@intutic/mcp-governance-proxy 1.9.0 → 1.10.1

package/dist/policy.js

@@ -11,6 +11,37 @@ import * as node_http from 'node:http';
 import { createStderrLogger as createLogger } from './stderrLog.js';
 import { callDaemonSocket } from './daemonClient.js';
 const log = createLogger('mcp-proxy-policy');
+/**
+ * Is this unvalidated object actually a policy rule?
+ *
+ * The daemon caches `sopRules` as `Record<string, unknown>[]` — it filters the
+ * control plane's response to plain objects and validates nothing further. The
+ * client then used `as SopRule[]`, behind a `Promise<any>` that hid the
+ * mismatch entirely.
+ *
+ * That matters because these drive blocking decisions: a rule missing
+ * `toolPattern` reaches `new RegExp(undefined)` and matches everything, and a
+ * rule with an unrecognised `action` falls through every branch and enforces
+ * nothing. Neither is a shape the control plane intends to send — which is the
+ * argument for dropping the malformed ones loudly rather than trusting a cast.
+ */
+/**
+ * Exported because it is the contract between this package and whatever
+ * produces rules for it, not merely an internal helper. `policyCache`'s snapshot
+ * seed has to satisfy it, and a test that asserted against a *copy* of this
+ * predicate would prove nothing about the real one — which is precisely the
+ * two-copies-of-one-rule failure the harness gates were just rebuilt to remove.
+ */
+export function isSopRule(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const r = value;
+    return (typeof r['id'] === 'string' &&
+        typeof r['toolPattern'] === 'string' &&
+        typeof r['reason'] === 'string' &&
+        (r['argPattern'] === undefined || typeof r['argPattern'] === 'string') &&
+        (r['action'] === 'block' || r['action'] === 'warn' || r['action'] === 'require_approval'));
+}
 export class PolicyClient {
     controlPlaneUrl;
     apiKey;
@@ -18,6 +49,57 @@ export class PolicyClient {
     ttlMs;
     mcpProxyMode;
     rules = [];
+    /**
+     * Workspace DLP regex sources, delivered to the scanner on every refresh.
+     * The daemon has cached these since the policy cache existed; this client
+     * received and dropped them — a workspace's custom patterns were a setting
+     * wired to nothing.
+     */
+    dlpPatterns = [];
+    /** Workspace injection-pattern sources (`mcpInjectionPatterns`, TD-436); empty = floor only. */
+    injectionPatterns = [];
+    /**
+     * Additive tool scoping: when non-empty, ONLY these tools may be called
+     * through this proxy. Empty means unrestricted — the same convention as
+     * `allow_harnesses` and the starter rules' allowlist inversion warnings:
+     * an empty allowlist read as "permit nothing" would block every workspace
+     * that never declared one.
+     */
+    allowedTools = [];
+    /** Operator-curated tool descriptions, applied to tools/list responses. */
+    toolDescriptionOverrides = {};
+    /**
+     * Additive SERVER scoping: when non-empty, ONLY these MCP server names may
+     * be proxied by this process. Empty means unrestricted — same convention
+     * and same source as `allowedTools` above (mirrors `mcpAllowedTools` /
+     * `mcpAllowedServers` in workspace settings, delivered via the same
+     * `GET /api/v1/sop/rules` response this class already polls).
+     */
+    allowedServers = [];
+    /**
+     * Control-plane-delivered prompt-injection disposition override. `undefined`
+     * (never `'warn'`/`'block'` by default) means "the control plane did not
+     * send this field" — distinct from the field being explicitly set to
+     * `'warn'` — so the caller (interceptor.ts) knows to fall back to
+     * `config.ts`'s `mcpInjectionAction` env-derived default rather than
+     * silently treating an unset policy as an explicit warn.
+     */
+    injectionAction;
+    /**
+     * Control-plane-delivered anomaly-detection mode override (Phase 2).
+     * `undefined` when absent — same "absent means no override, fall back to
+     * config.ts's env-derived default" convention as `injectionAction` above.
+     */
+    anomalyMode;
+    /**
+     * Control-plane-delivered per-detector disposition overrides. Always an
+     * object (never `undefined`) — an absent policy field reads as "no
+     * overrides," which `resolveEffectiveDisposition` (anomaly/index.ts)
+     * already treats as a no-op via `overrides[detectorId] === undefined`, the
+     * same empty-object-means-unrestricted convention `toolDescriptionOverrides`
+     * above uses.
