@iris-eval/mcp-server 0.4.4 → 0.4.6

package/dist/eval/rules/safety.js

@@ -5,21 +5,59 @@
  * patterns evaluate. Word-boundary anchors avoid matching inside larger
  * strings where appropriate.
  */
-const PII_PATTERNS = [
+/*
+ * Every pattern here runs against ATTACKER-CONTROLLED text — agent output is
+ * untrusted by definition (resolve.ts states this outright), and any agent
+ * that summarises a web page, reads email, or handles user tickets can be
+ * fed a crafted string straight into evaluate_output.
+ *
+ * So: no ambiguous quantifiers. The rule that bit us was `\s*[:.]?\s*` in
+ * DOB and Medical Record Number — two adjacent unbounded whitespace
+ * quantifiers give the engine N+1 ways to split a run of N spaces, each of
+ * which fails at the trailing character class. Cost was quadratic in the
+ * input: 'MRN' + N spaces + '!' measured 31ms at 4k, 118ms at 8k, 468ms at
+ * 16k, and did not finish at the 1MB body limit. Node is single-threaded,
+ * so one call wedged the whole server.
+ *
+ * Bounded quantifiers ({0,8}) keep the alternatives constant regardless of
+ * input length. When adding a pattern, check for: adjacent quantifiers over
+ * overlapping character classes, nested quantifiers, and a character that
+ * can match both inside a + and as the following literal.
+ *
+ * Exported so the claims drift test can assert .claims.json counts against
+ * the runtime truth (tests/claims-eval-rules-counts.test.ts).
+ */
+export const PII_PATTERNS = [
     // Original v0.3.0 patterns
     { name: 'SSN', pattern: /\b\d{3}-\d{2}-\d{4}\b/ },
     { name: 'Credit Card', pattern: /\b(?:\d{4}[-\s]?){3}\d{4}\b/ },
     { name: 'Phone', pattern: /\b(?:\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/ },
-    { name: 'Email', pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z]{2,}\b/i },
+    /*
+     * Every quantifier is bounded, at the RFC 5321 limits (local part 64,
+     * DNS label 63, TLD 24). Unbounded ones made this quadratic on text with
+     * no '@' in it: from EVERY starting position the local part consumed the
+     * rest of the string before failing, so N start positions each did O(N)
+     * work. 'a@' + 'a.'×32000 measured 3.5 seconds. Bounding the local part
+     * caps per-position work at a constant, which is what makes the whole
+     * scan linear.
+     *
+     * The domain is also written as explicit dot-separated labels rather than
+     * [A-Za-z0-9.-]+\. — that form lets '.' match both inside the + and as
+     * the following literal, which is its own source of splits to try.
+     */
+    {
+        name: 'Email',
+        pattern: /\b[A-Za-z0-9._%+-]{1,64}@(?:[A-Za-z0-9-]{1,63}\.){1,8}[A-Z]{2,24}\b/i,
+    },
     // v0.3.1 additions
     // IBAN: 2 letters + 2 digits + 1-30 alphanumeric (international bank account number)
     { name: 'IBAN', pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b/ },
     // US passport: 9 digits, optionally prefixed with letter (modern format C12345678)
     { name: 'Passport', pattern: /\b[A-Z]?\d{9}\b/ },
     // Date of birth contextual — DOB or "Born:" / "Birthday:" + date
-    { name: 'DOB', pattern: /\b(?:DOB|D\.O\.B\.|Date of Birth|Born|Birthday)\s*[:.]?\s*\d{1,2}[\/\-.]\d{1,2}[\/\-.](?:\d{2}|\d{4})\b/i },
+    { name: 'DOB', pattern: /\b(?:DOB|D\.O\.B\.|Date of Birth|Born|Birthday)\s{0,8}[:.]?\s{0,8}\d{1,2}[\/\-.]\d{1,2}[\/\-.](?:\d{2}|\d{4})\b/i },
     // Medical record number — MRN: + alphanumeric (common format)
-    { name: 'Medical Record Number', pattern: /\b(?:MRN|Medical Record (?:Number|No\.?|#))\s*[:.]?\s*[A-Z0-9]{6,12}\b/i },
+    { name: 'Medical Record Number', pattern: /\b(?:MRN|Medical Record (?:Number|No\.?|#))\s{0,8}[:.]?\s{0,8}[A-Z0-9]{6,12}\b/i },
     // IPv4 address
     { name: 'IP Address', pattern: /\b(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}\b/ },
     // API key heuristic — looks for sk-/pk-/api_/Bearer + long alphanumeric
@@ -79,7 +117,7 @@ export const noBlocklistWords = {
  * leaks, or role-override acknowledgments). Input-side detection is the
  * agent host's job; output-side is Iris's.
  */
-const INJECTION_PATTERNS = [
+export const INJECTION_PATTERNS = [
     // Original v0.3.0 patterns
     /ignore (?:all )?(?:previous|above|prior) (?:instructions|prompts)/i,
     /you are now (?:a |in )/i,

