@intutic/mcp-governance-proxy 1.10.0 → 1.10.1

package/dist/interceptor.js

@@ -9,17 +9,118 @@
  *
  * @module
  */
+import * as node_crypto from 'node:crypto';
 import { createStderrLogger as createLogger } from './stderrLog.js';
-import { scanToolInput, formatDlpBlockReason } from './dlp.js';
+import { scanToolInput, formatDlpBlockReason, setDynamicPatterns } from './dlp.js';
+import { scanText, injectionSeverity, setDynamicInjectionPatterns } from './injection.js';
+import { evaluateSequenceDetectors, resolveEffectiveDisposition, REASK_MAX_ATTEMPTS } from './anomaly/index.js';
+import { SessionState } from './session.js';
 const log = createLogger('mcp-proxy-interceptor');
 export class ToolCallInterceptor {
     policy;
     emitter;
     failOpen;
-    constructor(policy, emitter, failOpen = true) {
+    serverName;
+    injectionActionDefault;
+    session;
+    anomalyModeDefault;
+    anomalyOverridesDefault;
+    wasmRunner;
+    workspaceId;
+    constructor(policy, emitter, failOpen = true, 
+    /**
+     * The real MCP server this proxy process fronts, from `--server-name`
+     * (config.ts, threaded since Phase D's `wrapWithProxy` but unconsumed
+     * until now). `'unknown'` when unset, matching config.ts's own default —
+     * see the server-scoping check below for why an allowlist naming
+     * anything else then refuses every call from this process.
+     */
+    serverName = 'unknown', 
+    /**
+     * Env-derived default prompt-injection disposition (`config.ts`'s
+     * `mcpInjectionAction`), used whenever `policy.getInjectionAction()`
+     * reports no control-plane override. Defaults to `'warn'` here too, so
+     * every existing construction site/test that doesn't pass this
+     * parameter keeps the same steer-not-kill posture the Rust detector this
+     * was ported from uses by default.
+     */
+    injectionActionDefault = 'warn', 
+    /**
+     * Shared per-process session state (Phase 2) — the SAME instance
+     * `McpGovernanceProxy` (proxy.ts) owns and hands to `handleHarnessLine`
+     * for post-decision recording, so the sequence this method reads for
+     * detection and the sequence `handleHarnessLine` appends to after an
+     * `allow` are never two different objects that could drift. Defaults to
+     * a fresh instance so every existing construction site/test that
+     * predates Phase 2 keeps working unchanged.
+     */
+    session = new SessionState(), 
+    /**
+     * Env-derived default anomaly mode (`config.ts`'s `mcpAnomalyMode`),
+     * used whenever `policy.getAnomalyMode()` reports no control-plane
+     * override. Defaults to `'enforce'` — see `config.ts`'s doc comment on
+     * why "enforce" here does not mean "block on suspicion": every
+     * detector's own Rust-declared disposition ceiling still applies via
+     * `resolveEffectiveDisposition`.
+     */
+    anomalyModeDefault = 'enforce', 
+    /**
+     * Env-derived default per-detector override map (`config.ts`'s
+     * `mcpAnomalyOverrides`). Merged with `policy.getAnomalyOverrides()` per
+     * key, control-plane value winning — the same "policy overrides the
+     * env-derived default, per field" shape `injectionActionDefault` uses,
+     * just applied per-map-entry instead of to one scalar.
+     */
+    anomalyOverridesDefault = {}, 
+    /**
+     * Phase 3's WASM custom-rule runner, or `undefined` to skip WASM
+     * evaluation entirely (every construction site/test that predates Phase
+     * 3, and any deployment with no `~/.intutic/wasm/` rules). Owned by
+     * `McpGovernanceProxy` (proxy.ts), same sharing pattern as `session`.
+     */
+    wasmRunner = undefined, 
+    /**
+     * This proxy's workspace id, from `config.ts` — needed for Phase 3's
+     * `RequestContext.workspace_id` field. Stored separately from `policy`
+     * (which has no getter for it) and from `serverName` (a different
+     * identity: the MCP SERVER this process fronts, not the WORKSPACE it
+     * belongs to).
