@intutic/mcp-governance-proxy 2.1.0 → 2.3.0

package/dist/guardedValkey.js

@@ -0,0 +1,84 @@
+/**
+ * guardedValkey.ts — the one Valkey connection a proxy process holds, and the
+ * guard every command on it goes through.
+ *
+ * Two things in a proxy read and write Valkey: the shared session window
+ * (sessionStore.ts) and the MCP call budgets (budget.ts). They share this
+ * connection, and they share its rule: a command runs only on a connected
+ * client, never waits longer than a short timeout, and any failure comes back
+ * as `undefined`. What `undefined` means is each caller's business — the
+ * session window falls back to its per-process copy; a budget follows the
+ * proxy's fail setting.
+ *
+ * @module
+ */
+import { Redis } from 'ioredis';
+import { createStderrLogger } from './stderrLog.js';
+import { describeConnectionError } from './valkeyErrors.js';
+const log = createStderrLogger('mcp-proxy.valkey');
+/** A command that takes longer than this is treated as Valkey being unavailable. */
+export const VALKEY_COMMAND_TIMEOUT_MS = 200;
+export class GuardedValkey {
+    client;
+    timeoutMs;
+    warned = false;
+    constructor(url, opts = {}) {
+        this.timeoutMs = opts.timeoutMs ?? VALKEY_COMMAND_TIMEOUT_MS;
+        this.client = new Redis(url, {
+            lazyConnect: true,
+            // No offline queue: a command issued before the connection is up must
+            // fail now, not wait for a Valkey that may never answer.
+            enableOfflineQueue: false,
+            maxRetriesPerRequest: 1,
+            connectTimeout: 1000,
+            retryStrategy: (times) => Math.min(1000 * 2 ** Math.min(times, 5), 30_000),
+        });
+        this.client.on('error', (err) => this.warnOnce('Valkey unreachable', err));
+        void this.client.connect().catch((err) => this.warnOnce('Valkey connect failed', err));
+    }
+    /** Runs `op`, or answers `undefined` when Valkey is not connected, too slow, or fails. */
+    async run(op, opts = {}) {
+        let timer;
+        const timeout = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(undefined), this.timeoutMs);
+            timer.unref();
+        });
+        try {
+            if (this.client.status !== 'ready') {
+                const settingUp = this.client.status === 'connecting' || this.client.status === 'connect';
+                if (!opts.awaitConnect || !settingUp)
+                    return undefined;
+                const ready = new Promise((resolve) => this.client.once('ready', () => resolve(true)));
+                if ((await Promise.race([ready, timeout])) !== true)
+                    return undefined;
+            }
+            return await Promise.race([op(this.client), timeout]);
+        }
+        catch (err) {
+            this.warnOnce('Valkey command failed', err);
+            return undefined;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    async close() {
+        try {
+            await this.client.quit();
+        }
+        catch {
+            this.client.disconnect();
+        }
+    }
+    warnOnce(msg, err) {
+        const detail = { err: describeConnectionError(err) };
+        if (this.warned) {
+            log.debug(detail, msg);
+            return;
+        }
+        this.warned = true;
+        log.warn(detail, `${msg} — the anomaly session window falls back to this process, and MCP call budgets follow the fail setting`);
+    }
+}
+//# sourceMappingURL=guardedValkey.js.map