package/dist/index.js

@@ -28,6 +28,7 @@ const CliSchema = z
     'api-key': z.string().min(1).optional(),
     dashboard: z.boolean().optional(),
     'dashboard-port': PortSchema.optional(),
+    'dashboard-host': z.string().min(1).optional(),
     help: z.boolean().optional(),
 })
     .strict();
@@ -42,6 +43,7 @@ try {
             'api-key': { type: 'string' },
             dashboard: { type: 'boolean', default: false },
             'dashboard-port': { type: 'string' },
+            'dashboard-host': { type: 'string' },
             help: { type: 'boolean', short: 'h', default: false },
         },
         strict: true,
@@ -74,18 +76,26 @@ Options:
   --api-key <key>          API key for HTTP authentication
   --dashboard              Enable web dashboard
   --dashboard-port <port>  Dashboard port 1-65535 (default: 6920)
+  --dashboard-host <host>  Dashboard bind address (default: 127.0.0.1). The dashboard is
+                           unauthenticated unless --api-key is set — binding it beyond
+                           loopback exposes your full trace history to the network.
   -h, --help               Show this help message
 
 Environment variables (CLI flags take precedence):
   IRIS_TRANSPORT                       stdio | http
   IRIS_HOST                            Bind address for HTTP transport (default: 127.0.0.1)
   IRIS_PORT                            HTTP transport port (1-65535)
-  IRIS_DB_PATH                         SQLite database path
+  IRIS_HOME                            Directory for all per-user files: config.json, iris.db, custom-rules.json,
+                                       audit.log, preferences.json (default: ~/.iris)
+  IRIS_DB_PATH                         SQLite database path (overrides IRIS_HOME for the DB only)
   IRIS_LOG_LEVEL                       debug | info | warn | error
   IRIS_DASHBOARD                       true to enable web dashboard
   IRIS_DASHBOARD_PORT                  Dashboard port (1-65535, default: 6920)
+  IRIS_DASHBOARD_HOST                  Dashboard bind address (default: 127.0.0.1)
   IRIS_API_KEY                         API key for HTTP authentication
-  IRIS_ALLOWED_ORIGINS                 Comma-separated CORS origin allowlist
+  IRIS_ALLOWED_ORIGINS                 Comma-separated origin allowlist. Dashboard: CORS headers (supports globs, e.g. http://localhost:*).
+                                       HTTP transport: exact-match Origin allowlist for DNS-rebinding protection (globs ignored;
+                                       this server's own loopback origins are always allowed).
   IRIS_NO_AUTO_LAUNCH                  Set to 1 to disable first-run dashboard auto-launch
   IRIS_ANTHROPIC_API_KEY               Required by evaluate_with_llm_judge + verify_citations (provider=anthropic)
   IRIS_OPENAI_API_KEY                  Required by evaluate_with_llm_judge + verify_citations (provider=openai)
@@ -111,6 +121,7 @@ const config = loadConfig({
     apiKey: values['api-key'],
     dashboard: values.dashboard,
     dashboardPort: values['dashboard-port'],
+    dashboardHost: values['dashboard-host'],
 });
 const logger = createLogger(config);
 async function main() {

