@intutic/mcp-governance-proxy 2.1.0 → 2.3.0

package/dist/refusals.js

@@ -0,0 +1,43 @@
+/**
+ * refusals.ts — the stable code every refusal this proxy gives carries.
+ *
+ * A JSON-RPC refusal is `-32603` with a message, and a message is for a
+ * person: an agent or client that wants to tell a held call from a blocked
+ * one, or a used-up budget from a disabled tool, should not have to parse it.
+ * So every refusal frame also carries `error.data`: `code` (one of
+ * {@link MCP_REFUSAL_CODES}), `ruleId` (the rule, setting or detector that
+ * decided) and, where there is more to say, more fields — the hold's
+ * `holdId` and `status`, a budget's `budgetId`, `limit`, `used` and
+ * `resetAt`.
+ *
+ * Held to `packages/shared-types/fixtures/refusal-codes.json` (`mcp`) by a
+ * test, as the MCP proxy reference's table is.
+ *
+ * @module
+ */
+export const MCP_REFUSAL_CODES = [
+    'REGISTRY_UNAVAILABLE',
+    'SERVER_BLOCKED',
+    'SERVER_HELD',
+    'SERVER_NOT_APPROVED',
+    'TOOL_DISABLED',
+    'SERVER_NOT_ALLOWED',
+    'TOOL_NOT_ALLOWED',
+    'SSO_GROUP',
+    'DLP',
+    'SOP_RULE',
+    'HELD',
+    'INJECTION',
+    'ANOMALY',
+    'WASM_RULE',
+    'REASK',
+    'REASK_EXHAUSTED',
+    'BUDGET_EXCEEDED',
+    'BUDGET_UNAVAILABLE',
+    'GOVERNANCE_UNAVAILABLE',
+    'TOFU_UNAVAILABLE',
+    'TOOL_DEFINITIONS_CHANGED',
+    'RESULT_WITHHELD_DLP',
+    'RESULT_WITHHELD_INJECTION',
+];
+//# sourceMappingURL=refusals.js.map

package/dist/refusals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,sBAAsB;IACtB,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,kBAAkB;IAClB,WAAW;IACX,KAAK;IACL,UAAU;IACV,MAAM;IACN,WAAW;IACX,SAAS;IACT,WAAW;IACX,OAAO;IACP,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,0BAA0B;IAC1B,qBAAqB;IACrB,2BAA2B;CACnB,CAAA"}

package/dist/registryObserver.d.ts

@@ -0,0 +1,37 @@
+/**
+ * registryObserver.ts — tells the control plane which MCP server this proxy
+ * fronts, and which tools it declares.
+ *
+ * The MCP daemon's heartbeat reports the servers it finds in harness configs,
+ * but a per-session proxy runs without the daemon on most machines, and only
+ * the proxy ever sees a server's tools/list. So the proxy reports its own
+ * server: once at start (so a server refused under a `deny` default still
+ * reaches the approval queue, even if its tools/list never gets through) and
+ * again whenever the tools it sees change — a tool added or removed, or a
+ * description or input schema changed. The report carries the tool names (for
+ * the registry's per-tool toggles) and the definitions as the server declared
+ * them, before curation, which the control plane compares with the last ones
+ * it stored to score the change's risk. The control plane creates a candidate
+ * on first sight and notifies the workspace.
+ *
+ * Best-effort and quiet: a failed report costs one registry refresh, never a
+ * tool call.
+ *
+ * @module
+ */
+import type { McpToolDefinition } from '@intutic/shared-types';
+export declare class RegistryObserver {
+    private readonly controlPlaneUrl;
+    private readonly apiKey;
+    private readonly serverName;
+    private readonly transport;
+    private lastReported;
+    constructor(controlPlaneUrl: string, apiKey: string, serverName: string, transport: 'stdio' | 'http' | 'sse');
+    /**
+     * Reports the server, with its tools when known. A report identical to the
+     * last successful one is skipped. Without an API key, or without a
+     * `--server-name` to report, there is nothing the registry could record.
+     */
+    observe(tools?: readonly McpToolDefinition[]): Promise<void>;
+}
+//# sourceMappingURL=registryObserver.d.ts.map

package/dist/registryObserver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryObserver.d.ts","sourceRoot":"","sources":["../src/registryObserver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAM9D,qBAAa,gBAAgB;IAIzB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAN5B,OAAO,CAAC,YAAY,CAAsB;gBAGvB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK;IAGtD;;;;OAIG;IACG,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAsBnE"}

