@intutic/mcp-governance-proxy 2.4.0 → 2.5.1

package/README.md

@@ -22,7 +22,7 @@ The proxy spawns the real MCP server as a child process and relays JSON-RPC mess
 
 ### Standalone Mode
 
-With no server to wrap (no `--` command, no `--remote-url`), `intutic-mcp-proxy` is itself an MCP server named `intutic`, exposing three read-only tools: `intutic_governance_status`, `intutic_list_sops` and `intutic_list_incidents`. The two list tools take a `limit` (1–50, default 10), and `intutic_list_incidents` an optional incident `type`, such as `SCOPE_VIOLATION`, `WASM_RULE_REFUSED` or `SYSTEM_ANOMALY`. The control plane lists incidents only for the OWNER, ADMIN or EM role; any other role gets a message saying so instead.
+With no server to wrap (no `--` command, no `--remote-url`), `intutic-mcp-proxy` is itself an MCP server named `intutic`, exposing six read-only tools: `intutic_governance_status` (whether the control plane is reachable and accepts the API key), `intutic_list_sops` (the workspace's VALIDATED SOPs, the ones in force), `intutic_list_incidents`, `intutic_hold_status` (whether a held call, named by its `holdId`, was approved, and whether the identical retry will pass), `intutic_mcp_registry_status` (what the MCP server registry says about every server, or one `server`) and `intutic_mcp_budget_remaining` (the workspace's MCP call budgets that count your calls, with the calls left and when each resets). The two list tools take a `limit` (1–50, default 10), and `intutic_list_incidents` an optional incident `type`, such as `SCOPE_VIOLATION`, `WASM_RULE_REFUSED` or `SYSTEM_ANOMALY`. The control plane lists incidents only for the OWNER, ADMIN or EM role; any other role gets a message saying so instead.
 
 ```
 Agent ↔ intutic-mcp-proxy (MCP server) ↔ Intutic control plane

package/dist/agentTools.d.ts

@@ -21,23 +21,36 @@ export declare const LIST_INCIDENTS_ARGS: {
     limit: z.ZodDefault<z.ZodNumber>;
     type: z.ZodOptional<z.ZodEnum<[import("@intutic/shared-types").IncidentType, ...import("@intutic/shared-types").IncidentType[]]>>;
 };
+/**
+ * The control-plane path `intutic_list_sops` reads: the workspace's VALIDATED
+ * SOPs, the ones in force. Without the filter the list held drafts,
+ * hypotheses and invalidated SOPs too, under a tool that says "active".
+ */
+export declare function sopListPath(workspaceId: string, limit: number): string;
+/**
+ * `intutic_governance_status`'s answer. Asks `GET /api/v1/auth/key-context`,
+ * which only answers a valid workspace API key: the public `/healthz` it used
+ * to ask never looked at the key, so a rejected key read as connected.
+ */
+export declare function governanceStatus(controlPlaneUrl: string, apiKey: string, workspaceId: string): Promise<Record<string, unknown>>;
 /** The control-plane path `intutic_list_incidents` reads. */
 export declare function incidentListPath(workspaceId: string, args: {
     limit: number;
     type?: string;
 }): string;
 /** One control-plane read, never thrown: a failure degrades a tool's answer, it does not crash the server. */
+export type ControlPlaneFailure = 'unauthorized' | 'forbidden' | 'not_found' | 'unreachable';
 export type ControlPlaneResult = {
     ok: true;
     data: unknown;
 } | {
     ok: false;
-    reason: 'forbidden' | 'not_found' | 'unreachable';
+    reason: ControlPlaneFailure;
 };
 export declare function readControlPlane(controlPlaneUrl: string, apiKey: string, workspaceId: string, path: string): Promise<ControlPlaneResult>;
 /** Renders a failed read as text for the agent, naming the actual cause. */
 export declare function describeFailure(result: {
-    reason: 'forbidden' | 'not_found' | 'unreachable';
+    reason: ControlPlaneFailure;
 }, what: string): string;
 export interface HoldStatus {
     holdId: string;

package/dist/agentTools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentTools.d.ts","sourceRoot":"","sources":["../src/agentTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAmD,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC7G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;CAM/B,CAAA;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIpG;AAED,8GAA8G;AAC9G,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,CAAA;CAAE,CAAA;AAEpE,wBAAsB,gBAAgB,CACpC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,CAAA;CAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMnH;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAA;IAC3D,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAA;IACxD,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,QAAQ,EAAE,OAAO,GAAG,UAAU,CA0CxG;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkCtF;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACrD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAC3D,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAoB5B"}
+{"version":3,"file":"agentTools.d.ts","sourceRoot":"","sources":["../src/agentTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAmD,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC7G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;CAM/B,CAAA;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwBlC;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIpG;AAED,8GAA8G;AAC9G,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,CAAA;AAE5F,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAE9C,wBAAsB,gBAAgB,CACpC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,CAAC,CAgB7B;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,mBAAmB,CAAA;CAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS7F;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAA;IAC3D,qCAAqC;IACrC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAA;IACxD,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,QAAQ,EAAE,OAAO,GAAG,UAAU,CA0CxG;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkCtF;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,EACvB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACrD,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAC3D,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAoB5B"}

package/dist/agentTools.js

@@ -25,6 +25,43 @@ export const LIST_INCIDENTS_ARGS = {
         .optional()
         .describe('Only incidents of this type: an anomaly type such as SCOPE_VIOLATION, or WASM_RULE_REFUSED or SYSTEM_ANOMALY'),
 };
+/**
+ * The control-plane path `intutic_list_sops` reads: the workspace's VALIDATED
+ * SOPs, the ones in force. Without the filter the list held drafts,
+ * hypotheses and invalidated SOPs too, under a tool that says "active".