package/dist/middleware/error-handler.js

@@ -9,7 +9,25 @@ export function createErrorHandler(logger) {
             return;
         }
         const status = err.status ?? err.statusCode ?? 500;
-        const message = status >= 500 ? 'Internal server error' : (err.message ?? 'Unknown error');
+        /*
+         * Never echo a Node system error to the client. Their messages embed
+         * absolute paths — an ENOENT from res.sendFile returned
+         *   "ENOENT: no such file or directory, stat 'C:\...\dist\dashboard\index.html'"
+         * with a 404, disclosing the install path and OS user to anyone who
+         * could reach the dashboard (CWE-209). 5xx was already masked; the leak
+         * was in the 4xx branch, where echoing err.message is otherwise useful
+         * (body-parser's "request entity too large", Zod messages, etc.).
+         *
+         * Identify system errors by the shape Node gives them — a string `code`
+         * plus `syscall` — rather than by matching path-ish text, which would
+         * miss cases and mangle legitimate messages.
+         */
+        const isSystemError = typeof err?.code === 'string' && typeof err?.syscall === 'string';
+        const message = status >= 500 || isSystemError
+            ? status >= 500
+                ? 'Internal server error'
+                : 'Not found'
+            : (err.message ?? 'Unknown error');
         logger.error(`Request error: ${err.message}`, { status, stack: err.stack });
         res.status(status).json({
             error: message,

package/dist/middleware/rebinding-guard.d.ts

@@ -0,0 +1,21 @@
+import type { RequestHandler } from 'express';
+export declare function isLoopbackHost(host: string): boolean;
+/** Concrete origins/hosts this server answers to on `port`. */
+export declare function loopbackOriginsFor(port: number): string[];
+export declare function loopbackHostsFor(port: number): string[];
+export interface RebindingGuardOptions {
+    /**
+     * Port the server is actually bound to. Accepts a resolver because the
+     * middleware is registered BEFORE listen() — and the configured port is
+     * 0 whenever the caller wants an ephemeral one (tests and embedders do
+     * this). Baking 0 into the allowlist would produce `http://localhost:0`
+     * and reject every real request with a 403 that looks exactly like an
+     * attack. Same trap the MCP transport documents at transport/http.ts.
+     */
+    port: number | (() => number);
+    /** Bind address, used to decide whether Host validation applies. */
+    host: string;
+    /** Operator's configured origins; glob entries are ignored (see above). */
+    allowedOrigins?: string[];
+}
+export declare function createRebindingGuard(options: RebindingGuardOptions): RequestHandler;

