@mcp-audit-gateway/core 0.1.0

package/.github/workflows/npm-publish.yml

@@ -0,0 +1,21 @@
+name: Publish to npm
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org/
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+      - run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.npm_token}}

package/CONTRIBUTING.md

@@ -0,0 +1,41 @@
+# Contributing
+
+Contributions welcome. Here's how to get going.
+
+## Setup
+
+```bash
+git clone <repo-url> && cd mcp-audit-gateway
+npm install
+npm run build
+npm test
+```
+
+Requires Node.js 20+.
+
+## Running tests
+
+```bash
+npm test              # all tests
+npx vitest run src/attestation/  # just attestation tests
+```
+
+Tests use Vitest and run against real filesystem paths (no mocks for the audit log). Temp files go in `/tmp` and are cleaned up in `afterEach`.
+
+## Code style
+
+TypeScript strict mode. No `any` unless interfacing with the MCP SDK's dynamic types. Keep functions short and avoid class inheritance.
+
+## Pull requests
+
+One feature or fix per PR. Include a test that fails without the fix and passes with it.
+
+If you're changing the attestation or signing logic, run the full verification test suite and include `verify` CLI output in the PR description showing the audit log validates end-to-end.
+
+## Architecture decisions
+
+The gateway is a transparent proxy. It should never modify tool call arguments or results. Its job is to observe, sign, and enforce policy. If a feature requires mutating upstream data, it belongs in a different layer.
+
+## Security
+
+If you find a vulnerability in the signing, chain verification, or policy enforcement, please report it privately before opening a public issue.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Elankumaran Srinivasan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,156 @@
+# mcp-audit
+
+Your AI agent made 847 tool calls yesterday. Can you verify what it did?
+
+Tamper-evident audit trail for AI agent tool calls.
+
+## Setup (10 seconds)
+
+Before:
+```json
+{
+  "command": "npx",
+  "args": ["@modelcontextprotocol/server-github"]
+}
+```
+
+After:
+```json
+{
+  "command": "npx",
+  "args": ["mcp-audit", "wrap", "--", "npx", "@modelcontextprotocol/server-github"]
+}
+```
+
+Every tool call is now cryptographically signed and hash-chained. Nothing else changes. The MCP server works exactly as before.
+
+## What it does
+
+```
+$ mcp-audit tail
+
+✓ 14:32:01 github/create_pr                 234ms  bf7a2f62
+✓ 14:32:03 github/list_issues                89ms  a1c4e890
+✗ 14:32:05 fs/delete_file                    12ms  c3d9f012
+✓ 14:32:08 github/merge_pr                  456ms  e5f6a7b8
+```
+
+Every entry is signed with HMAC-SHA256 and chained to the previous record. Tamper with any entry and verification fails. Delete an entry and the chain breaks.
+
+## Verify integrity
+
+```bash
+$ mcp-audit verify ~/.mcp-audit/audit.jsonl
+
+Results:
+  Total records: 847
+  Valid: 847
+  Invalid: 0
+
+All records verified successfully.
+```