package/dist/guardedValkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardedValkey.js","sourceRoot":"","sources":["../src/guardedValkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAE3D,MAAM,GAAG,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;AAElD,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAgB5C,MAAM,OAAO,aAAa;IACf,MAAM,CAAO;IACL,SAAS,CAAQ;IAC1B,MAAM,GAAG,KAAK,CAAA;IAEtB,YAAY,GAAW,EAAE,OAA6B,EAAE;QACtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,yBAAyB,CAAA;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;YAC3B,WAAW,EAAE,IAAI;YACjB,sEAAsE;YACtE,yDAAyD;YACzD,kBAAkB,EAAE,KAAK;YACzB,oBAAoB,EAAE,CAAC;YACvB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3E,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,CAAA;QACnF,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,GAAG,CAAI,EAAiC,EAAE,OAA0B,EAAE;QAC1E,IAAI,KAAiC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;YACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YAC5D,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC,CAAC,CAAA;QACF,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAA;gBACzF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;oBAAE,OAAO,SAAS,CAAA;gBACtD,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC5F,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAA;YACvE,CAAC;YACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAA;YAC3C,OAAO,SAAS,CAAA;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,GAAY;QACxC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAA;QACpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,GAAG,CAAC,IAAI,CACN,MAAM,EACN,GAAG,GAAG,wGAAwG,CAC/G,CAAA;IACH,CAAC;CACF"}

package/dist/httpJson.d.ts

@@ -0,0 +1,19 @@
+/**
+ * httpJson.ts — the one HTTP client this package uses to talk to the control
+ * plane (node:http/https; no fetch polyfill, no extra dependency).
+ *
+ * Rejects on a transport error, a timeout, or any status >= 400, with the
+ * status in the message — a wrong or removed endpoint must surface as a
+ * failure, never as an empty success.
+ *
+ * @module
+ */
+/** A response with an error status, carrying the status for a caller that acts on it. */
+export declare class HttpStatusError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare function httpRequest(method: 'GET' | 'POST', url: string, apiKey: string, body?: string, timeoutMs?: number): Promise<string>;
+export declare function getJson(url: string, apiKey: string, timeoutMs?: number): Promise<unknown>;
+export declare function postJson(url: string, apiKey: string, payload: unknown, timeoutMs?: number): Promise<unknown>;
+//# sourceMappingURL=httpJson.d.ts.map

package/dist/httpJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpJson.d.ts","sourceRoot":"","sources":["../src/httpJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,yFAAyF;AACzF,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIrD;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,GAAG,MAAM,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,EACb,SAAS,SAAO,GACf,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/F;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlH"}

package/dist/httpJson.js

@@ -0,0 +1,62 @@
+/**
+ * httpJson.ts — the one HTTP client this package uses to talk to the control
+ * plane (node:http/https; no fetch polyfill, no extra dependency).
+ *
+ * Rejects on a transport error, a timeout, or any status >= 400, with the
+ * status in the message — a wrong or removed endpoint must surface as a
+ * failure, never as an empty success.
+ *
+ * @module
+ */
+import * as node_https from 'node:https';
+import * as node_http from 'node:http';
+/** A response with an error status, carrying the status for a caller that acts on it. */
+export class HttpStatusError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'HttpStatusError';
+    }
+}
+export function httpRequest(method, url, apiKey, body, timeoutMs = 5000) {
+    return new Promise((resolve, reject) => {
+        const lib = new URL(url).protocol === 'https:' ? node_https : node_http;
+        const headers = {
+            Authorization: `Bearer ${apiKey}`,
+            Accept: 'application/json',
+        };
+        if (body !== undefined) {
+            headers['Content-Type'] = 'application/json';
+            headers['Content-Length'] = Buffer.byteLength(body);
+        }
+        const req = lib.request(url, { method, headers, timeout: timeoutMs }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => {
+                const text = Buffer.concat(chunks).toString('utf-8');
+                const status = res.statusCode ?? 0;
+                if (status >= 400)
+                    reject(new HttpStatusError(status, `HTTP ${method} ${url} returned ${status}: ${text.slice(0, 200)}`));
+                else
+                    resolve(text);
+            });
+        });
+        req.on('error', reject);
+        req.on('timeout', () => {
+            req.destroy();
+            reject(new Error(`HTTP ${method} ${url} timed out`));
+        });
+        if (body !== undefined)
+            req.write(body);
+        req.end();
+    });
+}
+export async function getJson(url, apiKey, timeoutMs) {
+    return JSON.parse(await httpRequest('GET', url, apiKey, undefined, timeoutMs));
+}
+export async function postJson(url, apiKey, payload, timeoutMs) {
+    const text = await httpRequest('POST', url, apiKey, JSON.stringify(payload), timeoutMs);
+    return text ? JSON.parse(text) : null;
+}
+//# sourceMappingURL=httpJson.js.map