+ */
+export function sopListPath(workspaceId, limit) {
+    return `/api/v1/sops?${new URLSearchParams({ workspaceId, limit: String(limit), lifecycle_state: 'VALIDATED' })}`;
+}
+/**
+ * `intutic_governance_status`'s answer. Asks `GET /api/v1/auth/key-context`,
+ * which only answers a valid workspace API key: the public `/healthz` it used
+ * to ask never looked at the key, so a rejected key read as connected.
+ */
+export async function governanceStatus(controlPlaneUrl, apiKey, workspaceId) {
+    const res = await readControlPlane(controlPlaneUrl, apiKey, workspaceId, '/api/v1/auth/key-context');
+    if (!res.ok) {
+        return {
+            connected: false,
+            controlPlane: controlPlaneUrl,
+            workspaceId,
+            error: res.reason === 'unauthorized' || res.reason === 'forbidden'
+                ? 'Control plane rejected this API key'
+                : res.reason === 'not_found'
+                    ? 'Control plane has no key-context route'
+                    : 'Control plane unreachable',
+        };
+    }
+    const key = (res.data ?? {});
+    return {
+        connected: true,
+        controlPlane: controlPlaneUrl,
+        workspaceId,
+        apiKeyValid: true,
+        ...(typeof key.workspaceId === 'string' ? { keyWorkspaceId: key.workspaceId } : {}),
+        ...(typeof key.role === 'string' ? { role: key.role } : {}),
+    };
+}
 /** The control-plane path `intutic_list_incidents` reads. */
 export function incidentListPath(workspaceId, args) {
     const q = new URLSearchParams({ workspaceId, limit: String(args.limit) });
@@ -38,8 +75,10 @@ export async function readControlPlane(controlPlaneUrl, apiKey, workspaceId, pat
             headers: { Authorization: `Bearer ${apiKey}`, 'x-workspace-id': workspaceId },
             signal: AbortSignal.timeout(5000),
         });
-        // 403 and 404 are answers, not outages. Collapsing them into
+        // 401, 403 and 404 are answers, not outages. Collapsing them into
         // "unreachable" sends someone debugging their network for an hour.
+        if (res.status === 401)
+            return { ok: false, reason: 'unauthorized' };
         if (res.status === 403)
             return { ok: false, reason: 'forbidden' };
         if (res.status === 404)
@@ -54,6 +93,9 @@ export async function readControlPlane(controlPlaneUrl, apiKey, workspaceId, pat
 }
 /** Renders a failed read as text for the agent, naming the actual cause. */
 export function describeFailure(result, what) {
+    if (result.reason === 'unauthorized') {
+        return `The Intutic control plane rejected this API key when asked to ${what}. Check INTUTIC_API_KEY.`;
+    }
     if (result.reason === 'forbidden') {
         return `Your Intutic role is not permitted to ${what}. This needs the OWNER, ADMIN or EM role.`;
     }

package/dist/agentTools.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentTools.js","sourceRoot":"","sources":["../src/agentTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAwB,MAAM,uBAAuB,CAAA;AAC7G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnG,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,cAAc,CAAC;SACpB,QAAQ,EAAE;SACV,QAAQ,CAAC,8GAA8G,CAAC;CAC5H,CAAA;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAAsC;IAC1F,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACzE,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACvC,OAAO,qBAAqB,CAAC,EAAE,CAAA;AACjC,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE;YACnD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE;YAC7E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAA;QACF,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QACjE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;QACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAC7C,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,MAA6D,EAAE,IAAY;IACzG,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,yCAAyC,IAAI,2CAA2C,CAAA;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,wDAAwD,IAAI,GAAG,CAAA;IACzG,OAAO,oCAAoC,IAAI,GAAG,CAAA;AACpD,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,QAA8B,EAAE,QAAiB;IAC1F,MAAM,MAAM,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAChF,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO;YACL,MAAM;YACN,MAAM;YACN,KAAK,EAAE,MAAM;YACb,OAAO,EACL,6EAA6E;gBAC7E,6BAA6B,MAAM,oEAAoE;SAC1G,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAA;IACrI,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAI,QAA0C,EAAE,QAAQ,CAAA;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,CAAC,CAAE,IAAuC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CACtG;YACH,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,KAAK,EAAE,QAAQ;gBACf,eAAe,EAAE,MAAM,CAAC,SAAmB;gBAC3C,OAAO,EAAE,yEAAyE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC;aAC7I,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM;YACN,KAAK,EAAE,YAAY;YACnB,OAAO,EACL,+EAA+E;gBAC/E,2GAA2G;gBAC3G,yEAAyE;SAC5E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,MAAM,2BAA2B,EAAE,CAAA;AAC7G,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa,EAAE,MAAe;IAC3D,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmD,CAAA;IAC3E,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,OAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;SACvF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,KAAK,IAAI,CAAA;QACrC,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,MAAM,KAAK,SAAS;gBACpB,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,aAAa,KAAK,OAAO;oBAClD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,8DAA8D,CAAA;QACtE,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,UAAU;YACpB,MAAM;YACN,KAAK;YACL,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;SACrE,CAAA;IACH,CAAC,CAAC,CAAA;IACJ,OAAO;QACL,aAAa;QACb,OAAO;QACP,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAChC,CAAC,CAAC;gBACE,IAAI,EACF,aAAa,KAAK,MAAM;oBACtB,CAAC,CAAC,IAAI,MAAM,8GAA8G;oBAC1H,CAAC,CAAC,IAAI,MAAM,iFAAiF;aAClG;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,WAAmB,EACnB,MAAqD,EACrD,QAA2D,EAC3D,