@intutic/mcp-governance-proxy 2.2.0 → 2.4.0

package/dist/httpJson.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpJson.js","sourceRoot":"","sources":["../src/httpJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,yFAAyF;AACzF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,MAAc,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,WAAM,GAAN,MAAM,CAAQ;QAEjC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CACzB,MAAsB,EACtB,GAAW,EACX,MAAc,EACd,IAAa,EACb,SAAS,GAAG,IAAI;IAEhB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACvE,MAAM,OAAO,GAAoC;YAC/C,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;YAC5C,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACpD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;gBAClC,IAAI,MAAM,IAAI,GAAG;oBAAE,MAAM,CAAC,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,MAAM,IAAI,GAAG,aAAa,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;;oBACpH,OAAO,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAA;QACtD,CAAC,CAAC,CAAA;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvC,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,MAAc,EAAE,SAAkB;IAC3E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAY,CAAA;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,OAAgB,EAAE,SAAkB;IAC9F,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAA;IACvF,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AACpD,CAAC"}
+{"version":3,"file":"httpJson.js","sourceRoot":"","sources":["../src/httpJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AAEtC,yFAAyF;AACzF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,MAAc,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,WAAM,GAAN,MAAM,CAAQ;QAEjC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CACzB,MAAsB,EACtB,GAAW,EACX,MAAc,EACd,IAAa,EACb,SAAS,GAAG,IAAI;IAEhB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACvE,MAAM,OAAO,GAAoC;YAC/C,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,MAAM,EAAE,kBAAkB;SAC3B,CAAA;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;YAC5C,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5E,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACpD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;gBAClC,IAAI,MAAM,IAAI,GAAG;oBAAE,MAAM,CAAC,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,MAAM,IAAI,GAAG,aAAa,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;;oBACpH,OAAO,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAA;QACtD,CAAC,CAAC,CAAA;QACF,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvC,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,QAAgB,EAAE,SAAS,GAAG,IAAI;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACvE,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;QACjF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACnF,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;YAClC,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;gBAChB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;oBACpB,GAAG,CAAC,OAAO,EAAE,CAAA;oBACb,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,uBAAuB,QAAQ,QAAQ,CAAC,CAAC,CAAA;oBACzE,OAAM;gBACR,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAChB,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAClC,IAAI,MAAM,IAAI,GAAG;oBAAE,MAAM,CAAC,IAAI,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;;oBAChI,OAAO,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,YAAY,CAAC,CAAC,CAAA;QAChD,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,MAAc,EAAE,SAAkB;IAC3E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAY,CAAA;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,OAAgB,EAAE,SAAkB;IAC9F,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAA;IACvF,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AACpD,CAAC"}

package/dist/injection.js

@@ -65,7 +65,7 @@ const PATTERNS = [
  */
 const KILL_THRESHOLD = 2;
 /**
- * Workspace-supplied patterns, compiled (TD-436). Same contract as
+ * Workspace-supplied patterns, compiled. Same contract as
  * `dlp.ts`'s `setDynamicPatterns`: sources come from the control plane's
  * `mcpInjectionPatterns`, an invalid one is dropped and counted, and the
  * hardcoded floor above applies regardless — an unreachable control plane

package/dist/interceptor.d.ts

@@ -5,6 +5,8 @@
  * 0. The MCP server registry, server/tool allowlists and SSO group clearance
  * 1. DLP scan (credential / destructive pattern detection)
  * 2. SOP policy rules (fetched from control plane via PolicyClient)
+ * 3–5. Prompt injection, anomaly detectors, WASM rules
+ * 6. MCP call budgets — last, so only a call that would otherwise run is counted
  *
  * Returns an allow / block / redact decision.
  *
@@ -16,25 +18,38 @@ import type { WasmRunner } from './wasm/runner.js';
 import type { PolicyClient } from './policy.js';
 import { type GovernanceEmitter } from './emitter.js';
 import type { ApprovalHolds } from './approvalHold.js';
-export type Decision = {
-    action: 'allow';
-} | {
+import { type McpBudgetEnforcer } from './budget.js';
+import type { McpRefusalCode } from './refusals.js';
+/**
+ * A refusal: what the agent reads (`reason`), and what a client reads — the
+ * stable `code`, the `ruleId` that decided, and any `detail` the code carries
+ * (refusals.ts). All three reach the JSON-RPC frame's `error.data`.
+ */
+export interface Block {
     action: 'block';
     reason: string;
-} | {
+    code: Exclude<McpRefusalCode, 'HELD'>;
+    ruleId: string;
+    detail?: Record<string, unknown>;
+}
+export type Decision = {
+    action: 'allow';
+} | Block | {
     action: 'redact';
     reason: string;
     redactedInput: unknown;
 }
 /**
  * Refused for now, pending a person's approval (`require_approval`). Not a
- * block: the agent is told the hold id and that an identical retry passes
- * once approved — see approvalHold.ts.
