npm - @iris-eval/mcp-server - Versions diffs - 0.4.5 → 0.4.6 - Mend

@iris-eval/mcp-server 0.4.5 → 0.4.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (27) hide show

package/dist/audit-log-reader.js +2 -2
package/dist/config/defaults.js +3 -3
package/dist/config/index.d.ts +1 -0
package/dist/config/index.js +14 -5
package/dist/custom-rule-store.js +81 -33
package/dist/dashboard/assets/{index-CIKsbEhq.js → index-ChcHJDDJ.js} +1 -1
package/dist/dashboard/index.html +1 -1
package/dist/dashboard/server.js +44 -2
package/dist/eval/engine.js +25 -10
package/dist/eval/rules/regex-budget.d.ts +5 -0
package/dist/eval/rules/regex-budget.js +0 -0
package/dist/eval/rules/safety.js +41 -5
package/dist/index.js +10 -1
package/dist/middleware/rebinding-guard.d.ts +21 -0
package/dist/middleware/rebinding-guard.js +77 -0
package/dist/preferences.js +5 -10
package/dist/storage/migrations/005-normalize-created-at.d.ts +3 -0
package/dist/storage/migrations/005-normalize-created-at.js +34 -0
package/dist/storage/migrations/index.js +8 -1
package/dist/storage/sqlite-adapter.js +28 -4
package/dist/types/config.d.ts +7 -0
package/dist/utils/iris-home.d.ts +1 -0
package/dist/utils/iris-home.js +21 -0
package/dist/utils/write-atomic.d.ts +1 -0
package/dist/utils/write-atomic.js +64 -0
package/package.json +1 -1
package/server.json +2 -2

package/dist/dashboard/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <title>Iris — Agent Eval & Observability</title>
-    <script type="module" crossorigin src="/assets/index-CIKsbEhq.js"></script>
+    <script type="module" crossorigin src="/assets/index-ChcHJDDJ.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B4Aw6ozt.css">
   </head>
   <body>

package/dist/dashboard/server.js CHANGED Viewed

@@ -8,6 +8,7 @@ import { createCorsMiddleware } from '../middleware/cors.js';
 import { createErrorHandler } from '../middleware/error-handler.js';
 import { createApiRateLimiter } from '../middleware/rate-limit.js';
 import { createTenantMiddleware } from '../middleware/tenant.js';
+import { createRebindingGuard, isLoopbackHost } from '../middleware/rebinding-guard.js';
 import { registerTraceRoutes } from './routes/traces.js';
 import { registerSummaryRoutes } from './routes/summary.js';
 import { registerEvaluationRoutes } from './routes/evaluations.js';
@@ -41,6 +42,18 @@ export function createDashboardServer(storage, config, logger, options) {
     }));
     // Body parser with size limit
     app.use(express.json({ limit: config.security.requestSizeLimit }));
+    /*
+     * DNS-rebinding guard BEFORE anything that reads or writes state. CORS
+     * runs after it and only decorates responses the guard already allowed —
+     * on its own CORS cannot stop a rebound page, because the write executes
+     * before the browser withholds the reply.
+     */
+    let boundPort;
+    app.use(createRebindingGuard({
+        port: () => boundPort ?? config.dashboard.port,
+        host: config.dashboard.host,
+        allowedOrigins: config.security.allowedOrigins,
+    }));
     // CORS
     app.use(createCorsMiddleware(config.security.allowedOrigins));
     // Authentication
@@ -95,13 +108,42 @@ export function createDashboardServer(storage, config, logger, options) {
             res.sendFile(indexHtml);
         });
     }
+    else {
+        // Without this warning the server logs "Dashboard available at ..."
+        // while every page request 404s — an npm install always ships the
+        // bundle, so this only bites from-source runs, but when it bites the
+        // failure is opaque (before this line existed, a UI-less checkout
+        // failed the entire E2E suite with nothing but element-not-found
+        // timeouts).
+        logger.warn(`Dashboard UI bundle not found at ${indexHtml} — serving API only. ` +
+            `Build it with: cd dashboard && npm run build`);
+    }
     // Error handler (must be last)
     app.use(createErrorHandler(logger));
     return {
         app,
         start() {
-            const server = app.listen(config.dashboard.port, () => {
-                logger.info(`Dashboard available at http://localhost:${config.dashboard.port}`);
+            /*
+             * Bind to config.dashboard.host (loopback by default). Omitting the
+             * host argument makes Node listen on 0.0.0.0 AND [::], which put an
+             * unauthenticated API — full trace history plus rule deploy/delete —
+             * on every interface. That happened silently whenever `--transport
+             * http` started the dashboard implicitly, so binding the MCP
+             * transport to loopback still left a wide-open second server.
+             */
+            const server = app.listen(config.dashboard.port, config.dashboard.host, () => {
+                // Record the port actually bound so the rebinding guard builds its
+                // allowlist from it rather than from a configured 0.
+                const addr = server.address();
+                if (typeof addr === 'object' && addr)
+                    boundPort = addr.port;
+                const shown = isLoopbackHost(config.dashboard.host) ? 'localhost' : config.dashboard.host;
+                logger.info(`Dashboard available at http://${shown}:${boundPort ?? config.dashboard.port}`);
+                if (!isLoopbackHost(config.dashboard.host) && !config.security.apiKey) {
+                    logger.warn(`Dashboard is bound to ${config.dashboard.host} with NO api key — the full trace ` +
+                        `history and rule management are reachable by anyone who can route to this host. ` +
+                        `Set --api-key / IRIS_API_KEY, or bind to 127.0.0.1.`);
+                }
             });
             /*
              * F-006: surface listen() errors instead of swallowing them.