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAA;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC7B,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7H,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACnB,OAAO;YACL,QAAQ,EAAE,CAAC,CAAC,EAAE;YACd,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,IAAI,IAAI;YACf,SAAS,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC5D,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACvD,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"agentTools.js","sourceRoot":"","sources":["../src/agentTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAwB,MAAM,uBAAuB,CAAA;AAC7G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnG,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,cAAc,CAAC;SACpB,QAAQ,EAAE;SACV,QAAQ,CAAC,8GAA8G,CAAC;CAC5H,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,KAAa;IAC5D,OAAO,gBAAgB,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,EAAE,CAAA;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,eAAuB,EACvB,MAAc,EACd,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,0BAA0B,CAAC,CAAA;IACpG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,eAAe;YAC7B,WAAW;YACX,KAAK,EACH,GAAG,CAAC,MAAM,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;gBACzD,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW;oBAC1B,CAAC,CAAC,wCAAwC;oBAC1C,CAAC,CAAC,2BAA2B;SACpC,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA8C,CAAA;IACzE,OAAO;QACL,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,eAAe;QAC7B,WAAW;QACX,WAAW,EAAE,IAAI;QACjB,GAAG,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAA;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAAsC;IAC1F,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACzE,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACvC,OAAO,qBAAqB,CAAC,EAAE,CAAA;AACjC,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE;YACnD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE;YAC7E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAA;QACF,kEAAkE;QAClE,mEAAmE;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;QACpE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QACjE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;QACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAC7C,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,MAAuC,EAAE,IAAY;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,OAAO,iEAAiE,IAAI,0BAA0B,CAAA;IACxG,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,yCAAyC,IAAI,2CAA2C,CAAA;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,wDAAwD,IAAI,GAAG,CAAA;IACzG,OAAO,oCAAoC,IAAI,GAAG,CAAA;AACpD,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,QAA8B,EAAE,QAAiB;IAC1F,MAAM,MAAM,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAChF,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO;YACL,MAAM;YACN,MAAM;YACN,KAAK,EAAE,MAAM;YACb,OAAO,EACL,6EAA6E;gBAC7E,6BAA6B,MAAM,oEAAoE;SAC1G,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAA;IACrI,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAI,QAA0C,EAAE,QAAQ,CAAA;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,CAAC,CAAE,IAAuC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CACtG;YACH,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,MAAM;gBACN,MAAM;gBACN,KAAK,EAAE,QAAQ;gBACf,eAAe,EAAE,MAAM,CAAC,SAAmB;gBAC3C,OAAO,EAAE,yEAAyE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC;aAC7I,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM;YACN,MAAM;YACN,KAAK,EAAE,YAAY;YACnB,OAAO,EACL,+EAA+E;gBAC/E,2GAA2G;gBAC3G,yEAAyE;SAC5E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,MAAM,2BAA2B,EAAE,CAAA;AAC7G,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa,EAAE,MAAe;IAC3D,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmD,CAAA;IAC3E,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,OAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;SACvF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,KAAK,IAAI,CAAA;QACrC,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,MAAM,KAAK,SAAS;gBACpB,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,aAAa,KAAK,OAAO;oBAClD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,8DAA8D,CAAA;QACtE,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,UAAU;YACpB,MAAM;YACN,KAAK;YACL,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;SACrE,CAAA;IACH,CAAC,CAAC,CAAA;IACJ,OAAO;QACL,aAAa;QACb,OAAO;QACP,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAChC,CAAC,CAAC;gBACE,IAAI,EACF,aAAa,KAAK,MAAM;oBACtB,CAAC,CAAC,IAAI,MAAM,8GAA8G;oBAC1H,CAAC,CAAC,IAAI,MAAM,iFAAiF;aAClG;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,WAAmB,EACnB,MAAqD,EACrD,QAA2D,EAC3D,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrG,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAA;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC7B,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7H,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACnB,OAAO;YACL,QAAQ,EAAE,CAAC,CAAC,EAAE;YACd,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,IAAI,IAAI;YACf,SAAS,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC5D,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACvD,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/chaos.d.ts

@@ -0,0 +1,90 @@
+/**
+ * chaos.ts — agent fault injection for `intutic chaos run`.
+ *
+ * The chaos runner hands this process a plan through `INTUTIC_CHAOS_PLAN`
+ * and an events file through `INTUTIC_CHAOS_EVENTS` (see
+ * `@intutic/shared-types`' chaos contract). The faults this proxy injects
+ * stand in for the upstream MCP server misbehaving, so they live at the
+ * server-response boundary and governance runs around them unchanged:
+ *
+ * - request side: a fault is considered only for a `tools/call` the
+ *   interceptor allowed — a block or a hold is answered exactly as without a
+ *   plan, so a fault can never turn a refusal into an allow;
+ * - response side: a synthesized or modified result goes through the same
+ *   `handleServerLine` path a real one does, so DLP, the injection scanner,
+ *   TOFU pinning and the tool-poisoning check all see the faulted response.
