@intutic/mcp-governance-proxy 1.9.0 → 1.10.1

package/README.md

@@ -1,5 +1,7 @@
 # @intutic/mcp-governance-proxy
 
+> Three names, one thing: the directory is `packages/mcp-proxy`, the published package is `@intutic/mcp-governance-proxy`, and the docs page is `/integrations/mcp-proxy`.
+
 > Transparent stdio proxy that intercepts MCP `tools/call` JSON-RPC messages and applies workspace SOP policy before forwarding to real MCP servers.
 
 ## Overview
@@ -26,6 +28,16 @@ Runs as its own MCP server that exposes governance-aware tool wrappers:
 Agent ↔ intutic-mcp-daemon (MCP server)
 ```
 
+### Remote Bridge Mode
+
+Fronts a remote (HTTP/SSE-transport) MCP server instead of a spawned child process. The harness still spawns this proxy as a normal stdio child — no new listener, no new port — but the proxy's upstream side talks to the remote server over HTTP or Server-Sent Events using the MCP SDK's client transports directly:
+
+```
+Agent ↔ intutic-mcp-proxy ↔ Remote MCP Server (HTTP/SSE)
+```
+
+Every governance check proxy mode applies to a stdio server — allowlists, `tools/list` curation, TOFU pinning, DLP redaction, audit events — applies identically here; only the upstream transport differs. See `--remote-url`/`--remote-transport` below.
+
 ## Features
 
 ### DLP Scanning
@@ -78,6 +90,22 @@ npm install @intutic/mcp-governance-proxy
 intutic-mcp-daemon --port 3100
 ```
 
+### Remote Bridge Mode
+
+```json
+{
+  "mcpServers": {
+    "linear": {
+      "command": "intutic-mcp-proxy",
+      "args": ["--remote-url", "https://mcp.linear.app/sse", "--remote-transport", "sse"],
+      "env": { "INTUTIC_REMOTE_HEADERS": "{\"Authorization\":\"Bearer <token>\"}" }
+    }
+  }
+}
+```
+
+`--remote-transport` accepts `sse` or `http` (default `http`, the SDK's current non-deprecated `StreamableHTTPClientTransport`). `--remote-url` and a positional stdio command (`--` followed by a command) are mutually exclusive — pass one or the other. Auth headers ride via the `INTUTIC_REMOTE_HEADERS` environment variable (a JSON object string), never as a CLI argument — argv is visible to any local process via `ps`.
+
 ## Part of Intutic
 
 This package is part of the [Intutic](https://github.com/intutic/intutic) monorepo — an open-core AI governance control plane for developer teams.

package/dist/anomaly/detectors.d.ts

@@ -0,0 +1,129 @@
+/**
+ * anomaly/detectors.ts — The 7 anomaly detectors ported from
+ * `packages/proxy/src/plugins/anomaly/detectors.rs`, confirmed applicable to
+ * MCP tool-call traffic.
+ *
+ * Every threshold, window, marker list, and disposition below was read
+ * directly from `detectors.rs` (and, for `tool_poisoning`, from
+ * `tool_poison.rs`) — none invented. See this package's Phase 2 report for
+ * the verbatim citations.
+ *
+ * # Which 26 were excluded, and why
+ *
+ * `detectors.rs` registers ~26 detectors; this file ports exactly 7. The
+ * rest are excluded for reasons specific to what an MCP stdio proxy can
+ * honestly observe — see the Phase 2 report for the itemized list — not
+ * because they were skipped for time.
+ *
+ * @module
+ */
+import type { ToolsListEntry } from '../session.js';
+export type Disposition = 'steer' | 'reask' | 'kill';
+/** Severity order for sorting/clamping — mirrors `Disposition`'s derived
+ *  `Ord` in mod.rs (`Steer < Reask < Ask < Kill`); this package never uses
+ *  `Ask`, so the four-way order collapses to three. */
+export declare const DISPOSITION_SEVERITY: Readonly<Record<Disposition, number>>;
+export interface AnomalyFinding {
+    /** Stable detector identity — same convention as `AnomalyDetector::id()`. */
+    detectorId: string;
+    /** A taxonomy label, matching (a subset of) `AnomalyKind::as_str()`'s wire values. */
+    kind: string;
+    reason: string;
+    /** 0.0–1.0. */
+    confidence: number;
+    /** The disposition this DETECTOR declares — the Rust-source-verified
+     *  ceiling `mcpAnomalyMode`/per-detector overrides may only ever demote
+     *  from (see `anomaly/index.ts`'s `resolveEffectiveDisposition`). */
+    disposition: Disposition;
+}
+/**
+ * A node calling the same tool over and over — the most common shape of a
+ * graph that has stopped making progress. `Reask` disposition (verified:
+ * `AnomalyFinding::reask` in `ConsecutiveRepeatDetector::detect`).