+ * block: the agent is told the hold id and to retry once it is approved,
+ * which passes only while the workspace's review-hold bypass is on — see
+ * approvalHold.ts. `holdId` is empty when the hold could not be recorded.
  */
  | {
     action: 'hold';
     reason: string;
     holdId: string;
+    ruleId: string;
 };
 export declare class ToolCallInterceptor {
     private readonly policy;
@@ -111,6 +126,13 @@ export declare class ToolCallInterceptor {
      * refusal — never an allow.
      */
     private readonly holds;
+    /**
+     * Counts each call against the workspace's MCP call budgets (budget.ts).
+     * `undefined` (construction sites that predate budgets) skips them; the
+     * proxy always passes one, with no store when it has no Valkey, so a
+     * covered call then resolves through the fail setting.
+     */
+    private readonly budgets;
     constructor(policy: PolicyClient, emitter: GovernanceEmitter, 
     /**
      * The local fail setting (`INTUTIC_MCP_FAIL_OPEN`, config.ts). The
@@ -183,7 +205,16 @@ export declare class ToolCallInterceptor {
      * holds) leaves such a call held with nothing recorded, which is still a
      * refusal — never an allow.
      */
-    holds?: ApprovalHolds | undefined);
+    holds?: ApprovalHolds | undefined, 
+    /**
+     * Counts each call against the workspace's MCP call budgets (budget.ts).
+     * `undefined` (construction sites that predate budgets) skips them; the
+     * proxy always passes one, with no store when it has no Valkey, so a
+     * covered call then resolves through the fail setting.
+     */
+    budgets?: McpBudgetEnforcer | undefined);
+    /** Set once this process has said that budgets went unchecked under fail-open, so the log says it once. */
+    private budgetsUncheckedWarned;
     /**
      * Whether a governance check that cannot complete lets the call through:
      * the workspace's `mcpProxyFailBehavior` when the control plane has sent
@@ -203,9 +234,9 @@ export declare class ToolCallInterceptor {
     /**
      * A `require_approval` rule matched. Returns the hold decision, or `null`
      * when an approved bypass for this exact call lets it continue. Every hold
-     * reason names the hold id and the command that approves it, the same
-     * wording the hook gates print, so a person reading the agent's transcript
-     * knows what to run.
+     * reason names the hold id, who may approve it and when a retry passes, in
+     * the words the hook gates print (`holdApprovalHint`), so a person reading
+     * the agent's transcript knows what to do.
      */
     private hold;
     /**
@@ -226,6 +257,18 @@ export declare class ToolCallInterceptor {
      * from an `allow` one without the registry.
      */
     private checkRegistry;
+    /**
+     * Brings the workspace's control-plane rules up to date with the policy, and
+     * refuses the call when they have never loaded and the proxy fails closed.
+     *
+     * Never loaded means no policy from the control plane yet, or one whose rule
+     * binaries could not be fetched: whether one of those rules refuses this
+     * call is unknown. Fail-open judges the call by the rules that are loaded —
+     * this machine's — as a workspace with no uploaded rules would be;
+     * fail-closed refuses it, as it does an unknown registry. Once loaded, the
+     * set is kept for as long as the process runs, through any later outage.
+     */
+    private checkCloudRulesLoaded;
     /**
      * The workspace's SSO group policy, applied to the member this proxy's API
      * key resolves to, by `evaluateSsoGroupClearance` — the function the
@@ -248,5 +291,17 @@ export declare class ToolCallInterceptor {
      * @returns Decision: allow, block, or redact
      */
     decide(toolName: string, toolInput: unknown): Promise<Decision>;
+    /**
+     * Counts the call against every budget that covers it, or refuses it when
+     * one is used up. The threshold and exceeded events go out once per budget
+     * per period (the store claims them), each as a `budget_breach` finding; a
+     * refusal also sends `tool_blocked`, as every refusal does, carrying the
+     * budget — the control plane files one incident per budget per period from
+     * those and counts the rest on it.
+     *
+     * When the count cannot be checked, the fail setting decides, as for every
+     * other governance check that cannot complete.
