resource read ${truncate(request.params.uri)} \u2192 ${session.label}`);
+      const result = await downstream.readResource(request.params, {
+        signal: extra.signal,
+        timeout: downstreamTimeoutMs()
       });
-      return {
-        content: [
-          { type: "text", text: `airlock: downstream error: ${message}` }
-        ],
-        isError: true
-      };
+      return redactor.result(result);
+    });
+    if (dsCaps.resources?.subscribe) {
+      proxy.setRequestHandler(
+        SubscribeRequestSchema,
+        (request) => downstream.subscribeResource(request.params)
+      );
+      proxy.setRequestHandler(
+        UnsubscribeRequestSchema,
+        (request) => downstream.unsubscribeResource(request.params)
+      );
     }
-  });
-  return proxy;
+  }
+  function registerPromptHandlers() {
+    downstream.setNotificationHandler(PromptListChangedNotificationSchema, () => {
+      void proxy.sendPromptListChanged().catch(() => {
+      });
+    });
+    proxy.setRequestHandler(
+      ListPromptsRequestSchema,
+      (request) => downstream.listPrompts(request.params)
+    );
+    proxy.setRequestHandler(GetPromptRequestSchema, async (request, extra) => {
+      audit(`prompt get "${request.params.name}" \u2192 ${session.label}`);
+      const result = await downstream.getPrompt(request.params, {
+        signal: extra.signal,
+        timeout: downstreamTimeoutMs()
+      });
+      return redactor.result(result);
+    });
+  }
+}
+function parseHeaders(raw) {
+  const headers = {};
+  for (const line of raw ?? []) {
+    const idx = line.indexOf(":");
+    if (idx <= 0) throw new Error(`--header expects "Name: value", got "${line}"`);
+    headers[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();
+  }
+  return headers;
 }
 async function connectDownstream(opts) {
-  const client = new Client({
-    name: "q-ring-airlock",
-    version: PACKAGE_VERSION
-  });
-  const env = opts.inheritEnv ? Object.fromEntries(
-    Object.entries(process.env).filter(([, v]) => v !== void 0)
-  ) : void 0;
+  const client = new Client({ name: "q-ring-airlock", version: PACKAGE_VERSION });
+  if (opts.url) {
+    const headers = parseHeaders(opts.headers);
+    if (opts.authSecret) {
+      const value = getSecret(opts.authSecret, { projectPath: opts.projectPath, source: "cli" });
+      if (value === null) {
+        throw new Error(`--auth-secret: "${opts.authSecret}" not found in the keyring`);
+      }
+      headers.Authorization = `Bearer ${value}`;
+    }
+    const transport2 = new StreamableHTTPClientTransport(new URL(opts.url), {
+      requestInit: { headers }
+    });
+    await client.connect(transport2);
+    return client;
+  }
+  if (!opts.command) throw new Error("wrap needs a server command or --url");
+  const env = opts.inheritEnv ? Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== void 0)) : void 0;
   const transport = new StdioClientTransport({
     command: opts.command,
     args: opts.args ?? [],
@@ -4293,27 +4753,34 @@ async function connectDownstream(opts) {
   return client;
 }
 async function runWrap(opts) {
-  const label = opts.label ?? [opts.command, ...opts.args ?? []].join(" ");
+  const projectPath = opts.projectPath ?? process.cwd();
+  setPolicyRoot(projectPath);
+  const label = opts.label ?? opts.url ?? [opts.command, ...opts.args ?? []].join(" ");
   const session = { label, correlationId: randomUUID() };
   const downstream = await connectDownstream(opts);
   const downstreamInfo = downstream.getServerVersion();
-  if (!downstream.getServerCapabilities()?.tools) {
+  const caps = downstream.getServerCapabilities() ?? {};
+  const surfaces = ["tools", "resources", "prompts"].filter((c2) => caps[c2]);
+  if (surfaces.length === 0) {
     await downstream.close().catch(() => {
     });
     throw new Error(
-      `wrapped server "${downstreamInfo?.name ?? label}" exposes no tools capability \u2014 the airlock is tools-only (resources/prompts are not proxied yet)`