+ */
+export declare function consecutiveRepeat(seq: readonly string[]): AnomalyFinding | null;
+/**
+ * Two tools handing work back and forth — invisible to `consecutiveRepeat`
+ * because no tool ever repeats twice in a row. `Reask` disposition
+ * (verified).
+ */
+export declare function pingPongCycle(seq: readonly string[]): AnomalyFinding | null;
+/**
+ * Case-folded interning of the tool-name sequence into small integer ids.
+ *
+ * The Rust `anchor_projection` also strips synthesised `action:` tokens
+ * before interning — this proxy has no equivalent token-synthesis machinery
+ * (MCP's `tool_sequence` is recorded tool names only, see `session.ts`), so
+ * every entry here is already a concrete anchor; this function's only job is
+ * the interning itself.
+ */
+export declare function anchorProjection(seq: readonly string[]): {
+    anchors: number[];
+    symbols: string[];
+};
+/**
+ * Repetition that survives one stray call — the gap-tolerant counterpart to
+ * `consecutiveRepeat`/`pingPongCycle`. `Steer` disposition (verified: this
+ * detector "ships steer and may never earn kill under the promotion rule,"
+ * per `detectors.rs`'s own doc comment — `Read → View → Write` repeated
+ * eight times is both a perfect period-3 cycle AND a productive agent
+ * editing eight files, a category error in the signal no threshold fixes).
+ */
+export declare function landmarkCycle(seq: readonly string[]): AnomalyFinding | null;
+/**
+ * A long run drawing on a single tool, possibly interleaved with nothing
+ * else, that still makes no progress. `Steer` disposition, confidence 0.8
+ * (both verified from `ToolDiversityCollapseDetector::detect`).
+ */
+export declare function toolDiversityCollapse(seq: readonly string[]): AnomalyFinding | null;
+/**
+ * One code-execution call bundling what per-call gates would have caught
+ * apart — the in-blob analogue of `secret_read` followed by `http_post`.
+ * Substring markers, deliberately (see `detectors.rs`'s doc comment): an AST
+ * per language is neither cheap nor honestly complete, and a marker's
+ * failure mode (an obfuscated payload slips through) is strictly better than
+ * claiming AST-grade coverage and delivering it for two languages of ten.
+ * `Kill` disposition on both shapes (verified: both branches return
+ * `AnomalyFinding::kill` in `CodeAsActionDetector::detect`).
+ */
+export declare function codeAsAction(toolName: string, toolArguments: unknown): AnomalyFinding | null;
+/**
+ * Runs the five sequence/call-based detectors above against one prospective
+ * request and returns every finding, sorted most-severe-first — mirroring
+ * `DetectorRegistry::evaluate_all`'s own sort (disposition severity;
+ * `AnomalyKind` severity is not ported, since this proxy does not carry that
+ * taxonomy-wide ranking table).
+ */
+export declare function evaluateSequenceDetectors(toolSequence: readonly string[], toolName: string, toolArguments: unknown): AnomalyFinding[];
+/**
+ * Instructions hidden in a tool's DESCRIPTION rather than in conversation
+ * text — a different attack surface from `injection.ts`'s response-direction
+ * scan (which reuses the same 5 conversational patterns Phase 1 ported).
+ * Reads `toolPoison.ts`'s 7-pattern scanner. `Steer` disposition (verified:
+ * `AnomalyFinding::steer` in `ToolPoisoningDetector::detect`) — the Rust
+ * doc's own reasoning for why this steers rather than reasks applies
+ * identically here: the poisoned text belongs to a third-party server's
+ * static tool array, identical on every retry, so a reask would be a
+ * guaranteed three-strike block rather than a correction loop.
+ */
+export declare function toolPoisoning(tools: readonly ToolsListEntry[]): AnomalyFinding | null;
+/**
+ * ≥3 distinct DLP-redacted pattern types in one response is a credential
+ * sweep, not a single mistake. `Kill` in the Rust source (verified:
+ * `AnomalyFinding::kill` in `DlpEscalationDetector::detect`) — but this
+ * proxy deliberately never converts that into a NEW block decision: unlike
+ * the Rust proxy's request-direction detector, this MCP proxy's own DLP scan
+ * ALREADY blocks a request carrying any single finding (interceptor.ts step
+ * 1, unconditionally), so a request-direction escalation gate here would be
+ * unreachable dead code. The place this actually adds value is the RESPONSE
+ * direction, where DLP redacts rather than blocks (the call already ran) —
+ * there, blocking after redaction protects nothing further (the same
+ * reasoning `dlp.ts`'s own module doc gives for why redaction, not
+ * blocking, is correct on results), so this function is consulted for EVENT
+ * SEVERITY escalation only. Declaring its disposition as `'kill'` here is
+ * about honestly recording what the Rust source declares for the
+ * promotion-invariant bookkeeping, not about this proxy ever enforcing it as
+ * a block.
