@intutic/mcp-governance-proxy 1.0.3

package/dist/daemon/policyCache.d.ts

@@ -0,0 +1,20 @@
+export interface ResolvedPolicy {
+    workspaceId: string;
+    sopRules: Record<string, unknown>[];
+    dlpPatterns: string[];
+    interventionMode: string;
+    cachedAt: number;
+}
+/**
+ * Resolves policy for a workspace.
+ * Order: LRU (fresh) → LRU (stale, triggers async refresh) → Valkey → HTTP fetch
+ */
+export declare function resolvePolicy(workspaceId: string): Promise<ResolvedPolicy | null>;
+/** Invalidates policy cache for a workspace (called on SOP update). */
+export declare function invalidatePolicy(workspaceId: string): void;
+/** Returns cache statistics. */
+export declare function getCacheStats(): {
+    entries: number;
+    hitRate: number;
+};
+//# sourceMappingURL=policyCache.d.ts.map

package/dist/daemon/policyCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyCache.d.ts","sourceRoot":"","sources":["../../src/daemon/policyCache.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAI,MAAM,CAAA;IACrB,QAAQ,EAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACxC,WAAW,EAAI,MAAM,EAAE,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAO,MAAM,CAAA;CACtB;AA0CD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA+CvF;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAI1D;AAED,gCAAgC;AAChC,wBAAgB,aAAa,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEpE"}