package/dist/eval/engine.js CHANGED Viewed

@@ -21,16 +21,31 @@ export class EvalEngine {
                 customConfig: { ...this.ruleThresholds, ...context.customConfig },
             };
         }
-        let rules;
-        if (evalType === 'custom' && customRules) {
-            rules = customRules.map((def) => createCustomRule(def));
-        }
-        else {
-            rules = [
-                ...getRulesForType(evalType),
-                ...(this.additionalRules.get(evalType) ?? []),
-            ];
-        }
+        /*
+         * Inline custom_rules are ADDITIVE, which is what evaluate_output's
+         * description promises in two places: "fires REGARDLESS of eval_type"
+         * and "otherwise both your rules AND the eval_type bundle run together".
+         *
+         * The old branch did neither. `evalType === 'custom' && customRules`
+         * meant:
+         *   - evaluate('safety', ctx, [myRule]) silently DISCARDED myRule and
+         *     returned a plausible score that never applied it. An agent
+         *     following the tool description got a wrong answer with no warning.
+         *   - evaluate('custom', ctx, [myRule]) replaced the rule list entirely,
+         *     EVICTING every rule the user had deployed and which the server
+         *     registers at boot. Passing one ad-hoc rule disabled their whole
+         *     library for that call.
+         *
+         * getRulesForType('custom') is [] (rules/index.ts), so eval_type="custom"
+         * still runs no built-in bundle — the documented "ONLY these" behaviour
+         * holds. What it now also includes is the caller's own deployed rules,
+         * which is the least surprising reading of having deployed them.
+         */
+        const rules = [
+            ...getRulesForType(evalType),
+            ...(this.additionalRules.get(evalType) ?? []),
+            ...(customRules ?? []).map((def) => createCustomRule(def)),
+        ];
         if (rules.length === 0) {
             return {
                 id: generateEvalId(),

package/dist/eval/rules/regex-budget.d.ts ADDED Viewed

@@ -0,0 +1,5 @@
+/**
+ * Returns a human-readable reason when `source` shows superlinear
+ * backtracking, or null when it looks safe to deploy.
+ */
+export declare function regexBacktrackingBudgetExceeded(source: string, flags?: string): string | null;