package/dist/registryObserver.js

@@ -0,0 +1,70 @@
+/**
+ * registryObserver.ts — tells the control plane which MCP server this proxy
+ * fronts, and which tools it declares.
+ *
+ * The MCP daemon's heartbeat reports the servers it finds in harness configs,
+ * but a per-session proxy runs without the daemon on most machines, and only
+ * the proxy ever sees a server's tools/list. So the proxy reports its own
+ * server: once at start (so a server refused under a `deny` default still
+ * reaches the approval queue, even if its tools/list never gets through) and
+ * again whenever the tools it sees change — a tool added or removed, or a
+ * description or input schema changed. The report carries the tool names (for
+ * the registry's per-tool toggles) and the definitions as the server declared
+ * them, before curation, which the control plane compares with the last ones
+ * it stored to score the change's risk. The control plane creates a candidate
+ * on first sight and notifies the workspace.
+ *
+ * Best-effort and quiet: a failed report costs one registry refresh, never a
+ * tool call.
+ *
+ * @module
+ */
+import { createStderrLogger as createLogger } from './stderrLog.js';
+import { postJson } from './httpJson.js';
+const log = createLogger('mcp-proxy-registry');
+export class RegistryObserver {
+    controlPlaneUrl;
+    apiKey;
+    serverName;
+    transport;
+    lastReported = null;
+    constructor(controlPlaneUrl, apiKey, serverName, transport) {
+        this.controlPlaneUrl = controlPlaneUrl;
+        this.apiKey = apiKey;
+        this.serverName = serverName;
+        this.transport = transport;
+    }
+    /**
+     * Reports the server, with its tools when known. A report identical to the
+     * last successful one is skipped. Without an API key, or without a
+     * `--server-name` to report, there is nothing the registry could record.
+     */
+    async observe(tools) {
+        if (!this.apiKey || this.serverName === 'unknown')
+            return;
+        let definitions;
+        if (tools) {
+            // One entry per name, the first declared — the rule the risk score matches by.
+            const byName = new Map();
+            for (const t of tools)
+                if (!byName.has(t.name))
+                    byName.set(t.name, t);
+            definitions = [...byName.values()].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        }
+        const key = JSON.stringify(definitions ?? null);
+        if (key === this.lastReported || (definitions === undefined && this.lastReported !== null))
+            return;
+        try {
+            await postJson(`${this.controlPlaneUrl}/api/v1/mcp/servers/observe`, this.apiKey, {
+                serverName: this.serverName,
+                transport: this.transport,
+                ...(definitions ? { tools: definitions.map((t) => t.name), toolDefinitions: definitions } : {}),
+            });
+            this.lastReported = key;
+        }
+        catch (err) {
+            log.debug({ action: 'registry_observe_failed', err: err.message }, 'Could not report this MCP server to the registry');
+        }
+    }
+}
+//# sourceMappingURL=registryObserver.js.map

package/dist/registryObserver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryObserver.js","sourceRoot":"","sources":["../src/registryObserver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAE9C,MAAM,OAAO,gBAAgB;IAIR;IACA;IACA;IACA;IANX,YAAY,GAAkB,IAAI,CAAA;IAE1C,YACmB,eAAuB,EACvB,MAAc,EACd,UAAkB,EAClB,SAAmC;QAHnC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;QAClB,cAAS,GAAT,SAAS,CAA0B;IACnD,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAoC;QAChD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAM;QACzD,IAAI,WAA4C,CAAA;QAChD,IAAI,KAAK,EAAE,CAAC;YACV,+EAA+E;YAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAA;YACnD,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YACrE,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACrG,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;QAC/C,IAAI,GAAG,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;YAAE,OAAM;QAClG,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,eAAe,6BAA6B,EAAE,IAAI,CAAC,MAAM,EAAE;gBAChF,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChG,CAAC,CAAA;YACF,IAAI,CAAC,YAAY,GAAG,GAAG,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,kDAAkD,CAAC,CAAA;QACnI,CAAC;IACH,CAAC;CACF"}