+     */
+    private checkBudgets;
 }
 //# sourceMappingURL=interceptor.d.ts.map

package/dist/interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,aAAa,CAAA;AACxD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAItD,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE;AAC9D;;;;GAIG;GACD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtD,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAzEL,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB;IAC3C;;;;OAIG;IACc,aAAa,GAAE,OAAc;IAC9C;;;;;;OAMG;IACc,UAAU,GAAE,MAAkB;IAC/C;;;;;;;OAOG;IACc,sBAAsB,GAAE,MAAM,GAAG,OAAgB;IAClE;;;;;;;;OAQG;IACc,OAAO,GAAE,YAAiC;IAC3D;;;;;;;OAOG;IACc,kBAAkB,GAAE,WAAuB;IAC5D;;;;;;OAMG;IACc,uBAAuB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAAC,CAAM;IAC5F;;;;;OAKG;IACc,UAAU,GAAE,UAAU,GAAG,SAAqB;IAC/D;;;;;;OAMG;IACc,WAAW,GAAE,MAAkB;IAChD;;;;;OAKG;IACc,KAAK,GAAE,aAAa,GAAG,SAAqB;IAG/D;;;;;OAKG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;;;;;OAOG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;YACW,IAAI;IAwBlB;;;;;;;;;;;;;;;;OAgBG;YACW,aAAa;IAmC3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CA8RtE"}
+{"version":3,"file":"interceptor.d.ts","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,aAAa,CAAA;AACxD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAuE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACzH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAInD;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB,KAAK,GACL;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE;AAC9D;;;;;GAKG;GACD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAatE,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAhFP,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,iBAAiB;IAC3C;;;;OAIG;IACc,aAAa,GAAE,OAAc;IAC9C;;;;;;OAMG;IACc,UAAU,GAAE,MAAkB;IAC/C;;;;;;;OAOG;IACc,sBAAsB,GAAE,MAAM,GAAG,OAAgB;IAClE;;;;;;;;OAQG;IACc,OAAO,GAAE,YAAiC;IAC3D;;;;;;;OAOG;IACc,kBAAkB,GAAE,WAAuB;IAC5D;;;;;;OAMG;IACc,uBAAuB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAAC,CAAM;IAC5F;;;;;OAKG;IACc,UAAU,GAAE,UAAU,GAAG,SAAqB;IAC/D;;;;;;OAMG;IACc,WAAW,GAAE,MAAkB;IAChD;;;;;OAKG;IACc,KAAK,GAAE,aAAa,GAAG,SAAqB;IAC7D;;;;;OAKG;IACc,OAAO,GAAE,iBAAiB,GAAG,SAAqB;IAGrE,2GAA2G;IAC3G,OAAO,CAAC,sBAAsB,CAAQ;IAEtC;;;;;OAKG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;;;;;OAOG;YACW,gBAAgB;IAmB9B;;;;;;OAMG;YACW,IAAI;IAuBlB;;;;;;;;;;;;;;;;OAgBG;YACW,aAAa;IAyB3B;;;;;;;;;;OAUG;YACW,qBAAqB;IAYnC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAkB9B;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqUrE;;;;;;;;;;OAUG;YACW,YAAY;CAwD3B"}

package/dist/interceptor.js

@@ -5,6 +5,8 @@
  * 0. The MCP server registry, server/tool allowlists and SSO group clearance
  * 1. DLP scan (credential / destructive pattern detection)
  * 2. SOP policy rules (fetched from control plane via PolicyClient)
+ * 3–5. Prompt injection, anomaly detectors, WASM rules
+ * 6. MCP call budgets — last, so only a call that would otherwise run is counted
  *
  * Returns an allow / block / redact decision.
  *
@@ -12,13 +14,22 @@
  */
 import * as node_crypto from 'node:crypto';
 import { createStderrLogger as createLogger } from './stderrLog.js';
-import { evaluateSsoGroupClearance } from '@intutic/shared-types';
-import { scanToolInput, formatDlpBlockReason, setDynamicPatterns } from './dlp.js';
+import { evaluateMcpRegistry, evaluateSsoGroupClearance, holdApprovalHint } from '@intutic/shared-types';
+import { scanToolInput, formatDlpBlockReason, setDynamicPatterns, setWorkspacePii } from './dlp.js';
 import { scanText, injectionSeverity, setDynamicInjectionPatterns } from './injection.js';
 import { evaluateSequenceDetectors, resolveEffectiveDisposition, REASK_MAX_ATTEMPTS } from './anomaly/index.js';
 import { SessionState } from './session.js';
 import { detectionFinding } from './emitter.js';
+import { budgetEventDetail, exceededReason, unavailableReason, warningReason } from './budget.js';
 const log = createLogger('mcp-proxy-interceptor');
+/** The decision for a refusal. */
+function block(code, ruleId, reason, detail) {
+    return detail ? { action: 'block', reason, code, ruleId, detail } : { action: 'block', reason, code, ruleId };
+}
+/** Every governance check that cannot complete refuses with this, when the proxy fails closed. */
+const FAIL_CLOSED_REASON = 'Governance check failed — Intutic control plane unreachable. ' +
+    'Tool call blocked by workspace policy (fail-closed mode). ' +
+    'Contact your administrator or update mcpProxyFailBehavior to open.';
 export class ToolCallInterceptor {
     policy;
     emitter;
@@ -31,6 +42,7 @@ export class ToolCallInterceptor {
     wasmRunner;
     workspaceId;
     holds;
+    budgets;
     constructor(policy, emitter, 
     /**
      * The local fail setting (`INTUTIC_MCP_FAIL_OPEN`, config.ts). The
@@ -103,7 +115,14 @@ export class ToolCallInterceptor {
      * holds) leaves such a call held with nothing recorded, which is still a
      * refusal — never an allow.