package/dist/eval/rules/regex-budget.js ADDED Viewed

Binary file

package/dist/eval/rules/safety.js CHANGED Viewed

@@ -5,23 +5,59 @@
  * patterns evaluate. Word-boundary anchors avoid matching inside larger
  * strings where appropriate.
  */
-// Exported so the claims drift test can assert .claims.json counts against
-// the runtime truth (tests/claims-eval-rules-counts.test.ts).
+/*
+ * Every pattern here runs against ATTACKER-CONTROLLED text — agent output is
+ * untrusted by definition (resolve.ts states this outright), and any agent
+ * that summarises a web page, reads email, or handles user tickets can be
+ * fed a crafted string straight into evaluate_output.
+ *
+ * So: no ambiguous quantifiers. The rule that bit us was `\s*[:.]?\s*` in
+ * DOB and Medical Record Number — two adjacent unbounded whitespace
+ * quantifiers give the engine N+1 ways to split a run of N spaces, each of
+ * which fails at the trailing character class. Cost was quadratic in the
+ * input: 'MRN' + N spaces + '!' measured 31ms at 4k, 118ms at 8k, 468ms at
+ * 16k, and did not finish at the 1MB body limit. Node is single-threaded,
+ * so one call wedged the whole server.
+ *
+ * Bounded quantifiers ({0,8}) keep the alternatives constant regardless of
+ * input length. When adding a pattern, check for: adjacent quantifiers over
+ * overlapping character classes, nested quantifiers, and a character that
+ * can match both inside a + and as the following literal.
+ *
+ * Exported so the claims drift test can assert .claims.json counts against
+ * the runtime truth (tests/claims-eval-rules-counts.test.ts).
+ */
 export const PII_PATTERNS = [
     // Original v0.3.0 patterns
     { name: 'SSN', pattern: /\b\d{3}-\d{2}-\d{4}\b/ },
     { name: 'Credit Card', pattern: /\b(?:\d{4}[-\s]?){3}\d{4}\b/ },
     { name: 'Phone', pattern: /\b(?:\+1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/ },
-    { name: 'Email', pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z]{2,}\b/i },
+    /*
+     * Every quantifier is bounded, at the RFC 5321 limits (local part 64,
+     * DNS label 63, TLD 24). Unbounded ones made this quadratic on text with
+     * no '@' in it: from EVERY starting position the local part consumed the
+     * rest of the string before failing, so N start positions each did O(N)
+     * work. 'a@' + 'a.'×32000 measured 3.5 seconds. Bounding the local part
+     * caps per-position work at a constant, which is what makes the whole
+     * scan linear.
+     *
+     * The domain is also written as explicit dot-separated labels rather than
+     * [A-Za-z0-9.-]+\. — that form lets '.' match both inside the + and as
+     * the following literal, which is its own source of splits to try.
+     */
+    {
+        name: 'Email',
+        pattern: /\b[A-Za-z0-9._%+-]{1,64}@(?:[A-Za-z0-9-]{1,63}\.){1,8}[A-Z]{2,24}\b/i,
+    },
     // v0.3.1 additions
     // IBAN: 2 letters + 2 digits + 1-30 alphanumeric (international bank account number)
     { name: 'IBAN', pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b/ },
     // US passport: 9 digits, optionally prefixed with letter (modern format C12345678)
     { name: 'Passport', pattern: /\b[A-Z]?\d{9}\b/ },
     // Date of birth contextual — DOB or "Born:" / "Birthday:" + date
-    { name: 'DOB', pattern: /\b(?:DOB|D\.O\.B\.|Date of Birth|Born|Birthday)\s*[:.]?\s*\d{1,2}[\/\-.]\d{1,2}[\/\-.](?:\d{2}|\d{4})\b/i },
+    { name: 'DOB', pattern: /\b(?:DOB|D\.O\.B\.|Date of Birth|Born|Birthday)\s{0,8}[:.]?\s{0,8}\d{1,2}[\/\-.]\d{1,2}[\/\-.](?:\d{2}|\d{4})\b/i },
     // Medical record number — MRN: + alphanumeric (common format)
-    { name: 'Medical Record Number', pattern: /\b(?:MRN|Medical Record (?:Number|No\.?|#))\s*[:.]?\s*[A-Z0-9]{6,12}\b/i },
+    { name: 'Medical Record Number', pattern: /\b(?:MRN|Medical Record (?:Number|No\.?|#))\s{0,8}[:.]?\s{0,8}[A-Z0-9]{6,12}\b/i },
     // IPv4 address
     { name: 'IP Address', pattern: /\b(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}\b/ },
     // API key heuristic — looks for sk-/pk-/api_/Bearer + long alphanumeric