package/dist/session.d.ts

@@ -8,7 +8,7 @@
  * process (`mcpAutoWrite.ts`'s `wrapWithProxy`, in both `per-session` and
  * `daemon` mode), so one harness session runs one proxy per wrapped server.
  * This class holds the tool-call sequence and the per-detector reask counters
- * the anomaly detectors read. Until Wave 5.3 (TD-437) that state was
+ * the anomaly detectors read. Until Wave 5.3 that state was
  * per-process only — a cross-server ping-pong was invisible, a reask budget
  * reset per server and per restart — and the module doc claimed there was
  * "no second instance to share state with", which was never true of the

package/dist/session.js

@@ -8,7 +8,7 @@
  * process (`mcpAutoWrite.ts`'s `wrapWithProxy`, in both `per-session` and
  * `daemon` mode), so one harness session runs one proxy per wrapped server.
  * This class holds the tool-call sequence and the per-detector reask counters
- * the anomaly detectors read. Until Wave 5.3 (TD-437) that state was
+ * the anomaly detectors read. Until Wave 5.3 that state was
  * per-process only — a cross-server ping-pong was invisible, a reask budget
  * reset per server and per restart — and the module doc claimed there was
  * "no second instance to share state with", which was never true of the

package/dist/sessionScope.d.ts

@@ -1,6 +1,6 @@
 /**
  * sessionScope.ts — the shared-window scope a proxy process derives for
- * itself (TD-437, Wave 5.3).
+ * itself (Wave 5.3).
  *
  * The sync daemon wraps EACH MCP server entry with its own proxy process, so
  * one harness session runs several `McpGovernanceProxy` processes at once —

package/dist/sessionScope.js

@@ -1,6 +1,6 @@
 /**
  * sessionScope.ts — the shared-window scope a proxy process derives for
- * itself (TD-437, Wave 5.3).
+ * itself (Wave 5.3).
  *
  * The sync daemon wraps EACH MCP server entry with its own proxy process, so
  * one harness session runs several `McpGovernanceProxy` processes at once —

package/dist/sessionStore.d.ts

@@ -1,6 +1,6 @@
 /**
  * sessionStore.ts — the Valkey-backed session window the sibling proxy
- * processes of one harness session share (TD-437, Wave 5.3).
+ * processes of one harness session share (Wave 5.3).
  *
  * The Rust LLM proxy keeps a session's tool-call history in Valkey
  * (`store/valkey.rs`: a capped LIST for the sequence, a ZSET for the 60 s
@@ -12,15 +12,15 @@
  *
  * Never a hard dependency. Every operation fails open to `undefined`/`false`
  * and the caller (`SessionState`) falls back to its in-process window: when
- * no URL is configured, when the client is not connected (`status !==
- * 'ready'`, so an absent Valkey adds no latency), when a call takes longer
- * than {@link SHARED_WINDOW_TIMEOUT_MS}, or on any error. The proxy behaves
- * exactly as before Wave 5.3 in every one of those cases.
+ * no URL is configured, when the client is not connected (so an absent
+ * Valkey adds no latency), when a call takes longer than
+ * `VALKEY_COMMAND_TIMEOUT_MS`, or on any error — the guard every command on
+ * the proxy's one Valkey connection goes through (guardedValkey.ts). The
+ * proxy behaves exactly as before Wave 5.3 in every one of those cases.
  *
  * @module
  */
-/** A shared read or write that takes longer than this loses to the local window. */
-export declare const SHARED_WINDOW_TIMEOUT_MS = 200;
+import type { GuardedValkey } from './guardedValkey.js';
 /** Sliding lifetime of the sequence and call-window keys — the Rust `TOOL_SEQUENCE_TTL_SECS`. */
 export declare const SESSION_WINDOW_TTL_SECS = 86400;
 /** Lifetime of a reask allowance, set when the counter is created and never refreshed —
@@ -44,26 +44,13 @@ export interface SharedSessionStore {
     recordCall(scope: string, toolName: string, nowMs: number): Promise<boolean>;
     /** The count including this trip, or `undefined` when unavailable. */
     incrReaskAttempt(scope: string, key: string): Promise<number | undefined>;
-    close(): Promise<void>;
-}
-export interface ValkeySessionStoreOptions {
-    timeoutMs?: number;
 }
 export declare class ValkeySessionStore implements SharedSessionStore {
-    private readonly client;
-    private readonly timeoutMs;
-    private warned;
-    constructor(url: string, opts?: ValkeySessionStoreOptions);
+    private readonly valkey;
+    /** The proxy's one Valkey connection, shared with its call budgets; the proxy closes it. */
+    constructor(valkey: GuardedValkey);
     readWindow(scope: string, nowMs: number, windowMs: number): Promise<SharedWindowSnapshot | undefined>;
     recordCall(scope: string, toolName: string, nowMs: number): Promise<boolean>;
     incrReaskAttempt(scope: string, key: string): Promise<number | undefined>;
-    close(): Promise<void>;
-    /**
-     * The fail-open wrapper every operation goes through: nothing is attempted
-     * unless the client is connected, nothing waits longer than the timeout,
-     * and any failure is `undefined`.
-     */
-    private guarded;
-    private warnOnce;
 }
 //# sourceMappingURL=sessionStore.d.ts.map

