@intutic/mcp-governance-proxy 1.9.0 → 1.10.1

package/dist/daemon/telemetryBatcher.js

@@ -13,6 +13,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { Redis } from 'ioredis';
+import { describeConnectionError } from '../valkeyErrors.js';
 import { createLogger } from '@intutic/logger';
 const logger = createLogger('mcp-proxy.telemetryBatcher');
 const CP_URL = process.env['CONTROL_PLANE_URL'] ?? 'http://localhost:3001';
@@ -26,7 +27,7 @@ const valkey = new Redis(VALKEY_URL, {
     maxRetriesPerRequest: 3,
 });
 valkey.on('error', (err) => {
-    logger.warn({ err: err.message }, 'telemetryBatcher Valkey connection error');
+    logger.warn({ err: describeConnectionError(err) }, 'telemetryBatcher Valkey connection error');
 });
 const daemonId = process.pid.toString();
 const ring = [];
@@ -38,16 +39,31 @@ export function enqueueEvent(event) {
         ring.shift();
     ring.push(event);
 }
+/** Events awaiting the next flush. Reported upstream by the status reporter. */
+export function pendingCount() {
+    return ring.length;
+}
 async function flush() {
     if (isFlushing || ring.length === 0)
         return;
     isFlushing = true;
-    const batch = ring.splice(0, ring.length);
+    try {
+        await flushBatch(ring.splice(0, ring.length));
+    }
+    finally {
+        // Held in a finally because `isFlushing` is a latch, not a flag: the one
+        // path that can still throw past the handlers below is `new URL(CP_URL)`
+        // on a CONTROL_PLANE_URL with no scheme, and leaving the latch set there
+        // would silently retire the flush timer for the life of the daemon.
+        isFlushing = false;
+    }
+}
+async function flushBatch(batch) {
     const body = JSON.stringify({ events: batch });
     const url = new URL('/api/v1/hook-events', CP_URL);
     const isHttps = url.protocol === 'https:';
     const lib = isHttps ? https : http;
-    const tryUpload = (attempt) => new Promise((resolve, reject) => {
+    const tryUpload = () => new Promise((resolve, reject) => {
         const req = lib.request({ hostname: url.hostname, port: url.port, path: url.pathname, method: 'POST',
             headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body),
                 'Authorization': `Bearer ${DAEMON_API_KEY}` } }, (res) => {
@@ -65,7 +81,7 @@ async function flush() {
     let success = false;
     for (let i = 0; i < 3; i++) {
         try {
-            await tryUpload(i);
+            await tryUpload();
             success = true;
             break;
         }
@@ -82,11 +98,16 @@ async function flush() {
             logger.warn({ count: batch.length }, 'telemetry.flush_failed_buffered_to_valkey');
         }
         catch (valkeyErr) {
-            // Fallback: local disk buffer
+            // Fallback: local disk buffer. The Valkey failure is reported on the
+            // disk-fallback line rather than dropped — it is the reason this branch
+            // ran at all, and without it the log says only "wrote to disk".
+            const valkeyError = valkeyErr instanceof Error
+                ? describeConnectionError(valkeyErr)
+                : String(valkeyErr);
             try {
                 fs.mkdirSync(path.dirname(DISK_BUFFER), { recursive: true, mode: 0o700 });
                 fs.appendFileSync(DISK_BUFFER, batch.map(e => JSON.stringify(e)).join('\n') + '\n', { mode: 0o600 });
-                logger.warn({ count: batch.length }, 'telemetry.flush_failed_buffered_to_disk');
+                logger.warn({ valkeyError, count: batch.length }, 'telemetry.flush_failed_buffered_to_disk');
             }
             catch (diskErr) {
                 logger.error({ diskErr, count: batch.length }, 'telemetry.disk_buffer_failed');
@@ -96,7 +117,6 @@ async function flush() {
     else {
         logger.debug({ count: batch.length }, 'telemetry.flushed');
     }
-    isFlushing = false;
 }
 /** Drains any Valkey or disk buffer from a previous crash, then starts the flush timer. */
 export function startBatcher() {
@@ -108,7 +128,12 @@ export function startBatcher() {
                 try {
                     enqueueEvent(JSON.parse(line));
                 }
-                catch { }
+                catch {
+                    // Unparseable buffer entry (truncated by a crash mid-rpush, or
+                    // written by an older event schema). Drop the single bad line rather
+                    // than lose the rest of the recovered batch — telemetry is
+                    // best-effort and the buffer is deleted below regardless.
+                }
             }
             await valkey.del(key);
             logger.info({ count: lines.length }, 'telemetry.valkey_buffer_drained');
@@ -122,22 +147,40 @@ export function startBatcher() {
                 try {
                     enqueueEvent(JSON.parse(line));
                 }
-                catch { }
+                catch {
+                    // Unparseable NDJSON line — the last record is routinely truncated
+                    // when the daemon was killed mid-append. Drop the bad line and keep
+                    // draining the rest of the file.
+                }
             }
             fs.unlinkSync(DISK_BUFFER);
             logger.info({ count: lines.length }, 'telemetry.disk_buffer_drained');
         }
     }
-    catch { }
-    flushTimer = setInterval(() => { void flush(); }, FLUSH_MS);
+    catch (err) {
+        // The buffer file vanished between existsSync and readFileSync, or is
+        // unreadable, or the unlink failed. Startup must not fail over recovery of
+        // best-effort telemetry, so the daemon carries on either way. Note the
+        // unlink case leaves the file behind, so those events are re-enqueued (and
+        // re-delivered) on the next start; duplicate hook events are tolerable,
+        // blocking daemon startup is not.
+        logger.warn({ err }, 'telemetry.disk_buffer_drain_failed');
+    }
+    flushTimer = setInterval(() => {
+        // Nothing awaits this tick, so an escaping rejection is an unhandled one
+        // every FLUSH_MS. Telemetry is best-effort; log and keep the timer alive.
+        void flush().catch((err) => logger.error({ err }, 'telemetry.flush_failed'));
+    }, FLUSH_MS);
     flushTimer.unref();
 }
-/** Flushes remaining events and stops the timer. */
+/** Flushes remaining events and stops the timer. Never rejects. */
 export async function stopBatcher() {
     if (flushTimer) {
         clearInterval(flushTimer);
         flushTimer = null;
     }
-    await flush();
+    // Shutdown must not be blocked by a final flush that throws: the caller is a
+    // signal handler that has to reach process.exit().
+    await flush().catch((err) => logger.error({ err }, 'telemetry.final_flush_failed'));
 }
 //# sourceMappingURL=telemetryBatcher.js.map