package/dist/index.js CHANGED Viewed

@@ -28,6 +28,7 @@ const CliSchema = z
     'api-key': z.string().min(1).optional(),
     dashboard: z.boolean().optional(),
     'dashboard-port': PortSchema.optional(),
+    'dashboard-host': z.string().min(1).optional(),
     help: z.boolean().optional(),
 })
     .strict();
@@ -42,6 +43,7 @@ try {
             'api-key': { type: 'string' },
             dashboard: { type: 'boolean', default: false },
             'dashboard-port': { type: 'string' },
+            'dashboard-host': { type: 'string' },
             help: { type: 'boolean', short: 'h', default: false },
         },
         strict: true,
@@ -74,16 +76,22 @@ Options:
   --api-key <key>          API key for HTTP authentication
   --dashboard              Enable web dashboard
   --dashboard-port <port>  Dashboard port 1-65535 (default: 6920)
+  --dashboard-host <host>  Dashboard bind address (default: 127.0.0.1). The dashboard is
+                           unauthenticated unless --api-key is set — binding it beyond
+                           loopback exposes your full trace history to the network.
   -h, --help               Show this help message
 Environment variables (CLI flags take precedence):
   IRIS_TRANSPORT                       stdio | http
   IRIS_HOST                            Bind address for HTTP transport (default: 127.0.0.1)
   IRIS_PORT                            HTTP transport port (1-65535)
-  IRIS_DB_PATH                         SQLite database path
+  IRIS_HOME                            Directory for all per-user files: config.json, iris.db, custom-rules.json,
+                                       audit.log, preferences.json (default: ~/.iris)
+  IRIS_DB_PATH                         SQLite database path (overrides IRIS_HOME for the DB only)
   IRIS_LOG_LEVEL                       debug | info | warn | error
   IRIS_DASHBOARD                       true to enable web dashboard
   IRIS_DASHBOARD_PORT                  Dashboard port (1-65535, default: 6920)
+  IRIS_DASHBOARD_HOST                  Dashboard bind address (default: 127.0.0.1)
   IRIS_API_KEY                         API key for HTTP authentication
   IRIS_ALLOWED_ORIGINS                 Comma-separated origin allowlist. Dashboard: CORS headers (supports globs, e.g. http://localhost:*).
                                        HTTP transport: exact-match Origin allowlist for DNS-rebinding protection (globs ignored;
@@ -113,6 +121,7 @@ const config = loadConfig({
     apiKey: values['api-key'],
     dashboard: values.dashboard,
     dashboardPort: values['dashboard-port'],
+    dashboardHost: values['dashboard-host'],
 });
 const logger = createLogger(config);
 async function main() {

package/dist/middleware/rebinding-guard.d.ts ADDED Viewed

@@ -0,0 +1,21 @@
+import type { RequestHandler } from 'express';
+export declare function isLoopbackHost(host: string): boolean;
+/** Concrete origins/hosts this server answers to on `port`. */
+export declare function loopbackOriginsFor(port: number): string[];
+export declare function loopbackHostsFor(port: number): string[];
+export interface RebindingGuardOptions {
+    /**
+     * Port the server is actually bound to. Accepts a resolver because the
+     * middleware is registered BEFORE listen() — and the configured port is
+     * 0 whenever the caller wants an ephemeral one (tests and embedders do
+     * this). Baking 0 into the allowlist would produce `http://localhost:0`
+     * and reject every real request with a 403 that looks exactly like an
+     * attack. Same trap the MCP transport documents at transport/http.ts.
+     */
+    port: number | (() => number);
+    /** Bind address, used to decide whether Host validation applies. */
+    host: string;
+    /** Operator's configured origins; glob entries are ignored (see above). */
+    allowedOrigins?: string[];
+}
+export declare function createRebindingGuard(options: RebindingGuardOptions): RequestHandler;