package/dist/sessionStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionStore.d.ts","sourceRoot":"","sources":["../src/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAC3C,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAC7C;0EAC0E;AAC1E,eAAO,MAAM,iBAAiB,OAAQ,CAAA;AAEtC,eAAO,MAAM,WAAW;4BACP,MAAM;4BACN,MAAM;4BACN,MAAM,OAAO,MAAM;CAC1B,CAAA;AAEV,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IACrG,sEAAsE;IACtE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5E,sEAAsE;IACtE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,kBAAmB,YAAW,kBAAkB;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAO;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,MAAM,CAAQ;gBAEV,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,yBAA8B;IAevD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAcrG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB5E,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IASzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B;;;;OAIG;YACW,OAAO;IAiBrB,OAAO,CAAC,QAAQ;CASjB"}
+{"version":3,"file":"sessionStore.d.ts","sourceRoot":"","sources":["../src/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAGvD,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAC7C;0EAC0E;AAC1E,eAAO,MAAM,iBAAiB,OAAQ,CAAA;AAEtC,eAAO,MAAM,WAAW;4BACP,MAAM;4BACN,MAAM;4BACN,MAAM,OAAO,MAAM;CAC1B,CAAA;AAEV,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IACrG,sEAAsE;IACtE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5E,sEAAsE;IACtE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAC1E;AAED,qBAAa,kBAAmB,YAAW,kBAAkB;IAE/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IADnC,4FAA4F;gBAC/D,MAAM,EAAE,aAAa;IAE5C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAcrG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB5E,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAQhF"}