+
+## How it works
+
+```
+┌────────────┐       ┌───────────┐       ┌────────────┐
+│ MCP Client │──────▶│ mcp-audit │──────▶│ MCP Server │
+│ (Claude,   │◀──────│   wrap    │◀──────│ (any)      │
+│  Cursor)   │       └─────┬─────┘       └────────────┘
+└────────────┘             │
+                           ▼
+                    ~/.mcp-audit/
+                    audit.jsonl
+```
+
+The wrap command spawns your MCP server as a child process and sits between the client and server on stdio. It forwards ALL messages transparently. Only `tools/call` responses get signed and logged. Everything else passes through untouched.
+
+On first run, a signing key is auto-generated in `~/.mcp-audit/key.hex`. No configuration needed.
+
+## Audit record format
+
+```json
+{
+  "id": "bf7a2f62-4d0f-4cce-afd2-cbfbf7bca2a5",
+  "timestamp": "2026-08-16T14:32:01.000Z",
+  "method": "tools/call",
+  "toolName": "github/create_pr",
+  "args": {"title": "Fix bug", "body": "..."},
+  "durationMs": 234,
+  "success": true,
+  "previousHash": "8a3f2b...",
+  "attestation": "7c4d9e..."
+}
+```
+
+The `attestation` is an HMAC-SHA256 signature over the record's canonical fields. The `previousHash` is SHA-256 of the preceding record. Together they detect tampering, ordering, and completeness.
+
+## Use with Claude Desktop
+
+`claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "github": {
+      "command": "npx",
+      "args": ["mcp-audit", "wrap", "--", "npx", "@modelcontextprotocol/server-github"]
+    },
+    "filesystem": {
+      "command": "npx",
+      "args": ["mcp-audit", "wrap", "--", "npx", "@modelcontextprotocol/server-filesystem", "/tmp"]
+    }
+  }
+}
+```
+
+## Use with Claude Code
+
+`.claude/hooks/mcp-servers.json` or directly in your MCP server command — prefix with `mcp-audit wrap --`.
+
+## CLI
+
+```bash
+mcp-audit wrap -- <cmd> [args]    # Wrap any MCP server
+mcp-audit tail                    # Live stream of tool calls
+mcp-audit verify <log>            # Verify chain integrity
+mcp-audit serve [config]          # Full gateway (policy + OTel)
+mcp-audit keygen [dir]            # Generate Ed25519 key pair
+```
+
+## Full gateway mode
+
+For teams that also need access control, rate limiting, and multi-server routing:
+
+```bash
+mcp-audit serve gateway.config.json
+```
+
+The full gateway adds:
+- Policy engine (glob-based ACLs, per-principal rate limits)
+- Tool namespacing across multiple upstream MCP servers
+- OpenTelemetry traces and metrics export
+- Upstream health management with automatic reconnection
+- Ed25519 signatures (stronger than HMAC, portable verification)
+
+See [gateway configuration](gateway.config.example.json) for the full schema.
+
+## Install
+
+```bash
+npm install -g @mcp-gateway/audit
+```
+
+This installs the `mcp-audit` CLI globally. Or use without installing:
+```bash
+npx @mcp-gateway/audit wrap -- <your mcp server command>
+```
+
+## Testing
+
+```bash
+npm test   # 96 tests across 12 test files
+```
+
+## License
+
+MIT