package/dist/daemon/policyCache.js

@@ -0,0 +1,124 @@
+/**
+ * Policy Cache — LRU in-memory + Valkey write-through
+ *
+ * Resolves PCAS permissions + active SOP rules for MCP daemon.
+ * Cache hit: < 0.1ms (LRU). Valkey hit: < 2ms. Miss: HTTP to control-plane.
+ *
+ * LLD #28: MCP Daemon Mode, WS-5MCP
+ * @module
+ */
+import https from 'node:https';
+import http from 'node:http';
+import { Redis } from 'ioredis';
+import { createLogger } from '@intutic/logger';
+const logger = createLogger('mcp-proxy.policyCache');
+const getPolicyTtlMs = () => parseInt(process.env['MCP_DAEMON_POLICY_TTL_MS'] ?? '300000', 10);
+const getMaxEntries = () => parseInt(process.env['MCP_DAEMON_MAX_CACHE_ENTRIES'] ?? '500', 10);
+const getCpUrl = () => process.env['CONTROL_PLANE_URL'] ?? 'http://localhost:3001';
+const getDaemonApiKey = () => process.env['INTUTIC_API_KEY'] ?? '';
+const VALKEY_URL = process.env['VALKEY_URL'] ?? process.env['REDIS_URL'] ?? 'redis://localhost:6379';
+const valkey = new Redis(VALKEY_URL, {
+    lazyConnect: true,
+    maxRetriesPerRequest: 3,
+});
+valkey.on('error', (err) => {
+    logger.warn({ err: err.message }, 'policyCache Valkey connection error');
+});
+// Simple LRU map (insertion-order eviction)
+const lru = new Map();
+function evictIfFull() {
+    if (lru.size >= getMaxEntries()) {
+        const firstKey = lru.keys().next().value;
+        lru.delete(firstKey);
+    }
+}
+function isStale(entry) {
+    return Date.now() - entry.cachedAt > getPolicyTtlMs();
+}
+async function fetchFromControlPlane(workspaceId) {
+    return new Promise((resolve) => {
+        const path = `/api/v1/policy/resolve?workspaceId=${encodeURIComponent(workspaceId)}`;
+        const url = new URL(path, getCpUrl());
+        const lib = url.protocol === 'https:' ? https : http;
+        const req = lib.request({ hostname: url.hostname, port: url.port, path: url.pathname + url.search, method: 'GET',
+            headers: { 'Authorization': `Bearer ${getDaemonApiKey()}`, 'Accept': 'application/json' } }, (res) => {
+            let data = '';
+            res.on('data', (c) => { data += c; });
+            res.on('end', () => {
+                try {
+                    const parsed = JSON.parse(data);
+                    resolve({ workspaceId, sopRules: parsed.sopRules ?? [], dlpPatterns: parsed.dlpPatterns ?? [],
+                        interventionMode: parsed.interventionMode ?? 'BYPASS', cachedAt: Date.now() });
+                }
+                catch {
+                    resolve(null);
+                }
+            });
+        });
+        req.on('error', () => resolve(null));
+        req.setTimeout(5000, () => { req.destroy(); resolve(null); });
+        req.end();
+    });
+}
+/**
+ * Resolves policy for a workspace.
+ * Order: LRU (fresh) → LRU (stale, triggers async refresh) → Valkey → HTTP fetch
+ */
+export async function resolvePolicy(workspaceId) {
+    const cached = lru.get(workspaceId);
+    if (cached && !isStale(cached)) {
+        // Touch for LRU recency
+        lru.delete(workspaceId);
+        lru.set(workspaceId, cached);
+        return cached;
+    }
+    if (cached && isStale(cached)) {
+        // Return stale, trigger async refresh
+        void fetchFromControlPlane(workspaceId).then(async (fresh) => {
+            if (fresh) {
+                lru.delete(workspaceId);
+                evictIfFull();
+                lru.set(workspaceId, fresh);
+                try {
+                    await valkey.set(`mcp_daemon:policy:${workspaceId}`, JSON.stringify(fresh), 'PX', getPolicyTtlMs());
+                }
+                catch { }
+            }
+        });
+        return cached;
+    }
+    // Cache miss in LRU — check Valkey
+    try {
+        const valkeyCached = await valkey.get(`mcp_daemon:policy:${workspaceId}`);
+        if (valkeyCached) {
+            const parsed = JSON.parse(valkeyCached);
+            evictIfFull();
+            lru.set(workspaceId, parsed);
+            return parsed;
+        }
+    }
+    catch { }
+    // Cache miss in Valkey too — fetch synchronously
+    logger.debug({ workspaceId }, 'policy_cache.miss');
+    const fresh = await fetchFromControlPlane(workspaceId);
+    if (fresh) {
+        evictIfFull();
+        lru.set(workspaceId, fresh);
+        try {
+            await valkey.set(`mcp_daemon:policy:${workspaceId}`, JSON.stringify(fresh), 'PX', getPolicyTtlMs());
+        }
+        catch { }
+    }
+    return fresh;
+}
+/** Invalidates policy cache for a workspace (called on SOP update). */
+export function invalidatePolicy(workspaceId) {
+    lru.delete(workspaceId);
+    valkey.del(`mcp_daemon:policy:${workspaceId}`, `mcp_daemon:sop_rules:${workspaceId}`).catch(() => { });
+    logger.info({ workspaceId }, 'policy_cache.invalidated');
+}
+/** Returns cache statistics. */
+export function getCacheStats() {
+    return { entries: lru.size, hitRate: 0 }; // hit rate tracked by metrics in production
+}
+//# sourceMappingURL=policyCache.js.map

package/dist/daemon/policyCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyCache.js","sourceRoot":"","sources":["../../src/daemon/policyCache.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEpD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC,CAAA;AAC9F,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,KAAK,EAAK,EAAE,CAAC,CAAA;AACjG,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,CAAA;AAClF,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAM,EAAE,CAAA;AAEpE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAA;AACpG,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE;IACnC,WAAW,EAAE,IAAI;IACjB,oBAAoB,EAAE,CAAC;CACxB,CAAC,CAAA;AAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;IAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,qCAAqC,CAAC,CAAA;AAC1E,CAAC,CAAC,CAAA;AAUF,4CAA4C;AAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAA;AAE7C,SAAS,WAAW;IAClB,IAAI,GAAG,CAAC,IAAI,IAAI,aAAa,EAAE,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAA;QAClD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB;IACpC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,cAAc,EAAE,CAAA;AACvD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,sCAAsC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAA;QACpF,MAAM,GAAG,GAAI,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACtC,MAAM,GAAG,GAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QACrD,MAAM,GAAG,GAAI,GAAG,CAAC,OAAO,CACtB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK;YACtF,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAC7F,CAAC,GAAQ,EAAE,EAAE;YACX,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAC5C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAA;oBAC1D,OAAO,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;wBAC3F,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;gBAClF,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAAC,CAAC;YAC3B,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC5D,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAEnC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,wBAAwB;QACxB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACvB,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,sCAAsC;QACtC,KAAK,qBAAqB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;gBACvB,WAAW,EAAE,CAAA;gBACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBAC3B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;gBACrG,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,CAAC,CAAA;QACzE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAmB,CAAA;YACzD,WAAW,EAAE,CAAA;YACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;YAC5B,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,iDAAiD;IACjD,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAA;IACtD,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,EAAE,CAAA;QACb,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;QACrG,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACvB,MAAM,CAAC,GAAG,CAAC,qBAAqB,WAAW,EAAE,EAAE,wBAAwB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrG,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,0BAA0B,CAAC,CAAA;AAC1D,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA,CAAC,4CAA4C;AACvF,CAAC"}