+     */
+    anomalyOverrides = {};
     lastFetchAt = 0;
     refreshTimer = null;
     constructor(controlPlaneUrl, apiKey, workspaceId, ttlMs = 60_000, mcpProxyMode = 'per-session') {
@@ -27,17 +109,31 @@ export class PolicyClient {
         this.ttlMs = ttlMs;
         this.mcpProxyMode = mcpProxyMode;
     }
-    /** Start background refresh timer. */
-    start() {
+    /**
+     * Start background refresh timer.
+     *
+     * @param onTick - Optional callback invoked on the SAME interval as the
+     *   policy refresh (including the initial kick below) — Phase 3's
+     *   `~/.intutic/wasm/` rescan (`WasmRunner.rescan`, wired from proxy.ts)
+     *   hooks this rather than starting a second timer, per the task's own
+     *   "don't add a second timer" instruction. Errors are swallowed the same
+     *   way `refresh()`'s own are — a rescan failure must not take down the
+     *   policy refresh it rides alongside.
+     */
+    start(onTick) {
         this.refreshTimer = setInterval(() => {
             void this.refresh().catch(() => {
                 // Errors already logged inside refresh()
             });
+            if (onTick)
+                void Promise.resolve(onTick()).catch(() => { });
         }, this.ttlMs);
         // Don't block Node.js exit on this timer
         this.refreshTimer.unref();
         // Kick off initial fetch (non-blocking — proxy starts immediately)
         void this.refresh().catch(() => { });
+        if (onTick)
+            void Promise.resolve(onTick()).catch(() => { });
     }
     /** Stop the background refresh timer. */
     stop() {
@@ -50,6 +146,82 @@ export class PolicyClient {
     getRules() {
         return this.rules;
     }
+    /** Workspace DLP regex sources from the last successful refresh. */
+    /** Workspace-supplied prompt-injection regex sources; empty means the hardcoded floor alone. */
+    getInjectionPatterns() {
+        return this.injectionPatterns;
+    }
+    getDlpPatterns() {
+        return this.dlpPatterns;
+    }
+    /** The additive tool allowlist; empty means unrestricted. */
+    getAllowedTools() {
+        return this.allowedTools;
+    }
+    /** The additive MCP server allowlist; empty means unrestricted. */
+    getAllowedServers() {
+        return this.allowedServers;
+    }
+    /** Operator description overrides for tools/list curation. */
+    getToolDescriptionOverrides() {
+        return this.toolDescriptionOverrides;
+    }
+    /**
+     * The control-plane-delivered prompt-injection disposition, or `undefined`
+     * when the policy source never sent `mcpInjectionAction` — absent means
+     * "no override", not "warn". Callers (interceptor.ts) fall back to
+     * `config.ts`'s env-derived default in that case, the same "absent means
+     * default" convention every other optional policy field in this class
+     * follows.
+     */
+    getInjectionAction() {
+        return this.injectionAction;
+    }
+    /** The control-plane-delivered anomaly mode, or `undefined` if unset (see field doc). */
+    getAnomalyMode() {
+        return this.anomalyMode;
+    }
+    /** Per-detector disposition overrides; always an object, empty means none. */
+    getAnomalyOverrides() {
+        return this.anomalyOverrides;
+    }
+    /** Parse the optional curation fields shared by both refresh paths. */
+    absorbCuration(source) {
+        const allowed = source['allowedTools'] ?? source['mcpAllowedTools'];
+        this.allowedTools = Array.isArray(allowed)
+            ? allowed.filter((t) => typeof t === 'string')
+            : [];
+        const overrides = source['toolDescriptionOverrides'] ?? source['mcpToolDescriptionOverrides'];
+        this.toolDescriptionOverrides = {};
+        if (typeof overrides === 'object' && overrides !== null && !Array.isArray(overrides)) {
+            for (const [k, v] of Object.entries(overrides)) {
+                if (typeof v === 'string')
+                    this.toolDescriptionOverrides[k] = v;
+            }
+        }
+        const allowedServers = source['allowedServers'] ?? source['mcpAllowedServers'];
+        this.allowedServers = Array.isArray(allowedServers)
+            ? allowedServers.filter((s) => typeof s === 'string')
+            : [];
+        const injectionPatterns = source['mcpInjectionPatterns'];
+        this.injectionPatterns = Array.isArray(injectionPatterns)
+            ? injectionPatterns.filter((p) => typeof p === 'string')
+            : [];
+        const injectionAction = source['mcpInjectionAction'];
+        this.injectionAction =
+            injectionAction === 'warn' || injectionAction === 'block' ? injectionAction : undefined;
+        const anomalyMode = source['mcpAnomalyMode'];