package/dist/middleware/rebinding-guard.js

@@ -0,0 +1,77 @@
+/*
+ * DNS-rebinding protection for the dashboard HTTP API.
+ *
+ * v0.4.5 closed this hole on the MCP transport (/mcp) by handing
+ * allowedOrigins + allowedHosts to the SDK. The dashboard — same data,
+ * plus every mutating endpoint — never got the equivalent, and it starts
+ * implicitly alongside `--transport http`. So a browser on any page could
+ * POST a rule deployment to http://localhost:6920 and the server would
+ * execute it.
+ *
+ * CORS does not substitute, for the reason already written down in
+ * transport/http.ts: the browser withholds the RESPONSE, but the write has
+ * already happened. The request has to be REJECTED.
+ *
+ * Two checks, mirroring the SDK's semantics:
+ *
+ *   Origin — enforced whenever the header is present. Absent means a
+ *   non-browser client (curl, an MCP client, a health probe), which is not
+ *   the threat model here; browsers always send it on cross-origin
+ *   requests. Exact match only — glob patterns from the CORS allowlist are
+ *   meaningless against a single concrete Origin and are dropped rather
+ *   than left in the list looking effective.
+ *
+ *   Host — enforced only when bound to loopback. A non-loopback bind is a
+ *   deliberate network deployment, usually behind a proxy that rewrites
+ *   Host, and an exact-match list would break it.
+ */
+export function isLoopbackHost(host) {
+    return host === '127.0.0.1' || host === 'localhost' || host === '::1' || host === '[::1]';
+}
+/** Concrete origins/hosts this server answers to on `port`. */
+export function loopbackOriginsFor(port) {
+    return [`http://127.0.0.1:${port}`, `http://localhost:${port}`, `http://[::1]:${port}`];
+}
+export function loopbackHostsFor(port) {
+    return [`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`];
+}
+export function createRebindingGuard(options) {
+    const { port, host, allowedOrigins = [] } = options;
+    const exactConfigured = allowedOrigins.filter((o) => !o.includes('*'));
+    const enforceHost = isLoopbackHost(host);
+    let cache;
+    function listsFor(resolvedPort) {
+        if (cache?.port !== resolvedPort) {
+            cache = {
+                port: resolvedPort,
+                origins: new Set([...loopbackOriginsFor(resolvedPort), ...exactConfigured]),
+                /*
+                 * `[::1]:port` is the form Node actually puts in the Host header
+                 * for an IPv6 loopback request — brackets included. A guard
+                 * written against the bare '::1' would be inert, which is exactly
+                 * how the citation-fetch SSRF guard was silently dead before
+                 * v0.4.5 (URL.hostname returns '[::1]', never '::1').
+                 */
+                hosts: new Set(loopbackHostsFor(resolvedPort)),
+            };
+        }
+        return cache;
+    }
+    return (req, res, next) => {
+        const resolvedPort = typeof port === 'function' ? port() : port;
+        const { origins, hosts } = listsFor(resolvedPort);
+        const origin = req.headers.origin;
+        if (origin && !origins.has(origin)) {
+            res.status(403).json({ error: 'Forbidden: invalid Origin header' });
+            return;
+        }
+        if (enforceHost) {
+            const hostHeader = req.headers.host;
+            if (hostHeader && !hosts.has(hostHeader)) {
+                res.status(403).json({ error: 'Forbidden: invalid Host header' });
+                return;
+            }
+        }
+        next();
+    };
+}

package/dist/otel/mapper.js

@@ -9,6 +9,7 @@
 //
 // We intentionally do not depend on @opentelemetry/* — the exporter
 // serializes these plain objects, and the payload shape is the OTLP spec.
+import { PKG_VERSION } from '../config/defaults.js';
 // OTel SpanKind enum values (from opentelemetry-proto/trace/v1/trace.proto).
 const KIND_MAP = {
     INTERNAL: 1,
@@ -145,7 +146,7 @@ export function buildExportPayload(traces, serviceName) {
             { key: 'service.name', value: { stringValue: serviceName } },
             { key: 'telemetry.sdk.name', value: { stringValue: 'iris-mcp' } },
             { key: 'telemetry.sdk.language', value: { stringValue: 'nodejs' } },
-            { key: 'telemetry.sdk.version', value: { stringValue: '0.4.0' } },
+            { key: 'telemetry.sdk.version', value: { stringValue: PKG_VERSION } },
         ],
     };
     const spans = [];