package/dist/daemon/socketServer.d.ts

@@ -0,0 +1,13 @@
+/**
+ * JSON-RPC over Unix Domain Socket server
+ *
+ * Accepts newline-delimited JSON requests from MCP shims.
+ * Methods: proxy.tool_call, proxy.health_check, policy.get, telemetry.flush
+ *
+ * LLD #28: MCP Daemon Mode, WS-5MCP
+ * @module
+ */
+import net from 'node:net';
+export declare function getSocketPath(): string;
+export declare function createSocketServer(): net.Server;
+//# sourceMappingURL=socketServer.d.ts.map

package/dist/daemon/socketServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socketServer.d.ts","sourceRoot":"","sources":["../../src/daemon/socketServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,GAAG,MAAO,UAAU,CAAA;AAW3B,wBAAgB,aAAa,IAAI,MAAM,CAGtC;AA4DD,wBAAgB,kBAAkB,IAAI,GAAG,CAAC,MAAM,CA2B/C"}

package/dist/daemon/socketServer.js

@@ -0,0 +1,90 @@
+/**
+ * JSON-RPC over Unix Domain Socket server
+ *
+ * Accepts newline-delimited JSON requests from MCP shims.
+ * Methods: proxy.tool_call, proxy.health_check, policy.get, telemetry.flush
+ *
+ * LLD #28: MCP Daemon Mode, WS-5MCP
+ * @module
+ */
+import net from 'node:net';
+import path from 'node:path';
+import os from 'node:os';
+import { createLogger } from '@intutic/logger';
+import { resolvePolicy, getCacheStats, invalidatePolicy } from './policyCache.js';
+import { enqueueEvent } from './telemetryBatcher.js';
+import { getHealthSnapshot } from './healthMonitor.js';
+const logger = createLogger('mcp-proxy.socketServer');
+export function getSocketPath() {
+    return process.env['MCP_DAEMON_SOCKET'] ??
+        path.join(os.homedir(), '.intutic', 'mcp-proxy.sock');
+}
+function respond(socket, id, result) {
+    socket.write(JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n');
+}
+function respondError(socket, id, code, message) {
+    socket.write(JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } }) + '\n');
+}
+async function handleRequest(socket, req) {
+    const { id, method, params } = req;
+    switch (method) {
+        case 'proxy.health_check':
+            respond(socket, id, { status: 'ok', version: process.env['npm_package_version'] ?? '0.0.0',
+                cacheStats: getCacheStats(), mcpServers: getHealthSnapshot() });
+            break;
+        case 'proxy.tool_call': {
+            const workspaceId = params['workspaceId'];
+            const policy = await resolvePolicy(workspaceId);
+            // Simplified enforcement: if policy loaded, apply it
+            const allowed = policy !== null;
+            respond(socket, id, { allowed, policy: policy ?? null });
+            break;
+        }
+        case 'policy.get': {
+            const workspaceId = params['workspaceId'];
+            const policy = await resolvePolicy(workspaceId);
+            respond(socket, id, policy);
+            break;
+        }
+        case 'policy.invalidate': {
+            const workspaceId = params['workspaceId'];
+            invalidatePolicy(workspaceId);
+            respond(socket, id, { invalidated: true });
+            break;
+        }
+        case 'telemetry.enqueue': {
+            enqueueEvent(params);
+            respond(socket, id, { queued: true });
+            break;
+        }
+        default:
+            respondError(socket, id, -32601, `Method not found: ${method}`);
+    }
+}
+export function createSocketServer() {
+    const server = net.createServer((socket) => {
+        socket.setEncoding('utf8');
+        let buffer = '';
+        socket.on('data', (chunk) => {
+            buffer += chunk;
+            const lines = buffer.split('\n');
+            buffer = lines.pop() ?? '';
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                try {
+                    const req = JSON.parse(trimmed);
+                    void handleRequest(socket, req).catch(err => respondError(socket, req.id, -32603, String(err)));
+                }
+                catch {
+                    socket.write(JSON.stringify({ jsonrpc: '2.0', id: null,
+                        error: { code: -32700, message: 'Parse error' } }) + '\n');
+                }
+            }
+        });
+        socket.on('error', (err) => logger.warn({ err }, 'socket.client_error'));
+    });
+    return server;
+}
+//# sourceMappingURL=socketServer.js.map