package/dist/attestation/audit-log.d.ts

@@ -0,0 +1,25 @@
+import type { AuditRecord } from "../types.js";
+import type { Signer } from "./signer.js";
+export declare function hashRecord(record: AuditRecord): string;
+export declare class AuditLog {
+    private path;
+    private signer;
+    private rotateAfterBytes;
+    private currentSize;
+    private lastHash;
+    private writeQueue;
+    constructor(path: string, signer: Signer, rotateAfterBytes: number);
+    record(method: string, opts: {
+        toolName?: string;
+        namespace?: string;
+        upstream?: string;
+        principal?: string;
+        durationMs: number;
+        success: boolean;
+        errorCode?: number;
+    }): Promise<AuditRecord>;
+    private writeRecord;
+    private rotate;
+    init(): Promise<void>;
+}
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/attestation/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAGtD;AAED,qBAAa,QAAQ;IAMjB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,gBAAgB;IAP1B,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,UAAU,CAAoC;gBAG5C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM;IAG5B,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,WAAW,CAAC;YAaT,WAAW;YAmCX,MAAM;IAUd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAmC5B"}

package/dist/attestation/audit-log.js

@@ -0,0 +1,95 @@
+import { appendFile, stat, rename, open } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+export function hashRecord(record) {
+    const json = JSON.stringify(record);
+    return createHash("sha256").update(json).digest("hex");
+}
+export class AuditLog {
+    path;
+    signer;
+    rotateAfterBytes;
+    currentSize = 0;
+    lastHash = "genesis";
+    writeQueue = Promise.resolve();
+    constructor(path, signer, rotateAfterBytes) {
+        this.path = path;
+        this.signer = signer;
+        this.rotateAfterBytes = rotateAfterBytes;
+    }
+    async record(method, opts) {
+        return new Promise((resolve, reject) => {
+            this.writeQueue = this.writeQueue.then(async () => {
+                try {
+                    const result = await this.writeRecord(method, opts);
+                    resolve(result);
+                }
+                catch (err) {
+                    reject(err);
+                }
+            });
+        });
+    }
+    async writeRecord(method, opts) {
+        const record = {
+            id: randomUUID(),
+            timestamp: new Date().toISOString(),
+            method,
+            ...opts,
+            previousHash: this.lastHash,
+        };
+        record.attestation = await this.signer.sign(record);
+        const line = JSON.stringify(record) + "\n";
+        await appendFile(this.path, line);
+        this.currentSize += Buffer.byteLength(line);
+        this.lastHash = hashRecord(record);
+        if (this.currentSize >= this.rotateAfterBytes) {
+            await this.rotate();
+        }
+        return record;
+    }
+    async rotate() {
+        const ts = new Date().toISOString().replace(/[:.]/g, "-");
+        const rotatedPath = this.path.replace(/\.jsonl$/, `-${ts}.jsonl`);
+        try {
+            await rename(this.path, rotatedPath);
+            this.currentSize = 0;
+            this.lastHash = "genesis";
+        }
+        catch { }
+    }
+    async init() {
+        let s;
+        try {
+            s = await stat(this.path);
+        }
+        catch {
+            this.currentSize = 0;
+            return;
+        }
+        this.currentSize = s.size;
+        if (s.size > 0) {
+            const tailSize = Math.min(s.size, 8192);
+            const fh = await open(this.path, "r");
+            try {
+                const buf = Buffer.alloc(tailSize);
+                await fh.read(buf, 0, tailSize, s.size - tailSize);
+                const tail = buf.toString("utf-8");
+                const lines = tail.trimEnd().split("\n");
+                for (let i = lines.length - 1; i >= 0; i--) {
+                    try {
+                        const record = JSON.parse(lines[i]);
+                        this.lastHash = hashRecord(record);
+                        return;
+                    }
+                    catch {
+                        process.stderr.write(`[audit-log] warning: corrupt record in tail, skipping\n`);
+                    }
+                }
+            }
+            finally {
+                await fh.close();
+            }
+        }
+    }
+}
+//# sourceMappingURL=audit-log.js.map

package/dist/attestation/audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIrD,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,OAAO,QAAQ;IAMT;IACA;IACA;IAPF,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,GAAW,SAAS,CAAC;IAC7B,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,YACU,IAAY,EACZ,MAAc,EACd,gBAAwB;QAFxB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QACd,qBAAgB,GAAhB,gBAAgB,CAAQ;IAC/B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,MAAc,EACd,IAQC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACpD,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,IAQC;QAED,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,UAAU,EAAE;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,GAAG,IAAI;YACP,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC;QAEF,MAAM,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAE3C,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACrC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,CAAC;QACN,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;QAE1B,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACH,MAAM,MAAM,GAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;wBACjD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;wBACnC,OAAO;oBACT,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,CAC1D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/attestation/bugfix.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bugfix.test.d.ts.map

package/dist/attestation/bugfix.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bugfix.test.d.ts","sourceRoot":"","sources":["../../src/attestation/bugfix.test.ts"],"names":[],"mappings":""}