+ *
+ * Without a plan none of this is constructed and the proxy's paths carry no
+ * extra work.
+ *
+ * @module
+ */
+import { type ChaosEvent, type ChaosPlan } from '@intutic/shared-types';
+/** Distributes `Omit` over the event union, so each variant keeps its own fields. */
+type EventBody = ChaosEvent extends infer E ? (E extends ChaosEvent ? Omit<E, 'ts' | 'runId' | 'component'> : never) : never;
+/** What happens to one allowed `tools/call`. */
+export type CallFault = 
+/** Do not call the server; answer with this result. */
+{
+    kind: 'respond';
+    result: Record<string, unknown>;
+}
+/** Call the server, then append this text to its result. */
+ | {
+    kind: 'append';
+    payload: string;
+    call: number;
+};
+/**
+ * Read the plan from the environment. Null when no plan is set; throws when
+ * one is set but invalid, so the caller can refuse to start rather than run
+ * with a plan it silently ignores.
+ */
+export declare function readChaosPlan(env: NodeJS.ProcessEnv): ChaosPlan | null;
+export declare class ChaosInjector {
+    private readonly plan;
+    private readonly eventsPath;
+    private readonly counter;
+    /** Matching calls seen per fault index — the `call` an event reports. */
+    private readonly matched;
+    /** Toolset changes that have fired; every later tools/list is rewritten by them. */
+    private readonly toolsetChanges;
+    /** Emits `plan_loaded`. */
+    constructor(plan: ChaosPlan, eventsPath?: string | undefined);
+    /** Append one event line. Never throws: a lost event must not break the agent's call. */
+    emit(body: EventBody): void;
+    /** Counts this call against a fault; returns the 1-based matching-call index when it is hit. */
+    private hit;
+    /**
+     * Called once per `tools/call` governance allowed, before it is forwarded.
+     *
+     * Toolset changes count every such call; one that fires stays in effect for
+     * the rest of the run and calls `notify` once. Result faults are tried in
+     * plan order and the first that fires decides the call; faults after it do
+     * not count the call. `append` is reported when the payload is actually
+     * appended (see {@link faultServerLine}), the others here.
+     */
+    onAllowedCall(tool: string, notify: () => void): CallFault | null;
+    /**
+     * Apply the response-side faults to one upstream line before governance
+     * inspects it: append an `inject.tool_result` payload to the call it was
+     * chosen for, and rewrite a `tools/list` once a toolset change has fired.
+     * Returns the (possibly rewritten) line and, for a `tools/call` response,
+     * the tool it answers. `pending` is read, not consumed.
+     */
+    faultServerLine(raw: string, pending: ReadonlyMap<string | number, {
+        method: string;
+        toolName?: string;
+        inject?: {
+            payload: string;
+            call: number;
+        };
+    }>): {
+        line: string;
+        toolCall?: string;
+    };
+    /** Report a `tools/call` outcome; `frame` is what the agent receives. */
+    recordToolCall(tool: string, frame: string): void;
+}
+export {};
+//# sourceMappingURL=chaos.d.ts.map

package/dist/chaos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaos.d.ts","sourceRoot":"","sources":["../src/chaos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAQL,KAAK,UAAU,EACf,KAAK,SAAS,EAEf,MAAM,uBAAuB,CAAA;AAO9B,qFAAqF;AACrF,KAAK,SAAS,GAAG,UAAU,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,UAAU,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,OAAO,GAAG,WAAW,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,CAAA;AAE5H,gDAAgD;AAChD,MAAM,MAAM,SAAS;AACnB,uDAAuD;AACrD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE;AACtD,4DAA4D;GAC1D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAErD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,GAAG,IAAI,CAEtE;AAED,qBAAa,aAAa;IAStB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAT7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IAErD,2BAA2B;gBAER,IAAI,EAAE,SAAS,EACf,UAAU,GAAE,MAAM,GAAG,SAAyC;IASjF,yFAAyF;IACzF,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAU3B,gGAAgG;IAChG,OAAO,CAAC,GAAG;IAOX;;;;;;;;OAQG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,SAAS,GAAG,IAAI;IA6BjE;;;;;;OAMG;IACH,eAAe,CACb,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,GACvH;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAsCtC,yEAAyE;IACzE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;CAUlD"}

package/dist/chaos.js

@@ -0,0 +1,174 @@
+/**
+ * chaos.ts — agent fault injection for `intutic chaos run`.
+ *
+ * The chaos runner hands this process a plan through `INTUTIC_CHAOS_PLAN`
+ * and an events file through `INTUTIC_CHAOS_EVENTS` (see
+ * `@intutic/shared-types`' chaos contract). The faults this proxy injects
+ * stand in for the upstream MCP server misbehaving, so they live at the
+ * server-response boundary and governance runs around them unchanged:
+ *
+ * - request side: a fault is considered only for a `tools/call` the
+ *   interceptor allowed — a block or a hold is answered exactly as without a
+ *   plan, so a fault can never turn a refusal into an allow;
+ * - response side: a synthesized or modified result goes through the same
+ *   `handleServerLine` path a real one does, so DLP, the injection scanner,
+ *   TOFU pinning and the tool-poisoning check all see the faulted response.