package/dist/daemon/socketServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socketServer.js","sourceRoot":"","sources":["../../src/daemon/socketServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,GAAG,MAAO,UAAU,CAAA;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAQ,SAAS,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAGtD,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAA;AAErD,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AACzD,CAAC;AASD,SAAS,OAAO,CAAC,MAAkB,EAAE,EAAmB,EAAE,MAAe;IACvE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB,EAAE,EAAmB,EAAE,IAAY,EAAE,OAAe;IAC1F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;AACvF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAkB,EAAE,GAAmB;IAClE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAElC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB;YACvB,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO;gBACxF,UAAU,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;YACjE,MAAK;QAEP,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAW,CAAA;YACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAA;YAC/C,qDAAqD;YACrD,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAA;YAC/B,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;YACxD,MAAK;QACP,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAW,CAAA;YACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAA;YAC/C,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;YAC3B,MAAK;QACP,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAW,CAAA;YACnD,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;YAC1C,MAAK;QACP,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,YAAY,CAAC,MAA8B,CAAC,CAAA;YAC5C,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACrC,MAAK;QACP,CAAC;QAED;YACE,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAC1B,IAAI,MAAM,GAAG,EAAE,CAAA;QAEf,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,MAAM,IAAI,KAAK,CAAA;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAChC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;YAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC3B,IAAI,CAAC,OAAO;oBAAE,SAAQ;gBACtB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAA;oBACjD,KAAK,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAC1C,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI;wBACpD,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/daemon/telemetryBatcher.d.ts

@@ -0,0 +1,15 @@
+export interface HookEvent {
+    event: string;
+    toolName: string;
+    workspaceId: string;
+    harnessType: string;
+    timestamp: string;
+    [key: string]: unknown;
+}
+/** Enqueues a hook event. Evicts oldest on overflow. */
+export declare function enqueueEvent(event: HookEvent): void;
+/** Drains any Valkey or disk buffer from a previous crash, then starts the flush timer. */
+export declare function startBatcher(): void;
+/** Flushes remaining events and stops the timer. */
+export declare function stopBatcher(): Promise<void>;
+//# sourceMappingURL=telemetryBatcher.d.ts.map

package/dist/daemon/telemetryBatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetryBatcher.d.ts","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAqCA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAQ,MAAM,CAAA;IACnB,QAAQ,EAAK,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAI,MAAM,CAAA;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAMD,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAGnD;AA0DD,2FAA2F;AAC3F,wBAAgB,YAAY,IAAI,IAAI,CA2BnC;AAED,oDAAoD;AACpD,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAGjD"}