package/dist/daemon/telemetryBatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"telemetryBatcher.js","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAS,SAAS,CAAA;AAC3B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAS,SAAS,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAA;AAEzD,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAiB,uBAAuB,CAAA;AAChG,MAAM,cAAc,GAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAmB,EAAE,CAAA;AAC3E,MAAM,QAAQ,GAAU,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5F,MAAM,aAAa,GAAK,GAAG,CAAA;AAC3B,MAAM,WAAW,GAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAA;AAEtF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAA;AACpG,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE;IACnC,WAAW,EAAE,IAAI;IACjB,oBAAoB,EAAE,CAAC;CACxB,CAAC,CAAA;AAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;IAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0CAA0C,CAAC,CAAA;AAC/E,CAAC,CAAC,CAAA;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;AAWvC,MAAM,IAAI,GAAgB,EAAE,CAAA;AAC5B,IAAI,UAAU,GAA0C,IAAI,CAAA;AAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;AAEtB,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,IAAI,IAAI,CAAC,MAAM,IAAI,aAAa;QAAE,IAAI,CAAC,KAAK,EAAE,CAAA;IAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAC3C,UAAU,GAAG,IAAI,CAAA;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEzC,MAAM,IAAI,GAAK,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,MAAM,GAAG,GAAM,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACzC,MAAM,GAAG,GAAM,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAErC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM;YAC1E,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC7E,eAAe,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC5D,CAAC,GAAG,EAAE,EAAE;YACN,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBAAE,OAAO,EAAE,CAAA;;gBAChD,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QAClD,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IAEF,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,MAAK;QAAC,CAAC;QACjD,MAAM,CAAC;YAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0BAA0B;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,2BAA2B,QAAQ,EAAE,CAAA;YACjD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7D,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,aAAa;YAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,SAAc,EAAE,CAAC;YACxB,8BAA8B;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACzE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpG,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,yCAAyC,CAAC,CAAA;YACjF,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAA;YAChF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAC5D,CAAC;IACD,UAAU,GAAG,KAAK,CAAA;AACpB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY;IAC1B,sBAAsB;IACtB,MAAM,GAAG,GAAG,2BAA2B,QAAQ,EAAE,CAAA;IACjD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;QACvD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YAC9D,CAAC;YACD,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACzE,CAAC;IACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAElB,oBAAoB;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACrF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YAC9D,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAA,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC1D,UAAU,CAAC,KAAK,EAAE,CAAA;AACpB,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,UAAU,EAAE,CAAC;QAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAAC,UAAU,GAAG,IAAI,CAAA;IAAC,CAAC;IAChE,MAAM,KAAK,EAAE,CAAA;AACf,CAAC"}
+{"version":3,"file":"telemetryBatcher.js","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAS,SAAS,CAAA;AAC3B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAS,SAAS,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAA;AAEzD,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAiB,uBAAuB,CAAA;AAChG,MAAM,cAAc,GAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAmB,EAAE,CAAA;AAC3E,MAAM,QAAQ,GAAU,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5F,MAAM,aAAa,GAAK,GAAG,CAAA;AAC3B,MAAM,WAAW,GAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAA;AAEtF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAA;AACpG,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE;IACnC,WAAW,EAAE,IAAI;IACjB,oBAAoB,EAAE,CAAC;CACxB,CAAC,CAAA;AAGF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;IAChC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAA;AAChG,CAAC,CAAC,CAAA;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;AAWvC,MAAM,IAAI,GAAgB,EAAE,CAAA;AAC5B,IAAI,UAAU,GAA0C,IAAI,CAAA;AAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;AAEtB,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,IAAI,IAAI,CAAC,MAAM,IAAI,aAAa;QAAE,IAAI,CAAC,KAAK,EAAE,CAAA;IAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,MAAM,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAC3C,UAAU,GAAG,IAAI,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/C,CAAC;YAAS,CAAC;QACT,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,UAAU,GAAG,KAAK,CAAA;IACpB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAkB;IAC1C,MAAM,IAAI,GAAK,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,MAAM,GAAG,GAAM,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACzC,MAAM,GAAG,GAAM,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAErC,MAAM,SAAS,GAAG,GAAkB,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM;YAC1E,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC7E,eAAe,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC5D,CAAC,GAAG,EAAE,EAAE;YACN,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBAAE,OAAO,EAAE,CAAA;;gBAChD,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QAClD,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IAEF,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,MAAM,SAAS,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,MAAK;QAAC,CAAC;QAChD,MAAM,CAAC;YAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0BAA0B;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,2BAA2B,QAAQ,EAAE,CAAA;YACjD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7D,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,aAAa;YAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,SAAkB,EAAE,CAAC;YAC5B,qEAAqE;YACrE,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,WAAW,GAAG,SAAS,YAAY,KAAK;gBAC5C,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACrB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACzE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpG,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,yCAAyC,CAAC,CAAA;YAC9F,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAA;YAChF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY;IAC1B,sBAAsB;IACtB,MAAM,GAAG,GAAG,2BAA2B,QAAQ,EAAE,CAAA;IACjD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;QACvD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;oBAC/D,qEAAqE;oBACrE,2DAA2D;oBAC3D,0DAA0D;gBAC5D,CAAC;YACH,CAAC;YACD,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACzE,CAAC;IACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAElB,oBAAoB;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACrF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,oEAAoE;oBACpE,iCAAiC;gBACnC,CAAC;YACH,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAC5D,CAAC;IAED,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5B,yEAAyE;QACzE,0EAA0E;QAC1E,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAA;IACvF,CAAC,EAAE,QAAQ,CAAC,CAAA;IACZ,UAAU,CAAC,KAAK,EAAE,CAAA;AACpB,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,UAAU,EAAE,CAAC;QAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAAC,UAAU,GAAG,IAAI,CAAA;IAAC,CAAC;IAChE,6EAA6E;IAC7E,mDAAmD;IACnD,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAA;AAC9F,CAAC"}