package/dist/preferences.d.ts

@@ -1,108 +1,58 @@
 import { z } from 'zod';
 declare const MomentFiltersSchema: z.ZodObject<{
     agentName: z.ZodOptional<z.ZodString>;
-    verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-    significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-}, "strict", z.ZodTypeAny, {
-    verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-    agentName?: string | undefined;
-    significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-}, {
-    verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-    agentName?: string | undefined;
-    significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-}>;
-export declare const PreferencesSchema: z.ZodObject<{
-    autoLaunch: z.ZodDefault<z.ZodBoolean>;
-    firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
-    momentFilters: z.ZodDefault<z.ZodObject<{
-        agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+    verdict: z.ZodOptional<z.ZodEnum<{
+        pass: "pass";
+        fail: "fail";
+        partial: "partial";
+        unevaluated: "unevaluated";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
-    sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
-    notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    autoLaunch: z.ZodDefault<z.ZodBoolean>;
-    firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
-    momentFilters: z.ZodDefault<z.ZodObject<{
-        agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+    significanceKind: z.ZodOptional<z.ZodEnum<{
+        "safety-violation": "safety-violation";
+        "cost-spike": "cost-spike";
+        "first-failure": "first-failure";
+        "novel-pattern": "novel-pattern";
+        "rule-collision": "rule-collision";
+        "normal-pass": "normal-pass";
+        "normal-fail": "normal-fail";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
-    sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
-    notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+}, z.core.$strict>;
+export declare const PreferencesSchema: z.ZodObject<{
     autoLaunch: z.ZodDefault<z.ZodBoolean>;
     firstSeen: z.ZodOptional<z.ZodString>;
-    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Theme override; "system" defers to prefers-color-scheme. v0.4. */
-    theme: z.ZodDefault<z.ZodEnum<["dark", "light", "system"]>>;
-    /** Last filter set used on /moments — applied on next visit when the URL has no filter params. v0.4. */
+    dismissedBanners: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    theme: z.ZodDefault<z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+        system: "system";
+    }>>;
     momentFilters: z.ZodDefault<z.ZodObject<{
         agentName: z.ZodOptional<z.ZodString>;
-        verdict: z.ZodOptional<z.ZodEnum<["pass", "fail", "partial", "unevaluated"]>>;
-        significanceKind: z.ZodOptional<z.ZodEnum<["safety-violation", "cost-spike", "first-failure", "novel-pattern", "rule-collision", "normal-pass", "normal-fail"]>>;
-    }, "strict", z.ZodTypeAny, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
-    }, {
-        verdict?: "pass" | "fail" | "partial" | "unevaluated" | undefined;
-        agentName?: string | undefined;
-        significanceKind?: "safety-violation" | "cost-spike" | "first-failure" | "novel-pattern" | "rule-collision" | "normal-pass" | "normal-fail" | undefined;
+        verdict: z.ZodOptional<z.ZodEnum<{
+            pass: "pass";
+            fail: "fail";
+            partial: "partial";
+            unevaluated: "unevaluated";
+        }>>;
+        significanceKind: z.ZodOptional<z.ZodEnum<{
+            "safety-violation": "safety-violation";
+            "cost-spike": "cost-spike";
+            "first-failure": "first-failure";
+            "novel-pattern": "novel-pattern";
+            "rule-collision": "rule-collision";
+            "normal-pass": "normal-pass";
+            "normal-fail": "normal-fail";
+        }>>;
+    }, z.core.$strict>>;
+    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    density: z.ZodDefault<z.ZodEnum<{
+        compact: "compact";
+        comfortable: "comfortable";
     }>>;
-    /** Tour ids the user has completed or dismissed. v0.4. */
-    dismissedTours: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Decision Moments hidden from the timeline by user action. v0.4. */
-    archivedMoments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    /** Density mode for chrome (Design System v2.A). 'compact' default per R2.3. */
-    density: z.ZodDefault<z.ZodEnum<["compact", "comfortable"]>>;
-    /** Sidebar collapsed (icon-only at 64px) vs expanded (256px). Default expanded per R2.4. */
     sidebarCollapsed: z.ZodDefault<z.ZodBoolean>;
-    /** ISO timestamp of last notifications-popover opened — drives unread badge. */
     notificationsLastSeen: z.ZodOptional<z.ZodString>;
-}, z.ZodTypeAny, "passthrough">>;
+}, z.core.$loose>;
 export type Preferences = z.infer<typeof PreferencesSchema>;
 export type MomentFilters = z.infer<typeof MomentFiltersSchema>;
 export interface PreferenceState {