package/dist/daemon/telemetryBatcher.js

@@ -0,0 +1,143 @@
+/**
+ * Telemetry Batcher — ring buffer + 1s flush to control-plane
+ *
+ * Accumulates hook events and batches them for upload.
+ * Fallback: Valkey event buffer, followed by disk buffer at ~/.intutic/telemetry-buffer.ndjson on flush failure.
+ *
+ * LLD #28: MCP Daemon Mode, WS-5MCP
+ * @module
+ */
+import https from 'node:https';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { Redis } from 'ioredis';
+import { createLogger } from '@intutic/logger';
+const logger = createLogger('mcp-proxy.telemetryBatcher');
+const CP_URL = process.env['CONTROL_PLANE_URL'] ?? 'http://localhost:3001';
+const DAEMON_API_KEY = process.env['INTUTIC_API_KEY'] ?? '';
+const FLUSH_MS = parseInt(process.env['MCP_DAEMON_TELEMETRY_FLUSH_MS'] ?? '1000', 10);
+const RING_CAPACITY = 200;
+const DISK_BUFFER = path.join(os.homedir(), '.intutic', 'telemetry-buffer.ndjson');
+const VALKEY_URL = process.env['VALKEY_URL'] ?? process.env['REDIS_URL'] ?? 'redis://localhost:6379';
+const valkey = new Redis(VALKEY_URL, {
+    lazyConnect: true,
+    maxRetriesPerRequest: 3,
+});
+valkey.on('error', (err) => {
+    logger.warn({ err: err.message }, 'telemetryBatcher Valkey connection error');
+});
+const daemonId = process.pid.toString();
+const ring = [];
+let flushTimer = null;
+let isFlushing = false;
+/** Enqueues a hook event. Evicts oldest on overflow. */
+export function enqueueEvent(event) {
+    if (ring.length >= RING_CAPACITY)
+        ring.shift();
+    ring.push(event);
+}
+async function flush() {
+    if (isFlushing || ring.length === 0)
+        return;
+    isFlushing = true;
+    const batch = ring.splice(0, ring.length);
+    const body = JSON.stringify({ events: batch });
+    const url = new URL('/api/v1/hook-events', CP_URL);
+    const isHttps = url.protocol === 'https:';
+    const lib = isHttps ? https : http;
+    const tryUpload = (attempt) => new Promise((resolve, reject) => {
+        const req = lib.request({ hostname: url.hostname, port: url.port, path: url.pathname, method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body),
+                'Authorization': `Bearer ${DAEMON_API_KEY}` } }, (res) => {
+            res.resume();
+            if (res.statusCode && res.statusCode < 400)
+                resolve();
+            else
+                reject(new Error(`HTTP ${res.statusCode}`));
+        });
+        req.on('error', reject);
+        req.setTimeout(5000, () => { req.destroy(); reject(new Error('timeout')); });
+        req.write(body);
+        req.end();
+    });
+    let success = false;
+    for (let i = 0; i < 3; i++) {
+        try {
+            await tryUpload(i);
+            success = true;
+            break;
+        }
+        catch {
+            await new Promise(r => setTimeout(r, 500 * (i + 1)));
+        }
+    }
+    if (!success) {
+        // Persist to Valkey first
+        try {
+            const key = `mcp_daemon:event_buffer:${daemonId}`;
+            await valkey.rpush(key, ...batch.map(e => JSON.stringify(e)));
+            await valkey.expire(key, 600); // 10 min TTL
+            logger.warn({ count: batch.length }, 'telemetry.flush_failed_buffered_to_valkey');
+        }
+        catch (valkeyErr) {
+            // Fallback: local disk buffer
+            try {
+                fs.mkdirSync(path.dirname(DISK_BUFFER), { recursive: true, mode: 0o700 });
+                fs.appendFileSync(DISK_BUFFER, batch.map(e => JSON.stringify(e)).join('\n') + '\n', { mode: 0o600 });
+                logger.warn({ count: batch.length }, 'telemetry.flush_failed_buffered_to_disk');
+            }
+            catch (diskErr) {
+                logger.error({ diskErr, count: batch.length }, 'telemetry.disk_buffer_failed');
+            }
+        }
+    }
+    else {
+        logger.debug({ count: batch.length }, 'telemetry.flushed');
+    }
+    isFlushing = false;
+}
+/** Drains any Valkey or disk buffer from a previous crash, then starts the flush timer. */
+export function startBatcher() {
+    // Drain Valkey buffer
+    const key = `mcp_daemon:event_buffer:${daemonId}`;
+    valkey.lrange(key, 0, -1).then(async (lines) => {
+        if (lines && lines.length > 0) {
+            for (const line of lines) {
+                try {
+                    enqueueEvent(JSON.parse(line));
+                }
+                catch { }
+            }
+            await valkey.del(key);
+            logger.info({ count: lines.length }, 'telemetry.valkey_buffer_drained');
+        }
+    }).catch(() => { });
+    // Drain disk buffer
+    try {
+        if (fs.existsSync(DISK_BUFFER)) {
+            const lines = fs.readFileSync(DISK_BUFFER, 'utf8').trim().split('\n').filter(Boolean);
+            for (const line of lines) {
+                try {
+                    enqueueEvent(JSON.parse(line));
+                }
+                catch { }
+            }
+            fs.unlinkSync(DISK_BUFFER);
+            logger.info({ count: lines.length }, 'telemetry.disk_buffer_drained');
+        }
+    }
+    catch { }
+    flushTimer = setInterval(() => { void flush(); }, FLUSH_MS);
+    flushTimer.unref();
+}
+/** Flushes remaining events and stops the timer. */
+export async function stopBatcher() {
+    if (flushTimer) {
+        clearInterval(flushTimer);
+        flushTimer = null;
+    }
+    await flush();
+}
+//# sourceMappingURL=telemetryBatcher.js.map