+ */
+export declare function dlpEscalation(distinctPatternDescriptions: readonly string[]): AnomalyFinding | null;
+//# sourceMappingURL=detectors.d.ts.map

package/dist/anomaly/detectors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectors.d.ts","sourceRoot":"","sources":["../../src/anomaly/detectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;AAEpD;;uDAEuD;AACvD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAItE,CAAA;AAED,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,eAAe;IACf,UAAU,EAAE,MAAM,CAAA;IAClB;;yEAEqE;IACrE,WAAW,EAAE,WAAW,CAAA;CACzB;AAkBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CAmB/E;AAOD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CAgB3E;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAajG;AAmCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CA6B3E;AAQD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CAYnF;AAsBD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAuC5F;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,OAAO,GACrB,cAAc,EAAE,CAUlB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,GAAG,IAAI,CAmBrF;AAOD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,2BAA2B,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CAUnG"}

package/dist/anomaly/detectors.js

@@ -0,0 +1,368 @@
+/**
+ * anomaly/detectors.ts — The 7 anomaly detectors ported from
+ * `packages/proxy/src/plugins/anomaly/detectors.rs`, confirmed applicable to
+ * MCP tool-call traffic.
+ *
+ * Every threshold, window, marker list, and disposition below was read
+ * directly from `detectors.rs` (and, for `tool_poisoning`, from
+ * `tool_poison.rs`) — none invented. See this package's Phase 2 report for
+ * the verbatim citations.
+ *
+ * # Which 26 were excluded, and why
+ *
+ * `detectors.rs` registers ~26 detectors; this file ports exactly 7. The
+ * rest are excluded for reasons specific to what an MCP stdio proxy can
+ * honestly observe — see the Phase 2 report for the itemized list — not
+ * because they were skipped for time.
+ *
+ * @module
+ */
+import { scanToolDescription } from '../toolPoison.js';
+/** Severity order for sorting/clamping — mirrors `Disposition`'s derived
+ *  `Ord` in mod.rs (`Steer < Reask < Ask < Kill`); this package never uses
+ *  `Ask`, so the four-way order collapses to three. */
+export const DISPOSITION_SEVERITY = {
+    steer: 1,
+    reask: 2,
+    kill: 3,
+};
+/**
+ * Confidence for a threshold detector, from how far past its threshold it
+ * is. Ported verbatim from `detectors.rs`'s `threshold_confidence`: never
+ * reaches 1.0 (an unmeasured structural threshold has not earned certainty),
+ * starts at 0.55 at the threshold, +0.1 per unit past it, capped at 0.95.
+ */
+function thresholdConfidence(observed, threshold) {
+    const excess = Math.max(0, observed - threshold);
+    return Math.min(0.55 + 0.1 * excess, 0.95);
+}
+// ── consecutive_repeat ──────────────────────────────────────────────────────
+/** Ported from `detectors.rs`'s `REPETITION_THRESHOLD`. */
+const REPETITION_THRESHOLD = 5;
+/**
+ * A node calling the same tool over and over — the most common shape of a
+ * graph that has stopped making progress. `Reask` disposition (verified:
+ * `AnomalyFinding::reask` in `ConsecutiveRepeatDetector::detect`).
+ */
+export function consecutiveRepeat(seq) {
+    let run = 1;
+    for (let i = 1; i < seq.length; i++) {
+        if (seq[i] === seq[i - 1]) {
+            run += 1;
+            if (run >= REPETITION_THRESHOLD) {
+                return {
+                    detectorId: 'consecutive_repeat',
+                    kind: 'loop_detected',
+                    reason: `Loop detected: '${seq[i]}' called ${run} times consecutively without progress`,
+                    confidence: thresholdConfidence(run, REPETITION_THRESHOLD),
+                    disposition: 'reask',
+                };
+            }
+        }
+        else {
+            run = 1;
+        }
+    }
+    return null;
+}
+// ── ping_pong_cycle ──────────────────────────────────────────────────────
+/** Ported from `detectors.rs`'s `PING_PONG_CYCLES`. */
+const PING_PONG_CYCLES = 3;
+/**
+ * Two tools handing work back and forth — invisible to `consecutiveRepeat`
+ * because no tool ever repeats twice in a row. `Reask` disposition
+ * (verified).