package/dist/attestation/bugfix.test.js

@@ -0,0 +1,103 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { unlink, readFile } from "node:fs/promises";
+import { HmacSigner } from "./signer.js";
+import { AuditLog, hashRecord } from "./audit-log.js";
+import { verifyAuditLog } from "./verify.js";
+const TEST_LOG = "/tmp/bugfix-audit.jsonl";
+const SECRET = "d".repeat(64);
+describe("Bug fix: pipe injection in canonicalization", () => {
+    const signer = new HmacSigner(SECRET);
+    it("different records with pipe chars produce different signatures", async () => {
+        const record1 = {
+            id: "uuid-1",
+            timestamp: "2026-08-16T10:00:00Z",
+            method: "tools/call",
+            toolName: "db/read|admin",
+            namespace: "db",
+            upstream: "evil",
+            principal: "alice",
+            durationMs: 50,
+            success: true,
+        };
+        const record2 = {
+            id: "uuid-1",
+            timestamp: "2026-08-16T10:00:00Z",
+            method: "tools/call",
+            toolName: "db/read",
+            namespace: "admin",
+            upstream: "db",
+            principal: "evil|alice",
+            durationMs: 50,
+            success: true,
+        };
+        const sig1 = await signer.sign(record1);
+        const sig2 = await signer.sign(record2);
+        expect(sig1).not.toBe(sig2);
+    });
+});
+describe("Bug fix: hash chain survives restart", () => {
+    const signer = new HmacSigner(SECRET);
+    beforeEach(async () => { try {
+        await unlink(TEST_LOG);
+    }
+    catch { } });
+    afterEach(async () => { try {
+        await unlink(TEST_LOG);
+    }
+    catch { } });
+    it("restores lastHash from existing log on init", async () => {
+        const log1 = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log1.init();
+        await log1.record("tools/call", { toolName: "test/a", durationMs: 10, success: true });
+        await log1.record("tools/call", { toolName: "test/b", durationMs: 10, success: true });
+        const log2 = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log2.init();
+        await log2.record("tools/call", { toolName: "test/c", durationMs: 10, success: true });
+        const result = await verifyAuditLog(TEST_LOG, signer, { verifyChain: true });
+        expect(result.total).toBe(3);
+        expect(result.valid).toBe(3);
+        expect(result.invalid).toBe(0);
+    });
+});
+describe("Bug fix: concurrent writes maintain chain integrity", () => {
+    const signer = new HmacSigner(SECRET);
+    beforeEach(async () => { try {
+        await unlink(TEST_LOG);
+    }
+    catch { } });
+    afterEach(async () => { try {
+        await unlink(TEST_LOG);
+    }
+    catch { } });
+    it("serializes concurrent writes correctly", async () => {
+        const log = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log.init();
+        await log.record("tools/call", { toolName: "test/setup", durationMs: 10, success: true });
+        const concurrent = Array.from({ length: 10 }, (_, i) => log.record("tools/call", { toolName: `test/tool_${i}`, durationMs: i, success: true }));
+        await Promise.all(concurrent);
+        const content = await readFile(TEST_LOG, "utf-8");
+        const records = content.trimEnd().split("\n").map((l) => JSON.parse(l));
+        expect(records).toHaveLength(11);
+        const previousHashes = records.map((r) => r.previousHash);
+        const unique = new Set(previousHashes);
+        expect(unique.size).toBe(11);
+        for (let i = 1; i < records.length; i++) {
+            const expected = hashRecord(records[i - 1]);
+            expect(records[i].previousHash).toBe(expected);
+        }
+    });
+});
+describe("Bug fix: glob matcher prefix/suffix overlap", () => {
+    it("does not match when prefix and suffix overlap", async () => {
+        const { PolicyEngine } = await import("../policy/engine.js");
+        const engine = new PolicyEngine("allow", []);
+        const match = engine.globMatch.bind(engine);
+        expect(match("ab*ab", "ab")).toBe(false);
+        expect(match("admin*admin", "admin")).toBe(false);
+        expect(match("ab*ab", "abab")).toBe(true);
+        expect(match("ab*ab", "abXab")).toBe(true);
+        expect(match("*/write_*", "fs/write_file")).toBe(true);
+        expect(match("agent:readonly-*", "agent:readonly-bot")).toBe(true);
+    });
+});
+//# sourceMappingURL=bugfix.test.js.map

package/dist/attestation/bugfix.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bugfix.test.js","sourceRoot":"","sources":["../../src/attestation/bugfix.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAa,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE9B,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAgB;YAC3B,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,sBAAsB;YACjC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,MAAM,OAAO,GAAgB;YAC3B,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,sBAAsB;YACjC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,UAAU,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvF,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,UAAU,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjB,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1F,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrD,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACvF,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAEjC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAI,MAAc,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/attestation/chain.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=chain.test.d.ts.map

package/dist/attestation/chain.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.test.d.ts","sourceRoot":"","sources":["../../src/attestation/chain.test.ts"],"names":[],"mappings":""}