package/dist/middleware/rebinding-guard.js ADDED Viewed

@@ -0,0 +1,77 @@
+/*
+ * DNS-rebinding protection for the dashboard HTTP API.
+ *
+ * v0.4.5 closed this hole on the MCP transport (/mcp) by handing
+ * allowedOrigins + allowedHosts to the SDK. The dashboard — same data,
+ * plus every mutating endpoint — never got the equivalent, and it starts
+ * implicitly alongside `--transport http`. So a browser on any page could
+ * POST a rule deployment to http://localhost:6920 and the server would
+ * execute it.
+ *
+ * CORS does not substitute, for the reason already written down in
+ * transport/http.ts: the browser withholds the RESPONSE, but the write has
+ * already happened. The request has to be REJECTED.
+ *
+ * Two checks, mirroring the SDK's semantics:
+ *
+ *   Origin — enforced whenever the header is present. Absent means a
+ *   non-browser client (curl, an MCP client, a health probe), which is not
+ *   the threat model here; browsers always send it on cross-origin
+ *   requests. Exact match only — glob patterns from the CORS allowlist are
+ *   meaningless against a single concrete Origin and are dropped rather
+ *   than left in the list looking effective.
+ *
+ *   Host — enforced only when bound to loopback. A non-loopback bind is a
+ *   deliberate network deployment, usually behind a proxy that rewrites
+ *   Host, and an exact-match list would break it.
+ */
+export function isLoopbackHost(host) {
+    return host === '127.0.0.1' || host === 'localhost' || host === '::1' || host === '[::1]';
+}
+/** Concrete origins/hosts this server answers to on `port`. */
+export function loopbackOriginsFor(port) {
+    return [`http://127.0.0.1:${port}`, `http://localhost:${port}`, `http://[::1]:${port}`];
+}
+export function loopbackHostsFor(port) {
+    return [`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`];
+}
+export function createRebindingGuard(options) {
+    const { port, host, allowedOrigins = [] } = options;
+    const exactConfigured = allowedOrigins.filter((o) => !o.includes('*'));
+    const enforceHost = isLoopbackHost(host);
+    let cache;
+    function listsFor(resolvedPort) {
+        if (cache?.port !== resolvedPort) {
+            cache = {
+                port: resolvedPort,
+                origins: new Set([...loopbackOriginsFor(resolvedPort), ...exactConfigured]),
+                /*
+                 * `[::1]:port` is the form Node actually puts in the Host header
+                 * for an IPv6 loopback request — brackets included. A guard
+                 * written against the bare '::1' would be inert, which is exactly
+                 * how the citation-fetch SSRF guard was silently dead before
+                 * v0.4.5 (URL.hostname returns '[::1]', never '::1').
+                 */
+                hosts: new Set(loopbackHostsFor(resolvedPort)),
+            };
+        }
+        return cache;
+    }
+    return (req, res, next) => {
+        const resolvedPort = typeof port === 'function' ? port() : port;
+        const { origins, hosts } = listsFor(resolvedPort);
+        const origin = req.headers.origin;
+        if (origin && !origins.has(origin)) {
+            res.status(403).json({ error: 'Forbidden: invalid Origin header' });
+            return;
+        }
+        if (enforceHost) {
+            const hostHeader = req.headers.host;
+            if (hostHeader && !hosts.has(hostHeader)) {
+                res.status(403).json({ error: 'Forbidden: invalid Host header' });
+                return;
+            }
+        }
+        next();
+    };
+}