      */
-    holds = undefined) {
+    holds = undefined, 
+    /**
+     * Counts each call against the workspace's MCP call budgets (budget.ts).
+     * `undefined` (construction sites that predate budgets) skips them; the
+     * proxy always passes one, with no store when it has no Valkey, so a
+     * covered call then resolves through the fail setting.
+     */
+    budgets = undefined) {
         this.policy = policy;
         this.emitter = emitter;
         this.localFailOpen = localFailOpen;
@@ -115,7 +134,10 @@ export class ToolCallInterceptor {
         this.wasmRunner = wasmRunner;
         this.workspaceId = workspaceId;
         this.holds = holds;
+        this.budgets = budgets;
     }
+    /** Set once this process has said that budgets went unchecked under fail-open, so the log says it once. */
+    budgetsUncheckedWarned = false;
     /**
      * Whether a governance check that cannot complete lets the call through:
      * the workspace's `mcpProxyFailBehavior` when the control plane has sent
@@ -142,19 +164,19 @@ export class ToolCallInterceptor {
                 `attempts with no correction.`;
             log.warn({ action: 'reask_hardened', toolName, key, attempts }, 'Reask attempts exhausted — hardening to a hard block');
             this.emitter.emit('tool_blocked', toolName, toolInput, hardenedReason);
-            return { action: 'block', reason: hardenedReason };
+            return block('REASK_EXHAUSTED', key, hardenedReason);
         }
         const reaskReason = `${baseReason} (attempt ${attempts}/${REASK_MAX_ATTEMPTS} — will become an unconditional ` +
             `block if this keeps tripping)`;
         this.emitter.emit('tool_blocked', toolName, toolInput, reaskReason);
-        return { action: 'block', reason: reaskReason };
+        return block('REASK', key, reaskReason);
     }
     /**
      * A `require_approval` rule matched. Returns the hold decision, or `null`
      * when an approved bypass for this exact call lets it continue. Every hold
-     * reason names the hold id and the command that approves it, the same
-     * wording the hook gates print, so a person reading the agent's transcript
-     * knows what to run.
+     * reason names the hold id, who may approve it and when a retry passes, in
+     * the words the hook gates print (`holdApprovalHint`), so a person reading
+     * the agent's transcript knows what to do.
      */
     async hold(rule, toolName, toolInput) {
         const outcome = this.holds
@@ -168,14 +190,13 @@ export class ToolCallInterceptor {
         }
         const reason = outcome.recorded
             ? `HELD for approval: ${rule.reason} [${rule.id}]. Hold id: ${outcome.holdId}. ` +
-                `An approver can run: intutic decision approve ${outcome.holdId} (or reject it). ` +
-                `Retry this exact call after it is approved.`
+                holdApprovalHint(outcome.holdId)
             : `HELD for approval: ${rule.reason} [${rule.id}], but the hold could not be recorded ` +
                 `(Intutic control plane unreachable), so there is nothing to approve yet. Retry once the ` +
                 `control plane is reachable to request approval.`;
         log.warn({ action: 'tool_held', toolName, ruleId: rule.id, holdId: outcome.holdId, recorded: outcome.recorded }, reason);
         this.emitter.emit('tool_held', toolName, toolInput, `${rule.reason} [${rule.id}]`);
-        return { action: 'hold', reason, holdId: outcome.holdId };
+        return { action: 'hold', reason, holdId: outcome.recorded ? outcome.holdId : '', ruleId: rule.id };
     }
     /**
      * Refuses the call when the registry says this server — or this tool on it —
@@ -205,30 +226,40 @@ export class ToolCallInterceptor {
                 `Tool call blocked (fail-closed mode: mcpProxyFailBehavior or INTUTIC_MCP_FAIL_OPEN=false).`;
             log.warn({ action: 'registry_unknown_block', serverName: this.serverName, toolName }, reason);
             this.emitter.emit('tool_blocked', toolName, toolInput, reason);
-            return { action: 'block', reason };
-        }
-        let reason = null;
-        if (registry.blockedServers.includes(this.serverName)) {
-            reason =
-                `MCP server "${this.serverName}" is blocked in this workspace's MCP server registry. ` +
-                    `An owner or admin can change that on the MCP Servers page.`;
-        }
-        else if (registry.defaultPolicy === 'deny' && !registry.approvedServers.includes(this.serverName)) {
-            reason =
-                `MCP server "${this.serverName}" is not approved in this workspace's MCP server registry, ` +
-                    `and the workspace refuses unapproved servers (mcpDefaultPolicy: deny). It is waiting in ` +
-                    `the approval queue on the MCP Servers page for an owner or admin.`;
+            return block('REGISTRY_UNAVAILABLE', 'mcpProxyFailBehavior', reason);
         }
-        else if ((registry.disabledTools[this.serverName] ?? []).includes(toolName)) {
-            reason =
-                `Tool "${toolName}" is disabled on MCP server "${this.serverName}" in this workspace's ` +
-                    `MCP server registry. An owner or admin can re-enable it on the MCP Servers page.`;
-        }
-        if (!reason)
+        // The decision every gate makes (`@intutic/shared-types` mcpRegistryRecord.ts):
+        // the harness hook gates apply the same function, from the policy
+        // snapshot, to the servers no proxy fronts.