package/dist/sessionStore.js

@@ -1,6 +1,6 @@
 /**
  * sessionStore.ts — the Valkey-backed session window the sibling proxy
- * processes of one harness session share (TD-437, Wave 5.3).
+ * processes of one harness session share (Wave 5.3).
  *
  * The Rust LLM proxy keeps a session's tool-call history in Valkey
  * (`store/valkey.rs`: a capped LIST for the sequence, a ZSET for the 60 s
@@ -12,21 +12,16 @@
  *
  * Never a hard dependency. Every operation fails open to `undefined`/`false`
  * and the caller (`SessionState`) falls back to its in-process window: when
- * no URL is configured, when the client is not connected (`status !==
- * 'ready'`, so an absent Valkey adds no latency), when a call takes longer
- * than {@link SHARED_WINDOW_TIMEOUT_MS}, or on any error. The proxy behaves
- * exactly as before Wave 5.3 in every one of those cases.
+ * no URL is configured, when the client is not connected (so an absent
+ * Valkey adds no latency), when a call takes longer than
+ * `VALKEY_COMMAND_TIMEOUT_MS`, or on any error — the guard every command on
+ * the proxy's one Valkey connection goes through (guardedValkey.ts). The
+ * proxy behaves exactly as before Wave 5.3 in every one of those cases.
  *
  * @module
  */
 import * as node_crypto from 'node:crypto';
-import { Redis } from 'ioredis';
-import { createStderrLogger } from './stderrLog.js';
-import { describeConnectionError } from './valkeyErrors.js';
 import { TOOL_SEQUENCE_CAP } from './session.js';
-const log = createStderrLogger('mcp-proxy.sessionStore');
-/** A shared read or write that takes longer than this loses to the local window. */
-export const SHARED_WINDOW_TIMEOUT_MS = 200;
 /** Sliding lifetime of the sequence and call-window keys — the Rust `TOOL_SEQUENCE_TTL_SECS`. */
 export const SESSION_WINDOW_TTL_SECS = 86_400;
 /** Lifetime of a reask allowance, set when the counter is created and never refreshed —
@@ -38,26 +33,14 @@ export const sessionKeys = {
     reask: (scope, key) => `v2:mcpsession:${scope}:reask:${key}`,
 };
 export class ValkeySessionStore {
-    client;
-    timeoutMs;
-    warned = false;
-    constructor(url, opts = {}) {
-        this.timeoutMs = opts.timeoutMs ?? SHARED_WINDOW_TIMEOUT_MS;
-        this.client = new Redis(url, {
-            lazyConnect: true,
-            // No offline queue: a command issued before the connection is up must
-            // fail now, not wait for a Valkey that may never answer.
-            enableOfflineQueue: false,
-            maxRetriesPerRequest: 1,
-            connectTimeout: 1000,
-            retryStrategy: (times) => Math.min(1000 * 2 ** Math.min(times, 5), 30_000),
-        });
-        this.client.on('error', (err) => this.warnOnce('Valkey session store unreachable', err));
-        void this.client.connect().catch((err) => this.warnOnce('Valkey session store connect failed', err));
+    valkey;
+    /** The proxy's one Valkey connection, shared with its call budgets; the proxy closes it. */
+    constructor(valkey) {
+        this.valkey = valkey;
     }
     async readWindow(scope, nowMs, windowMs) {
-        return this.guarded(async () => {
-            const results = await this.client
+        return this.valkey.run(async (client) => {
+            const results = await client
                 .pipeline()
                 .lrange(sessionKeys.tools(scope), 0, -1)
                 .zcount(sessionKeys.calls(scope), nowMs - windowMs, '+inf')
@@ -70,10 +53,10 @@ export class ValkeySessionStore {
         });
     }
     async recordCall(scope, toolName, nowMs) {
-        const done = await this.guarded(async () => {
+        const done = await this.valkey.run(async (client) => {
             const tools = sessionKeys.tools(scope);
             const calls = sessionKeys.calls(scope);
-            await this.client
+            await client
                 .pipeline()
                 .rpush(tools, toolName)
                 .ltrim(tools, -TOOL_SEQUENCE_CAP, -1)
@@ -89,55 +72,13 @@ export class ValkeySessionStore {
         return done === true;
     }
     async incrReaskAttempt(scope, key) {
-        return this.guarded(async () => {
+        return this.valkey.run(async (client) => {
             const k = sessionKeys.reask(scope, key);
-            const n = await this.client.incr(k);
+            const n = await client.incr(k);
             if (n === 1)
-                await this.client.expire(k, REASK_WINDOW_SECS);
+                await client.expire(k, REASK_WINDOW_SECS);
             return n;
         });
     }
-    async close() {
-        try {
-            await this.client.quit();
-        }
-        catch {
-            this.client.disconnect();
-        }
-    }
-    /**
-     * The fail-open wrapper every operation goes through: nothing is attempted
-     * unless the client is connected, nothing waits longer than the timeout,
-     * and any failure is `undefined`.
-     */
-    async guarded(op) {
-        if (this.client.status !== 'ready')
-            return undefined;
-        let timer;
-        const timeout = new Promise((resolve) => {
-            timer = setTimeout(() => resolve(undefined), this.timeoutMs);
-            timer.unref();
-        });
-        try {
-            return await Promise.race([op(), timeout]);
-        }
-        catch (err) {
-            this.warnOnce('Valkey session store operation failed', err);
-            return undefined;
-        }
-        finally {
-            if (timer)
-                clearTimeout(timer);
-        }
-    }
-    warnOnce(msg, err) {
-        const detail = { err: describeConnectionError(err) };
-        if (this.warned) {
-            log.debug(detail, msg);
-            return;
-        }
-        this.warned = true;
-        log.warn(detail, `${msg} — falling back to the per-process session window`);
-    }
 }
 //# sourceMappingURL=sessionStore.js.map