package/dist/attestation/chain.test.js

@@ -0,0 +1,153 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { unlink, readFile } from "node:fs/promises";
+import { HmacSigner } from "./signer.js";
+import { AuditLog, hashRecord } from "./audit-log.js";
+import { verifyChain } from "./verify.js";
+const TEST_LOG = "/tmp/test-chain-audit.jsonl";
+const SECRET = "c".repeat(64);
+async function readRecords(path) {
+    const content = await readFile(path, "utf-8");
+    return content
+        .split("\n")
+        .filter((line) => line.trim().length > 0)
+        .map((line) => JSON.parse(line));
+}
+describe("hash chain integrity", () => {
+    const signer = new HmacSigner(SECRET);
+    beforeEach(async () => {
+        try {
+            await unlink(TEST_LOG);
+        }
+        catch { }
+    });
+    afterEach(async () => {
+        try {
+            await unlink(TEST_LOG);
+        }
+        catch { }
+    });
+    it("valid chain passes verification", async () => {
+        const log = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log.init();
+        await log.record("tools/call", {
+            toolName: "test/tool_a",
+            namespace: "test",
+            upstream: "test-server",
+            principal: "agent:bot",
+            durationMs: 100,
+            success: true,
+        });
+        await log.record("tools/call", {
+            toolName: "test/tool_b",
+            namespace: "test",
+            upstream: "test-server",
+            principal: "agent:bot",
+            durationMs: 50,
+            success: true,
+        });
+        await log.record("tools/call", {
+            toolName: "test/tool_c",
+            namespace: "test",
+            upstream: "test-server",
+            principal: "agent:bot",
+            durationMs: 75,
+            success: true,
+        });
+        const records = await readRecords(TEST_LOG);
+        const result = await verifyChain(records);
+        expect(result.valid).toBe(true);
+        expect(result.total).toBe(3);
+        expect(result.errors).toHaveLength(0);
+        // Verify first record has genesis
+        expect(records[0].previousHash).toBe("genesis");
+        // Verify second record references hash of first
+        expect(records[1].previousHash).toBe(hashRecord(records[0]));
+        // Verify third record references hash of second
+        expect(records[2].previousHash).toBe(hashRecord(records[1]));
+    });
+    it("detects deleted record", async () => {
+        const log = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log.init();
+        await log.record("tools/call", {
+            toolName: "test/tool_a",
+            durationMs: 100,
+            success: true,
+        });
+        await log.record("tools/call", {
+            toolName: "test/tool_b",
+            durationMs: 50,
+            success: true,
+        });
+        await log.record("tools/call", {
+            toolName: "test/tool_c",
+            durationMs: 75,
+            success: true,
+        });
+        const records = await readRecords(TEST_LOG);
+        // Remove the middle record
+        const tampered = [records[0], records[2]];
+        const result = await verifyChain(tampered);
+        expect(result.valid).toBe(false);
+        expect(result.errors.length).toBeGreaterThan(0);
+        expect(result.errors[0].reason).toBe("previousHash does not match hash of prior record");
+    });
+    it("detects reordered records", async () => {
+        const log = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log.init();
+        await log.record("tools/call", {
+            toolName: "test/tool_a",
+            durationMs: 100,
+            success: true,
+        });
+        await log.record("tools/call", {
+            toolName: "test/tool_b",
+            durationMs: 50,
+            success: true,
+        });
+        await log.record("tools/call", {
+            toolName: "test/tool_c",
+            durationMs: 75,
+            success: true,
+        });
+        const records = await readRecords(TEST_LOG);
+        // Swap the second and third records
+        const reordered = [records[0], records[2], records[1]];
+        const result = await verifyChain(reordered);
+        expect(result.valid).toBe(false);
+        expect(result.errors.length).toBeGreaterThan(0);
+        expect(result.errors[0].reason).toBe("previousHash does not match hash of prior record");
+    });
+    it("detects inserted record (previousHash won't match)", async () => {
+        const log = new AuditLog(TEST_LOG, signer, 100 * 1024 * 1024);
+        await log.init();
+        await log.record("tools/call", {
+            toolName: "test/tool_a",
+            durationMs: 100,
+            success: true,
+        });
+        await log.record("tools/call", {
+            toolName: "test/tool_b",
+            durationMs: 50,
+            success: true,
+        });
+        const records = await readRecords(TEST_LOG);
+        // Insert a fake record between the two
+        const inserted = {
+            id: "fake-inserted-id",
+            timestamp: new Date().toISOString(),
+            method: "tools/call",
+            toolName: "test/malicious_tool",
+            durationMs: 1,
+            success: true,
+            previousHash: hashRecord(records[0]),
+        };
+        const tampered = [records[0], inserted, records[1]];
+        const result = await verifyChain(tampered);
+        expect(result.valid).toBe(false);
+        // The record after the inserted one will fail because its previousHash
+        // was computed against the original record[0], not the inserted record
+        expect(result.errors.length).toBeGreaterThan(0);
+        expect(result.errors.some((e) => e.reason === "previousHash does not match hash of prior record")).toBe(true);
+    });
+});
+//# sourceMappingURL=chain.test.js.map