+        const decision = evaluateMcpRegistry(registry, this.serverName, toolName);
+        const refusal = decision ? block(decision.code, decision.ruleId, decision.reason) : null;
+        if (!refusal)
             return null;
-        log.warn({ action: 'registry_block', serverName: this.serverName, toolName }, reason);
+        log.warn({ action: 'registry_block', serverName: this.serverName, toolName }, refusal.reason);
+        this.emitter.emit('tool_blocked', toolName, toolInput, refusal.reason);
+        return refusal;
+    }
+    /**
+     * Brings the workspace's control-plane rules up to date with the policy, and
+     * refuses the call when they have never loaded and the proxy fails closed.
+     *
+     * Never loaded means no policy from the control plane yet, or one whose rule
+     * binaries could not be fetched: whether one of those rules refuses this
+     * call is unknown. Fail-open judges the call by the rules that are loaded —
+     * this machine's — as a workspace with no uploaded rules would be;
+     * fail-closed refuses it, as it does an unknown registry. Once loaded, the
+     * set is kept for as long as the process runs, through any later outage.
+     */
+    async checkCloudRulesLoaded(runner, toolName, toolInput) {
+        await runner.syncCloudRules(this.policy.getWasmRules());
+        if (runner.cloudRulesLoaded() || this.failOpen)
+            return null;
+        const reason = `This workspace's custom rules have not loaded (Intutic control plane unreachable since this ` +
+            `proxy started), so whether one of them refuses this call is unknown. Tool call blocked ` +
+            `(fail-closed mode: mcpProxyFailBehavior or INTUTIC_MCP_FAIL_OPEN=false).`;
+        log.warn({ action: 'wasm_cloud_unknown_block', toolName }, reason);
         this.emitter.emit('tool_blocked', toolName, toolInput, reason);
-        return { action: 'block', reason };
+        return block('GOVERNANCE_UNAVAILABLE', 'mcpProxyFailBehavior', reason);
     }
     /**
      * The workspace's SSO group policy, applied to the member this proxy's API
@@ -256,7 +287,7 @@ export class ToolCallInterceptor {
         const reason = `${decision.reason} [${decision.ruleId}]`;
         log.warn({ action: 'sso_group_block', toolName, memberId: principal?.memberId ?? null, ruleId: decision.ruleId }, reason);
         this.emitter.emit('tool_blocked', toolName, toolInput, reason);
-        return { action: 'block', reason };
+        return block('SSO_GROUP', decision.ruleId ?? 'sso_group', reason);
     }
     /**
      * Evaluate a tools/call request and return a governance decision.
@@ -299,7 +330,7 @@ export class ToolCallInterceptor {
                 `allowlist in workspace settings (mcpAllowedServers).`;
             log.warn({ action: 'server_allowlist_block', serverName: this.serverName, toolName }, reason);
             this.emitter.emit('tool_blocked', toolName, toolInput, reason);
-            return { action: 'block', reason };
+            return block('SERVER_NOT_ALLOWED', 'mcpAllowedServers', reason);
         }
         // 0. Additive tool scoping. When the workspace declares an allowlist,
         // ONLY those tools may be called — the inverse of every other rule here,
@@ -314,7 +345,7 @@ export class ToolCallInterceptor {
                 `allowlist in workspace settings (mcpAllowedTools).`;
             log.warn({ action: 'allowlist_block', toolName }, reason);
             this.emitter.emit('tool_blocked', toolName, toolInput, reason);
-            return { action: 'block', reason };
+            return block('TOOL_NOT_ALLOWED', 'mcpAllowedTools', reason);
         }
         // 0.5. SSO group clearance, after the scoping checks and before DLP.
         const clearance = this.checkSsoGroupClearance(toolName, toolInput);
@@ -328,6 +359,21 @@ export class ToolCallInterceptor {
         catch {
             // Pattern delivery must never take the scanner down; the floor stands.