package/dist/sessionStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../src/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;AAExD,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAC3C,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAC7C;0EAC0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAEtC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,QAAQ;IACxD,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,QAAQ;IACxD,KAAK,EAAE,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,iBAAiB,KAAK,UAAU,GAAG,EAAE;CACpE,CAAA;AAuBV,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAO;IACb,SAAS,CAAQ;IAC1B,MAAM,GAAG,KAAK,CAAA;IAEtB,YAAY,GAAW,EAAE,OAAkC,EAAE;QAC3D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAA;QAC3D,IAAI,CAAC,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;YAC3B,WAAW,EAAE,IAAI;YACjB,sEAAsE;YACtE,yDAAyD;YACzD,kBAAkB,EAAE,KAAK;YACzB,oBAAoB,EAAE,CAAC;YACvB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3E,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC,CAAA;QACjG,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/G,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM;iBAC9B,QAAQ,EAAE;iBACV,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;iBACvC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;iBAC1D,IAAI,EAAE,CAAA;YACT,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAClC,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACxF,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAClF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,IAAI,CAAC,MAAM;iBACd,QAAQ,EAAE;iBACV,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC;iBACtB,KAAK,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;iBACpC,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC;iBACtC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;gBAChD,qEAAqE;gBACrE,gBAAgB;iBACf,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;iBAC1D,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC;iBACtC,IAAI,EAAE,CAAA;YACT,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,KAAK,IAAI,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,GAAW;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACvC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;YAC3D,OAAO,CAAC,CAAA;QACV,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CAAI,EAAoB;QAC3C,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAA;QACpD,IAAI,KAAiC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;YACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YAC5D,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC,CAAC,CAAA;QACF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAA;YAC3D,OAAO,SAAS,CAAA;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,GAAY;QACxC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAA;QACpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,mDAAmD,CAAC,CAAA;IAC7E,CAAC;CACF"}
+{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../src/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAC7C;0EAC0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAEtC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,QAAQ;IACxD,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,QAAQ;IACxD,KAAK,EAAE,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,iBAAiB,KAAK,UAAU,GAAG,EAAE;CACpE,CAAA;AAkBV,MAAM,OAAO,kBAAkB;IAEA;IAD7B,4FAA4F;IAC5F,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,MAAM;iBACzB,QAAQ,EAAE;iBACV,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;iBACvC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;iBAC1D,IAAI,EAAE,CAAA;YACT,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAClC,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACxF,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAClF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAClD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,MAAM;iBACT,QAAQ,EAAE;iBACV,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC;iBACtB,KAAK,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;iBACpC,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC;iBACtC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;gBAChD,qEAAqE;gBACrE,gBAAgB;iBACf,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;iBAC1D,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC;iBACtC,IAAI,EAAE,CAAA;YACT,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,KAAK,IAAI,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,GAAW;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACtD,OAAO,CAAC,CAAA;QACV,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/version.d.ts

@@ -0,0 +1,12 @@
+/**
+ * version.ts — this package's own version, read from its package.json.
+ *
+ * The standalone `intutic` MCP server reports it to clients in its
+ * `initialize` response. It was a hard-coded `'0.1.0'` that never moved with
+ * a release. `../package.json` resolves from both `src/` (tests) and `dist/`
+ * (the published build), and npm always ships package.json.
+ *
+ * @module
+ */
+export declare const PACKAGE_VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,eAAO,MAAM,eAAe,EAAE,MAA2F,CAAA"}

package/dist/version.js

@@ -0,0 +1,13 @@
+/**
+ * version.ts — this package's own version, read from its package.json.
+ *
+ * The standalone `intutic` MCP server reports it to clients in its
+ * `initialize` response. It was a hard-coded `'0.1.0'` that never moved with
+ * a release. `../package.json` resolves from both `src/` (tests) and `dist/`
+ * (the published build), and npm always ships package.json.
+ *
+ * @module
+ */
+import { createRequire } from 'node:module';
+export const PACKAGE_VERSION = createRequire(import.meta.url)('../package.json').version;
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAY,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAyB,CAAC,OAAO,CAAA"}

package/dist/wasm/context.d.ts

@@ -46,6 +46,8 @@ export interface WasmContextInput {
     corroboratingDetectors: number;
     /** `undefined` when no `tools/list` response has been TOFU-checked yet this session. */
     toolContractChanged: boolean | undefined;
+    /** The MCP server this proxy fronts (`--server-name`); a Rego rule reads it as `input.server`. */
+    serverName?: string;
 }
 /**
  * Builds the plain object to `JSON.stringify` and hand to a WASM rule's
@@ -54,4 +56,12 @@ export interface WasmContextInput {
  * not present as keys at all.
  */
 export declare function buildWasmContext(input: WasmContextInput): Record<string, unknown>;
+/**
+ * The `input` document a Rego rule is evaluated against — version 1, the shape
+ * `packages/proxy/src/wasm/opa.rs`'s `policy_input` builds for the LLM proxy,
+ * less the fields this proxy has no honest value for (`model`, `risk_tier`,
+ * the budget), plus `server`. Bounded and serialised by `boundedRegoInput`,
+ * which cuts long strings in `args` exactly as the Rust host does.
+ */
+export declare function buildRegoInput(input: WasmContextInput): string;
 //# sourceMappingURL=context.d.ts.map