+        this.anomalyMode =
+            anomalyMode === 'enforce' || anomalyMode === 'warn' || anomalyMode === 'off' ? anomalyMode : undefined;
+        const anomalyOverrides = source['mcpAnomalyOverrides'];
+        this.anomalyOverrides = {};
+        if (typeof anomalyOverrides === 'object' && anomalyOverrides !== null && !Array.isArray(anomalyOverrides)) {
+            for (const [k, v] of Object.entries(anomalyOverrides)) {
+                if (v === 'steer' || v === 'reask' || v === 'kill' || v === 'off')
+                    this.anomalyOverrides[k] = v;
+            }
+        }
+    }
     /** Find the first matching rule for a given tool name + serialized args. */
     matchRule(toolName, toolInputJson) {
         for (const rule of this.rules) {
@@ -74,16 +246,40 @@ export class PolicyClient {
     async refresh() {
         if (this.mcpProxyMode === 'daemon') {
             try {
-                const policy = await callDaemonSocket('policy.get', { workspaceId: this.workspaceId });
+                // The socket returns whatever the daemon serialised, so the caller
+                // names the shape it expects. `policy.get` is answered by `resolvePolicy`
+                // in the daemon's own policyCache, which is where this type comes from —
+                // not an assertion, the actual producer's return type.
+                const policy = await callDaemonSocket('policy.get', {
+                    workspaceId: this.workspaceId,
+                });
                 if (policy) {
-                    this.rules = (policy.sopRules || []);
+                    const candidates = policy.sopRules ?? [];
+                    // An explicit loop rather than `.filter(isSopRule)`: TypeScript will
+                    // not narrow `Record<string, unknown>[]` to `SopRule[]` through a type
+                    // predicate, because an interface has no implicit index signature.
+                    const accepted = [];
+                    for (const candidate of candidates) {
+                        if (isSopRule(candidate))
+                            accepted.push(candidate);
+                    }
+                    this.rules = accepted;
+                    const dropped = candidates.length - accepted.length;
+                    if (dropped > 0) {
+                        log.warn({ action: 'policy_rules_malformed', dropped, kept: this.rules.length }, 'Dropped malformed SOP rules from the daemon — they cannot be enforced');
+                    }
+                    this.dlpPatterns = (policy.dlpPatterns ?? []).filter((p) => typeof p === 'string');
+                    this.absorbCuration(policy);
                     this.lastFetchAt = Date.now();
                     log.info({ action: 'policy_refreshed_from_daemon', ruleCount: this.rules.length }, 'SOP rules refreshed from daemon');
                     return;
                 }
             }
             catch (err) {
-                log.warn({ action: 'policy_daemon_failed', err: err.message }, 'Failed to refresh policy from daemon socket — falling back to HTTP');
+                log.warn({
+                    action: 'policy_daemon_failed',
+                    err: err instanceof Error ? err.message : String(err),
+                }, 'Failed to refresh policy from daemon socket — falling back to HTTP');
             }
         }
         const url = `${this.controlPlaneUrl}/api/v1/sop/rules?workspaceId=${encodeURIComponent(this.workspaceId)}&active=true`;
@@ -92,6 +288,11 @@ export class PolicyClient {
         const parsed = JSON.parse(body);
         const rules = Array.isArray(parsed.rules) ? parsed.rules : [];
         this.rules = rules;
+        const dlp = parsed['dlpPatterns'];
+        this.dlpPatterns = Array.isArray(dlp)
+            ? dlp.filter((p) => typeof p === 'string')
+            : [];
+        this.absorbCuration(parsed);
         this.lastFetchAt = Date.now();
         log.info({ action: 'policy_refreshed', ruleCount: rules.length }, 'SOP rules refreshed');
     }