package/dist/daemonClient.d.ts

@@ -1,5 +1,5 @@
 /**
  * Sends a JSON-RPC request to the mcp-daemon Unix domain socket.
  */
-export declare function callDaemonSocket(method: string, params: Record<string, unknown>): Promise<any>;
+export declare function callDaemonSocket<T = unknown>(method: string, params: Record<string, unknown>): Promise<T>;
 //# sourceMappingURL=daemonClient.d.ts.map

package/dist/daemonClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemonClient.d.ts","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAkBA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAiD9F"}
+{"version":3,"file":"daemonClient.d.ts","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAeA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAiDZ"}

package/dist/daemonClient.js

@@ -7,8 +7,6 @@
 import * as net from 'node:net';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { createStderrLogger as createLogger } from './stderrLog.js';
-const log = createLogger('mcp-proxy-daemon-client');
 function getSocketPath() {
     return process.env['MCP_DAEMON_SOCKET'] ??
         path.join(os.homedir(), '.intutic', 'mcp-proxy.sock');

package/dist/daemonClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemonClient.js","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAA;AAEnD,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAA+B;IAC9E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAA;QACpD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAE1B,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,MAAM;YACN,MAAM;SACP,CAAA;QAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,MAAM,IAAI,KAAK,CAAA;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;gBAC7B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;wBAC5B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;4BACd,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;wBACtC,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;wBACrB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,CAAC,CAAA;oBACb,CAAC;4BAAS,CAAC;wBACT,MAAM,CAAC,GAAG,EAAE,CAAA;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,aAAa;QACb,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"daemonClient.js","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAA;QACpD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAE1B,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,MAAM;YACN,MAAM;SACP,CAAA;QAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,MAAM,IAAI,KAAK,CAAA;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;gBAC7B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;wBAC5B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;4BACd,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;wBACtC,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;wBACrB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,CAAC,CAAA;oBACb,CAAC;4BAAS,CAAC;wBACT,MAAM,CAAC,GAAG,EAAE,CAAA;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,aAAa;QACb,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/dlp.d.ts