+ *
+ * Without a plan none of this is constructed and the proxy's paths carry no
+ * extra work.
+ *
+ * @module
+ */
+import * as node_fs from 'node:fs';
+import { CHAOS_EVENTS_ENV, CHAOS_PLAN_ENV, FAULT_CATALOG, FaultCounter, decodeChaosPlan, faultMatches, faultMessage, } from '@intutic/shared-types';
+import { createStderrLogger as createLogger } from './stderrLog.js';
+const log = createLogger('mcp-chaos');
+/**
+ * Read the plan from the environment. Null when no plan is set; throws when
+ * one is set but invalid, so the caller can refuse to start rather than run
+ * with a plan it silently ignores.
+ */
+export function readChaosPlan(env) {
+    return decodeChaosPlan(env[CHAOS_PLAN_ENV]);
+}
+export class ChaosInjector {
+    plan;
+    eventsPath;
+    counter = new FaultCounter();
+    /** Matching calls seen per fault index — the `call` an event reports. */
+    matched = new Map();
+    /** Toolset changes that have fired; every later tools/list is rewritten by them. */
+    toolsetChanges = [];
+    /** Emits `plan_loaded`. */
+    constructor(plan, eventsPath = process.env[CHAOS_EVENTS_ENV]) {
+        this.plan = plan;
+        this.eventsPath = eventsPath;
+        if (!eventsPath) {
+            log.warn({ action: 'chaos_events_unset' }, `${CHAOS_EVENTS_ENV} is not set: faults are injected but no events are recorded`);
+        }
+        const ours = plan.faults.filter((f) => FAULT_CATALOG[f.id].injectedBy.includes('mcp-proxy')).length;
+        this.emit({ type: 'plan_loaded', faults: ours });
+    }
+    /** Append one event line. Never throws: a lost event must not break the agent's call. */
+    emit(body) {
+        if (!this.eventsPath)
+            return;
+        const event = { ts: new Date().toISOString(), runId: this.plan.runId, component: 'mcp-proxy', ...body };
+        try {
+            node_fs.appendFileSync(this.eventsPath, JSON.stringify(event) + '\n');
+        }
+        catch (err) {
+            log.warn({ action: 'chaos_event_write_error', err: err.message, type: body.type }, 'Could not record chaos event');
+        }
+    }
+    /** Counts this call against a fault; returns the 1-based matching-call index when it is hit. */
+    hit(index, fault, tool) {
+        if (!faultMatches(fault, { tool }))
+            return null;
+        const call = (this.matched.get(index) ?? 0) + 1;
+        this.matched.set(index, call);
+        return this.counter.shouldInject(index, fault) ? call : null;
+    }
+    /**
+     * Called once per `tools/call` governance allowed, before it is forwarded.
+     *
+     * Toolset changes count every such call; one that fires stays in effect for
+     * the rest of the run and calls `notify` once. Result faults are tried in
+     * plan order and the first that fires decides the call; faults after it do
+     * not count the call. `append` is reported when the payload is actually
+     * appended (see {@link faultServerLine}), the others here.
+     */
+    onAllowedCall(tool, notify) {
+        let outcome = null;
+        for (const [index, fault] of this.plan.faults.entries()) {
+            if (fault.id === 'mcp.toolset_change') {
+                if (this.toolsetChanges.includes(fault))
+                    continue;
+                const call = this.hit(index, fault, tool);
+                if (call === null)
+                    continue;
+                this.toolsetChanges.push(fault);
+                this.emit({ type: 'fault_injected', faultId: fault.id, call, target: tool });
+                notify();
+                continue;
+            }
+            if (outcome)
+                continue;
+            if (fault.id !== 'tool.error' && fault.id !== 'tool.stale_data' && fault.id !== 'inject.tool_result')
+                continue;
+            const call = this.hit(index, fault, tool);
+            if (call === null)
+                continue;
+            if (fault.id === 'inject.tool_result') {
+                outcome = { kind: 'append', payload: fault.payload, call };
+                continue;
+            }
+            this.emit({ type: 'fault_injected', faultId: fault.id, call, target: tool });
+            outcome =
+                fault.id === 'tool.error'
+                    ? { kind: 'respond', result: { content: [{ type: 'text', text: faultMessage(this.plan, fault.message) }], isError: true } }
+                    : { kind: 'respond', result: { content: [{ type: 'text', text: fault.result }] } };
+        }
+        return outcome;
+    }
+    /**
+     * Apply the response-side faults to one upstream line before governance
+     * inspects it: append an `inject.tool_result` payload to the call it was
+     * chosen for, and rewrite a `tools/list` once a toolset change has fired.
+     * Returns the (possibly rewritten) line and, for a `tools/call` response,
+     * the tool it answers. `pending` is read, not consumed.