+ */
+export function pingPongCycle(seq) {
+    const needed = PING_PONG_CYCLES * 2;
+    if (seq.length < needed)
+        return null;
+    const tail = seq.slice(seq.length - needed);
+    const a = tail[0];
+    const b = tail[1];
+    if (a === b)
+        return null; // that is a spin, not an alternation
+    const alternating = tail.every((t, i) => (i % 2 === 0 ? t === a : t === b));
+    if (!alternating)
+        return null;
+    return {
+        detectorId: 'ping_pong_cycle',
+        kind: 'loop_detected',
+        reason: `Loop detected: '${a}' and '${b}' alternating for ${PING_PONG_CYCLES} cycles with no other activity`,
+        confidence: thresholdConfidence(PING_PONG_CYCLES, PING_PONG_CYCLES),
+        disposition: 'reask',
+    };
+}
+// ── landmark_cycle ──────────────────────────────────────────────────────
+// All six constants below are ported verbatim from `detectors.rs` — see that
+// file's own extensive doc comments (LANDMARK_WINDOW/MAX_CYCLE_PERIOD are
+// deliberately coupled: 6 * MIN_CYCLE_REPEATS(4) == 24 == LANDMARK_WINDOW).
+const LANDMARK_WINDOW = 24;
+const MIN_LANDMARK_ANCHORS = 8;
+const MAX_CYCLE_PERIOD = 6;
+const MIN_CYCLE_REPEATS = 4;
+const CYCLE_COVERAGE_FLOOR = 0.75;
+const CYCLE_MATCH_RATIO = 0.75;
+const ANCHOR_FREQ_SLOTS = 256;
+/**
+ * Case-folded interning of the tool-name sequence into small integer ids.
+ *
+ * The Rust `anchor_projection` also strips synthesised `action:` tokens
+ * before interning — this proxy has no equivalent token-synthesis machinery
+ * (MCP's `tool_sequence` is recorded tool names only, see `session.ts`), so
+ * every entry here is already a concrete anchor; this function's only job is
+ * the interning itself.
+ */
+export function anchorProjection(seq) {
+    const symbols = [];
+    const anchors = [];
+    for (const tok of seq) {
+        const lower = tok.toLowerCase();
+        let id = symbols.findIndex((s) => s.toLowerCase() === lower);
+        if (id === -1) {
+            symbols.push(tok);
+            id = symbols.length - 1;
+        }
+        anchors.push(Math.min(id, 0xffff));
+    }
+    return { anchors, symbols };
+}
+/** Ported from `detectors.rs`'s `landmark_cycle_coverage`. */
+function landmarkCycleCoverage(seq) {
+    const { anchors, symbols } = anchorProjection(seq);
+    if (anchors.length < MIN_LANDMARK_ANCHORS)
+        return null;
+    const window = anchors.slice(Math.max(0, anchors.length - LANDMARK_WINDOW));
+    const freq = new Array(ANCHOR_FREQ_SLOTS).fill(0);
+    for (const id of window) {
+        const slot = id % ANCHOR_FREQ_SLOTS;
+        freq[slot] = (freq[slot] ?? 0) + 1;
+    }
+    const survivors = window.filter((id) => (freq[id % ANCHOR_FREQ_SLOTS] ?? 0) > 1);
+    if (survivors.length < MIN_LANDMARK_ANCHORS)
+        return null;
+    return { coverage: survivors.length / window.length, windowLen: window.length, survivors, symbols };
+}
+/** Ported from `detectors.rs`'s `describe_cycle`. */
+function describeCycle(symbols, survivors, period) {
+    if (survivors.length < period)
+        return '';
+    return survivors
+        .slice(survivors.length - period)
+        .map((id) => symbols[id] ?? '?')
+        .join(' → ');
+}
+/**
+ * Repetition that survives one stray call — the gap-tolerant counterpart to
+ * `consecutiveRepeat`/`pingPongCycle`. `Steer` disposition (verified: this
+ * detector "ships steer and may never earn kill under the promotion rule,"
+ * per `detectors.rs`'s own doc comment — `Read → View → Write` repeated
+ * eight times is both a perfect period-3 cycle AND a productive agent
+ * editing eight files, a category error in the signal no threshold fixes).