@@ -15,6 +15,25 @@ export interface DlpScanResult {
     hasFinding: boolean;
     findings: DlpFinding[];
 }
+/**
+ * Replace the dynamic pattern set from control-plane regex sources.
+ * Invalid sources are dropped loudly by count — a pattern that does not
+ * compile enforces nothing, and silence there is how it stays broken.
+ * Returns the number dropped so the caller can log it.
+ */
+export declare function setDynamicPatterns(sources: readonly string[]): number;
+/**
+ * Redact every redactable-pattern match in a string.
+ *
+ * Used on the RESPONSE direction (tool results, resource reads), where the
+ * action already happened and blocking protects nothing — redaction keeps the
+ * secret out of the agent's context, which is the only thing still at stake.
+ * Command patterns are skipped by design; see DLP_PATTERNS.
+ */
+export declare function redactText(text: string): {
+    redacted: string;
+    findings: DlpFinding[];
+};
 /**
  * Scan tool arguments for DLP findings.
  *

package/dist/dlp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dlp.d.ts","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,UAAU,EAAE,CAAA;CACvB;AA2BD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,OAAO,GAAG,aAAa,CAY/D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAGnE"}
+{"version":3,"file":"dlp.d.ts","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,UAAU,EAAE,CAAA;CACvB;AAqDD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAgBrE;AAMD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,CAYrF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,OAAO,GAAG,aAAa,CAe/D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAGnE"}