+     */
+    faultServerLine(raw, pending) {
+        let msg;
+        try {
+            msg = JSON.parse(raw);
+        }
+        catch {
+            return { line: raw };
+        }
+        if (msg.id === undefined || msg.id === null)
+            return { line: raw };
+        const req = pending.get(msg.id);
+        if (!req)
+            return { line: raw };
+        if (req.method === 'tools/call') {
+            const tool = req.toolName ?? '<unknown>';
+            const content = msg.result?.['content'];
+            if (!req.inject || !Array.isArray(content))
+                return { line: raw, toolCall: tool };
+            content.push({ type: 'text', text: req.inject.payload });
+            this.emit({ type: 'fault_injected', faultId: 'inject.tool_result', call: req.inject.call, target: tool });
+            return { line: JSON.stringify(msg), toolCall: tool };
+        }
+        if (req.method === 'tools/list' && this.toolsetChanges.length > 0) {
+            const tools = msg.result?.['tools'];
+            if (!msg.result || !Array.isArray(tools))
+                return { line: raw };
+            let kept = tools;
+            for (const change of this.toolsetChanges) {
+                kept = kept.filter((t) => !change.remove.includes(t['name']));
+                for (const t of kept) {
+                    const description = change.redefine[t['name']];
+                    if (description !== undefined)
+                        t['description'] = description;
+                }
+            }
+            msg.result['tools'] = kept;
+            return { line: JSON.stringify(msg) };
+        }
+        return { line: raw };
+    }
+    /** Report a `tools/call` outcome; `frame` is what the agent receives. */
+    recordToolCall(tool, frame) {
+        let ok = false;
+        try {
+            const msg = JSON.parse(frame);
+            ok = msg.error === undefined && msg.result !== undefined && msg.result.isError !== true;
+        }
+        catch {
+            // Not JSON: the agent got nothing usable.
+        }
+        this.emit({ type: 'tool_call', tool, ok });
+    }
+}
+//# sourceMappingURL=chaos.js.map

package/dist/chaos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaos.js","sourceRoot":"","sources":["../src/chaos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,GAIb,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEnE,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;AAcrC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAsB;IAClD,OAAO,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,OAAO,aAAa;IASL;IACA;IATF,OAAO,GAAG,IAAI,YAAY,EAAE,CAAA;IAC7C,yEAAyE;IACxD,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACpD,oFAAoF;IACnE,cAAc,GAAoB,EAAE,CAAA;IAErD,2BAA2B;IAC3B,YACmB,IAAe,EACf,aAAiC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAD9D,SAAI,GAAJ,IAAI,CAAW;QACf,eAAU,GAAV,UAAU,CAAoD;QAE/E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,GAAG,gBAAgB,6DAA6D,CAAC,CAAA;QAC9H,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAA;QACnG,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,yFAAyF;IACzF,IAAI,CAAC,IAAe;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAM;QAC5B,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAA;QACvG,IAAI,CAAC;YACH,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAC/H,CAAC;IACH,CAAC;IAED,gGAAgG;IACxF,GAAG,CAAC,KAAa,EAAE,KAAY,EAAE,IAAY;QACnD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9D,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CAAC,IAAY,EAAE,MAAkB;QAC5C,IAAI,OAAO,GAAqB,IAAI,CAAA;QACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,IAAI,KAAK,CAAC,EAAE,KAAK,oBAAoB,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,SAAQ;gBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;gBACzC,IAAI,IAAI,KAAK,IAAI;oBAAE,SAAQ;gBAC3B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC5E,MAAM,EAAE,CAAA;gBACR,SAAQ;YACV,CAAC;YACD,IAAI,OAAO;gBAAE,SAAQ;YACrB,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY,IAAI,KAAK,CAAC,EAAE,KAAK,iBAAiB,IAAI,KAAK,CAAC,EAAE,KAAK,oBAAoB;gBAAE,SAAQ;YAC9G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACzC,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAQ;YAC3B,IAAI,KAAK,CAAC,EAAE,KAAK,oBAAoB,EAAE,CAAC;gBACtC,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;gBAC1D,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAC5E,OAAO;gBACL,KAAK,CAAC,EAAE,KAAK,YAAY;oBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;oBAC3H,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAA;QACxF,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CACb,GAAW,EACX,OAAwH;QAExH,IAAI,GAAsE,CAAA;QAC1E,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAA;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;QACtB,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;QAE9B,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAA;YACxC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAA;YACvC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;YAChF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YACxD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACzG,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QACtD,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;YAC9D,IAAI,IAAI,GAAG,KAAuC,CAAA;YAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC,CAAA;gBACvE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC,CAAA;oBACxD,IAAI,WAAW,KAAK,SAAS;wBAAE,CAAC,CAAC,aAAa,CAAC,GAAG,WAAW,CAAA;gBAC/D,CAAC;YACH,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;YAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;QACtC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IACtB,CAAC;IAED,yEAAyE;IACzE,cAAc,CAAC,IAAY,EAAE,KAAa;QACxC,IAAI,EAAE,GAAG,KAAK,CAAA;QACd,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAwD,CAAA;YACpF,EAAE,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAA;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IAC5C,CAAC;CACF"}

package/dist/config.d.ts

@@ -30,9 +30,10 @@ export interface ProxyConfig {
      * MCP proxy deployment model ('per-session' | 'daemon').
      * WS-5 Q2 — 'daemon' is active: when set, policy lookups are answered by the
      * long-lived daemon over its Unix socket (see policy.ts) instead of a
-     * per-process fetch from the control plane. What is NOT active is daemon
-     * health telemetry — the health-snapshot route was removed and the dashboard
-     * flag is hardcoded off, so daemon health is not reported anywhere.
+     * per-process fetch from the control plane. The daemon also reports its
+     * health: `daemon/statusReporter.ts` posts a snapshot to
+     * `POST /api/v1/mcp-daemon/report` every minute by default, which the dashboard
+     * reads back through `GET /api/v1/mcp-daemon/status`.