+      `wrapped server "${downstreamInfo?.name ?? label}" exposes no tools, resources, or prompts \u2014 nothing to proxy`
     );
   }
+  const redact = opts.redact ?? wrapRedactsResults(projectPath);
+  const redactor = redact ? createRedactor({ projectPath }) : NOOP_REDACTOR;
+  const envNote = opts.url ? "remote (http)" : opts.inheritEnv ? "inherited" : "stripped";
   logAudit({
     action: "wrap",
     source: "cli",
-    detail: `airlock session started: ${label}${opts.inheritEnv ? " (env inherited)" : " (env stripped)"}`,
+    detail: `airlock session started: ${label} (env ${envNote}; ${surfaces.join("+")}; results ${redact ? "redacted" : "unredacted"})`,
     correlationId: session.correlationId
   });
   console.error(
-    `q-ring airlock: wrapping ${downstreamInfo?.name ?? label} \u2014 env ${opts.inheritEnv ? "inherited" : "stripped"}, tool calls audited (session ${session.correlationId.slice(0, 8)})`
+    `q-ring airlock: wrapping ${downstreamInfo?.name ?? label} \u2014 env ${envNote}, ${surfaces.join("/")} audited, results ${redact ? "redacted" : "NOT redacted"} (session ${session.correlationId.slice(0, 8)})`
   );
-  const proxy = createAirlockServer(downstream, session);
+  const proxy = createAirlockServer(downstream, session, { projectPath, redactor });
   const transport = new StdioServerTransport();
   return new Promise((resolve) => {
     let settled = false;
@@ -4352,20 +4819,44 @@ async function runWrap(opts) {
 }
 
 // src/cli/commands/mcp.ts
+var collect = (value, previous = []) => [...previous, value];
 function registerMcpCommands(program2) {
   const mcp = program2.command("mcp").description("MCP airlock \u2014 run third-party MCP servers behind q-ring");
-  mcp.command("wrap <command...>").description(
-    "Proxy an MCP server through the airlock: spawned with a stripped env, every tool call audited. Use -- before the server command: qring mcp wrap -- npx some-server"
+  mcp.command("wrap [command...]").description(
+    "Proxy an MCP server through the airlock: spawned with a stripped env (or dialed over HTTP), every tool call / resource read / prompt audited, results scrubbed of known secrets, policy.wrap enforced. Use -- before the server command: qring mcp wrap -- npx some-server"
+  ).option(
+    "--url <url>",
+    "Wrap a remote Streamable HTTP MCP endpoint instead of spawning a command"
+  ).option(
+    "--header <name:value>",
+    "Extra request header for --url (repeatable)",
+    collect,
+    []
+  ).option(
+    "--auth-secret <KEY>",
+    "q-ring key whose value is sent as `Authorization: Bearer \u2026` to --url (audited read)"
   ).option(
     "--inherit-env",
     "Pass the full parent environment to the wrapped server (default: minimal safe env)"
-  ).option("--label <label>", "Session label for audit events (default: the command line)").action(async (commandArgs, cmd) => {
+  ).option("--no-redact", "Do not scrub known secret values from results").option("--label <label>", "Session label for audit events (default: the command line / url)").option(
+    "--project-path <path>",
+    "Project whose .q-ring.json policy governs the session (default: cwd)"
+  ).action(async (commandArgs, cmd) => {
     try {
+      if (!cmd.url && commandArgs.length === 0) {
+        throw new Error("give a server command after -- or pass --url");
+      }
       const code = await runWrap({
         command: commandArgs[0],
         args: commandArgs.slice(1),
+        url: cmd.url,
+        headers: cmd.header,
+        authSecret: cmd.authSecret,
         inheritEnv: cmd.inheritEnv === true,
-        label: cmd.label
+        // commander turns --no-redact into redact:false; undefined → policy decides
+        redact: cmd.redact === false ? false : void 0,
+        label: cmd.label,
+        projectPath: cmd.projectPath
       });
       process.exit(code);
     } catch (err) {
@@ -4377,6 +4868,59 @@ function registerMcpCommands(program2) {