package/dist/wasm/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IAChC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,OAAO,CAAA;IACtB,0GAA0G;IAC1G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB;;;mEAG+D;IAC/D,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wFAAwF;IACxF,mBAAmB,EAAE,OAAO,GAAG,SAAS,CAAA;CACzC;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBjF"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IAChC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,OAAO,CAAA;IACtB,0GAA0G;IAC1G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB;;;mEAG+D;IAC/D,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wFAAwF;IACxF,mBAAmB,EAAE,OAAO,GAAG,SAAS,CAAA;IACxC,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBjF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAkB9D"}

package/dist/wasm/context.js

@@ -17,6 +17,7 @@
  *
  * @module
  */
+import { REGO_INPUT_VERSION, boundedRegoInput } from '@intutic/shared-types';
 /** `(tool, count)` pairs, wire-shaped as 2-element arrays — see context.ts's module doc. */
 function foldToolCallCounts(sequence) {
     const counts = new Map();
@@ -56,4 +57,30 @@ export function buildWasmContext(input) {
     }
     return ctx;
 }
+/**
+ * The `input` document a Rego rule is evaluated against — version 1, the shape
+ * `packages/proxy/src/wasm/opa.rs`'s `policy_input` builds for the LLM proxy,
+ * less the fields this proxy has no honest value for (`model`, `risk_tier`,
+ * the budget), plus `server`. Bounded and serialised by `boundedRegoInput`,
+ * which cuts long strings in `args` exactly as the Rust host does.
+ */
+export function buildRegoInput(input) {
+    return boundedRegoInput({
+        v: REGO_INPUT_VERSION,
+        host: 'mcp',
+        tool: input.toolName,
+        args: input.toolArguments ?? {},
+        ...(input.serverName ? { server: input.serverName } : {}),
+        session: {
+            id: input.sessionId,
+            workspace_id: input.workspaceId,
+            tool_sequence: [...input.toolSequence],
+            calls_last_60s: input.callsLast60s,
+        },
+        request: {
+            dlp_findings: input.dlpFindingDescriptions.map((description) => ({ pattern_name: description })),
+            injection_findings: [...input.injectionFindings],
+        },
+    });
+}
 //# sourceMappingURL=context.js.map

package/dist/wasm/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkCH,4FAA4F;AAC5F,SAAS,kBAAkB,CAAC,QAA2B;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,MAAM,GAAG,GAA4B;QACnC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClG,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC;QACxD,cAAc,EAAE,KAAK,CAAC,YAAY;QAClC,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAChG,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAChD,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC9C,uBAAuB,EAAE,KAAK,CAAC,sBAAsB;KACtD,CAAA;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/wasm/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAmC5E,4FAA4F;AAC5F,SAAS,kBAAkB,CAAC,QAA2B;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1E,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,MAAM,GAAG,GAA4B;QACnC,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACnF,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClG,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC;QACxD,cAAc,EAAE,KAAK,CAAC,YAAY;QAClC,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAChG,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAChD,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC9C,uBAAuB,EAAE,KAAK,CAAC,sBAAsB;KACtD,CAAA;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,OAAO,gBAAgB,CAAC;QACtB,CAAC,EAAE,kBAAkB;QACrB,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,IAAI,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;QAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE;YACP,EAAE,EAAE,KAAK,CAAC,SAAS;YACnB,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;YACtC,cAAc,EAAE,KAAK,CAAC,YAAY;SACnC;QACD,OAAO,EAAE;YACP,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;YAChG,kBAAkB,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;SACjD;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/wasm/hostImports.d.ts