+     */
+    workspaceId = 'unknown') {
         this.policy = policy;
         this.emitter = emitter;
         this.failOpen = failOpen;
+        this.serverName = serverName;
+        this.injectionActionDefault = injectionActionDefault;
+        this.session = session;
+        this.anomalyModeDefault = anomalyModeDefault;
+        this.anomalyOverridesDefault = anomalyOverridesDefault;
+        this.wasmRunner = wasmRunner;
+        this.workspaceId = workspaceId;
+    }
+    /**
+     * Applies the shared reask ladder (Phase 2 anomaly detectors AND Phase 3
+     * WASM rules both use this): a session-lifetime attempt counter keyed by
+     * `key`, `REASK_MAX_ATTEMPTS` (3) tries before hardening into an
+     * unconditional block. Always emits `tool_blocked` — a reask blocks the
+     * CURRENT attempt, so existing consumers keyed on `tool_blocked` must see
+     * it, exactly like every other new block reason in this package.
+     */
+    async applyReaskLadder(key, baseReason, toolName, toolInput) {
+        // Shared across the session's sibling proxy processes when a session
+        // store is configured (Wave 5.3); the per-process counter otherwise.
+        const attempts = await this.session.incrReaskAttemptShared(key);
+        if (attempts > REASK_MAX_ATTEMPTS) {
+            const hardenedReason = `${baseReason} — hardened to an unconditional block after ${REASK_MAX_ATTEMPTS} reask ` +
+                `attempts with no correction.`;
+            log.warn({ action: 'reask_hardened', toolName, key, attempts }, 'Reask attempts exhausted — hardening to a hard block');
+            this.emitter.emit('tool_blocked', toolName, toolInput, hardenedReason);
+            return { action: 'block', reason: hardenedReason };
+        }
+        const reaskReason = `${baseReason} (attempt ${attempts}/${REASK_MAX_ATTEMPTS} — will become an unconditional ` +
+            `block if this keeps tripping)`;
+        this.emitter.emit('tool_blocked', toolName, toolInput, reaskReason);
+        return { action: 'block', reason: reaskReason };
     }
     /**
      * Evaluate a tools/call request and return a governance decision.
@@ -30,9 +131,65 @@ export class ToolCallInterceptor {
      */
     async decide(toolName, toolInput) {
         log.debug({ action: 'interceptor_decide', toolName }, 'Evaluating tool call');
-        // 1. DLP scan
+        // Captured across pipeline steps for Phase 3's WASM context (built only
+        // if this call reaches step 5) — each stays honestly empty/undefined
+        // when its step never ran or found nothing, never fabricated.
+        let dlpFindingsForContext = [];
+        let injectionFindingsForContext = [];
+        let injectionSourcesForContext = [];
+        let corroboratingDetectorsForContext = 0;
+        // -1. Additive SERVER scoping. When the workspace declares a server
+        // allowlist (mcpAllowedServers), ONLY calls proxied to those servers may
+        // proceed — checked ahead of the per-tool allowlist below since a
+        // disallowed server should never even reach tool-name evaluation. Same
+        // empty-means-unrestricted convention as every allowlist in this file,
+        // and — deliberately, like the tool-scoping check right below it — NOT
+        // gated on `failOpen`: an explicit, non-empty allowlist that excludes
+        // this server is a definite policy decision the proxy already has the
+        // data to make, not a "control plane unreachable" failure mode. A
+        // control-plane outage naturally fails open here too, for the same
+        // reason it does for tool scoping: an unreachable policy fetch leaves
+        // `allowedServers` empty, which reads as unrestricted rather than as a
+        // block.
+        const allowedServers = this.policy.getAllowedServers();
+        if (allowedServers.length > 0 && !allowedServers.includes(this.serverName)) {
+            const reason = `MCP server "${this.serverName}" is not in this workspace's MCP server allowlist ` +
+                `(${allowedServers.length} server(s) permitted). An operator can widen the ` +
+                `allowlist in workspace settings (mcpAllowedServers).`;
+            log.warn({ action: 'server_allowlist_block', serverName: this.serverName, toolName }, reason);
+            this.emitter.emit('tool_blocked', toolName, toolInput, reason);
+            return { action: 'block', reason };
+        }
+        // 0. Additive tool scoping. When the workspace declares an allowlist,
+        // ONLY those tools may be called — the inverse of every other rule here,
+        // which names what is forbidden. An EMPTY allowlist means unrestricted,
+        // never "permit nothing": read the other way it would block every
+        // workspace that never declared one, which is the exact inversion the
+        // starter rules' harness-allowlist near-miss exists to catch.
+        const allowedTools = this.policy.getAllowedTools();
+        if (allowedTools.length > 0 && !allowedTools.includes(toolName)) {
+            const reason = `Tool "${toolName}" is not in this workspace's MCP tool allowlist ` +
+                `(${allowedTools.length} tool(s) permitted). An operator can widen the ` +
+                `allowlist in workspace settings (mcpAllowedTools).`;
+            log.warn({ action: 'allowlist_block', toolName }, reason);
+            this.emitter.emit('tool_blocked', toolName, toolInput, reason);
+            return { action: 'block', reason };
+        }
+        // 1. DLP scan — with the workspace's own patterns loaded first, so a
+        // control-plane-defined pattern reaches the same scanner as the floor.