+ */
+export function landmarkCycle(seq) {
+    const sample = landmarkCycleCoverage(seq);
+    if (!sample || sample.coverage < CYCLE_COVERAGE_FLOOR)
+        return null;
+    const { windowLen, survivors, symbols } = sample;
+    const n = survivors.length;
+    for (let p = 1; p <= MAX_CYCLE_PERIOD; p++) {
+        if (n < Math.max(MIN_LANDMARK_ANCHORS, p * MIN_CYCLE_REPEATS))
+            continue;
+        const comparable = n - p;
+        if (comparable === 0)
+            continue;
+        let matches = 0;
+        for (let i = p; i < n; i++) {
+            if (survivors[i] === survivors[i - p])
+                matches += 1;
+        }
+        const score = matches / comparable;
+        if (score < CYCLE_MATCH_RATIO)
+            continue;
+        const cycle = describeCycle(symbols, survivors, p);
+        return {
+            detectorId: 'landmark_cycle',
+            kind: 'loop_detected',
+            reason: `Loop detected: ${survivors.length} of the last ${windowLen} concrete tool calls are ` +
+                `repeating on a period of ${p} (${cycle}), matching ${(score * 100).toFixed(0)}% of the time`,
+            confidence: score,
+            disposition: 'steer',
+        };
+    }
+    return null;
+}
+// ── tool_diversity_collapse ──────────────────────────────────────────────
+/** Ported from `detectors.rs`'s `DIVERSITY_WINDOW` / `DIVERSITY_MIN_DISTINCT`. */
+const DIVERSITY_WINDOW = 10;
+const DIVERSITY_MIN_DISTINCT = 2;
+/**
+ * A long run drawing on a single tool, possibly interleaved with nothing
+ * else, that still makes no progress. `Steer` disposition, confidence 0.8
+ * (both verified from `ToolDiversityCollapseDetector::detect`).
+ */
+export function toolDiversityCollapse(seq) {
+    if (seq.length < DIVERSITY_WINDOW)
+        return null;
+    const tail = seq.slice(seq.length - DIVERSITY_WINDOW);
+    const distinct = new Set(tail);
+    if (distinct.size >= DIVERSITY_MIN_DISTINCT)
+        return null;
+    return {
+        detectorId: 'tool_diversity_collapse',
+        kind: 'token_waste',
+        reason: `No progress: the last ${DIVERSITY_WINDOW} tool calls used only '${tail[0]}'`,
+        confidence: 0.8,
+        disposition: 'steer',
+    };
+}
+// ── code_as_action ──────────────────────────────────────────────────────
+// Ported verbatim from `detectors.rs`'s four marker arrays.
+const CODE_EXECUTION_TOOL_MARKERS = [
+    'bash', 'shell', 'exec', 'python', 'repl', 'run_code', 'code_interpreter', 'jupyter', 'terminal', 'eval',
+];
+const CODE_SECRET_ACCESS_MARKERS = [
+    '.aws/credentials', 'id_rsa', '.ssh/', '.env', 'aws_secret_access_key',
+    'getenv("anthropic', 'getenv("openai', 'getenv("aws',
+    'process.env.anthropic', 'process.env.openai', 'process.env.aws',
+    'keychain', 'secretsmanager',
+];
+const CODE_EGRESS_MARKERS = [
+    'curl ', 'wget ', 'http.post', 'requests.post', 'requests.put', 'fetch(', 'urlopen',
+    'httpx.', 'nc ', 'netcat', 'scp ', 'rsync ',
+];
+const CODE_DESTRUCTIVE_MARKERS = [
+    'rm -rf /', 'rm -fr /', 'mkfs', 'dd if=', ' of=/dev/', ':(){', '> /dev/sda',
+];
+/**
+ * One code-execution call bundling what per-call gates would have caught
+ * apart — the in-blob analogue of `secret_read` followed by `http_post`.
+ * Substring markers, deliberately (see `detectors.rs`'s doc comment): an AST
+ * per language is neither cheap nor honestly complete, and a marker's
+ * failure mode (an obfuscated payload slips through) is strictly better than
+ * claiming AST-grade coverage and delivering it for two languages of ten.
+ * `Kill` disposition on both shapes (verified: both branches return
+ * `AnomalyFinding::kill` in `CodeAsActionDetector::detect`).
+ */
+export function codeAsAction(toolName, toolArguments) {
+    const name = toolName.toLowerCase();
+    if (!CODE_EXECUTION_TOOL_MARKERS.some((m) => name.includes(m)))
+        return null;
+    let code;
+    try {
+        code = JSON.stringify(toolArguments ?? {}).toLowerCase();
+    }
+    catch {
+        return null; // circular/unserializable arguments — nothing to scan
+    }
+    const destructive = CODE_DESTRUCTIVE_MARKERS.find((m) => code.includes(m));
+    if (destructive) {
+        return {
+            detectorId: 'code_as_action',
+            kind: 'tool_abuse',
+            reason: `Code-execution call '${toolName}' contains a destructive operation ('${destructive.trim()}'). ` +
+                `Per-call gates cannot see inside a code blob; this one was read.`,
+            confidence: 1.0,
+            disposition: 'kill',
+        };
+    }
+    const secretAccess = CODE_SECRET_ACCESS_MARKERS.find((m) => code.includes(m));
+    const egress = CODE_EGRESS_MARKERS.find((m) => code.includes(m));
+    if (secretAccess && egress) {
+        return {
+            detectorId: 'code_as_action',
+            kind: 'data_exfiltration',
+            reason: `Code-execution call '${toolName}' bundles credential access ('${secretAccess}') with network ` +
+                `egress ('${egress.trim()}') in one blob — the in-code shape of secret_read -> http_post, which ` +
+                `the succession detector cannot see because both halves are inside a single call.`,
+            confidence: 1.0,
+            disposition: 'kill',
+        };
+    }
+    return null;
+}
+/**
+ * Runs the five sequence/call-based detectors above against one prospective
+ * request and returns every finding, sorted most-severe-first — mirroring
+ * `DetectorRegistry::evaluate_all`'s own sort (disposition severity;
+ * `AnomalyKind` severity is not ported, since this proxy does not carry that
+ * taxonomy-wide ranking table).