package/dist/httpJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpJson.js","sourceRoot":"","sources":["../src/httpJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,yFAAyF;AACzF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,MAAc,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,WAAM,GAAN,MAAM,CAAQ;QAEjC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CACzB,MAAsB,EACtB,GAAW,EACX,MAAc,EACd,IAAa,EACb,SAAS,GAAG,IAAI;IAEhB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACvE,MAAM,OAAO,GAAoC;YAC/C,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;YAC5C,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACpD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;gBAClC,IAAI,MAAM,IAAI,GAAG;oBAAE,MAAM,CAAC,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,MAAM,IAAI,GAAG,aAAa,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;;oBACpH,OAAO,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAA;QACtD,CAAC,CAAC,CAAA;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvC,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,MAAc,EAAE,SAAkB;IAC3E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAY,CAAA;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,OAAgB,EAAE,SAAkB;IAC9F,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAA;IACvF,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AACpD,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,27 @@
+/**
+ * identity.ts — who is calling, as far as this proxy process can tell.
+ *
+ * Carried on every governance event and hold record. Three of these fields are
+ * local observations the control plane records as reported, never as proof:
+ * the OS account the proxy runs under, the harness session it shares with its
+ * sibling proxies (sessionScope.ts), and the server it fronts. The fourth is
+ * the API key's prefix — the first 12 characters of a `vk_` key, which the
+ * control plane itself treats as a published identifier rather than a secret
+ * (`apiKeyAuth.ts` keys its lookup on it). The member the key belongs to is
+ * resolved by the control plane from the key itself, so it is not here: a
+ * proxy can claim an OS user, but not a member.
+ *
+ * @module
+ */
+export interface CallerIdentity {
+    /** First 12 characters of the `vk_` API key; absent for any other credential. */
+    apiKeyPrefix?: string;
+    /** The OS account this proxy runs as. */
+    osUser?: string;
+    /** The harness session scope shared with sibling proxies, when one could be derived. */
+    session?: string;
+    /** The MCP server this proxy fronts (`--server-name`). */
+    serverName: string;
+}
+export declare function callerIdentity(apiKey: string, serverName: string, session: string | undefined): CallerIdentity;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;CACnB;AAcD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAO9G"}

package/dist/identity.js

@@ -0,0 +1,36 @@
+/**
+ * identity.ts — who is calling, as far as this proxy process can tell.
+ *
+ * Carried on every governance event and hold record. Three of these fields are
+ * local observations the control plane records as reported, never as proof:
+ * the OS account the proxy runs under, the harness session it shares with its
+ * sibling proxies (sessionScope.ts), and the server it fronts. The fourth is
+ * the API key's prefix — the first 12 characters of a `vk_` key, which the
+ * control plane itself treats as a published identifier rather than a secret
+ * (`apiKeyAuth.ts` keys its lookup on it). The member the key belongs to is
+ * resolved by the control plane from the key itself, so it is not here: a
+ * proxy can claim an OS user, but not a member.
+ *
+ * @module
+ */
+import * as node_os from 'node:os';
+/** The same prefix length the control plane's key lookup uses. */
+const KEY_PREFIX_LENGTH = 12;
+function osUserName() {
+    try {
+        return node_os.userInfo().username || undefined;
+    }
+    catch {
+        // No passwd entry for the uid (some containers): there is no name to report.
+        return undefined;
+    }
+}
+export function callerIdentity(apiKey, serverName, session) {
+    return {
+        ...(apiKey.startsWith('vk_') ? { apiKeyPrefix: apiKey.slice(0, KEY_PREFIX_LENGTH) } : {}),
+        ...(osUserName() ? { osUser: osUserName() } : {}),
+        ...(session ? { session } : {}),
+        serverName,
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAalC,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAE5B,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,IAAI,SAAS,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,UAAkB,EAAE,OAA2B;IAC5F,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,UAAU;KACX,CAAA;AACH,CAAC"}