+        try {
+            setDynamicPatterns(this.policy.getDlpPatterns());
+        }
+        catch {
+            // Pattern delivery must never take the scanner down; the floor stands.
+        }
         try {
             const dlp = scanToolInput(toolInput);
+            // Captured regardless of outcome — by pipeline position, a non-empty
+            // result here always blocks below, so `dlpFindingsForContext` is
+            // honestly almost always `[]` by the time Phase 3 reads it (a
+            // property of the pipeline order, not a bug in this capture).
+            dlpFindingsForContext = dlp.findings;
             if (dlp.hasFinding) {
                 const reason = formatDlpBlockReason(dlp.findings);
                 log.warn({ action: 'dlp_block', toolName, findings: dlp.findings }, 'DLP block');
@@ -63,7 +220,10 @@ export class ToolCallInterceptor {
                 }
                 if (rule.action === 'warn') {
                     log.warn({ action: 'policy_warn', toolName, ruleId: rule.id, reason: rule.reason }, 'Policy warning (allowing)');
-                    // Fall through to allow — warnings are logged only
+                    // Fall through to allow. Reported as `tool_flagged` with the rule id
+                    // in the reason — the same shape the harness gates use — so a
+                    // SHADOW guardrail's evidence (LLD #71) counts this proxy's traffic.
+                    this.emitter.emit('tool_flagged', toolName, toolInput, `${rule.reason} [${rule.id}]`);
                 }
                 // 'require_approval' treated as block in headless proxy (no interactive UI)
                 if (rule.action === 'require_approval') {
@@ -85,7 +245,143 @@ export class ToolCallInterceptor {
                 };
             }
         }
-        // 3. Allow — emit telemetry event
+        // 3. Prompt-injection scan (request direction) — the `toolInput` a
+        // MISBEHAVING or COMPROMISED calling agent sends, e.g. an agent that
+        // itself already ingested injected content from an earlier step and is
+        // now echoing instructions into its own tool call. Pipeline position
+        // mirrors the Rust proxy's own ordering: after DLP/SOP, before anomaly
+        // detection and WASM rules (neither exists yet in this package — Phase
+        // 2/3 land after this).
+        try {
+            const toolInputText = JSON.stringify(toolInput ?? {});
+            setDynamicInjectionPatterns(this.policy.getInjectionPatterns());
+            const findings = scanText(toolInputText);
+            if (findings.length > 0) {
+                injectionFindingsForContext = findings;
+                injectionSourcesForContext = ['tool_input'];
+                const severity = injectionSeverity(findings, 'tool_input');
+                const reason = `Prompt-injection pattern(s) detected in tool input: ${findings.join(', ')}`;
+                log.warn({ action: 'injection_detected', toolName, patterns: findings, source: 'tool_input', severity }, 'Prompt-injection pattern matched in tool call input');
+                const injectionAction = this.policy.getInjectionAction() ?? this.injectionActionDefault;
+                this.emitter.emit('injection_detected', toolName, toolInput, reason, severity);
+                if (injectionAction === 'block') {
+                    this.emitter.emit('tool_blocked', toolName, toolInput, reason);
+                    return { action: 'block', reason };
+                }
+                // 'warn' (default): report only, fall through to allow.
+            }
+        }
+        catch (err) {
+            // Never let a scanner failure take the proxy down — same posture as
+            // the DLP/SOP try/catches above, and unconditionally non-fatal (unlike
+            // those) because injection scanning's own default disposition is
+            // report-only, so a scanner error degrading to "scan skipped" is no
+            // more permissive than the feature's own warn default.
+            log.error({ action: 'injection_scan_error', err: err.message }, 'Injection scan error — skipping');
+        }
+        // 4. Anomaly detection (Phase 2) — the 7 detectors ported from
+        // `packages/proxy/src/plugins/anomaly/detectors.rs`; see
+        // `anomaly/detectors.ts`. Five (consecutive_repeat, ping_pong_cycle,
+        // landmark_cycle, tool_diversity_collapse, code_as_action) are
+        // sequence/current-call detectors evaluated here, on every request; the
+        // other two (tool_poisoning, dlp_escalation) read data this pipeline
+        // stage does not have (a cached tools/list, response-direction DLP
+        // findings) and run from `proxy.ts`'s response-direction handling
+        // instead. Position: after injection, before WASM (Phase 3, not yet
+        // built) and allow.