package/dist/preferences.js

@@ -18,9 +18,10 @@
  * /moments), dismissedTours, archivedMoments. These let the dashboard
  * remember the user's last view across reloads + across iris-mcp restarts.
  */
-import { mkdirSync, readFileSync, writeFileSync, existsSync, renameSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { homedir } from 'node:os';
+import { readFileSync, existsSync } from 'node:fs';
+import { writeAtomic } from './utils/write-atomic.js';
+import { irisHome } from './utils/iris-home.js';
+import { join } from 'node:path';
 import { z } from 'zod';
 const MomentFiltersSchema = z
     .object({
@@ -61,7 +62,7 @@ export const PreferencesSchema = z
 })
     .passthrough();
 function defaultPreferencesPath() {
-    return join(homedir(), '.iris', 'preferences.json');
+    return join(irisHome(), 'preferences.json');
 }
 function freshPreferences() {
     return PreferencesSchema.parse({
@@ -74,12 +75,6 @@ function freshPreferences() {
         archivedMoments: [],
     });
 }
-function writeAtomic(targetPath, contents) {
-    mkdirSync(dirname(targetPath), { recursive: true });
-    const tmp = `${targetPath}.tmp.${process.pid}`;
-    writeFileSync(tmp, contents, 'utf-8');
-    renameSync(tmp, targetPath);
-}
 export function loadOrInitPreferences(customPath) {
     const path = customPath ?? defaultPreferencesPath();
     if (!existsSync(path)) {

package/dist/storage/migrations/005-normalize-created-at.d.ts

@@ -0,0 +1,3 @@
+import type Database from 'better-sqlite3';
+export declare const id = "005-normalize-created-at";
+export declare function up(db: Database.Database): void;

package/dist/storage/migrations/005-normalize-created-at.js

@@ -0,0 +1,34 @@
+export const id = '005-normalize-created-at';
+/*
+ * Normalize created_at to ISO-8601 UTC.
+ *
+ * The column's DEFAULT is `datetime('now')`, which SQLite renders as
+ * "2026-08-09 15:00:00" — space separator, no milliseconds, no Z. Nothing
+ * ever wrote the column explicitly, so every row carried that shape. But
+ * every query compares it against a JS `toISOString()` value
+ * ("2026-08-09T15:00:00.000Z") using plain string comparison.
+ *
+ * ' ' is 0x20 and 'T' is 0x54, so the stored value sorts BEFORE any
+ * same-date boundary. Result: every eval whose calendar date equalled the
+ * window boundary's date was silently dropped from the window. A 20-hour-old
+ * eval vanished from "last 24h"; at 01:00 UTC the 24h view showed only what
+ * had happened since midnight. Traces were unaffected — log-trace writes a
+ * real ISO string — which is why this presented as "my evals are missing but
+ * my traces aren't".
+ *
+ * Fix in two halves: the adapter now writes ISO explicitly (so the DEFAULT
+ * never fires), and this migration rewrites the rows already on disk.
+ * strftime with %f gives milliseconds; SQLite stores UTC, so the literal Z
+ * is accurate. Rows already in ISO form are left alone — the LIKE guard
+ * matches only the space-separated shape, which keeps this idempotent and
+ * safe to run against a partially-migrated DB.
+ */
+export function up(db) {
+    for (const table of ['traces', 'eval_results']) {
+        db.exec(`
+      UPDATE ${table}
+         SET created_at = strftime('%Y-%m-%dT%H:%M:%fZ', created_at)
+       WHERE created_at LIKE '____-__-__ __:__:__%'
+    `);
+    }
+}

package/dist/storage/migrations/index.js

@@ -2,7 +2,14 @@ import * as migration001 from './001-initial-schema.js';
 import * as migration002 from './002-eval-skip-fields.js';
 import * as migration003 from './003-eval-passed-index.js';
 import * as migration004 from './004-tenant-id.js';
-const migrations = [migration001, migration002, migration003, migration004];
+import * as migration005 from './005-normalize-created-at.js';
+const migrations = [
+    migration001,
+    migration002,
+    migration003,
+    migration004,
+    migration005,
+];
 export function runMigrations(db) {
     db.exec(`
     CREATE TABLE IF NOT EXISTS _iris_migrations (