package/dist/injection.js

@@ -65,7 +65,7 @@ const PATTERNS = [
  */
 const KILL_THRESHOLD = 2;
 /**
- * Workspace-supplied patterns, compiled (TD-436). Same contract as
+ * Workspace-supplied patterns, compiled. Same contract as
  * `dlp.ts`'s `setDynamicPatterns`: sources come from the control plane's
  * `mcpInjectionPatterns`, an invalid one is dropped and counted, and the
  * hardcoded floor above applies regardless — an unreachable control plane

package/dist/interceptor.d.ts

@@ -2,8 +2,11 @@
  * interceptor.ts — tools/call decision engine.
  *
  * Given a tool name and arguments, evaluates:
+ * 0. The MCP server registry, server/tool allowlists and SSO group clearance
  * 1. DLP scan (credential / destructive pattern detection)
  * 2. SOP policy rules (fetched from control plane via PolicyClient)
+ * 3–5. Prompt injection, anomaly detectors, WASM rules
+ * 6. MCP call budgets — last, so only a call that would otherwise run is counted
  *
  * Returns an allow / block / redact decision.
  *
@@ -13,21 +16,50 @@ import type { AnomalyMode, Disposition } from './anomaly/index.js';
 import { SessionState } from './session.js';
 import type { WasmRunner } from './wasm/runner.js';
 import type { PolicyClient } from './policy.js';
-import type { GovernanceEmitter } from './emitter.js';
-export type Decision = {
-    action: 'allow';
-} | {
+import { type GovernanceEmitter } from './emitter.js';
+import type { ApprovalHolds } from './approvalHold.js';
+import { type McpBudgetEnforcer } from './budget.js';
+import type { McpRefusalCode } from './refusals.js';
+/**
+ * A refusal: what the agent reads (`reason`), and what a client reads — the
+ * stable `code`, the `ruleId` that decided, and any `detail` the code carries
+ * (refusals.ts). All three reach the JSON-RPC frame's `error.data`.
+ */
+export interface Block {
     action: 'block';
     reason: string;
-} | {
+    code: Exclude<McpRefusalCode, 'HELD'>;
+    ruleId: string;
+    detail?: Record<string, unknown>;
+}
+export type Decision = {
+    action: 'allow';
+} | Block | {
     action: 'redact';
     reason: string;
     redactedInput: unknown;
+}
+/**
+ * Refused for now, pending a person's approval (`require_approval`). Not a
+ * block: the agent is told the hold id and to retry once it is approved,
+ * which passes only while the workspace's review-hold bypass is on — see
+ * approvalHold.ts. `holdId` is empty when the hold could not be recorded.
+ */
+ | {
+    action: 'hold';
+    reason: string;
+    holdId: string;
+    ruleId: string;
 };
 export declare class ToolCallInterceptor {
     private readonly policy;
     private readonly emitter;
-    private readonly failOpen;
+    /**
+     * The local fail setting (`INTUTIC_MCP_FAIL_OPEN`, config.ts). The
+     * workspace's `mcpProxyFailBehavior`, once a policy has delivered it,
+     * takes precedence — see {@link failOpen}.
+     */
+    private readonly localFailOpen;
     /**
      * The real MCP server this proxy process fronts, from `--server-name`
      * (config.ts, threaded since Phase D's `wrapWithProxy` but unconsumed
@@ -87,7 +119,27 @@ export declare class ToolCallInterceptor {
      * belongs to).
      */
     private readonly workspaceId;
-    constructor(policy: PolicyClient, emitter: GovernanceEmitter, failOpen?: boolean, 
+    /**
+     * Turns a `require_approval` rule into a hold through the control
+     * plane's decisions API. `undefined` (construction sites that predate
+     * holds) leaves such a call held with nothing recorded, which is still a
+     * refusal — never an allow.
+     */
+    private readonly holds;
+    /**
+     * Counts each call against the workspace's MCP call budgets (budget.ts).
+     * `undefined` (construction sites that predate budgets) skips them; the
+     * proxy always passes one, with no store when it has no Valkey, so a
+     * covered call then resolves through the fail setting.
+     */
+    private readonly budgets;
+    constructor(policy: PolicyClient, emitter: GovernanceEmitter, 
+    /**
+     * The local fail setting (`INTUTIC_MCP_FAIL_OPEN`, config.ts). The
+     * workspace's `mcpProxyFailBehavior`, once a policy has delivered it,
+     * takes precedence — see {@link failOpen}.
+     */
+    localFailOpen?: boolean, 
     /**
      * The real MCP server this proxy process fronts, from `--server-name`
      * (config.ts, threaded since Phase D's `wrapWithProxy` but unconsumed
@@ -146,7 +198,30 @@ export declare class ToolCallInterceptor {
      * identity: the MCP SERVER this process fronts, not the WORKSPACE it
      * belongs to).
      */
-    workspaceId?: string);
+    workspaceId?: string, 
+    /**