+        const anomalyMode = this.policy.getAnomalyMode() ?? this.anomalyModeDefault;
+        // The session window — the shared one across this session's sibling
+        // proxy processes when a store is configured (Wave 5.3, TD-437), the
+        // per-process one otherwise. One round trip at most per tools/call, and
+        // none when nothing below would read it.
+        const window = anomalyMode !== 'off' || this.wasmRunner ? await this.session.loadWindow(toolName) : undefined;
+        if (anomalyMode !== 'off' && window) {
+            try {
+                const prospective = window.prospective;
+                const findings = evaluateSequenceDetectors(prospective, toolName, toolInput);
+                corroboratingDetectorsForContext = findings.length;
+                const overrides = { ...this.anomalyOverridesDefault, ...this.policy.getAnomalyOverrides() };
+                for (const finding of findings) {
+                    const effective = resolveEffectiveDisposition(finding, anomalyMode, overrides);
+                    if (effective === 'off')
+                        continue; // demoted below reporting entirely — skip silently
+                    const severity = effective === 'kill' ? 'high' : effective === 'reask' ? 'medium' : 'low';
+                    log.warn({
+                        action: 'anomaly_detected',
+                        toolName,
+                        detectorId: finding.detectorId,
+                        kind: finding.kind,
+                        disposition: effective,
+                        confidence: finding.confidence,
+                    }, 'Anomaly detector fired');
+                    this.emitter.emit('anomaly_detected', toolName, toolInput, finding.reason, severity);
+                    if (effective === 'kill') {
+                        this.emitter.emit('tool_blocked', toolName, toolInput, finding.reason);
+                        return { action: 'block', reason: finding.reason };
+                    }
+                    if (effective === 'reask') {
+                        // Keyed per-detector-id, independent of every other detector's
+                        // (and every WASM rule's — see applyReaskLadder) own counter.
+                        return await this.applyReaskLadder(finding.detectorId, finding.reason, toolName, toolInput);
+                    }
+                    // 'steer': report only. Findings are sorted most-severe-first
+                    // (evaluateSequenceDetectors), so once we reach a 'steer' finding
+                    // every remaining one is 'steer' too — keep logging/emitting them,
+                    // then fall through to allow.
+                }
+            }
+            catch (err) {
+                // Same non-fatal posture as the injection scanner above: an anomaly
+                // detector is a pure function of in-memory state, but a defensive
+                // catch here means a bug in one detector degrades to "this call's
+                // anomaly check was skipped," never "the proxy crashed."
+                log.error({ action: 'anomaly_detection_error', err: err.message }, 'Anomaly detection error — skipping');
+            }
+        }
+        // 5. WASM custom rules (Phase 3) — operator-authored, compiled
+        // AssemblyScript rules dropped into `~/.intutic/wasm/`. Position: after
+        // every built-in check, immediately before allow — this is deliberately
+        // the LAST gate, so a WASM rule's `RequestContext` carries
+        // `injection_findings`/`corroborating_detectors`/etc. already populated
+        // by the steps above it (see `wasm/context.ts`'s module doc).
+        if (this.wasmRunner) {
+            try {
+                const verdict = await this.wasmRunner.evaluate({
+                    sessionId: this.session.sessionId,
+                    workspaceId: this.workspaceId,
+                    tools: this.session.getToolsList(),
+                    toolCallId: node_crypto.randomUUID(),
+                    toolName,
+                    toolArguments: toolInput,
+                    toolSequence: window?.prospective ?? this.session.prospectiveSequence(toolName),
+                    callsLast60s: window?.callsLast60s ?? this.session.callsInLastMs(),
+                    dlpFindingDescriptions: dlpFindingsForContext.map((f) => f.description),
+                    injectionFindings: injectionFindingsForContext,
+                    injectionSources: injectionSourcesForContext,
+                    corroboratingDetectors: corroboratingDetectorsForContext,
+                    toolContractChanged: this.session.getToolContractChanged(),
+                });
+                if (verdict.code === 'block') {
+                    log.warn({ action: 'wasm_block', toolName, ruleId: verdict.ruleId }, 'Tool call blocked by WASM governance rule');
+                    this.emitter.emit('tool_blocked', toolName, toolInput, verdict.reason);
+                    return { action: 'block', reason: verdict.reason };
+                }
+                if (verdict.code === 'reask') {
+                    // Keyed per-rule-id, independent of every anomaly detector's own
+                    // counter — see applyReaskLadder's doc comment.