package/dist/dlp.js

@@ -8,29 +8,103 @@
  * @module
  */
 /**
- * Compiled DLP patterns. Each entry has a regex and a human-readable description.
+ * Compiled DLP patterns.
+ *
+ * `redactable` separates VALUE patterns (a credential-shaped string that can
+ * be replaced with a placeholder wherever it appears) from COMMAND patterns
+ * (a destructive instruction, meaningful only as a reason to refuse an
+ * input). The distinction exists for the response direction: redacting
+ * "DROP TABLE" out of a tool RESULT would rewrite data the tool legitimately
+ * returned (a schema dump mentions DROP TABLE), while redacting a key out of
+ * a result protects the agent's context without changing what the result
+ * means. Command patterns therefore never apply to results.
  */
 const DLP_PATTERNS = [
     // API keys / tokens
-    { regex: /sk-[A-Za-z0-9]{20,}/, description: 'OpenAI API key pattern' },
-    { regex: /sk-ant-[A-Za-z0-9\-_]{20,}/, description: 'Anthropic API key pattern' },
-    { regex: /AIza[A-Za-z0-9\-_]{35}/, description: 'Google API key pattern' },
-    { regex: /ghp_[A-Za-z0-9]{36}/, description: 'GitHub personal access token' },
-    { regex: /ghs_[A-Za-z0-9]{36}/, description: 'GitHub server token' },
-    { regex: /xoxb-[A-Za-z0-9\-]{50,}/, description: 'Slack bot token' },
-    { regex: /xoxp-[A-Za-z0-9\-]{50,}/, description: 'Slack user token' },
-    { regex: /AKIA[A-Z0-9]{16}/, description: 'AWS Access Key ID' },
+    { regex: /sk-[A-Za-z0-9]{20,}/, description: 'OpenAI API key pattern', redactable: true },
+    { regex: /sk-ant-[A-Za-z0-9\-_]{20,}/, description: 'Anthropic API key pattern', redactable: true },
+    { regex: /AIza[A-Za-z0-9\-_]{35}/, description: 'Google API key pattern', redactable: true },
+    { regex: /ghp_[A-Za-z0-9]{36}/, description: 'GitHub personal access token', redactable: true },
+    { regex: /ghs_[A-Za-z0-9]{36}/, description: 'GitHub server token', redactable: true },
+    // `-` is last in these classes, where it is already a literal — the escape
+    // was a no-op. It stays a class member either way; see the Slack cases in
+    // __tests__/dlp.test.ts, which pin the hyphen-spanning token shape.
+    { regex: /xoxb-[A-Za-z0-9-]{50,}/, description: 'Slack bot token', redactable: true },
+    { regex: /xoxp-[A-Za-z0-9-]{50,}/, description: 'Slack user token', redactable: true },
+    { regex: /AKIA[A-Z0-9]{16}/, description: 'AWS Access Key ID', redactable: true },
+    // PII. The Rust proxy's dlp.rs has carried an SSN pattern from the start;
+    // this scanner had none, so a tool result carrying one streamed into the
+    // agent's context unremarked. Same shape dlp.rs uses: grouped digits only —
+    // a bare 9-digit run matches phone numbers and IDs far too often.
+    { regex: /\b\d{3}-\d{2}-\d{4}\b/, description: 'US Social Security Number', redactable: true },
     // High-entropy strings that look like secrets (≥40 chars of hex or base64)
-    { regex: /[0-9a-f]{40,}/, description: 'High-entropy hex string (possible secret)' },
-    // Destructive shell patterns in Bash/command arguments
-    { regex: /rm\s+-rf?\s+\//, description: 'Destructive rm -rf / command' },
-    { regex: /DROP\s+TABLE/i, description: 'SQL DROP TABLE statement' },
-    { regex: /DROP\s+DATABASE/i, description: 'SQL DROP DATABASE statement' },
-    { regex: /TRUNCATE\s+TABLE/i, description: 'SQL TRUNCATE TABLE statement' },
+    { regex: /[0-9a-f]{40,}/, description: 'High-entropy hex string (possible secret)', redactable: true },
+    // Destructive shell patterns in Bash/command arguments — input-only.
+    { regex: /rm\s+-rf?\s+\//, description: 'Destructive rm -rf / command', redactable: false },
+    { regex: /DROP\s+TABLE/i, description: 'SQL DROP TABLE statement', redactable: false },
+    { regex: /DROP\s+DATABASE/i, description: 'SQL DROP DATABASE statement', redactable: false },
+    { regex: /TRUNCATE\s+TABLE/i, description: 'SQL TRUNCATE TABLE statement', redactable: false },
     // Private key material
-    { regex: /-----BEGIN\s+(RSA\s+)?PRIVATE KEY-----/, description: 'PEM private key material' },
-    { regex: /-----BEGIN\s+EC\s+PRIVATE KEY-----/, description: 'EC private key material' },
+    { regex: /-----BEGIN\s+(RSA\s+)?PRIVATE KEY-----/, description: 'PEM private key material', redactable: true },
+    { regex: /-----BEGIN\s+EC\s+PRIVATE KEY-----/, description: 'EC private key material', redactable: true },
 ];
+/**
+ * Control-plane-supplied patterns, compiled. The daemon has fetched and
+ * cached `dlpPatterns` since the policy cache existed, and this scanner never
+ * read them — a workspace's custom patterns were a setting wired to nothing.
+ * The hardcoded floor above stays regardless: an unreachable control plane
+ * must degrade to the floor, never to no scanning.
+ */
+let dynamicPatterns = [];
+/**
+ * Replace the dynamic pattern set from control-plane regex sources.
+ * Invalid sources are dropped loudly by count — a pattern that does not
+ * compile enforces nothing, and silence there is how it stays broken.
+ * Returns the number dropped so the caller can log it.
+ */
+export function setDynamicPatterns(sources) {
+    const compiled = [];
+    let dropped = 0;
+    for (const src of sources) {
+        try {
+            compiled.push({
+                regex: new RegExp(src),
+                description: `Workspace DLP pattern: ${src}`,
+                redactable: true,
+            });
+        }
+        catch {
+            dropped += 1;
+        }
+    }
+    dynamicPatterns = compiled;
+    return dropped;
+}
+function allPatterns() {
+    return dynamicPatterns.length ? [...DLP_PATTERNS, ...dynamicPatterns] : DLP_PATTERNS;
+}
+/**
+ * Redact every redactable-pattern match in a string.
+ *
+ * Used on the RESPONSE direction (tool results, resource reads), where the
+ * action already happened and blocking protects nothing — redaction keeps the
+ * secret out of the agent's context, which is the only thing still at stake.
+ * Command patterns are skipped by design; see DLP_PATTERNS.
+ */
+export function redactText(text) {
+    const findings = [];
+    let redacted = text;
+    for (const { regex, description, redactable } of allPatterns()) {
+        if (!redactable)
+            continue;
+        const global = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+        if (global.test(redacted)) {
+            findings.push({ pattern: regex.source, description });
+            redacted = redacted.replace(global, '[REDACTED_SECRET]');
+        }
+    }
+    return { redacted, findings };
+}
 /**
  * Scan tool arguments for DLP findings.
  *
@@ -41,7 +115,10 @@ export function scanToolInput(toolInput) {
     // Serialize to string for pattern matching
     const serialized = JSON.stringify(toolInput ?? {});
     const findings = [];
-    for (const { regex, description } of DLP_PATTERNS) {
+    // The full set — floor plus workspace patterns — on the input direction too:
+    // a workspace pattern that blocked results but not the input that exfiltrates
+    // them would be scanning the wrong side.
+    for (const { regex, description } of allPatterns()) {
         if (regex.test(serialized)) {
             findings.push({ pattern: regex.source, description });
         }