+     * Turns a `require_approval` rule into a hold through the control
+     * plane's decisions API. `undefined` (construction sites that predate
+     * holds) leaves such a call held with nothing recorded, which is still a
+     * refusal — never an allow.
+     */
+    holds?: ApprovalHolds | undefined, 
+    /**
+     * Counts each call against the workspace's MCP call budgets (budget.ts).
+     * `undefined` (construction sites that predate budgets) skips them; the
+     * proxy always passes one, with no store when it has no Valkey, so a
+     * covered call then resolves through the fail setting.
+     */
+    budgets?: McpBudgetEnforcer | undefined);
+    /** Set once this process has said that budgets went unchecked under fail-open, so the log says it once. */
+    private budgetsUncheckedWarned;
+    /**
+     * Whether a governance check that cannot complete lets the call through:
+     * the workspace's `mcpProxyFailBehavior` when the control plane has sent
+     * it, the local `INTUTIC_MCP_FAIL_OPEN` until then (and for a workspace
+     * that never chose).
+     */
+    get failOpen(): boolean;
     /**
      * Applies the shared reask ladder (Phase 2 anomaly detectors AND Phase 3
      * WASM rules both use this): a session-lifetime attempt counter keyed by
@@ -156,6 +231,46 @@ export declare class ToolCallInterceptor {
      * it, exactly like every other new block reason in this package.
      */
     private applyReaskLadder;
+    /**
+     * A `require_approval` rule matched. Returns the hold decision, or `null`
+     * when an approved bypass for this exact call lets it continue. Every hold
+     * reason names the hold id, who may approve it and when a retry passes, in
+     * the words the hook gates print (`holdApprovalHint`), so a person reading
+     * the agent's transcript knows what to do.
+     */
+    private hold;
+    /**
+     * Refuses the call when the registry says this server — or this tool on it —
+     * may not be used. Returns `null` to let the call continue.
+     *
+     * A blocked server is refused under either default; under `deny`, so is any
+     * server not approved (a candidate, or one the registry has never seen);
+     * a disabled tool is refused within any server. All three are definite
+     * operator decisions and do not depend on `failOpen`.
+     *
+     * What does depend on it is a registry this process has never loaded — the
+     * control plane unreachable since start, or only the MCP daemon's snapshot
+     * seed so far. The last-known registry is kept for as long as the process
+     * runs, so this is only ever the never-loaded case. Fail-open lets the call continue
+     * unchecked against the registry, exactly as a workspace with no registry;
+     * fail-closed refuses it, because a `deny` workspace cannot be told apart
+     * from an `allow` one without the registry.
+     */
+    private checkRegistry;
+    /**
+     * The workspace's SSO group policy, applied to the member this proxy's API
+     * key resolves to, by `evaluateSsoGroupClearance` — the function the
+     * server-side hook gate (`resolveSsoGroupPrivilege`) and the policy snapshot
+     * use, so all of them answer alike. A tool matches by its bare MCP name or
+     * as `mcp__<server>__<tool>`, the name the harness hooks see for the same
+     * call. A tool on the `requireOboFor` list is refused: a proxy has no
+     * on-behalf-of token to present.
+     *
+     * With a policy but no resolved member the groups are unknown, and a
+     * high-risk tool is refused rather than allowed — unknown is never granted.
+     * Without a policy there is nothing to apply.
+     */
+    private checkSsoGroupClearance;
     /**
      * Evaluate a tools/call request and return a governance decision.
      *
@@ -164,5 +279,17 @@ export declare class ToolCallInterceptor {
      * @returns Decision: allow, block, or redact
      */
     decide(toolName: string, toolInput: unknown): Promise<Decision>;
+    /**
+     * Counts the call against every budget that covers it, or refuses it when
+     * one is used up. The threshold and exceeded events go out once per budget
+     * per period (the store claims them), each as a `budget_breach` finding; a
+     * refusal also sends `tool_blocked`, as every refusal does, carrying the
+     * budget — the control plane files one incident per budget per period from
+     * those and counts the rest on it.
+     *
+     * When the count cannot be checked, the fail setting decides, as for every
+     * other governance check that cannot complete.
+     */
+    private checkBudgets;
 }
 //# sourceMappingURL=interceptor.d.ts.map