+                    return await this.applyReaskLadder(`wasm:${verdict.ruleId}`, verdict.reason, toolName, toolInput);
+                }
+                // 'allow': fall through.
+            }
+            catch (err) {
+                // Fail-open, matching every other governance-check catch in this
+                // method — a WASM runner failure (not to be confused with a single
+                // rule's own timeout/trap, which `WasmRunner.evaluate` already
+                // absorbs internally) must not take the whole proxy down.
+                log.error({ action: 'wasm_evaluate_error', err: err.message }, 'WASM rule evaluation error — skipping');
+            }
+        }
+        // 6. Allow — emit telemetry event
         this.emitter.emit('tool_allowed', toolName, toolInput);
         return { action: 'allow' };
     }

package/dist/interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAI9D,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAOjD,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IAHnB,YACmB,MAAoB,EACpB,OAA0B,EAC1B,WAAoB,IAAI;QAFxB,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAmB;QAC1B,aAAQ,GAAR,QAAQ,CAAgB;IACxC,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAkB;QAC/C,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,sBAAsB,CAAC,CAAA;QAE7E,cAAc;QACd,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YACpC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAA;gBAChF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;gBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAC5F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EACJ,+DAA+D;wBAC/D,4DAA4D;wBAC5D,oEAAoE;iBACvE,CAAA;YACH,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;YAC3D,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAA;oBACpG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;oBACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBACjD,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAA;oBAChH,mDAAmD;gBACrD,CAAC;gBACD,4EAA4E;gBAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;oBACvC,MAAM,MAAM,GAAG,6CAA6C,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAA;oBACrF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;oBACnF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;oBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAA;YAC7F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EACJ,+DAA+D;wBAC/D,4DAA4D;wBAC5D,oEAAoE;iBACvE,CAAA;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QACtD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC5B,CAAC;CACF"}
+{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAElF,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAK3C,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAOjD,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IAQA;IASA;IAUA;IASA;IAQA;IAOA;IAQA;IA9DnB,YACmB,MAAoB,EACpB,OAA0B,EAC1B,WAAoB,IAAI;IACzC;;;;;;OAMG;IACc,aAAqB,SAAS;IAC/C;;;;;;;OAOG;IACc,yBAA2C,MAAM;IAClE;;;;;;;;OAQG;IACc,UAAwB,IAAI,YAAY,EAAE;IAC3D;;;;;;;OAOG;IACc,qBAAkC,SAAS;IAC5D;;;;;;OAMG;IACc,0BAAyE,EAAE;IAC5F;;;;;OAKG;IACc,aAAqC,SAAS;IAC/D;;;;;;OAMG;IACc,cAAsB,SAAS;QA7D/B,WAAM,GAAN,MAAM,CAAc;QACpB,YAAO,GAAP,OAAO,CAAmB;QAC1B,aAAQ,GAAR,QAAQ,CAAgB;QAQxB,eAAU,GAAV,UAAU,CAAoB;QAS9B,2BAAsB,GAAtB,sBAAsB,CAA2B;QAUjD,YAAO,GAAP,OAAO,CAAmC;QAS1C,uBAAkB,GAAlB,kBAAkB,CAAyB;QAQ3C,4BAAuB,GAAvB,uBAAuB,CAAoD;QAO3E,eAAU,GAAV,UAAU,CAAoC;QAQ9C,gBAAW,GAAX,WAAW,CAAoB;IAC/C,CAAC;IAEJ;;;;;;;OAOG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,UAAkB,EAAE,QAAgB,EAAE,SAAkB;QAClG,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;QAC/D,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,cAAc,GAClB,GAAG,UAAU,+CAA+C,kBAAkB,SAAS;gBACvF,8BAA8B,CAAA;YAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,sDAAsD,CAAC,CAAA;YACvH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;YACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,WAAW,GACf,GAAG,UAAU,aAAa,QAAQ,IAAI,kBAAkB,kCAAkC;YAC1F,+BAA+B,CAAA;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACjD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAkB;QAC/C,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,sBAAsB,CAAC,CAAA;QAE7E,wEAAwE;QACxE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,qBAAqB,GAAiB,EAAE,CAAA;QAC5C,IAAI,2BAA2B,GAAa,EAAE,CAAA;QAC9C,IAAI,0BAA0B,GAAa,EAAE,CAAA;QAC7C,IAAI,gCAAgC,GAAG,CAAC,CAAA;QAExC,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,SAAS;QACT,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAA;QACtD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,MAAM,GACV,eAAe,IAAI,CAAC,UAAU,oDAAoD;gBAClF,IAAI,cAAc,CAAC,MAAM,mDAAmD;gBAC5E,sDAAsD,CAAA;YACxD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YAC7F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAA;QAClD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GACV,SAAS,QAAQ,kDAAkD;gBACnE,IAAI,YAAY,CAAC,MAAM,iDAAiD;gBACxE,oDAAoD,CAAA;YACtD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;YACzD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,CAAC;YACH,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAA;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YACpC,qEAAqE;YACrE,iEAAiE;YACjE,8DAA8D;YAC9D,8DAA8D;YAC9D,qBAAqB,GAAG,GAAG,CAAC,QAAQ,CAAA;YACpC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAA;gBAChF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;gBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAC5F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EACJ,+DAA+D;wBAC/D,4DAA4D;wBAC5D,oEAAoE;iBACvE,CAAA;YACH,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;YAC3D,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAA;oBACpG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;oBACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;gBACjD,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAA;oBAChH,qEAAqE;oBACrE,8DAA8D;oBAC9D,qEAAqE;oBACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;gBACvF,CAAC;gBACD,4EAA4E;gBAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;oBACvC,MAAM,MAAM,GAAG,6CAA6C,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAA;oBACrF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;oBACnF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;oBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAA;YAC7F,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;oBACL,MAAM,EAAE,OAAO;oBACf,MAAM,EACJ,+DAA+D;wBAC/D,4DAA4D;wBAC5D,oEAAoE;iBACvE,CAAA;YACH,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAA;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAA;YACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,2BAA2B,GAAG,QAAQ,CAAA;gBACtC,0BAA0B,GAAG,CAAC,YAAY,CAAC,CAAA;gBAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;gBAC1D,MAAM,MAAM,GAAG,uDAAuD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;gBAC3F,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAC9F,qDAAqD,CACtD,CAAA;gBACD,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAA;gBACvF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAC9E,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;oBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;gBACpC,CAAC;gBACD,wDAAwD;YAC1D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,uEAAuE;YACvE,iEAAiE;YACjE,oEAAoE;YACpE,uDAAuD;YACvD,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,iCAAiC,CAAC,CAAA;QAC/G,CAAC;QAED,+DAA+D;QAC/D,yDAAyD;QACzD,qEAAqE;QACrE,+DAA+D;QAC/D,wEAAwE;QACxE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,oBAAoB;QACpB,MAAM,WAAW,GAAgB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAA;QACxF,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,MAAM,GAAG,WAAW,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7G,IAAI,WAAW,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;gBACtC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC5E,gCAAgC,GAAG,QAAQ,CAAC,MAAM,CAAA;gBAClD,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAA;gBAC3F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,SAAS,GAAwB,2BAA2B,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;oBACnG,IAAI,SAAS,KAAK,KAAK;wBAAE,SAAQ,CAAC,mDAAmD;oBAErF,MAAM,QAAQ,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;oBACzF,GAAG,CAAC,IAAI,CACN;wBACE,MAAM,EAAE,kBAAkB;wBAC1B,QAAQ;wBACR,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,WAAW,EAAE,SAAS;wBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;qBAC/B,EACD,wBAAwB,CACzB,CAAA;oBACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;oBAEpF,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;wBACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;wBACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;oBACpD,CAAC;oBAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;wBAC1B,+DAA+D;wBAC/D,8DAA8D;wBAC9D,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;oBAC7F,CAAC;oBAED,8DAA8D;oBAC9D,kEAAkE;oBAClE,mEAAmE;oBACnE,8BAA8B;gBAChC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,yDAAyD;gBACzD,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,oCAAoC,CAAC,CAAA;YACrH,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,wEAAwE;QACxE,wEAAwE;QACxE,2DAA2D;QAC3D,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAC7C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;oBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;oBAClC,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;oBACpC,QAAQ;oBACR,aAAa,EAAE,SAAS;oBACxB,YAAY,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC;oBAC/E,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;oBAClE,sBAAsB,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;oBACvE,iBAAiB,EAAE,2BAA2B;oBAC9C,gBAAgB,EAAE,0BAA0B;oBAC5C,sBAAsB,EAAE,gCAAgC;oBACxD,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE;iBAC3D,CAAC,CAAA;gBAEF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;oBACjH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;oBACtE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;gBACpD,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,iEAAiE;oBACjE,gDAAgD;oBAChD,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;gBACnG,CAAC;gBACD,yBAAyB;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iEAAiE;gBACjE,mEAAmE;gBACnE,+DAA+D;gBAC/D,0DAA0D;gBAC1D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,uCAAuC,CAAC,CAAA;YACpH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QACtD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC5B,CAAC;CACF"}

package/dist/policy.d.ts

@@ -17,6 +17,28 @@ export interface SopRule {
     /** Human-readable reason reported back to harness */
     reason: string;
 }
+/**
+ * Is this unvalidated object actually a policy rule?