+ */
+export function evaluateSequenceDetectors(toolSequence, toolName, toolArguments) {
+    const findings = [
+        consecutiveRepeat(toolSequence),
+        pingPongCycle(toolSequence),
+        landmarkCycle(toolSequence),
+        toolDiversityCollapse(toolSequence),
+        codeAsAction(toolName, toolArguments),
+    ].filter((f) => f !== null);
+    findings.sort((a, b) => DISPOSITION_SEVERITY[b.disposition] - DISPOSITION_SEVERITY[a.disposition]);
+    return findings;
+}
+// ── tool_poisoning ──────────────────────────────────────────────────────
+/**
+ * Instructions hidden in a tool's DESCRIPTION rather than in conversation
+ * text — a different attack surface from `injection.ts`'s response-direction
+ * scan (which reuses the same 5 conversational patterns Phase 1 ported).
+ * Reads `toolPoison.ts`'s 7-pattern scanner. `Steer` disposition (verified:
+ * `AnomalyFinding::steer` in `ToolPoisoningDetector::detect`) — the Rust
+ * doc's own reasoning for why this steers rather than reasks applies
+ * identically here: the poisoned text belongs to a third-party server's
+ * static tool array, identical on every retry, so a reask would be a
+ * guaranteed three-strike block rather than a correction loop.
+ */
+export function toolPoisoning(tools) {
+    const hits = [];
+    for (const tool of tools) {
+        if (!tool.description)
+            continue;
+        for (const technique of scanToolDescription(tool.description)) {
+            hits.push(`${tool.name}: ${technique}`);
+        }
+    }
+    if (hits.length === 0)
+        return null;
+    const deduped = Array.from(new Set(hits)).sort();
+    return {
+        detectorId: 'tool_poisoning',
+        kind: 'prompt_injection',
+        reason: `Tool description carries model-directed instructions (${deduped.join('; ')}). The description ` +
+            `reaches the model unchanged — this is a report, not a block.`,
+        confidence: 0.6,
+        disposition: 'steer',
+    };
+}
+// ── dlp_escalation ──────────────────────────────────────────────────────
+/** Ported from `detectors.rs`'s `DLP_ESCALATION_THRESHOLD`. */
+const DLP_ESCALATION_THRESHOLD = 3;
+/**
+ * ≥3 distinct DLP-redacted pattern types in one response is a credential
+ * sweep, not a single mistake. `Kill` in the Rust source (verified:
+ * `AnomalyFinding::kill` in `DlpEscalationDetector::detect`) — but this
+ * proxy deliberately never converts that into a NEW block decision: unlike
+ * the Rust proxy's request-direction detector, this MCP proxy's own DLP scan
+ * ALREADY blocks a request carrying any single finding (interceptor.ts step
+ * 1, unconditionally), so a request-direction escalation gate here would be
+ * unreachable dead code. The place this actually adds value is the RESPONSE
+ * direction, where DLP redacts rather than blocks (the call already ran) —
+ * there, blocking after redaction protects nothing further (the same
+ * reasoning `dlp.ts`'s own module doc gives for why redaction, not
+ * blocking, is correct on results), so this function is consulted for EVENT
+ * SEVERITY escalation only. Declaring its disposition as `'kill'` here is
+ * about honestly recording what the Rust source declares for the
+ * promotion-invariant bookkeeping, not about this proxy ever enforcing it as
+ * a block.