package/dist/dlp.js.map

@@ -1 +1 @@
-{"version":3,"file":"dlp.js","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH;;GAEG;AACH,MAAM,YAAY,GAAkD;IAClE,oBAAoB;IACpB,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,EAAE;IACvE,EAAE,KAAK,EAAE,4BAA4B,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACjF,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,wBAAwB,EAAE;IAC1E,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC7E,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACpE,EAAE,KAAK,EAAE,yBAAyB,EAAE,WAAW,EAAE,iBAAiB,EAAE;IACpE,EAAE,KAAK,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE;IACrE,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAC/D,2EAA2E;IAC3E,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,2CAA2C,EAAE;IACpF,uDAAuD;IACvD,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IACxE,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACnE,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACzE,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC3E,uBAAuB;IACvB,EAAE,KAAK,EAAE,wCAAwC,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC5F,EAAE,KAAK,EAAE,oCAAoC,EAAE,WAAW,EAAE,yBAAyB,EAAE;CACxF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,2CAA2C;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAiB,EAAE,CAAA;IAEjC,KAAK,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAsB;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,OAAO,uEAAuE,IAAI,EAAE,CAAA;AACtF,CAAC"}
+{"version":3,"file":"dlp.js","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAuE;IACvF,oBAAoB;IACpB,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE;IACzF,EAAE,KAAK,EAAE,4BAA4B,EAAE,WAAW,EAAE,2BAA2B,EAAE,UAAU,EAAE,IAAI,EAAE;IACnG,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5F,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,8BAA8B,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/F,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IACtF,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE;IACrF,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE;IACtF,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,IAAI,EAAE;IACjF,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,kEAAkE;IAClE,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,2BAA2B,EAAE,UAAU,EAAE,IAAI,EAAE;IAC9F,2EAA2E;IAC3E,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,2CAA2C,EAAE,UAAU,EAAE,IAAI,EAAE;IACtG,qEAAqE;IACrE,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,8BAA8B,EAAE,UAAU,EAAE,KAAK,EAAE;IAC3F,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,0BAA0B,EAAE,UAAU,EAAE,KAAK,EAAE;IACtF,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,6BAA6B,EAAE,UAAU,EAAE,KAAK,EAAE;IAC5F,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,8BAA8B,EAAE,UAAU,EAAE,KAAK,EAAE;IAC9F,uBAAuB;IACvB,EAAE,KAAK,EAAE,wCAAwC,EAAE,WAAW,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IAC9G,EAAE,KAAK,EAAE,oCAAoC,EAAE,WAAW,EAAE,yBAAyB,EAAE,UAAU,EAAE,IAAI,EAAE;CAC1G,CAAA;AAED;;;;;;GAMG;AACH,IAAI,eAAe,GAAuE,EAAE,CAAA;AAE5F;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC;gBACtB,WAAW,EAAE,0BAA0B,GAAG,EAAE;gBAC5C,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,eAAe,GAAG,QAAQ,CAAA;IAC1B,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,KAAK,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC,UAAU;YAAE,SAAQ;QACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAA;QACpG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,2CAA2C;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAiB,EAAE,CAAA;IAEjC,6EAA6E;IAC7E,8EAA8E;IAC9E,yCAAyC;IACzC,KAAK,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,WAAW,EAAE,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAsB;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,OAAO,uEAAuE,IAAI,EAAE,CAAA;AACtF,CAAC"}

package/dist/emitter.d.ts

@@ -8,7 +8,38 @@
  *
  * @module
  */
-export type EventKind = 'tool_allowed' | 'tool_blocked' | 'tool_redacted';
+export type EventKind = 'tool_allowed' | 'tool_blocked' | 'tool_redacted'
+/**
+ * A `warn` SOP rule matched and the call was allowed (LLD #71): the same
+ * event the harness gates log for a warn-severity rule, carrying the rule
+ * id as `[<id>]` in `reason`, so a SHADOW guardrail seen through this
+ * proxy counts toward its evidence like one seen through a gate.
+ */
+ | 'tool_flagged'
+/**
+ * Server-level TOFU pin mismatch (tofu.ts) — a server's `tools/list`
+ * response no longer matches the fingerprint pinned on first contact. Sent
+ * with `toolName` carrying the SERVER name (there is no single tool
+ * involved), the same "reuse toolName as the identifier of whatever this
+ * event is about" shape `tool_blocked`/`tool_allowed` already use.
+ */
+ | 'mcp_server_definition_changed'
+/**
+ * A prompt-injection pattern fired (injection.ts), on any of the three
+ * scanned surfaces (`tool_result`/`tool_description`/`tool_input`). Always
+ * emitted regardless of `mcpInjectionAction` — warn mode reports and
+ * allows, block mode reports and additionally emits `tool_blocked` (see
+ * interceptor.ts / proxy.ts) so existing consumers keyed on `tool_blocked`
+ * are not blind to this new block reason.
+ */
+ | 'injection_detected'
+/**
+ * A Phase-2 anomaly detector (anomaly/detectors.ts) fired against the
+ * session's tool-call sequence. Emitted on Steer (allow) and on Reask/Kill
+ * (block) alike — a Reask/Kill firing ALSO emits `tool_blocked`, the same
+ * "existing consumers key on it" rule `injection_detected` follows.
+ */
+ | 'anomaly_detected';
 export interface GovernanceEvent {
     incidentId: string;
     kind: EventKind;
@@ -17,6 +48,13 @@ export interface GovernanceEvent {
     workspaceId: string;
     harnessType: string;
     reason?: string;
+    /**
+     * Set only by `injection_detected`/`anomaly_detected` today — the
+     * escalation-rule mirror `injection.ts`'s `injectionSeverity` (Phase 1) and
+     * the per-detector disposition mapping (Phase 2) compute. Absent on every
+     * other event kind, matching how `reason` is already optional here.
+     */
+    severity?: string;
     timestamp: string;
 }
 export declare class GovernanceEmitter {
@@ -26,7 +64,7 @@ export declare class GovernanceEmitter {
     private readonly workspaceId;
     private readonly mcpProxyMode;
     constructor(controlPlaneUrl: string, apiKey: string, eventsFilePath: string, workspaceId: string, mcpProxyMode?: string);
-    emit(kind: EventKind, toolName: string, toolInput: unknown, reason?: string): void;
+    emit(kind: EventKind, toolName: string, toolInput: unknown, reason?: string, severity?: string): void;
     private runDualPath;
     private postToControlPlane;
     private appendToFile;