+ *
+ * The daemon caches `sopRules` as `Record<string, unknown>[]` — it filters the
+ * control plane's response to plain objects and validates nothing further. The
+ * client then used `as SopRule[]`, behind a `Promise<any>` that hid the
+ * mismatch entirely.
+ *
+ * That matters because these drive blocking decisions: a rule missing
+ * `toolPattern` reaches `new RegExp(undefined)` and matches everything, and a
+ * rule with an unrecognised `action` falls through every branch and enforces
+ * nothing. Neither is a shape the control plane intends to send — which is the
+ * argument for dropping the malformed ones loudly rather than trusting a cast.
+ */
+/**
+ * Exported because it is the contract between this package and whatever
+ * produces rules for it, not merely an internal helper. `policyCache`'s snapshot
+ * seed has to satisfy it, and a test that asserted against a *copy* of this
+ * predicate would prove nothing about the real one — which is precisely the
+ * two-copies-of-one-rule failure the harness gates were just rebuilt to remove.
+ */
+export declare function isSopRule(value: unknown): value is SopRule;
 export declare class PolicyClient {
     private readonly controlPlaneUrl;
     private readonly apiKey;
@@ -24,15 +46,101 @@ export declare class PolicyClient {
     private readonly ttlMs;
     private readonly mcpProxyMode;
     private rules;
+    /**
+     * Workspace DLP regex sources, delivered to the scanner on every refresh.
+     * The daemon has cached these since the policy cache existed; this client
+     * received and dropped them — a workspace's custom patterns were a setting
+     * wired to nothing.
+     */
+    private dlpPatterns;
+    /** Workspace injection-pattern sources (`mcpInjectionPatterns`, TD-436); empty = floor only. */
+    private injectionPatterns;
+    /**
+     * Additive tool scoping: when non-empty, ONLY these tools may be called
+     * through this proxy. Empty means unrestricted — the same convention as
+     * `allow_harnesses` and the starter rules' allowlist inversion warnings:
+     * an empty allowlist read as "permit nothing" would block every workspace
+     * that never declared one.
+     */
+    private allowedTools;
+    /** Operator-curated tool descriptions, applied to tools/list responses. */
+    private toolDescriptionOverrides;
+    /**
+     * Additive SERVER scoping: when non-empty, ONLY these MCP server names may
+     * be proxied by this process. Empty means unrestricted — same convention
+     * and same source as `allowedTools` above (mirrors `mcpAllowedTools` /
+     * `mcpAllowedServers` in workspace settings, delivered via the same
+     * `GET /api/v1/sop/rules` response this class already polls).
+     */
+    private allowedServers;
+    /**
+     * Control-plane-delivered prompt-injection disposition override. `undefined`
+     * (never `'warn'`/`'block'` by default) means "the control plane did not
+     * send this field" — distinct from the field being explicitly set to
+     * `'warn'` — so the caller (interceptor.ts) knows to fall back to
+     * `config.ts`'s `mcpInjectionAction` env-derived default rather than
+     * silently treating an unset policy as an explicit warn.
+     */
+    private injectionAction;
+    /**
+     * Control-plane-delivered anomaly-detection mode override (Phase 2).
+     * `undefined` when absent — same "absent means no override, fall back to
+     * config.ts's env-derived default" convention as `injectionAction` above.
+     */
+    private anomalyMode;
+    /**
+     * Control-plane-delivered per-detector disposition overrides. Always an
+     * object (never `undefined`) — an absent policy field reads as "no
+     * overrides," which `resolveEffectiveDisposition` (anomaly/index.ts)
+     * already treats as a no-op via `overrides[detectorId] === undefined`, the
+     * same empty-object-means-unrestricted convention `toolDescriptionOverrides`
+     * above uses.
+     */
+    private anomalyOverrides;
     private lastFetchAt;
     private refreshTimer;
     constructor(controlPlaneUrl: string, apiKey: string, workspaceId: string, ttlMs?: number, mcpProxyMode?: string);
-    /** Start background refresh timer. */
-    start(): void;
+    /**
+     * Start background refresh timer.