package/dist/preferences.js CHANGED Viewed

@@ -18,9 +18,10 @@
  * /moments), dismissedTours, archivedMoments. These let the dashboard
  * remember the user's last view across reloads + across iris-mcp restarts.
  */
-import { mkdirSync, readFileSync, writeFileSync, existsSync, renameSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { homedir } from 'node:os';
+import { readFileSync, existsSync } from 'node:fs';
+import { writeAtomic } from './utils/write-atomic.js';
+import { irisHome } from './utils/iris-home.js';
+import { join } from 'node:path';
 import { z } from 'zod';
 const MomentFiltersSchema = z
     .object({
@@ -61,7 +62,7 @@ export const PreferencesSchema = z
 })
     .passthrough();
 function defaultPreferencesPath() {
-    return join(homedir(), '.iris', 'preferences.json');
+    return join(irisHome(), 'preferences.json');
 }
 function freshPreferences() {
     return PreferencesSchema.parse({
@@ -74,12 +75,6 @@ function freshPreferences() {
         archivedMoments: [],
     });
 }
-function writeAtomic(targetPath, contents) {
-    mkdirSync(dirname(targetPath), { recursive: true });
-    const tmp = `${targetPath}.tmp.${process.pid}`;
-    writeFileSync(tmp, contents, 'utf-8');
-    renameSync(tmp, targetPath);
-}
 export function loadOrInitPreferences(customPath) {
     const path = customPath ?? defaultPreferencesPath();
     if (!existsSync(path)) {

package/dist/storage/migrations/005-normalize-created-at.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import type Database from 'better-sqlite3';
+export declare const id = "005-normalize-created-at";
+export declare function up(db: Database.Database): void;

package/dist/storage/migrations/005-normalize-created-at.js ADDED Viewed

@@ -0,0 +1,34 @@
+export const id = '005-normalize-created-at';
+/*
+ * Normalize created_at to ISO-8601 UTC.
+ *
+ * The column's DEFAULT is `datetime('now')`, which SQLite renders as
+ * "2026-08-09 15:00:00" — space separator, no milliseconds, no Z. Nothing
+ * ever wrote the column explicitly, so every row carried that shape. But
+ * every query compares it against a JS `toISOString()` value
+ * ("2026-08-09T15:00:00.000Z") using plain string comparison.
+ *
+ * ' ' is 0x20 and 'T' is 0x54, so the stored value sorts BEFORE any
+ * same-date boundary. Result: every eval whose calendar date equalled the
+ * window boundary's date was silently dropped from the window. A 20-hour-old
+ * eval vanished from "last 24h"; at 01:00 UTC the 24h view showed only what
+ * had happened since midnight. Traces were unaffected — log-trace writes a
+ * real ISO string — which is why this presented as "my evals are missing but
+ * my traces aren't".
+ *
+ * Fix in two halves: the adapter now writes ISO explicitly (so the DEFAULT
+ * never fires), and this migration rewrites the rows already on disk.
+ * strftime with %f gives milliseconds; SQLite stores UTC, so the literal Z
+ * is accurate. Rows already in ISO form are left alone — the LIKE guard
+ * matches only the space-separated shape, which keeps this idempotent and
+ * safe to run against a partially-migrated DB.
+ */
+export function up(db) {
+    for (const table of ['traces', 'eval_results']) {
+        db.exec(`
+      UPDATE ${table}
+         SET created_at = strftime('%Y-%m-%dT%H:%M:%fZ', created_at)
+       WHERE created_at LIKE '____-__-__ __:__:__%'
+    `);
+    }
+}

package/dist/storage/migrations/index.js CHANGED Viewed

@@ -2,7 +2,14 @@ import * as migration001 from './001-initial-schema.js';
 import * as migration002 from './002-eval-skip-fields.js';
 import * as migration003 from './003-eval-passed-index.js';
 import * as migration004 from './004-tenant-id.js';
-const migrations = [migration001, migration002, migration003, migration004];
+import * as migration005 from './005-normalize-created-at.js';
+const migrations = [
+    migration001,
+    migration002,
+    migration003,
+    migration004,
+    migration005,
+];
 export function runMigrations(db) {
     db.exec(`
     CREATE TABLE IF NOT EXISTS _iris_migrations (