@@ -11,9 +11,9 @@
  * (never `console.log`/stdout — the same stdio-isolation rule every other
  * module in this package follows). `read_referenced_file` resolves against
  * the per-evaluation table the runner pre-reads through `referencedFiles.ts`
- * (TD-441) — the port of `host.rs`'s `read_referenced_file_impl`, code for
- * code: the read budget is charged before argument validation, a refusal is
- * a value the rule can act on, and nothing here traps. With no table (no
+ * — the port of `host.rs`'s `read_referenced_file_impl`, code for code: the
+ * read budget is charged before argument validation, a refusal is a value
+ * the rule can act on, and nothing here traps. With no table (no
  * `INTUTIC_WASM_MANIFEST_ROOT`, or a rule that does not import the function)
  * every call gets `ERR_REFUSED`, which is what the Rust proxy answers with no
  * root configured.

package/dist/wasm/hostImports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hostImports.d.ts","sourceRoot":"","sources":["../../src/wasm/hostImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,eAAe,EAOhB,MAAM,sBAAsB,CAAA;AAI7B,mIAAmI;AACnI,eAAO,MAAM,WAAW,KAAU,CAAA;AAElC,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,KAAK,EAAE,eAAe,CAAA;IACtB,6DAA6D;IAC7D,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,GAAE,eAAyC,GAAG,eAAe,CAEpG;AAoBD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,WAAW,CAAC,MAAM,GAAG,SAAS,EAC/C,KAAK,GAAE,eAAsC,GAC5C,WAAW,CAAC,aAAa,CA0G3B"}
+{"version":3,"file":"hostImports.d.ts","sourceRoot":"","sources":["../../src/wasm/hostImports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,eAAe,EAOhB,MAAM,sBAAsB,CAAA;AAI7B,mIAAmI;AACnI,eAAO,MAAM,WAAW,KAAU,CAAA;AAElC,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,KAAK,EAAE,eAAe,CAAA;IACtB,6DAA6D;IAC7D,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,GAAE,eAAyC,GAAG,eAAe,CAEpG;AAoBD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,WAAW,CAAC,MAAM,GAAG,SAAS,EAC/C,KAAK,GAAE,eAAsC,GAC5C,WAAW,CAAC,aAAa,CA2G3B"}

package/dist/wasm/hostImports.js

@@ -11,9 +11,9 @@
  * (never `console.log`/stdout — the same stdio-isolation rule every other
  * module in this package follows). `read_referenced_file` resolves against
  * the per-evaluation table the runner pre-reads through `referencedFiles.ts`
- * (TD-441) — the port of `host.rs`'s `read_referenced_file_impl`, code for
- * code: the read budget is charged before argument validation, a refusal is
- * a value the rule can act on, and nothing here traps. With no table (no
+ * — the port of `host.rs`'s `read_referenced_file_impl`, code for code: the
+ * read budget is charged before argument validation, a refusal is a value
+ * the rule can act on, and nothing here traps. With no table (no
  * `INTUTIC_WASM_MANIFEST_ROOT`, or a rule that does not import the function)
  * every call gets `ERR_REFUSED`, which is what the Rust proxy answers with no
  * root configured.
@@ -74,7 +74,8 @@ export function createHostImports(getMemory, state = newHostImportState()) {
         // Mirrors host.rs's `abort` import: log only, never throw/trap. A guest
         // unhandled-exception calling `abort` must not crash the evaluation —
         // the caller (worker.ts) still wraps the whole `evaluate` call so any
-        // resulting trap fails open, but this import itself is inert.
+        // resulting trap is a rule that reached no verdict, but this import itself
+        // is inert.
         abort: (msgPtr, filePtr, line, col) => {
             log.warn({ action: 'wasm_abort', msgPtr, filePtr, line, col }, 'WASM rule called abort (AssemblyScript unhandled exception)');
         },
@@ -110,9 +111,9 @@ export function createHostImports(getMemory, state = newHostImportState()) {
         },
         // Ported from host.rs's `read_referenced_file_impl`. Returns a length or
         // one of the negative codes; never throws — a host trap would unwind the
-        // guest, fail the whole evaluation and land in the runner's fail-open
-        // arm, so one malformed call would silently switch off every OTHER
-        // check the rule performs.
+        // guest and leave the whole evaluation without a verdict, so one malformed
+        // call would override every OTHER check the rule performs with the fail
+        // setting.
         read_referenced_file: (pathPtr, pathLen, outPtr, outCap) => {
             // Charged before anything else, including argument validation, so a
             // guest cannot spin on cheap malformed calls any more than on