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAkB5C,MAAM,OAAO,YAAY;IAMJ;IACA;IACA;IACA;IACA;IATX,KAAK,GAAc,EAAE,CAAA;IACrB,WAAW,GAAG,CAAC,CAAA;IACf,YAAY,GAA0B,IAAI,CAAA;IAElD,YACmB,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,QAAgB,MAAM,EACtB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ,sCAAsC;IACtC,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,yCAAyC;YAC3C,CAAC,CAAC,CAAA;QACJ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAEzB,mEAAmE;QACnE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrC,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAgB,EAAE,aAAqB;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;wBAAE,SAAQ;gBAC7C,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;gBACtF,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAc,CAAA;oBACjD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;oBACrH,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,oEAAoE,CAAC,CAAA;YACtI,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAA;QACtH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAA;QAErF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAA;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAC1F,CAAC;CACF;AAED,qEAAqE;AACrE,SAAS,OAAO,CAAC,GAAW,EAAE,MAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CACjB,GAAG,EACH;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;aAC3B;YACD,OAAO,EAAE,IAAI;SACd,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACpD,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAc5C;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,CAC1F,CAAA;AACH,CAAC;AAMD,MAAM,OAAO,YAAY;IAyDJ;IACA;IACA;IACA;IACA;IA5DX,KAAK,GAAc,EAAE,CAAA;IAC7B;;;;;OAKG;IACK,WAAW,GAAa,EAAE,CAAA;IAClC,gGAAgG;IACxF,iBAAiB,GAAa,EAAE,CAAA;IACxC;;;;;;OAMG;IACK,YAAY,GAAa,EAAE,CAAA;IACnC,2EAA2E;IACnE,wBAAwB,GAA2B,EAAE,CAAA;IAC7D;;;;;;OAMG;IACK,cAAc,GAAa,EAAE,CAAA;IACrC;;;;;;;OAOG;IACK,eAAe,CAA8B;IACrD;;;;OAIG;IACK,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACK,gBAAgB,GAAuD,EAAE,CAAA;IACzE,WAAW,GAAG,CAAC,CAAA;IACf,YAAY,GAA0B,IAAI,CAAA;IAElD,YACmB,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,QAAgB,MAAM,EACtB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAmC;QACvC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,yCAAyC;YAC3C,CAAC,CAAC,CAAA;YACF,IAAI,MAAM;gBAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5D,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAEzB,mEAAmE;QACnE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACnC,IAAI,MAAM;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,6DAA6D;IAC7D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,mEAAmE;IACnE,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,8DAA8D;IAC9D,2BAA2B;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAA;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,yFAAyF;IACzF,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAED,uEAAuE;IAC/D,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7F,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9E,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YACjD,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,iBAAiB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACxD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACvD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACrE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,eAAe,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,CAAC,WAAW;YACd,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;QACxG,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAA2C,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAgB,EAAE,aAAqB;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;wBAAE,SAAQ;gBAC7C,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,0EAA0E;gBAC1E,yEAAyE;gBACzE,uDAAuD;gBACvD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAwB,YAAY,EAAE;oBACzE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAA;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;oBACxC,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,MAAM,QAAQ,GAAc,EAAE,CAAA;oBAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,SAAS,CAAC,SAAS,CAAC;4BAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACpD,CAAC;oBACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACnD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EACtE,uEAAuE,CACxE,CAAA;oBACH,CAAC;oBACD,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAA;oBACD,IAAI,CAAC,cAAc,CAAC,MAA4C,CAAC,CAAA;oBACjE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;oBACrH,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtD,EACD,oEAAoE,CACrE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAA;QACtH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAA;QAErF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAA;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvD,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAC1F,CAAC;CACF;AAED,qEAAqE;AACrE,SAAS,OAAO,CAAC,GAAW,EAAE,MAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CACjB,GAAG,EACH;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;aAC3B;YACD,OAAO,EAAE,IAAI;SACd,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACpD,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/proxy.d.ts

@@ -9,6 +9,16 @@
  *   Harness ↔ [McpGovernanceProxy as MCP Server] ↔ Control Plane REST API
  *   Exposes governance tools: intutic_governance_status, intutic_list_sops, intutic_list_incidents.