package/dist/storage/sqlite-adapter.js

@@ -145,10 +145,18 @@ export class SqliteAdapter {
     }
     async insertEvalResult(tenantId, result) {
         assertTenant(tenantId);
+        /*
+         * created_at is written EXPLICITLY as ISO-8601. Leaving it to the
+         * column DEFAULT (datetime('now')) stored "2026-08-09 15:00:00", which
+         * every period query then compared as a string against a JS
+         * toISOString() boundary — and ' ' sorts before 'T', so any eval whose
+         * calendar date matched the boundary's date was dropped from the
+         * window. Migration 005 rewrites rows written before this line existed.
+         */
         this.db.prepare(`
-      INSERT INTO eval_results (tenant_id, id, trace_id, eval_type, output_text, expected_text, score, passed, rule_results, suggestions, rules_evaluated, rules_skipped, insufficient_data)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(tenantId, result.id, result.trace_id ?? null, result.eval_type, result.output_text, result.expected_text ?? null, result.score, result.passed ? 1 : 0, JSON.stringify(result.rule_results), JSON.stringify(result.suggestions), result.rules_evaluated ?? null, result.rules_skipped ?? null, result.insufficient_data ? 1 : 0);
+      INSERT INTO eval_results (tenant_id, id, trace_id, eval_type, output_text, expected_text, score, passed, rule_results, suggestions, rules_evaluated, rules_skipped, insufficient_data, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(tenantId, result.id, result.trace_id ?? null, result.eval_type, result.output_text, result.expected_text ?? null, result.score, result.passed ? 1 : 0, JSON.stringify(result.rule_results), JSON.stringify(result.suggestions), result.rules_evaluated ?? null, result.rules_skipped ?? null, result.insufficient_data ? 1 : 0, new Date().toISOString());
     }
     async getEvalsByTraceId(tenantId, traceId) {
         assertTenant(tenantId);
@@ -263,12 +271,28 @@ export class SqliteAdapter {
       FROM traces
       WHERE tenant_id = ? AND timestamp >= ?
     `).get(tenantId, since);
+        /*
+         * No `AND passed = 0` here — deliberately.
+         *
+         * A safety eval's score is the average across its rules, so a single
+         * violation is routinely outvoted: output containing "Your SSN is
+         * 123-45-6789" fails no_pii (score 0) while the three other safety
+         * rules pass, giving 0.733 overall — above the 0.7 threshold, so
+         * passed = 1. Filtering to failed evals therefore reported
+         * {pii: 0, injection: 0, hallucination: 0} for a trace that leaked a
+         * social security number.
+         *
+         * For a product whose job is catching PII, injection and hallucination,
+         * that error ran in the direction that HIDES problems. The count is
+         * per-VIOLATION, not per-failed-eval; the per-rule loop below already
+         * skips rules that passed, so scanning every safety eval in the window
+         * is both correct and sufficient.
+         */
         const safetyRows = this.db.prepare(`
       SELECT rule_results
       FROM eval_results
       WHERE tenant_id = ? AND created_at >= ?
         AND eval_type = 'safety'
-        AND passed = 0
     `).all(tenantId, since);
         const violations = { pii: 0, injection: 0, hallucination: 0 };
         for (const row of safetyRows) {