package/dist/interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAIrD,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAA;AAEhE,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW;gBA7DX,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,GAAE,OAAc;IACzC;;;;;;OAMG;IACc,UAAU,GAAE,MAAkB;IAC/C;;;;;;;OAOG;IACc,sBAAsB,GAAE,MAAM,GAAG,OAAgB;IAClE;;;;;;;;OAQG;IACc,OAAO,GAAE,YAAiC;IAC3D;;;;;;;OAOG;IACc,kBAAkB,GAAE,WAAuB;IAC5D;;;;;;OAMG;IACc,uBAAuB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAAC,CAAM;IAC5F;;;;;OAKG;IACc,UAAU,GAAE,UAAU,GAAG,SAAqB;IAC/D;;;;;;OAMG;IACc,WAAW,GAAE,MAAkB;IAGlD;;;;;;;OAOG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAiRtE"}
+{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,aAAa,CAAA;AACxD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAuE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACzH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAInD;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB,KAAK,GACL;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE;AAC9D;;;;;GAKG;GACD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAatE,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAhFP,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB;IAC3C;;;;OAIG;IACc,aAAa,GAAE,OAAc;IAC9C;;;;;;OAMG;IACc,UAAU,GAAE,MAAkB;IAC/C;;;;;;;OAOG;IACc,sBAAsB,GAAE,MAAM,GAAG,OAAgB;IAClE;;;;;;;;OAQG;IACc,OAAO,GAAE,YAAiC;IAC3D;;;;;;;OAOG;IACc,kBAAkB,GAAE,WAAuB;IAC5D;;;;;;OAMG;IACc,uBAAuB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAAC,CAAM;IAC5F;;;;;OAKG;IACc,UAAU,GAAE,UAAU,GAAG,SAAqB;IAC/D;;;;;;OAMG;IACc,WAAW,GAAE,MAAkB;IAChD;;;;;OAKG;IACc,KAAK,GAAE,aAAa,GAAG,SAAqB;IAC7D;;;;;OAKG;IACc,OAAO,GAAE,iBAAiB,GAAG,SAAqB;IAGrE,2GAA2G;IAC3G,OAAO,CAAC,sBAAsB,CAAQ;IAEtC;;;;;OAKG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;;;;;OAOG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;YACW,IAAI;IAuBlB;;;;;;;;;;;;;;;;OAgBG;YACW,aAAa;IAyB3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4TrE;;;;;;;;;;OAUG;YACW,YAAY;CAwD3B"}