+ */
+export function dlpEscalation(distinctPatternDescriptions) {
+    const distinct = Array.from(new Set(distinctPatternDescriptions)).sort();
+    if (distinct.length < DLP_ESCALATION_THRESHOLD)
+        return null;
+    return {
+        detectorId: 'dlp_escalation',
+        kind: 'data_exfiltration',
+        reason: `Credential sweep: ${distinct.length} distinct sensitive patterns in one response (${distinct.join(', ')})`,
+        confidence: 1.0,
+        disposition: 'kill',
+    };
+}
+//# sourceMappingURL=detectors.js.map

package/dist/anomaly/detectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectors.js","sourceRoot":"","sources":["../../src/anomaly/detectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAKtD;;uDAEuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAA0C;IACzE,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;CACR,CAAA;AAgBD;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,QAAgB,EAAE,SAAiB;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAA;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,CAAA;AAC5C,CAAC;AAED,+EAA+E;AAE/E,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAE9B;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1B,GAAG,IAAI,CAAC,CAAA;YACR,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;gBAChC,OAAO;oBACL,UAAU,EAAE,oBAAoB;oBAChC,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,mBAAmB,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,uCAAuC;oBACvF,UAAU,EAAE,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,CAAC;oBAC1D,WAAW,EAAE,OAAO;iBACrB,CAAA;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,CAAC,CAAA;QACT,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4EAA4E;AAE5E,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAsB;IAClD,MAAM,MAAM,GAAG,gBAAgB,GAAG,CAAC,CAAA;IACnC,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,qCAAqC;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3E,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,mBAAmB,CAAC,UAAU,CAAC,qBAAqB,gBAAgB,gCAAgC;QAC5G,UAAU,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QACnE,WAAW,EAAE,OAAO;KACrB,CAAA;AACH,CAAC;AAED,2EAA2E;AAE3E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,EAAE,CAAA;AAC1B,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAC9B,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAC1B,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAC3B,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACjC,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAC9B,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAE7B;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAA;QAC5D,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjB,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;QACzB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC;AASD,8DAA8D;AAC9D,SAAS,qBAAqB,CAAC,GAAsB;IACnD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAA;IAE3E,MAAM,IAAI,GAAG,IAAI,KAAK,CAAS,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,EAAE,GAAG,iBAAiB,CAAA;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAChF,IAAI,SAAS,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAA;IAExD,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AACrG,CAAC;AAED,qDAAqD;AACrD,SAAS,aAAa,CAAC,OAA0B,EAAE,SAA4B,EAAE,MAAc;IAC7F,IAAI,SAAS,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,EAAE,CAAA;IACxC,OAAO,SAAS;SACb,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;SAChC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC;SAC/B,IAAI,CAAC,KAAK,CAAC,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAsB;IAClD,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAA;IAClE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,CAAA;IAChD,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAA;IAE1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,GAAG,iBAAiB,CAAC;YAAE,SAAQ;QACvE,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,UAAU,KAAK,CAAC;YAAE,SAAQ;QAC9B,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,GAAG,UAAU,CAAA;QAClC,IAAI,KAAK,GAAG,iBAAiB;YAAE,SAAQ;QAEvC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO;YACL,UAAU,EAAE,gBAAgB;YAC5B,IAAI,EAAE,eAAe;YACrB,MAAM,EACJ,kBAAkB,SAAS,CAAC,MAAM,gBAAgB,SAAS,2BAA2B;gBACtF,4BAA4B,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;YAC/F,UAAU,EAAE,KAAK;YACjB,WAAW,EAAE,OAAO;SACrB,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4EAA4E;AAE5E,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEhC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAsB;IAC1D,IAAI,GAAG,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,IAAI,CAAA;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,QAAQ,CAAC,IAAI,IAAI,sBAAsB;QAAE,OAAO,IAAI,CAAA;IACxD,OAAO;QACL,UAAU,EAAE,yBAAyB;QACrC,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,yBAAyB,gBAAgB,0BAA0B,IAAI,CAAC,CAAC,CAAC,GAAG;QACrF,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,OAAO;KACrB,CAAA;AACH,CAAC;AAED,2EAA2E;AAE3E,4DAA4D;AAC5D,MAAM,2BAA2B,GAAG;IAClC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM;CAChG,CAAA;AACV,MAAM,0BAA0B,GAAG;IACjC,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,uBAAuB;IACtE,mBAAmB,EAAE,gBAAgB,EAAE,aAAa;IACpD,uBAAuB,EAAE,oBAAoB,EAAE,iBAAiB;IAChE,UAAU,EAAE,gBAAgB;CACpB,CAAA;AACV,MAAM,mBAAmB,GAAG;IAC1B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS;IACnF,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;CACnC,CAAA;AACV,MAAM,wBAAwB,GAAG;IAC/B,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY;CACnE,CAAA;AAEV;