package/dist/daemon/telemetryBatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetryBatcher.js","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAS,SAAS,CAAA;AAC3B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAS,SAAS,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAA;AAEzD,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAiB,uBAAuB,CAAA;AAChG,MAAM,cAAc,GAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAmB,EAAE,CAAA;AAC3E,MAAM,QAAQ,GAAU,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5F,MAAM,aAAa,GAAK,GAAG,CAAA;AAC3B,MAAM,WAAW,GAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAA;AAEtF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAA;AACpG,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE;IACnC,WAAW,EAAE,IAAI;IACjB,oBAAoB,EAAE,CAAC;CACxB,CAAC,CAAA;AAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;IAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0CAA0C,CAAC,CAAA;AAC/E,CAAC,CAAC,CAAA;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;AAWvC,MAAM,IAAI,GAAgB,EAAE,CAAA;AAC5B,IAAI,UAAU,GAA0C,IAAI,CAAA;AAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;AAEtB,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,IAAI,IAAI,CAAC,MAAM,IAAI,aAAa;QAAE,IAAI,CAAC,KAAK,EAAE,CAAA;IAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAC3C,UAAU,GAAG,IAAI,CAAA;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEzC,MAAM,IAAI,GAAK,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,MAAM,GAAG,GAAM,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACzC,MAAM,GAAG,GAAM,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAErC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM;YAC1E,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC7E,eAAe,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC5D,CAAC,GAAG,EAAE,EAAE;YACN,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBAAE,OAAO,EAAE,CAAA;;gBAChD,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QAClD,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IAEF,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,MAAK;QAAC,CAAC;QACjD,MAAM,CAAC;YAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0BAA0B;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,2BAA2B,QAAQ,EAAE,CAAA;YACjD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7D,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,aAAa;YAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,SAAc,EAAE,CAAC;YACxB,8BAA8B;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACzE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpG,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,yCAAyC,CAAC,CAAA;YACjF,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAA;YAChF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAC5D,CAAC;IACD,UAAU,GAAG,KAAK,CAAA;AACpB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY;IAC1B,sBAAsB;IACtB,MAAM,GAAG,GAAG,2BAA2B,QAAQ,EAAE,CAAA;IACjD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;QACvD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YAC9D,CAAC;YACD,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACzE,CAAC;IACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAElB,oBAAoB;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACrF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YAC9D,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAA,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC1D,UAAU,CAAC,KAAK,EAAE,CAAA;AACpB,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,UAAU,EAAE,CAAC;QAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAAC,UAAU,GAAG,IAAI,CAAA;IAAC,CAAC;IAChE,MAAM,KAAK,EAAE,CAAA;AACf,CAAC"}

package/dist/daemonClient.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Sends a JSON-RPC request to the mcp-daemon Unix domain socket.
+ */
+export declare function callDaemonSocket(method: string, params: Record<string, unknown>): Promise<any>;
+//# sourceMappingURL=daemonClient.d.ts.map