  *
+ * Architecture (remote bridge mode — `--remote-url`, see remoteBridge.ts):
+ *   Harness stdin → [McpGovernanceProxy] → remote MCP server (HTTP/SSE)
+ *   Remote MCP server → [McpGovernanceProxy] → Harness stdout
+ *   The harness still spawns this proxy as an ordinary stdio child process —
+ *   only the UPSTREAM side changes, from a spawned child's stdin/stdout to an
+ *   MCP SDK client transport talking HTTP/SSE. `handleHarnessLine` (request
+ *   direction) and `handleServerLine` (response direction) are the exact same
+ *   functions proxy mode uses; remoteBridge.ts only supplies a different
+ *   upstream and a different `forward`.
+ *
  * CRITICAL: Never write to process.stdout except for valid JSON-RPC frames.
  *           All logging MUST go to process.stderr via @intutic/logger.
  *
@@ -17,13 +27,187 @@
  * @module
  */
 import type { ProxyConfig } from './config.js';
+import { ToolCallInterceptor } from './interceptor.js';
+import { type InjectionSource } from './injection.js';
+import { SessionState } from './session.js';
+/** What the harness asked for under a given request id, awaiting its response. */
+export interface PendingRequest {
+    method: 'tools/call' | 'tools/list' | 'resources/read';
+    toolName?: string;
+}
+/** The outcome of inspecting one server→harness line. */
+export interface ServerLineOutcome {
+    /** The line to forward — possibly rewritten. */
+    line: string;
+    /** Set when result content was redacted: the tool (or resource) it came from. */
+    redactedTool?: string;
+    /** Pattern descriptions redacted out of the result. */
+    redactions?: string[];
+    /** Set when a tools/list response was filtered or had descriptions overridden. */
+    curated?: {
+        hidden: number;
+        overridden: number;
+    };
+    /**
+     * The (post-curation) tool array, set whenever this line was a `tools/list`
+     * response — regardless of whether curation changed anything — so the
+     * caller can run TOFU pinning (tofu.ts) over it. `undefined` for every
+     * other line.
+     */
+    toolsListTools?: Array<Record<string, unknown>>;
+    /** The JSON-RPC id of the `tools/list` response, needed to build a block
+     *  frame in the caller if TOFU refuses it. Set alongside `toolsListTools`. */
+    toolsListMsgId?: string | number | null;
+    /**
+     * Prompt-injection findings (injection.ts) from this line, one entry per
+     * scanned surface that matched — a `tools/call`/`resources/read` result
+     * (`tool_result`) yields at most one entry; a `tools/list` response can
+     * yield one per tool whose (post-curation) description matched. The
+     * caller (`handleServerLine`) emits `injection_detected` (and, on a
+     * response-direction block, `tool_blocked`) from these — `processServerLine`
+     * itself stays a pure function with no emitter access, the same reason
+     * `redactedTool`/`redactions` exist as outcome fields rather than emitting
+     * directly.
+     */
+    injectionFindings?: Array<{
+        source: InjectionSource;
+        toolName: string;
+        patterns: string[];
+    }>;
+    /**
+     * Set when a response-direction injection match, under `mcpInjectionAction:
+     * 'block'`, caused `line` to carry a withheld-result error frame instead of
+     * the real result — mirrors `redactedTool` for the injection path, so the
+     * caller can log/emit the block distinctly from a plain redaction.
+     */
+    injectionBlocked?: boolean;
+    /**
+     * Phase 2's `dlp_escalation` finding (anomaly/detectors.ts), set when a
+     * `tools/call`/`resources/read` result carried ≥3 distinct DLP-redacted
+     * pattern types. Severity-escalation only — see `dlpEscalation`'s own doc
+     * comment for why this never becomes a NEW block: the content is already
+     * redacted (`redactions` above), and this proxy's DLP scan already blocks
+     * any request-direction finding unconditionally, so escalating an
+     * already-redacted RESPONSE protects nothing further.
+     */
+    dlpEscalationReason?: string;
+    /**
+     * Phase 2's `tool_poisoning` finding (anomaly/detectors.ts), set on a
+     * `tools/list` response whose post-curation tool descriptions matched
+     * `toolPoison.ts`'s 7-pattern scanner. Report-only, same as
+     * `injectionFindings` on this same response type — never removes or
+     * blocks a listing.
+     */
+    toolPoisoningReason?: string;
+}
+/**
+ * Inspect one line of real-server output before it reaches the harness.