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,aAAsB;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IACnC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE3E,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA,CAAC,sDAAsD;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,UAAU,EAAE,gBAAgB;YAC5B,IAAI,EAAE,YAAY;YAClB,MAAM,EACJ,wBAAwB,QAAQ,wCAAwC,WAAW,CAAC,IAAI,EAAE,MAAM;gBAChG,kEAAkE;YACpE,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,MAAM;SACpB,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAChE,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO;YACL,UAAU,EAAE,gBAAgB;YAC5B,IAAI,EAAE,mBAAmB;YACzB,MAAM,EACJ,wBAAwB,QAAQ,iCAAiC,YAAY,kBAAkB;gBAC/F,YAAY,MAAM,CAAC,IAAI,EAAE,wEAAwE;gBACjG,kFAAkF;YACpF,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,MAAM;SACpB,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAA+B,EAC/B,QAAgB,EAChB,aAAsB;IAEtB,MAAM,QAAQ,GAAG;QACf,iBAAiB,CAAC,YAAY,CAAC;QAC/B,aAAa,CAAC,YAAY,CAAC;QAC3B,aAAa,CAAC,YAAY,CAAC;QAC3B,qBAAqB,CAAC,YAAY,CAAC;QACnC,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC;KACtC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAuB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAChD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;IAClG,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,2EAA2E;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,SAAQ;QAC/B,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAChD,OAAO;QACL,UAAU,EAAE,gBAAgB;QAC5B,IAAI,EAAE,kBAAkB;QACxB,MAAM,EACJ,yDAAyD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB;YAChG,8DAA8D;QAChE,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,OAAO;KACrB,CAAA;AACH,CAAC;AAED,2EAA2E;AAE3E,+DAA+D;AAC/D,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAElC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAAC,2BAA8C;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACxE,IAAI,QAAQ,CAAC,MAAM,GAAG,wBAAwB;QAAE,OAAO,IAAI,CAAA;IAC3D,OAAO;QACL,UAAU,EAAE,gBAAgB;QAC5B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,qBAAqB,QAAQ,CAAC,MAAM,iDAAiD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACnH,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,MAAM;KACpB,CAAA;AACH,CAAC"}

package/dist/anomaly/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * anomaly/index.ts — Public entry point for Phase 2 anomaly detection:
+ * disposition resolution (the config promotion-invariant) and the reask
+ * escalation constant, layered on top of `detectors.ts`'s pure detector
+ * functions.
+ *
+ * @module
+ */
+import type { AnomalyFinding, Disposition } from './detectors.js';
+export * from './detectors.js';
+/**
+ * Ported from `packages/proxy/src/plugins/anomaly/mod.rs`'s
+ * `REASK_MAX_ATTEMPTS` (confirmed: `pub const REASK_MAX_ATTEMPTS: u32 = 3;`).
+ * How many times one session may trip the same reask finding before it
+ * hardens into an unconditional block.
+ */
+export declare const REASK_MAX_ATTEMPTS = 3;
+/**
+ * The Rust-source-declared disposition CEILING for each of the 7 ported
+ * detectors — copied from the `disposition` field each `detectors.ts`
+ * function's own finding already carries, restated here as a lookup table
+ * so `resolveEffectiveDisposition` can validate a config override against it
+ * even when no finding fired yet (an `'off'` override skips evaluation
+ * entirely — see `resolveEffectiveDisposition`).
+ */
+export declare const DETECTOR_BASE_DISPOSITION: Readonly<Record<string, Disposition>>;
+export type AnomalyMode = 'enforce' | 'warn' | 'off';
+/**
+ * Resolves the EFFECTIVE disposition for one finding, honoring:
+ *
+ * 1. `mode: 'off'` — this detector class is disabled outright (caller should
+ *    skip evaluation before this is even called, but `'off'` is handled here
+ *    too as a defensive floor).
+ * 2. `mode: 'warn'` — every finding is capped at `'steer'` (report, never
+ *    block), regardless of what the detector itself declared.
+ * 3. A per-detector override (`mcpAnomalyOverrides`) — capped at
+ *    `min(override, the detector's own Rust-declared disposition)`.
+ *
+ * **The invariant this function exists to enforce, mirrored from
+ * `plugins/anomaly/mod.rs`'s promotion rule**: config may only ever DEMOTE a
+ * finding toward `steer`/`off`, never promote it past what
+ * `DETECTOR_BASE_DISPOSITION` (or, equivalently, `finding.disposition`
+ * itself — the two must always agree, since `detectors.ts` never emits a
+ * disposition other than each function's declared one) already declares. An
+ * override of `'kill'` on `landmark_cycle` (whose Rust source only ever
+ * disposes `steer`) has no effect — `min(kill, steer) = steer` — because the
+ * Rust proxy has never measured `landmark_cycle`'s false-positive rate at
+ * `kill` severity, and this proxy inherits that same unmeasured status
+ * rather than re-deciding it locally.
+ */
+export declare function resolveEffectiveDisposition(finding: AnomalyFinding, mode: AnomalyMode, overrides: Readonly<Record<string, Disposition | 'off'>>): Disposition | 'off';
+//# sourceMappingURL=index.d.ts.map

package/dist/anomaly/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/anomaly/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjE,cAAc,gBAAgB,CAAA;AAE9B;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAA;AAEnC;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAQ3E,CAAA;AAID,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;AAEpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAAC,CAAC,GACvD,WAAW,GAAG,KAAK,CAarB"}