package/dist/daemonClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemonClient.d.ts","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAkBA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAiD9F"}

package/dist/daemonClient.js

@@ -0,0 +1,67 @@
+/**
+ * daemonClient.ts — IPC socket client helper for communicating with mcp-daemon.
+ * LLD #28: MCP Daemon Mode, WS-5MCP
+ *
+ * @module
+ */
+import * as net from 'node:net';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { createStderrLogger as createLogger } from './stderrLog.js';
+const log = createLogger('mcp-proxy-daemon-client');
+function getSocketPath() {
+    return process.env['MCP_DAEMON_SOCKET'] ??
+        path.join(os.homedir(), '.intutic', 'mcp-proxy.sock');
+}
+/**
+ * Sends a JSON-RPC request to the mcp-daemon Unix domain socket.
+ */
+export function callDaemonSocket(method, params) {
+    return new Promise((resolve, reject) => {
+        const socket = net.createConnection(getSocketPath());
+        socket.setEncoding('utf8');
+        let buffer = '';
+        const req = {
+            jsonrpc: '2.0',
+            id: Date.now().toString() + Math.random().toString(36).substring(2, 7),
+            method,
+            params,
+        };
+        socket.on('connect', () => {
+            socket.write(JSON.stringify(req) + '\n');
+        });
+        socket.on('data', (chunk) => {
+            buffer += chunk;
+            const lines = buffer.split('\n');
+            if (lines.length > 1) {
+                const line = lines[0].trim();
+                if (line) {
+                    try {
+                        const res = JSON.parse(line);
+                        if (res.error) {
+                            reject(new Error(res.error.message));
+                        }
+                        else {
+                            resolve(res.result);
+                        }
+                    }
+                    catch (err) {
+                        reject(err);
+                    }
+                    finally {
+                        socket.end();
+                    }
+                }
+            }
+        });
+        socket.on('error', (err) => {
+            reject(err);
+        });
+        // 2s timeout
+        socket.setTimeout(2000, () => {
+            socket.destroy();
+            reject(new Error('Daemon socket timeout'));
+        });
+    });
+}
+//# sourceMappingURL=daemonClient.js.map

package/dist/daemonClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemonClient.js","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAA;AAEnD,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAA+B;IAC9E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAA;QACpD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAE1B,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,MAAM;YACN,MAAM;SACP,CAAA;QAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,MAAM,IAAI,KAAK,CAAA;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;gBAC7B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;wBAC5B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;4BACd,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;wBACtC,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;wBACrB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,CAAC,CAAA;oBACb,CAAC;4BAAS,CAAC;wBACT,MAAM,CAAC,GAAG,EAAE,CAAA;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,aAAa;QACb,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/dlp.d.ts

@@ -0,0 +1,29 @@
+/**
+ * dlp.ts — DLP (Data Loss Prevention) argument scanner.
+ *
+ * Scans tool arguments (as a JSON string) for patterns that indicate
+ * credentials, secrets, PII, or other sensitive data before allowing
+ * the tool call to proceed.
+ *
+ * @module
+ */
+export interface DlpFinding {
+    pattern: string;
+    description: string;
+}
+export interface DlpScanResult {
+    hasFinding: boolean;
+    findings: DlpFinding[];
+}
+/**
+ * Scan tool arguments for DLP findings.
+ *
+ * @param toolInput - The tool_input object from the MCP tools/call request
+ * @returns DLP scan result with any findings
+ */
+export declare function scanToolInput(toolInput: unknown): DlpScanResult;
+/**
+ * Format DLP findings into a human-readable block reason.
+ */
+export declare function formatDlpBlockReason(findings: DlpFinding[]): string;
+//# sourceMappingURL=dlp.d.ts.map

package/dist/dlp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dlp.d.ts","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,UAAU,EAAE,CAAA;CACvB;AA2BD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,OAAO,GAAG,aAAa,CAY/D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAGnE"}