package/dist/emitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emitter.d.ts","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,GAAG,eAAe,CAAA;AAEzE,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,SAAS,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAJZ,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,MAAsB;IAGvD,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAkClF,OAAO,CAAC,WAAW;YAYL,kBAAkB;YAoBlB,YAAY;CAM3B"}
+{"version":3,"file":"emitter.d.ts","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,cAAc,GACd,eAAe;AACjB;;;;;GAKG;GACD,cAAc;AAChB;;;;;;GAMG;GACD,+BAA+B;AACjC;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;GAKG;GACD,kBAAkB,CAAA;AAEtB,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,SAAS,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAJZ,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,MAAsB;IAGvD,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAuCrG,OAAO,CAAC,WAAW;YAYL,kBAAkB;YA4BlB,YAAY;CAM3B"}

package/dist/emitter.js

@@ -29,7 +29,7 @@ export class GovernanceEmitter {
         this.workspaceId = workspaceId;
         this.mcpProxyMode = mcpProxyMode;
     }
-    emit(kind, toolName, toolInput, reason) {
+    emit(kind, toolName, toolInput, reason, severity) {
         const event = {
             incidentId: node_crypto.randomUUID(),
             kind,
@@ -38,16 +38,21 @@ export class GovernanceEmitter {
             workspaceId: this.workspaceId,
             harnessType: 'mcp-governance-proxy',
             reason,
+            severity,
             timestamp: new Date().toISOString(),
         };
         if (this.mcpProxyMode === 'daemon') {
             const eventPayload = {
-                event: kind === 'tool_blocked' ? 'tool_blocked' : 'tool_allowed',
+                // `tool_redacted` was declared in EventKind and collapsed to
+                // `tool_allowed` here since the type existed — a redaction the audit
+                // trail recorded as a plain allow. The kind passes through as itself.
+                event: kind,
                 toolName,
                 workspaceId: this.workspaceId,
                 harnessType: 'mcp-governance-proxy',
                 timestamp: event.timestamp,
                 reason,
+                severity,
                 toolInput,
             };
             callDaemonSocket('telemetry.enqueue', eventPayload).then(() => {
@@ -74,18 +79,26 @@ export class GovernanceEmitter {
         const payload = JSON.stringify({
             events: [
                 {
-                    event: event.kind === 'tool_blocked' ? 'tool_blocked' : 'tool_allowed',
+                    // Same collapse as the daemon path had: the kind IS the event.
+                    event: event.kind,
                     toolName: event.toolName,
                     toolInput: event.toolInput,
                     workspaceId: event.workspaceId,
                     harnessType: event.harnessType,
                     incidentId: event.incidentId,
                     reason: event.reason,
+                    severity: event.severity,
                     timestamp: event.timestamp,
                 },
             ],
         });
-        const url = `${this.controlPlaneUrl}/api/v1/telemetry/enqueue`;
+        // POST /api/v1/hook-events — the batch governance-event ingest whose
+        // BatchHookEventsSchema this payload already matches exactly. Path A used
+        // to post to /api/v1/telemetry/enqueue, an endpoint that never existed in
+        // the control plane; because httpPost resolved on any response, every
+        // tool_allowed/tool_blocked event 404'd silently and the 'Path A failed'
+        // warning never fired.
+        const url = `${this.controlPlaneUrl}/api/v1/hook-events`;
         await httpPost(url, this.apiKey, payload);
     }
     async appendToFile(event) {
@@ -110,7 +123,16 @@ function httpPost(url, apiKey, body) {
         }, (res) => {
             // Drain response body to free socket
             res.resume();
-            res.on('end', resolve);
+            res.on('end', () => {
+                // Reject on error statuses so a wrong or removed endpoint surfaces as
+                // a caller-visible failure instead of silently succeeding.
+                const status = res.statusCode ?? 0;
+                if (status >= 400) {
+                    reject(new Error(`HTTP POST ${url} returned ${status}`));
+                    return;
+                }
+                resolve();
+            });
         });
         req.on('error', reject);
         req.on('timeout', () => { req.destroy(); reject(new Error('HTTP POST timed out')); });