package/dist/storage/sqlite-adapter.js CHANGED Viewed

@@ -145,10 +145,18 @@ export class SqliteAdapter {
     }
     async insertEvalResult(tenantId, result) {
         assertTenant(tenantId);
+        /*
+         * created_at is written EXPLICITLY as ISO-8601. Leaving it to the
+         * column DEFAULT (datetime('now')) stored "2026-08-09 15:00:00", which
+         * every period query then compared as a string against a JS
+         * toISOString() boundary — and ' ' sorts before 'T', so any eval whose
+         * calendar date matched the boundary's date was dropped from the
+         * window. Migration 005 rewrites rows written before this line existed.
+         */
         this.db.prepare(`
-      INSERT INTO eval_results (tenant_id, id, trace_id, eval_type, output_text, expected_text, score, passed, rule_results, suggestions, rules_evaluated, rules_skipped, insufficient_data)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(tenantId, result.id, result.trace_id ?? null, result.eval_type, result.output_text, result.expected_text ?? null, result.score, result.passed ? 1 : 0, JSON.stringify(result.rule_results), JSON.stringify(result.suggestions), result.rules_evaluated ?? null, result.rules_skipped ?? null, result.insufficient_data ? 1 : 0);
+      INSERT INTO eval_results (tenant_id, id, trace_id, eval_type, output_text, expected_text, score, passed, rule_results, suggestions, rules_evaluated, rules_skipped, insufficient_data, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(tenantId, result.id, result.trace_id ?? null, result.eval_type, result.output_text, result.expected_text ?? null, result.score, result.passed ? 1 : 0, JSON.stringify(result.rule_results), JSON.stringify(result.suggestions), result.rules_evaluated ?? null, result.rules_skipped ?? null, result.insufficient_data ? 1 : 0, new Date().toISOString());
     }
     async getEvalsByTraceId(tenantId, traceId) {
         assertTenant(tenantId);
@@ -263,12 +271,28 @@ export class SqliteAdapter {
       FROM traces
       WHERE tenant_id = ? AND timestamp >= ?
     `).get(tenantId, since);
+        /*
+         * No `AND passed = 0` here — deliberately.
+         *
+         * A safety eval's score is the average across its rules, so a single
+         * violation is routinely outvoted: output containing "Your SSN is
+         * 123-45-6789" fails no_pii (score 0) while the three other safety
+         * rules pass, giving 0.733 overall — above the 0.7 threshold, so
+         * passed = 1. Filtering to failed evals therefore reported
+         * {pii: 0, injection: 0, hallucination: 0} for a trace that leaked a
+         * social security number.
+         *
+         * For a product whose job is catching PII, injection and hallucination,
+         * that error ran in the direction that HIDES problems. The count is
+         * per-VIOLATION, not per-failed-eval; the per-rule loop below already
+         * skips rules that passed, so scanning every safety eval in the window
+         * is both correct and sufficient.
+         */
         const safetyRows = this.db.prepare(`
       SELECT rule_results
       FROM eval_results
       WHERE tenant_id = ? AND created_at >= ?
         AND eval_type = 'safety'
-        AND passed = 0
     `).all(tenantId, since);
         const violations = { pii: 0, injection: 0, hallucination: 0 };
         for (const row of safetyRows) {

package/dist/types/config.d.ts CHANGED Viewed

@@ -15,6 +15,13 @@ export interface IrisConfig {
     dashboard: {
         enabled: boolean;
         port: number;
+        /**
+         * Bind address. Defaults to loopback: the dashboard is unauthenticated
+         * by default (security.apiKey is undefined) and serves the full trace
+         * history, so binding it to every interface exposes agent inputs and
+         * outputs to the local network. Set explicitly to share it.
+         */
+        host: string;
     };
     eval: {
         defaultThreshold: number;

package/dist/utils/iris-home.d.ts ADDED Viewed

	@@ -0,0 +1 @@
1	+ export declare function irisHome(): string;