+     *
+     * @param onTick - Optional callback invoked on the SAME interval as the
+     *   policy refresh (including the initial kick below) — Phase 3's
+     *   `~/.intutic/wasm/` rescan (`WasmRunner.rescan`, wired from proxy.ts)
+     *   hooks this rather than starting a second timer, per the task's own
+     *   "don't add a second timer" instruction. Errors are swallowed the same
+     *   way `refresh()`'s own are — a rescan failure must not take down the
+     *   policy refresh it rides alongside.
+     */
+    start(onTick?: () => void | Promise<void>): void;
     /** Stop the background refresh timer. */
     stop(): void;
     /** Return the current cached rule set. */
     getRules(): readonly SopRule[];
+    /** Workspace DLP regex sources from the last successful refresh. */
+    /** Workspace-supplied prompt-injection regex sources; empty means the hardcoded floor alone. */
+    getInjectionPatterns(): readonly string[];
+    getDlpPatterns(): readonly string[];
+    /** The additive tool allowlist; empty means unrestricted. */
+    getAllowedTools(): readonly string[];
+    /** The additive MCP server allowlist; empty means unrestricted. */
+    getAllowedServers(): readonly string[];
+    /** Operator description overrides for tools/list curation. */
+    getToolDescriptionOverrides(): Readonly<Record<string, string>>;
+    /**
+     * The control-plane-delivered prompt-injection disposition, or `undefined`
+     * when the policy source never sent `mcpInjectionAction` — absent means
+     * "no override", not "warn". Callers (interceptor.ts) fall back to
+     * `config.ts`'s env-derived default in that case, the same "absent means
+     * default" convention every other optional policy field in this class
+     * follows.
+     */
+    getInjectionAction(): 'warn' | 'block' | undefined;
+    /** The control-plane-delivered anomaly mode, or `undefined` if unset (see field doc). */
+    getAnomalyMode(): 'enforce' | 'warn' | 'off' | undefined;
+    /** Per-detector disposition overrides; always an object, empty means none. */
+    getAnomalyOverrides(): Readonly<Record<string, 'steer' | 'reask' | 'kill' | 'off'>>;
+    /** Parse the optional curation fields shared by both refresh paths. */
+    private absorbCuration;
     /** Find the first matching rule for a given tool name + serialized args. */
     matchRule(toolName: string, toolInputJson: string): SopRule | null;
     /** Fetch fresh rules from the control plane. */

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAA;CACf;AAMD,qBAAa,YAAY;IAMrB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAT/B,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,WAAW,CAAI;IACvB,OAAO,CAAC,YAAY,CAA8B;gBAG/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,MAAe,EACtB,YAAY,GAAE,MAAsB;IAGvD,sCAAsC;IACtC,KAAK,IAAI,IAAI;IAab,yCAAyC;IACzC,IAAI,IAAI,IAAI;IAOZ,0CAA0C;IAC1C,QAAQ,IAAI,SAAS,OAAO,EAAE;IAI9B,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI;IAiBlE,gDAAgD;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAyB/B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAC7C,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAU1D;AAMD,qBAAa,YAAY;IAyDrB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IA5D/B,OAAO,CAAC,KAAK,CAAgB;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW,CAAe;IAClC,gGAAgG;IAChG,OAAO,CAAC,iBAAiB,CAAe;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,CAAe;IACnC,2EAA2E;IAC3E,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAAe;IACrC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe,CAA8B;IACrD;;;;OAIG;IACH,OAAO,CAAC,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB,CAAyD;IACjF,OAAO,CAAC,WAAW,CAAI;IACvB,OAAO,CAAC,YAAY,CAA8B;gBAG/B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,MAAe,EACtB,YAAY,GAAE,MAAsB;IAGvD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAehD,yCAAyC;IACzC,IAAI,IAAI,IAAI;IAOZ,0CAA0C;IAC1C,QAAQ,IAAI,SAAS,OAAO,EAAE;IAI9B,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB,IAAI,SAAS,MAAM,EAAE;IAIzC,cAAc,IAAI,SAAS,MAAM,EAAE;IAInC,6DAA6D;IAC7D,eAAe,IAAI,SAAS,MAAM,EAAE;IAIpC,mEAAmE;IACnE,iBAAiB,IAAI,SAAS,MAAM,EAAE;IAItC,8DAA8D;IAC9D,2BAA2B,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI/D;;;;;;;OAOG;IACH,kBAAkB,IAAI,MAAM,GAAG,OAAO,GAAG,SAAS;IAIlD,yFAAyF;IACzF,cAAc,IAAI,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS;IAIxD,8EAA8E;IAC9E,mBAAmB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;IAInF,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAmCtB,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI;IAiBlE,gDAAgD;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA6D/B"}