package/dist/emitter.js.map

@@ -1 +1 @@
-{"version":3,"file":"emitter.js","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAe7C,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IACA;IALnB,YACmB,eAAuB,EACvB,MAAc,EACd,cAAsB,EACtB,WAAmB,EACnB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAQ;QACtB,gBAAW,GAAX,WAAW,CAAQ;QACnB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ,IAAI,CAAC,IAAe,EAAE,QAAgB,EAAE,SAAkB,EAAE,MAAe;QACzE,MAAM,KAAK,GAAoB;YAC7B,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;YACpC,IAAI;YACJ,QAAQ;YACR,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,sBAAsB;YACnC,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAA;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG;gBACnB,KAAK,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc;gBAChE,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,sBAAsB;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;gBACN,SAAS;aACV,CAAA;YACD,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,2CAA2C,CAAC,CAAA;YAC1F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0EAA0E,CAAC,CAAA;gBAC7I,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;QAEF,0CAA0C;QAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc;oBACtE,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF;SACF,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,2BAA2B,CAAA;QAC9D,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAsB;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QACzC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,IAAY;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBACzC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,OAAO,EAAE,IAAI;SACd,EACD,CAAC,GAAG,EAAE,EAAE;YACN,qCAAqC;YACrC,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACxB,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACpF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"emitter.js","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAwD7C,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IACA;IALnB,YACmB,eAAuB,EACvB,MAAc,EACd,cAAsB,EACtB,WAAmB,EACnB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAQ;QACtB,gBAAW,GAAX,WAAW,CAAQ;QACnB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ,IAAI,CAAC,IAAe,EAAE,QAAgB,EAAE,SAAkB,EAAE,MAAe,EAAE,QAAiB;QAC5F,MAAM,KAAK,GAAoB;YAC7B,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;YACpC,IAAI;YACJ,QAAQ;YACR,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,sBAAsB;YACnC,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAA;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG;gBACnB,6DAA6D;gBAC7D,qEAAqE;gBACrE,sEAAsE;gBACtE,KAAK,EAAE,IAAI;gBACX,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,sBAAsB;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;gBACN,QAAQ;gBACR,SAAS;aACV,CAAA;YACD,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,2CAA2C,CAAC,CAAA;YAC1F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0EAA0E,CAAC,CAAA;gBAC7I,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;QAEF,0CAA0C;QAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE;gBACN;oBACE,+DAA+D;oBAC/D,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF;SACF,CAAC,CAAA;QAEF,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,uBAAuB;QACvB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,qBAAqB,CAAA;QACxD,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAsB;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QACzC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,IAAY;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBACzC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,OAAO,EAAE,IAAI;SACd,EACD,CAAC,GAAG,EAAE,EAAE;YACN,qCAAqC;YACrC,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,sEAAsE;gBACtE,2DAA2D;gBAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;gBAClC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,aAAa,MAAM,EAAE,CAAC,CAAC,CAAA;oBACxD,OAAM;gBACR,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACpF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/index.js

@@ -22,6 +22,7 @@
  */
 import { loadConfig } from './config.js';
 import { McpGovernanceProxy } from './proxy.js';
+import { runRemoteProxy } from './remoteBridge.js';
 import { createStderrLogger as createLogger } from './stderrLog.js';
 const log = createLogger('mcp-proxy-main');
 async function main() {
@@ -34,9 +35,19 @@ async function main() {
         process.stderr.write(`[intutic-mcp-proxy] Configuration error: ${err.message}\n`);
         process.exit(1);
     }
-    const proxy = new McpGovernanceProxy(config);
+    // Remote (HTTP/SSE) bridge mode, from `--remote-url` — see remoteBridge.ts.
+    // Shares the SAME proxy_fatal/exit(1) catch below as stdio proxy mode
+    // rather than a second error surface, so a remote connect failure and a
+    // "spawned stdio command doesn't exist" failure look identical to whatever
+    // is watching this process's stderr/exit code.
     try {
-        await proxy.run();
+        if (config.remoteUrl !== undefined) {
+            await runRemoteProxy(config);
+        }
+        else {
+            const proxy = new McpGovernanceProxy(config);
+            await proxy.run();
+        }
     }
     catch (err) {
         log.error({ action: 'proxy_fatal', err: err.message }, 'Proxy exited with error');

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE1C,KAAK,UAAU,IAAI;IACjB,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iCAAiC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA6C,GAAa,CAAC,OAAO,IAAI,CAAC,CAAA;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAE5C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAA;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAA;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE1C,KAAK,UAAU,IAAI;IACjB,IAAI,MAAM,CAAA;IACV,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iCAAiC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA6C,GAAa,CAAC,OAAO,IAAI,CAAC,CAAA;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,wEAAwE;IACxE,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;YAC5C,MAAM,KAAK,CAAC,GAAG,EAAE,CAAA;QACnB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAA;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}