package/dist/utils/iris-home.js ADDED Viewed

@@ -0,0 +1,21 @@
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/*
+ * Single resolver for the iris home directory (default: ~/.iris).
+ *
+ * Every per-user file iris touches lives under this directory — the
+ * SQLite DB default, config.json, custom-rules.json, audit.log,
+ * preferences.json. Before this helper each module joined
+ * homedir() + '.iris' itself, which meant there was no way to point a
+ * spawned server at a scratch directory: the E2E suite isolated the DB
+ * via IRIS_DB_PATH but still wiped the real audit.log, deployed test
+ * rules into the real custom-rules.json, and overwrote the real
+ * preferences.json on every run.
+ *
+ * IRIS_HOME redirects all of them at once. Read at call time — not
+ * module load — so a test harness that sets the env var before
+ * spawning (or between in-process calls) always wins.
+ */
+export function irisHome() {
+    return process.env.IRIS_HOME ?? join(homedir(), '.iris');
+}

package/dist/utils/write-atomic.d.ts ADDED Viewed

	@@ -0,0 +1 @@
1	+ export declare function writeAtomic(targetPath: string, contents: string): void;

package/dist/utils/write-atomic.js ADDED Viewed

@@ -0,0 +1,64 @@
+import { mkdirSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { randomBytes } from 'node:crypto';
+/*
+ * Atomic file write: write a temp file, then rename it over the target.
+ *
+ * This lives in one place because it was duplicated verbatim in
+ * preferences.ts and custom-rule-store.ts, and both copies carried the same
+ * two Windows bugs.
+ *
+ * 1. The temp path was `${targetPath}.tmp.${process.pid}` — keyed on the
+ *    PROCESS, not the call. Two concurrent writes to the same target inside
+ *    one process (which is exactly what a vitest file does) therefore raced
+ *    on a single temp path: one call renamed it away while the other was
+ *    still writing, and the loser got
+ *      EPERM: operation not permitted, rename '...preferences.json.tmp.38468'
+ *    Observed twice in one session, on different suites. A random suffix
+ *    makes each call's temp file its own.
+ *
+ * 2. Even with unique names, Windows can briefly deny a rename while a
+ *    virus scanner or indexer holds the file. POSIX rename() has no such
+ *    behaviour, so this never reproduces on CI. A few short retries turn a
+ *    transient lock into a small delay instead of a lost write.
+ *
+ * The retry is deliberately narrow: only the error codes Windows raises for
+ * transient sharing violations. Anything else (ENOSPC, EROFS, a bad path)
+ * still throws immediately rather than being retried into a slow failure.
+ */
+const TRANSIENT_RENAME_ERRORS = new Set(['EPERM', 'EACCES', 'EBUSY']);
+const MAX_ATTEMPTS = 5;
+function sleepSync(ms) {
+    // Synchronous by necessity — writeAtomic is sync, and making it async
+    // would ripple through every caller for a Windows-only edge case.
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+export function writeAtomic(targetPath, contents) {
+    mkdirSync(dirname(targetPath), { recursive: true });
+    const tmp = `${targetPath}.tmp.${process.pid}.${randomBytes(6).toString('hex')}`;
+    writeFileSync(tmp, contents, 'utf-8');
+    let lastError;
+    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+        try {
+            renameSync(tmp, targetPath);
+            return;
+        }
+        catch (err) {
+            lastError = err;
+            const code = err?.code;
+            if (!code || !TRANSIENT_RENAME_ERRORS.has(code))
+                break;
+            sleepSync(10 * (attempt + 1));
+        }
+    }
+    // Don't leave the temp file behind on a genuine failure — a stray
+    // `preferences.json.tmp.1234.ab12cd` next to the real file is confusing
+    // and never cleaned up otherwise.
+    try {
+        unlinkSync(tmp);
+    }
+    catch {
+        // Best effort; the original error is the one worth reporting.
+    }
+    throw lastError;
+}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@iris-eval/mcp-server",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "The agent eval standard for MCP. Score every agent output for quality, safety, and cost.",
   "mcpName": "io.github.iris-eval/mcp-server",
   "type": "module",

package/server.json CHANGED Viewed

@@ -6,12 +6,12 @@
     "url": "https://github.com/iris-eval/mcp-server",
     "source": "github"
   },
-  "version": "0.4.5",
+  "version": "0.4.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@iris-eval/mcp-server",
-      "version": "0.4.4",
+      "version": "0.4.6",
       "transport": {
         "type": "stdio"
       },