         }
+        // The workspace's PII detector actions, the baseline this machine's
+        // INTUTIC_MCP_DLP_DETECTORS may only tighten. When the control plane
+        // could not read them, which detectors the workspace requires is
+        // unknown: fail-closed refuses the call, as the LLM proxy refuses the
+        // request; fail-open scans with the local config alone.
+        const piiDetectors = this.policy.getPiiDetectors();
+        if (piiDetectors.kind === 'unreadable' && !this.failOpen) {
+            const reason = `This workspace's PII detector actions could not be read (${piiDetectors.reason}), so which ` +
+                `detectors apply is unknown. Tool call blocked (fail-closed mode: mcpProxyFailBehavior or ` +
+                `INTUTIC_MCP_FAIL_OPEN=false).`;
+            log.warn({ action: 'pii_detectors_unreadable_block', toolName }, reason);
+            this.emitter.emit('tool_blocked', toolName, toolInput, reason);
+            return block('GOVERNANCE_UNAVAILABLE', 'piiDetectors', reason);
+        }
+        setWorkspacePii(piiDetectors);
         try {
             const dlp = scanToolInput(toolInput);
             // Captured regardless of outcome — by pipeline position, a non-empty
@@ -339,19 +385,13 @@ export class ToolCallInterceptor {
                 const reason = formatDlpBlockReason(dlp.findings);
                 log.warn({ action: 'dlp_block', toolName, findings: dlp.findings }, 'DLP block');
                 this.emitter.emit('tool_blocked', toolName, toolInput, reason);
-                return { action: 'block', reason };
+                return block('DLP', `dlp.${dlp.findings[0]?.pattern ?? 'input'}`, reason);
             }
         }
         catch (err) {
             log.error({ action: 'dlp_error', err: err.message }, 'DLP scan error — skipping');
-            if (!this.failOpen) {
-                return {
-                    action: 'block',
-                    reason: 'Governance check failed — Intutic control plane unreachable. ' +
-                        'Tool call blocked by workspace policy (fail-closed mode). ' +
-                        'Contact your administrator or update mcpProxyFailBehavior to open.',
-                };
-            }
+            if (!this.failOpen)
+                return block('GOVERNANCE_UNAVAILABLE', 'mcpProxyFailBehavior', FAIL_CLOSED_REASON);
         }
         // 2. SOP policy rule match
         try {
@@ -361,13 +401,13 @@ export class ToolCallInterceptor {
                 if (rule.action === 'block') {
                     log.warn({ action: 'policy_block', toolName, ruleId: rule.id, reason: rule.reason }, 'Policy block');
                     this.emitter.emit('tool_blocked', toolName, toolInput, rule.reason);
-                    return { action: 'block', reason: rule.reason };
+                    return block('SOP_RULE', rule.id, rule.reason);
                 }
                 if (rule.action === 'warn') {
                     log.warn({ action: 'policy_warn', toolName, ruleId: rule.id, reason: rule.reason }, 'Policy warning (allowing)');
                     // Fall through to allow. Reported as `tool_flagged` with the rule id
                     // in the reason — the same shape the harness gates use — so a
-                    // SHADOW guardrail's evidence (LLD #71) counts this proxy's traffic.
+                    // SHADOW guardrail's evidence counts this proxy's traffic.
                     this.emitter.emit('tool_flagged', toolName, toolInput, `${rule.reason} [${rule.id}]`);
                 }
                 if (rule.action === 'require_approval') {
@@ -380,14 +420,8 @@ export class ToolCallInterceptor {
         }
         catch (err) {
             log.error({ action: 'policy_error', err: err.message }, 'Policy evaluation error');
-            if (!this.failOpen) {
-                return {
-                    action: 'block',
-                    reason: 'Governance check failed — Intutic control plane unreachable. ' +
-                        'Tool call blocked by workspace policy (fail-closed mode). ' +
-                        'Contact your administrator or update mcpProxyFailBehavior to open.',
-                };
-            }
+            if (!this.failOpen)
+                return block('GOVERNANCE_UNAVAILABLE', 'mcpProxyFailBehavior', FAIL_CLOSED_REASON);
         }
         // 3. Prompt-injection scan (request direction) — the `toolInput` a
         // MISBEHAVING or COMPROMISED calling agent sends, e.g. an agent that
@@ -416,7 +450,7 @@ export class ToolCallInterceptor {
                 });
                 if (injectionAction === 'block') {
                     this.emitter.emit('tool_blocked', toolName, toolInput, reason);
-                    return { action: 'block', reason };
+                    return block('INJECTION', 'injection.tool_input', reason);
                 }
                 // 'warn' (default): report only, fall through to allow.