package/dist/dlp.js

@@ -0,0 +1,58 @@
+/**
+ * dlp.ts — DLP (Data Loss Prevention) argument scanner.
+ *
+ * Scans tool arguments (as a JSON string) for patterns that indicate
+ * credentials, secrets, PII, or other sensitive data before allowing
+ * the tool call to proceed.
+ *
+ * @module
+ */
+/**
+ * Compiled DLP patterns. Each entry has a regex and a human-readable description.
+ */
+const DLP_PATTERNS = [
+    // API keys / tokens
+    { regex: /sk-[A-Za-z0-9]{20,}/, description: 'OpenAI API key pattern' },
+    { regex: /sk-ant-[A-Za-z0-9\-_]{20,}/, description: 'Anthropic API key pattern' },
+    { regex: /AIza[A-Za-z0-9\-_]{35}/, description: 'Google API key pattern' },
+    { regex: /ghp_[A-Za-z0-9]{36}/, description: 'GitHub personal access token' },
+    { regex: /ghs_[A-Za-z0-9]{36}/, description: 'GitHub server token' },
+    { regex: /xoxb-[A-Za-z0-9\-]{50,}/, description: 'Slack bot token' },
+    { regex: /xoxp-[A-Za-z0-9\-]{50,}/, description: 'Slack user token' },
+    { regex: /AKIA[A-Z0-9]{16}/, description: 'AWS Access Key ID' },
+    // High-entropy strings that look like secrets (≥40 chars of hex or base64)
+    { regex: /[0-9a-f]{40,}/, description: 'High-entropy hex string (possible secret)' },
+    // Destructive shell patterns in Bash/command arguments
+    { regex: /rm\s+-rf?\s+\//, description: 'Destructive rm -rf / command' },
+    { regex: /DROP\s+TABLE/i, description: 'SQL DROP TABLE statement' },
+    { regex: /DROP\s+DATABASE/i, description: 'SQL DROP DATABASE statement' },
+    { regex: /TRUNCATE\s+TABLE/i, description: 'SQL TRUNCATE TABLE statement' },
+    // Private key material
+    { regex: /-----BEGIN\s+(RSA\s+)?PRIVATE KEY-----/, description: 'PEM private key material' },
+    { regex: /-----BEGIN\s+EC\s+PRIVATE KEY-----/, description: 'EC private key material' },
+];
+/**
+ * Scan tool arguments for DLP findings.
+ *
+ * @param toolInput - The tool_input object from the MCP tools/call request
+ * @returns DLP scan result with any findings
+ */
+export function scanToolInput(toolInput) {
+    // Serialize to string for pattern matching
+    const serialized = JSON.stringify(toolInput ?? {});
+    const findings = [];
+    for (const { regex, description } of DLP_PATTERNS) {
+        if (regex.test(serialized)) {
+            findings.push({ pattern: regex.source, description });
+        }
+    }
+    return { hasFinding: findings.length > 0, findings };
+}
+/**
+ * Format DLP findings into a human-readable block reason.
+ */
+export function formatDlpBlockReason(findings) {
+    const list = findings.map((f) => `• ${f.description}`).join('\n');
+    return `Tool call blocked by Intutic DLP scanner. Sensitive data detected:\n${list}`;
+}
+//# sourceMappingURL=dlp.js.map

package/dist/dlp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dlp.js","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH;;GAEG;AACH,MAAM,YAAY,GAAkD;IAClE,oBAAoB;IACpB,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,EAAE;IACvE,EAAE,KAAK,EAAE,4BAA4B,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACjF,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,wBAAwB,EAAE;IAC1E,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC7E,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACpE,EAAE,KAAK,EAAE,yBAAyB,EAAE,WAAW,EAAE,iBAAiB,EAAE;IACpE,EAAE,KAAK,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE;IACrE,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAC/D,2EAA2E;IAC3E,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,2CAA2C,EAAE;IACpF,uDAAuD;IACvD,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IACxE,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACnE,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACzE,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC3E,uBAAuB;IACvB,EAAE,KAAK,EAAE,wCAAwC,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC5F,EAAE,KAAK,EAAE,oCAAoC,EAAE,WAAW,EAAE,yBAAyB,EAAE;CACxF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,2CAA2C;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAiB,EAAE,CAAA;IAEjC,KAAK,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAsB;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,OAAO,uEAAuE,IAAI,EAAE,CAAA;AACtF,CAAC"}