       process.exit(1);
     }
   });
+  mcp.command("approve <tool>").description(
+    "Grant a time-limited approval for a wrapped tool listed in policy.wrap.approveTools (or revoke it)"
+  ).option("--for <seconds>", "Approval lifetime in seconds", (v) => parseInt(v, 10), 3600).option("--reason <text>", "Why this tool is being approved").option("--revoke", "Revoke an existing approval instead").option("--project-path <path>", "Project the airlock runs in (default: cwd)").action((tool, cmd) => {
+    const projectPath = cmd.projectPath ?? process.cwd();
+    const service = wrapApprovalService(projectPath);
+    if (cmd.revoke) {
+      if (revokeApproval(tool, WRAP_APPROVAL_SCOPE, service)) {
+        console.log(
+          `${SYMBOLS.check} ${c.green("revoked")} airlock approval for ${c.bold(tool)}`
+        );
+      } else {
+        console.error(c.red(`${SYMBOLS.cross} no airlock approval found for "${tool}"`));
+        process.exit(1);
+      }
+      return;
+    }
+    const entry = grantApproval(tool, WRAP_APPROVAL_SCOPE, service, cmd.for, {
+      reason: cmd.reason ?? "manual airlock approval"
+    });
+    console.log(
+      `${SYMBOLS.check} ${c.green("approved")} wrapped tool ${c.bold(tool)} for ${cmd.for}s`
+    );
+    console.log(c.dim(`  id=${entry.id} reason="${entry.reason}" expires=${entry.expiresAt}`));
+    console.log(
+      c.dim(
+        "  Applies to airlocks launched from this project directory (policy.wrap.approveTools)."
+      )
+    );
+  });
+  mcp.command("approvals").description("List live airlock tool approvals for this project").option("--project-path <path>", "Project the airlock runs in (default: cwd)").option("--json", "Output as JSON").action((cmd) => {
+    const service = wrapApprovalService(cmd.projectPath ?? process.cwd());
+    const entries = listApprovals().filter(
+      (a) => a.scope === WRAP_APPROVAL_SCOPE && a.service === service
+    );
+    if (cmd.json) {
+      console.log(JSON.stringify({ approvals: entries }, null, 2));
+      return;
+    }
+    if (entries.length === 0) {
+      console.log(
+        c.dim(
+          'No airlock approvals. Grant one: qring mcp approve <tool> --for 3600 --reason "\u2026"'
+        )
+      );
+      return;
+    }
+    for (const a of entries) {
+      const state = a.tampered ? c.red("TAMPERED") : a.valid ? c.green("valid") : c.yellow("expired");
+      console.log(
+        `  ${SYMBOLS.check} ${c.bold(a.key)}  ${state}  ${c.dim(`expires ${a.expiresAt} \xB7 ${a.reason}`)}`
+      );
+    }
+  });
 }
 
 // src/cli/commands/doctor.ts
@@ -4571,13 +5115,13 @@ function registerDoctorCommand(program2) {
 }
 
 // src/cli/commands/completion.ts
-function collect(cmd) {
+function collect2(cmd) {
   return {
     name: cmd.name(),
     aliases: cmd.aliases(),
     description: cmd.description(),
     options: cmd.options.map((o) => ({ flag: o.long ?? o.short ?? "", description: o.description ?? "" })).filter((o) => o.flag.startsWith("--")),
-    subcommands: cmd.commands.filter((s) => s.name() !== "help").map((s) => collect(s))
+    subcommands: cmd.commands.filter((s) => s.name() !== "help").map((s) => collect2(s))
   };
 }
 var sanitize = (s) => s.replace(/['"`$\\]/g, "").replace(/[:[\]]/g, " ").replace(/\s+/g, " ").trim();
@@ -4668,7 +5212,7 @@ function fishScript(cmds) {
 }
 function registerCompletionCommand(program2) {
   program2.command("completion <shell>").description("Print a shell completion script (bash, zsh, fish)").action((shell) => {
-    const cmds = program2.commands.filter((s) => s.name() !== "help" && s.name() !== "completion").map((s) => collect(s));
+    const cmds = program2.commands.filter((s) => s.name() !== "help" && s.name() !== "completion").map((s) => collect2(s));
     if (shell === "bash") process.stdout.write(bashScript(cmds));
     else if (shell === "zsh") process.stdout.write(zshScript(cmds));
     else if (shell === "fish") process.stdout.write(fishScript(cmds));