      */
     mcpProxyMode: string;
     /**
@@ -111,8 +112,9 @@ export interface ProxyConfig {
      * (`anomaly/index.ts`'s `DETECTOR_BASE_DISPOSITION`); values are
      * `'steer' | 'reask' | 'kill' | 'off'`, clamped at each detector's own
      * Rust-declared ceiling by `resolveEffectiveDisposition` — never able to
-     * promote past it. Overridden wholesale by the control plane's
-     * `mcpAnomalyOverrides` policy field when present. Empty object when
+     * promote past it. Merged per detector with the control plane's
+     * `mcpAnomalyOverrides` policy field, whose entry wins for a detector both
+     * name (interceptor.ts). Empty object when
      * unset, malformed, or not a plain JSON object.
      */
     mcpAnomalyOverrides: Record<string, 'steer' | 'reask' | 'kill' | 'off'>;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;IACvB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAA;IACtB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;IACnB;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IAChC;;;;;;;OAOG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAA;IACpC;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAC1C;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAA;IACvE;;;;;;;;;;;OAWG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAyHD;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CA+G7F"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;IACvB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,qFAAqF;IACrF,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAA;IACtB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAA;IACjB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;IACnB;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IAChC;;;;;;;OAOG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAA;IACpC;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAC1C;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAA;IACvE;;;;;;;;;;;OAWG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAyHD;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CA+G7F"}

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AA6ItC,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;AACxG,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AAE5F;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACzD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YACjD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,SAAQ;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACvC,sCAAsC;YACtC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAc;IAOlC,IAAI,WAA+B,CAAA;IACnC,IAAI,UAA8B,CAAA;IAClC,IAAI,SAA6B,CAAA;IACjC,IAAI,eAAmC,CAAA;IACvC,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACxD,WAAW,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9D,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACxB,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7D,SAAS,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACvB,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnE,eAAe,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC7B,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,cAAc,GAAG,CAAC,CAAA;YAClB,MAAK;QACP,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAA;AACnF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IACrF,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACrD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAEhF;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,GAAuB;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IACrF,MAAM,SAAS,GAAuD,EAAE,CAAA;IACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,SAAS,CAAC,GAAG,CAAC,GAAG,KAA2C,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAE9B,wEAAwE;IACxE,0EAA0E;IAC1E,oEAAoE;IACpE,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACxC,UAAU,CAAC,2BAA2B,CAAC;QACvC,UAAU,CAAC,cAAc,CAAC;QAC1B,uBAAuB,CAAA;IAEzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9B,UAAU,CAAC,iBAAiB,CAAC;QAC7B,EAAE,CAAA;IAEJ,MAAM,WAAW,GACf,GAAG,CAAC,WAAW;QACf,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACnC,UAAU,CAAC,sBAAsB,CAAC;QAClC,SAAS,CAAA;IAEX,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAClC,UAAU,CAAC,qBAAqB,CAAC;QACjC,mBAAmB,CAAA;IAErB,MAAM,QAAQ,GACZ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,UAAU,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAA;IAEnH,2EAA2E;IAC3E,6EAA6E;IAC7E,gBAAgB;IAChB,MAAM,YAAY,GAAG,UAAU,CAAC,wBAAwB,CAAC,IAAI,aAAa,CAAA;IAE1E,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,SAAS,CAAA;IAE9C,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,mDAAmD;IACnD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,gFAAgF;YAChF,6EAA6E,CAChF,CAAA;IACH,CAAC;IAED,IAAI,eAA2C,CAAA;IAC/C,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACtC,qEAAqE;YACrE,uEAAuE;YACvE,2EAA2E;YAC3E,eAAe,GAAG,MAAM,CAAA;QAC1B,CAAC;aAAM,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YAC3E,eAAe,GAAG,GAAG,CAAC,eAAe,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,yEAAyE,GAAG,CAAC,eAAe,KAAK,CAClG,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAA;IAEpF,MAAM,kBAAkB,GACtB,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC,KAAK,OAAO;QACrG,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,CAAA;IAEZ,MAAM,SAAS,GACb,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAA;IAChI,4EAA4E;IAC5E,sDAAsD;IACtD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAE1D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAA;IACxG,MAAM,cAAc,GAClB,cAAc,KAAK,MAAM,IAAI,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IAEpF,OAAO;QACL,WAAW;QACX,eAAe;QACf,MAAM;QACN,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,cAAc;QACd,WAAW,EAAE,MAAM;QACnB,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,UAAU;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,eAAe;QACf,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxE,kBAAkB;QAClB,cAAc;QACd,mBAAmB,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACxF,UAAU,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,SAAS;QAC7D,SAAS;QACT,YAAY;KACb,CAAA;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AA+ItC,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;AACxG,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AAE5F;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACzD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YACjD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,SAAQ;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACvC,sCAAsC;YACtC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC5B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAc;IAOlC,IAAI,WAA+B,CAAA;IACnC,IAAI,UAA8B,CAAA;IAClC,IAAI,SAA6B,CAAA;IACjC,IAAI,eAAmC,CAAA;IACvC,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACxD,WAAW,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9D,UAAU,