             }
@@ -441,7 +475,7 @@ export class ToolCallInterceptor {
         // built) and allow.
         const anomalyMode = this.policy.getAnomalyMode() ?? this.anomalyModeDefault;
         // The session window — the shared one across this session's sibling
-        // proxy processes when a store is configured (Wave 5.3, TD-437), the
+        // proxy processes when a store is configured (Wave 5.3), the
         // per-process one otherwise. One round trip at most per tools/call, and
         // none when nothing below would read it.
         const window = anomalyMode !== 'off' || this.wasmRunner ? await this.session.loadWindow(toolName) : undefined;
@@ -467,7 +501,7 @@ export class ToolCallInterceptor {
                     this.emitter.emit('anomaly_detected', toolName, toolInput, finding.reason, detectionFinding(finding, effective, severity));
                     if (effective === 'kill') {
                         this.emitter.emit('tool_blocked', toolName, toolInput, finding.reason);
-                        return { action: 'block', reason: finding.reason };
+                        return block('ANOMALY', finding.detectorId, finding.reason);
                     }
                     if (effective === 'reask') {
                         // Keyed per-detector-id, independent of every other detector's
@@ -488,14 +522,19 @@ export class ToolCallInterceptor {
                 log.error({ action: 'anomaly_detection_error', err: err.message }, 'Anomaly detection error — skipping');
             }
         }
-        // 5. WASM custom rules (Phase 3) — operator-authored, compiled
-        // AssemblyScript rules dropped into `~/.intutic/wasm/`. Position: after
-        // every built-in check, immediately before allow — this is deliberately
-        // the LAST gate, so a WASM rule's `RequestContext` carries
+        // 5. WASM custom rules (Phase 3) — operator-authored rules, native or
+        // Rego: the workspace's, uploaded to the control plane, and this
+        // machine's, dropped into `~/.intutic/wasm/`. Position: after every
+        // built-in check, immediately before allow — this is deliberately the
+        // LAST gate, so a WASM rule's `RequestContext` carries
         // `injection_findings`/`corroborating_detectors`/etc. already populated
         // by the steps above it (see `wasm/context.ts`'s module doc).
         if (this.wasmRunner) {
+            const unloaded = await this.checkCloudRulesLoaded(this.wasmRunner, toolName, toolInput);
+            if (unloaded)
+                return unloaded;
             try {
+                const shadow = [];
                 const verdict = await this.wasmRunner.evaluate({
                     sessionId: this.session.sessionId,
                     workspaceId: this.workspaceId,
@@ -510,30 +549,112 @@ export class ToolCallInterceptor {
                     injectionSources: injectionSourcesForContext,
                     corroboratingDetectors: corroboratingDetectorsForContext,
                     toolContractChanged: this.session.getToolContractChanged(),
-                });
+                    serverName: this.serverName,
+                }, shadow);
+                // Whatever the call's outcome: the shadowed rules' evaluations are
+                // promotion evidence whether or not another rule refused the call.
+                if (shadow.length > 0) {
+                    this.emitter.emit('wasm_shadow_evaluated', toolName, toolInput, undefined, undefined, undefined, { wasmShadowReports: shadow });
+                }
+                if (verdict.code === 'unavailable') {
+                    // A rule reached no verdict: refused whatever `failOpen` says (see
+                    // `WasmRunner.evaluate`). Reported like any refusal, except a
+                    // quarantined rule's: the call that quarantined it was reported
+                    // already, and one event per refused call after it would file an
+                    // incident per retry.
+                    log.warn({ action: 'wasm_unavailable_block', toolName, ruleId: verdict.ruleId, stop: verdict.stop }, verdict.reason);
+                    if (verdict.stop !== 'quarantined')
+                        this.emitter.emit('tool_blocked', toolName, toolInput, verdict.reason);
+                    return block('GOVERNANCE_UNAVAILABLE', `wasm:${verdict.ruleId}`, verdict.reason);
+                }
                 if (verdict.code === 'block') {
                     log.warn({ action: 'wasm_block', toolName, ruleId: verdict.ruleId }, 'Tool call blocked by WASM governance rule');
                     this.emitter.emit('tool_blocked', toolName, toolInput, verdict.reason);
-                    return { action: 'block', reason: verdict.reason };
+                    return block('WASM_RULE', `wasm:${verdict.ruleId}`, verdict.reason);
                 }
                 if (verdict.code === 'reask') {
                     // Keyed per-rule-id, independent of every anomaly detector's own
                     // counter — see applyReaskLadder's doc comment.
                     return await this.applyReaskLadder(`wasm:${verdict.ruleId}`, verdict.reason, toolName, toolInput);
                 }
+                if (verdict.code === 'hold') {
+                    // A Rego rule's hold takes the `require_approval` path: the same
+                    // approved-bypass lookup and hold record, keyed on the rule id.