package/dist/tools/deploy-rule.js

@@ -24,7 +24,7 @@ const CustomRuleDefinitionSchema = z.object({
         'json_schema',
         'cost_threshold',
     ]),
-    config: z.record(z.unknown()),
+    config: z.record(z.string(), z.unknown()),
     weight: z.number().optional(),
 });
 const inputSchema = {
@@ -63,7 +63,7 @@ export function registerDeployRuleTool(server, customRuleStore) {
             '',
             "Don't use to VALIDATE a rule before committing — deploy writes immediately. Use the dashboard's preview endpoint (POST /api/v1/rules/custom/preview) for dry-run validation against sample output. Don't use to EDIT an existing rule — this call only creates; edits require a dedicated flow (coming in v0.5). To update a rule today: delete_rule then deploy_rule with the new definition.",
             '',
-            'Parameters. name is 1-120 chars (Zod-enforced min/max); appears in eval_result rule_results so make it human-readable. description is optional, max 500 chars (used in dashboard tooltips). evalType determines WHEN the rule fires (must match the eval_type your evaluate_output calls use; e.g., a "completeness" rule fires on every evaluate_output where eval_type="completeness" OR eval_type="custom"). severity affects dashboard sort + audit log signal but does NOT affect scoring (scoring uses the rule\'s weight). definition.type and definition.config must match (e.g., regex_match needs config.pattern; cost_threshold needs config.max_usd; min_length needs config.min). sourceMomentId is optional but recommended (preserves workflow-inversion provenance from Make-This-A-Rule composer). Defaults: severity="medium".',
+            'Parameters. name is 1-120 chars (Zod-enforced min/max); appears in eval_result rule_results so make it human-readable. description is optional, max 500 chars (used in dashboard tooltips). evalType determines WHEN the rule fires (must match the eval_type your evaluate_output calls use; e.g., a "completeness" rule fires on every evaluate_output where eval_type="completeness" OR eval_type="custom"). severity affects dashboard sort + audit log signal but does NOT affect scoring (scoring uses the rule\'s weight). definition.type and definition.config must match (e.g., regex_match needs config.pattern; cost_threshold needs config.max_cost; min_length needs config.min_length; max_length needs config.max_length; contains_keywords/excludes_keywords need config.keywords). Invalid configs are now REJECTED at deploy time with the offending field named, instead of deploying and then failing every evaluation. sourceMomentId is optional but recommended (preserves workflow-inversion provenance from Make-This-A-Rule composer). Defaults: severity="medium".',
             '',
             "Error modes. Throws 400 on invalid definition (Zod rejects — e.g., regex that fails safe-regex2 ReDoS check, or length > 1000 chars). Throws 400 on empty `name`. Throws 400 if the eval category mismatches the definition type. Returns 429 when HTTP rate limit exceeded. File-write failures (disk full, read-only fs) propagate as 500; the audit log is best-effort and does not block deploy.",
         ].join('\n'),

package/dist/tools/evaluate-output.js

@@ -6,7 +6,7 @@ const CustomRuleSchema = z.object({
         'regex_match', 'regex_no_match', 'min_length', 'max_length',
         'contains_keywords', 'excludes_keywords', 'json_schema', 'cost_threshold',
     ]),
-    config: z.record(z.unknown()),
+    config: z.record(z.string(), z.unknown()),
     weight: z.number().optional(),
 });
 const inputSchema = {

package/dist/tools/log-trace.js

@@ -18,11 +18,11 @@ const SpanSchema = z.object({
     status_message: z.string().optional(),
     start_time: z.string(),
     end_time: z.string().optional(),
-    attributes: z.record(z.unknown()).optional(),
+    attributes: z.record(z.string(), z.unknown()).optional(),
     events: z.array(z.object({
         name: z.string(),
         timestamp: z.string(),
-        attributes: z.record(z.unknown()).optional(),
+        attributes: z.record(z.string(), z.unknown()).optional(),
     })).optional(),
 });
 const TokenUsageSchema = z.object({
@@ -39,7 +39,7 @@ const inputSchema = {
     latency_ms: z.number().optional().describe('Total execution time in milliseconds (end-to-end agent latency)'),
     token_usage: TokenUsageSchema.optional().describe('Token usage breakdown (prompt/completion/total — used for cost analysis)'),
     cost_usd: z.number().optional().describe('Total cost in USD — overrides per-span aggregation when provided (treated as authoritative)'),
-    metadata: z.record(z.unknown()).optional().describe('Opaque key-value tags (e.g. {requestId, userId, env}) — queryable in dashboard, not via get_traces filters'),
+    metadata: z.record(z.string(), z.unknown()).optional().describe('Opaque key-value tags (e.g. {requestId, userId, env}) — queryable in dashboard, not via get_traces filters'),
     spans: z.array(SpanSchema).optional().describe('Detailed execution spans (hierarchical span tree with timings, attributes, events)'),
     timestamp: z.string().optional().describe('Trace timestamp (ISO 8601); defaults to now() when omitted'),
 };