+ *
+ * This is the seam the byte-for-byte pipe never had: the request direction has
+ * been scanned since the interceptor existed, while the real server's stdout —
+ * tool results, resource reads, every tools/list — streamed into the agent's
+ * context untouched. A result carrying a credential put it straight into
+ * model-visible context; a `redact` Decision variant and a `tool_redacted`
+ * event existed as declared types with no producer. This function is the
+ * producer.
+ *
+ * Redaction, not blocking, on results: the call already executed, so refusing
+ * the response protects nothing — keeping the secret out of the agent's
+ * context is the only thing still at stake. If the redacted result no longer
+ * parses (a secret that spanned JSON syntax), the whole result is withheld
+ * and replaced with an error naming why — forwarding either the original or
+ * a broken body would be worse, the same fail-closed reparse rule the Rust
+ * proxy applies to non-streaming bodies.
+ *
+ * tools/list curation (the Uber-gateway mechanism): when the workspace
+ * declares an additive allowlist, tools outside it are removed from the
+ * listing — an agent that never sees a tool does not hallucinate calls to
+ * it, and the call-time block in the interceptor stays as the enforcement
+ * backstop. Operator description overrides apply to what remains, which is
+ * also the counter to a poisoned upstream description — the pin detects the
+ * change; the override controls what the agent actually reads.
+ */
+export declare function processServerLine(raw: string, pending: Map<string | number, PendingRequest>, allowedTools: readonly string[], overrides: Readonly<Record<string, string>>, injectionAction?: 'warn' | 'block', injectionPatterns?: readonly string[]): ServerLineOutcome;
+/**
+ * Handle one harness→upstream line — shared, byte-for-byte, between stdio
+ * proxy mode (`McpGovernanceProxy.runProxy`, below) and the remote HTTP/SSE
+ * bridge (`remoteBridge.ts`'s `runRemoteProxy`): parse JSON-RPC, register any
+ * `tools/list`/`resources/read` request so its response gets inspected on the
+ * way back (see `processServerLine`), and run every `tools/call` through the
+ * SAME `interceptor.decide()` call this proxy has always used. `forward` is
+ * the ONLY thing that differs by upstream transport — stdio mode writes to
+ * the spawned child process's stdin, remote bridge mode calls the MCP SDK
+ * transport's `send()` — so pulling it out as a parameter, rather than
+ * forking this whole function, is what keeps governance identical across
+ * both upstream transports instead of two copies that could quietly drift.
+ *
+ * A free function (like `processServerLine`), not a class method, precisely
+ * so `remoteBridge.ts` can call it without needing a `McpGovernanceProxy`
+ * instance shaped for the stdio child-process lifecycle it doesn't have.
+ */
+export declare function handleHarnessLine(line: string, pending: Map<string | number, PendingRequest>, interceptor: ToolCallInterceptor, forward: (line: string) => void, session?: SessionState): void;
 export declare class McpGovernanceProxy {
     private readonly config;
     private readonly policy;
     private readonly emitter;
     private readonly interceptor;
+    /**
+     * Phase 2's session state — the tool-call sequence and per-detector reask
+     * counters. ONE instance per proxy process, shared with the interceptor
+     * (for detection + reask counting), `handleHarnessLine` (for post-decision
+     * recording), and this class's own `handleServerLine` (for caching the
+     * post-curation tools/list the tool_poisoning detector reads). Since Wave
+     * 5.3 (TD-437) it is also shared ACROSS the session's sibling proxy
+     * processes through `sessionStore` when a Valkey URL is configured — see
+     * session.ts's module doc.
+     */
+    private readonly session;
+    /** The Valkey-backed shared window, when `config.valkeyUrl` is set and this is not the standalone entry. */
+    private readonly sessionStore;
+    /**
+     * Phase 3's WASM custom-rule runner — owns the one dedicated
+     * `worker_threads` Worker and the `~/.intutic/wasm/` directory loader.
+     * Rescanned on the SAME 60s policy-tick timer `PolicyClient.start` already
+     * runs, not a second one (see `policy.ts`'s `start(onTick)`).
+     */
+    private readonly wasmRunner;
     private realServer;
     constructor(config: ProxyConfig);
+    /**
+     * The tools/call decision engine — exposed so `remoteBridge.ts` can drive
+     * `handleHarnessLine` (the exported free function above) against the SAME
+     * interceptor instance this class builds from `config` in its constructor,
+     * rather than constructing a second one that could drift.