+                    const held = await this.hold({ id: verdict.ruleId, reason: verdict.reason }, toolName, toolInput);
+                    if (held)
+                        return held;
+                    // An approved bypass: the remaining checks still apply.
+                }
                 // 'allow': fall through.
             }
             catch (err) {
-                // Fail-open, matching every other governance-check catch in this
-                // method — a WASM runner failure (not to be confused with a single
-                // rule's own timeout/trap, which `WasmRunner.evaluate` already
-                // absorbs internally) must not take the whole proxy down.
-                log.error({ action: 'wasm_evaluate_error', err: err.message }, 'WASM rule evaluation error — skipping');
+                // The runner itself failed (not one rule's timeout or trap, which
+                // `WasmRunner.evaluate` turns into a verdict): no rule judged the
+                // call, so it is refused like a rule that reached no verdict, whatever
+                // the fail setting.
+                log.error({ action: 'wasm_evaluate_error', err: err.message }, 'WASM rule evaluation error');
+                return block('GOVERNANCE_UNAVAILABLE', 'wasm', `Custom rules could not be evaluated: ${err.message}. Tool call blocked: a rule ` +
+                    `that cannot decide never allows.`);
             }
         }
-        // 6. Allow — emit telemetry event
+        // 6. MCP call budgets — after every other check, so a call another check
+        // refuses never spends allowance.
+        const budgetDecision = await this.checkBudgets(toolName, toolInput);
+        if (budgetDecision)
+            return budgetDecision;
+        // 7. Allow — emit telemetry event
         this.emitter.emit('tool_allowed', toolName, toolInput);
         return { action: 'allow' };
     }
+    /**
+     * Counts the call against every budget that covers it, or refuses it when
+     * one is used up. The threshold and exceeded events go out once per budget
+     * per period (the store claims them), each as a `budget_breach` finding; a
+     * refusal also sends `tool_blocked`, as every refusal does, carrying the
+     * budget — the control plane files one incident per budget per period from
+     * those and counts the rest on it.
+     *
+     * When the count cannot be checked, the fail setting decides, as for every
+     * other governance check that cannot complete.
+     */
+    async checkBudgets(toolName, toolInput) {
+        if (!this.budgets)
+            return null;
+        const policy = this.policy.getMcpBudgets();
+        const verdict = await this.budgets.check(policy, toolName, this.policy.getPrincipal()?.memberId ?? null);
+        if (verdict.kind === 'unlimited')
+            return null;
+        if (verdict.kind === 'allowed') {
+            for (const standing of verdict.warnings) {
+                const reason = warningReason(standing, policy.warnAtPct);
+                log.warn({ action: 'mcp_budget_threshold', toolName, budgetId: standing.budget.id, used: standing.used }, reason);
+                this.emitter.emit('mcp_budget_threshold', toolName, undefined, reason, { detectorId: 'budget', kind: 'budget_breach', disposition: 'steer', severity: 'low', confidence: 1 }, budgetEventDetail(standing));
+            }
+            return null;
+        }
+        if (verdict.kind === 'exceeded') {
+            const reason = exceededReason(verdict.standing);
+            log.warn({ action: 'mcp_budget_exceeded', toolName, budgetId: verdict.standing.budget.id, notify: verdict.notify }, reason);
+            if (verdict.notify) {
+                this.emitter.emit('mcp_budget_exceeded', toolName, undefined, reason, { detectorId: 'budget', kind: 'budget_breach', disposition: 'kill', severity: 'medium', confidence: 1 }, budgetEventDetail(verdict.standing));
+            }
+            const detail = budgetEventDetail(verdict.standing);
+            this.emitter.emit('tool_blocked', toolName, toolInput, reason, undefined, detail);
+            return block('BUDGET_EXCEEDED', detail.budgetId, reason, { ...detail });
+        }
+        // Unavailable: no Valkey configured, or it did not answer.
+        if (this.failOpen) {
+            if (!this.budgetsUncheckedWarned) {
+                this.budgetsUncheckedWarned = true;
+                log.warn({ action: 'mcp_budget_unchecked', budgets: verdict.budgets.map((b) => b.id) }, 'MCP call budgets cover calls through this proxy but could not be checked (no Valkey, or unreachable); ' +
+                    'allowing them uncounted (fail-open)');
+            }
+            return null;
+        }
+        const reason = unavailableReason(verdict.budgets);
+        log.warn({ action: 'mcp_budget_unchecked_block', toolName }, reason);
+        this.emitter.emit('tool_blocked', toolName, toolInput, reason);
+        return block('BUDGET_UNAVAILABLE', 'mcpProxyFailBehavior', reason, { budgetIds: verdict.budgets.map((b) => b.id) });
+    }
 }
 //# sourceMappingURL=interceptor.js.map