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACxB,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7D,SAAS,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACvB,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnE,eAAe,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC7B,CAAC,EAAE,CAAA,CAAC,aAAa;QACnB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,cAAc,GAAG,CAAC,CAAA;YAClB,MAAK;QACP,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAA;AACnF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IACrF,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACrD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAEhF;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,GAAuB;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IACrF,MAAM,SAAS,GAAuD,EAAE,CAAA;IACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,SAAS,CAAC,GAAG,CAAC,GAAG,KAA2C,CAAA;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAE9B,wEAAwE;IACxE,0EAA0E;IAC1E,oEAAoE;IACpE,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACxC,UAAU,CAAC,2BAA2B,CAAC;QACvC,UAAU,CAAC,cAAc,CAAC;QAC1B,uBAAuB,CAAA;IAEzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9B,UAAU,CAAC,iBAAiB,CAAC;QAC7B,EAAE,CAAA;IAEJ,MAAM,WAAW,GACf,GAAG,CAAC,WAAW;QACf,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACnC,UAAU,CAAC,sBAAsB,CAAC;QAClC,SAAS,CAAA;IAEX,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAClC,UAAU,CAAC,qBAAqB,CAAC;QACjC,mBAAmB,CAAA;IAErB,MAAM,QAAQ,GACZ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,UAAU,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAA;IAEnH,2EAA2E;IAC3E,6EAA6E;IAC7E,gBAAgB;IAChB,MAAM,YAAY,GAAG,UAAU,CAAC,wBAAwB,CAAC,IAAI,aAAa,CAAA;IAE1E,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,SAAS,CAAA;IAE9C,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,mDAAmD;IACnD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,gFAAgF;YAChF,6EAA6E,CAChF,CAAA;IACH,CAAC;IAED,IAAI,eAA2C,CAAA;IAC/C,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACtC,qEAAqE;YACrE,uEAAuE;YACvE,2EAA2E;YAC3E,eAAe,GAAG,MAAM,CAAA;QAC1B,CAAC;aAAM,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YAC3E,eAAe,GAAG,GAAG,CAAC,eAAe,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,yEAAyE,GAAG,CAAC,eAAe,KAAK,CAClG,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAA;IAEpF,MAAM,kBAAkB,GACtB,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC,KAAK,OAAO;QACrG,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,CAAA;IAEZ,MAAM,SAAS,GACb,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAA;IAChI,4EAA4E;IAC5E,sDAAsD;IACtD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAE1D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAA;IACxG,MAAM,cAAc,GAClB,cAAc,KAAK,MAAM,IAAI,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IAEpF,OAAO;QACL,WAAW;QACX,eAAe;QACf,MAAM;QACN,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,cAAc;QACd,WAAW,EAAE,MAAM;QACnB,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,UAAU;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,eAAe;QACf,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxE,kBAAkB;QAClB,cAAc;QACd,mBAAmB,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACxF,UAAU,EAAE,UAAU,CAAC,wBAAwB,CAAC,IAAI,SAAS;QAC7D,SAAS;QACT,YAAY;KACb,CAAA;AACH,CAAC"}

package/dist/daemon/policyCache.d.ts

@@ -135,7 +135,11 @@ export declare function seedFromSnapshot(snapshotPath?: string): Promise<string
  * Order: LRU (fresh) → LRU (stale, triggers async refresh) → Valkey → HTTP fetch
  */
 export declare function resolvePolicy(workspaceId: string): Promise<ResolvedPolicy | null>;
-/** Invalidates policy cache for a workspace (called on SOP update). */
+/**
+ * Invalidates policy cache for a workspace (called on SOP update): this
+ * daemon's LRU entry, and every caller's shared entry, by bumping the
+ * workspace's generation as the control plane does.
+ */
 export declare function invalidatePolicy(workspaceId: string): void;
 /** Returns cache statistics. */
 export declare function getCacheStats(): {

package/dist/daemon/policyCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policyCache.d.ts","sourceRoot":"","sources":["../../src/daemon/policyCache.ts"],"names":[],"mappings":"AAaA,OAAO,EAKL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAoBlF,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAI,MAAM,CAAA;IACrB,QAAQ,EAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACxC,WAAW,EAAI,MAAM,EAAE,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2EAA2E;IAC3E,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD;sEACkE;IAClE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC,mFAAmF;IACnF,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAC3C;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAA;IACvE;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,wEAAwE;IACxE,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB,yDAAyD;IACzD,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;IACxC,0GAA0G;IAC1G,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAO,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AA6OD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,gBAAgB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4EpF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAkGvF;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAI1D;AAED,gCAAgC;AAChC,wBAAgB,aAAa,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEpE"}
+{"version":3,"file":"policyCache.d.ts","sourceRoot":"","sources":["../../src/daemon/policyCache.ts"],"names":[],"mappings":"AAcA,OAAO,EAKL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAA;AACrB,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAA;AAoB9B,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAI,MAAM,CAAA;IACrB,QAAQ,EAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IACxC,WAAW,EAAI,MAAM,EAAE,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2EAA2E;IAC3E,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD;sEACkE;IAClE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC,mFAAmF;IACnF,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAC3C;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,CAAA;IACvE;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,wEAAwE;IACxE,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB,yDAAyD;IACzD,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;IACxC,0GAA0G;IAC1G,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAO,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAmRD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,gBAAgB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4EpF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA8FvF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAK1D;AAED,gCAAgC;AAChC,wBAAgB,aAAa,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEpE"}