+     */
+    getInterceptor(): ToolCallInterceptor;
+    /**
+     * The shared session state — exposed for the same reason `getInterceptor`
+     * is: `remoteBridge.ts` drives `handleHarnessLine` with this exact
+     * instance so the sequence detectors read and the sequence
+     * `handleHarnessLine` records into are never two different objects.
+     */
+    getSessionState(): SessionState;
+    /**
+     * Start the policy client's background refresh timer. Exposed alongside
+     * `stopPolicy` so `remoteBridge.ts` can drive the same policy lifecycle
+     * `runProxy` below drives for stdio mode, without reaching into `policy`
+     * (private) directly. Also rides this same tick to rescan Phase 3's
+     * `~/.intutic/wasm/` directory — see `policy.ts`'s `start(onTick)` doc.
+     */
+    startPolicy(): void;
+    private wasmWatch;
+    /**
+     * Hot reload for `~/.intutic/wasm/` (TD-442): a directory watcher, not a
+     * second timer, so a dropped-in rule takes effect within a second instead
+     * of at the next 60-second tick. Re-armed on every tick because the
+     * directory may not exist when the proxy starts.
+     */
+    private ensureWasmWatch;
+    /**
+     * Stop the policy client's background refresh timer, and shut down the
+     * WASM worker thread. See `startPolicy`.
+     */
+    stopPolicy(): void;
     /**
      * Start the proxy. Dispatches to standalone or proxy mode based on config.
      */
@@ -34,6 +218,27 @@ export declare class McpGovernanceProxy {
      * Gracefully degrades when the control plane is unreachable.
      */
     private runStandalone;
+    /**
+     * Inspects one real-server → harness line (see `processServerLine`) and
+     * writes the outcome to stdout. Async, unlike the byte pipe this replaced,
+     * because a `tools/list` response also runs server-level TOFU pinning
+     * (tofu.ts), which does file I/O — the ONLY case this awaits before
+     * writing; every other line is forwarded exactly as fast as before.
+     *
+     * On a TOFU mismatch, honors `mcpProxyFailBehavior` via `config.failOpen` —
+     * the SAME field `interceptor.ts` already reads for its own fail-open/
+     * fail-closed branches, not a new mechanism: fail-open logs and forwards
+     * the (possibly curated) tools/list response as normal; fail-closed
+     * replaces it with a JSON-RPC error naming the server and the setting,
+     * mirroring `buildBlockResponse`'s existing wording style.
+     *
+     * Public (not `private`) so `remoteBridge.ts` can hand it every message
+     * `transport.onmessage` receives from a remote upstream, VERBATIM — DLP
+     * redaction, TOFU pinning, and event emission on the response direction
+     * must apply identically regardless of which upstream transport produced
+     * the line, and this is the one place that logic lives.
+     */
+    handleServerLine(rawLine: string, pending: Map<string | number, PendingRequest>): Promise<void>;
     /**
      * Start the proxy. Spawns the real MCP server and begins proxying stdin/stdout.
      * Returns a promise that resolves when the real server exits.

package/dist/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAkD9C,qBAAa,kBAAkB;IAMjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,UAAU,CAAuC;gBAE5B,MAAM,EAAE,WAAW;IAoBhD;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B;;;;OAIG;YACW,aAAa;IA0G3B;;;OAGG;YACW,QAAQ;CAqGvB"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,EAA4D,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAmD3C,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAA;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,kFAAkF;IAClF,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC5F;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,eAAe,GAAE,MAAM,GAAG,OAAgB,EAC1C,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACxC,iBAAiB,CAqLnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,YAAY,GACrB,IAAI,CA2DN;AAED,qBAAa,kBAAkB;IA0BjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAzBnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,4GAA4G;IAC5G,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,UAAU,CAAuC;gBAE5B,MAAM,EAAE,WAAW;IA4ChD;;;;;OAKG;IACH,cAAc,IAAI,mBAAmB;IAIrC;;;;;OAKG;IACH,eAAe,IAAI,YAAY;IAI/B;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAOnB,OAAO,CAAC,SAAS,CAA8B;IAE/C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B;;;;OAIG;YACW,aAAa;IAuI3B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;IAwJhB;;;OAGG;YACW,QAAQ;CAoFvB"}