@minionry/minion 0.7.36 → 0.7.39

package/dist/server/mcp/permission-channels.js

@@ -0,0 +1,176 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { createHash } from 'node:crypto';
+export const BOUNCER_MCP_SERVER_NAME = 'minionry-bouncer';
+export const PERMISSION_PROMPT_TOOL = 'approval_prompt';
+export const PERMISSION_REQUEST_HOOK_TOOL = 'permission_request_hook';
+export const PERMISSION_MODE_GUARD_TOOL = 'permission_mode_guard';
+export const BOUNCER_PERMISSION_MODE = 'default';
+export function bouncerToolName(tool) {
+    return `mcp__${BOUNCER_MCP_SERVER_NAME}__${tool}`;
+}
+export const BOUNCER_HOOK_TOOLS = [PERMISSION_REQUEST_HOOK_TOOL, PERMISSION_MODE_GUARD_TOOL].map(bouncerToolName);
+const HOOK_INPUT_TEMPLATE = {
+    tool_name: '${tool_name}',
+    tool_input: '${tool_input}',
+    agent_id: '${agent_id}',
+    agent_type: '${agent_type}',
+};
+const BOUNCER_GOVERNED_MODES = new Set(['default', 'manual', 'plan', 'dontAsk']);
+const MODE_GUARD_SKIPPED_TOOLS = [
+    'Read',
+    'Grep',
+    'Glob',
+    'ToolSearch',
+    'TodoWrite',
+    'TaskCreate',
+    'TaskGet',
+    'TaskList',
+    'TaskUpdate',
+];
+export const MODE_GUARD_MATCHER = `^(?!(${MODE_GUARD_SKIPPED_TOOLS.join('|')})$)`;
+const MODE_GUARD_TIMEOUT_S = 30;
+const MODE_GUARD_INPUT_TEMPLATE = {
+    tool_name: '${tool_name}',
+    agent_id: '${agent_id}',
+    agent_type: '${agent_type}',
+    permission_mode: '${permission_mode}',
+};
+export function bouncerSpawnSettings(permissionRequestTimeoutSeconds) {
+    return {
+        permissions: { disableBypassPermissionsMode: 'disable' },
+        hooks: {
+            PreToolUse: [
+                {
+                    matcher: MODE_GUARD_MATCHER,
+                    hooks: [
+                        {
+                            type: 'mcp_tool',
+                            server: BOUNCER_MCP_SERVER_NAME,
+                            tool: PERMISSION_MODE_GUARD_TOOL,
+                            input: MODE_GUARD_INPUT_TEMPLATE,
+                            timeout: MODE_GUARD_TIMEOUT_S,
+                        },
+                    ],
+                },
+            ],
+            PermissionRequest: [
+                {
+                    matcher: '*',
+                    hooks: [
+                        {
+                            type: 'mcp_tool',
+                            server: BOUNCER_MCP_SERVER_NAME,
+                            tool: PERMISSION_REQUEST_HOOK_TOOL,
+                            input: HOOK_INPUT_TEMPLATE,
+                            timeout: permissionRequestTimeoutSeconds,
+                        },
+                    ],
+                },
+            ],
+        },
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function substitutedIdentifier(value) {
+    return typeof value === 'string' && value !== '' && !value.includes('${') ? value : undefined;
+}
+function toolInputObject(value) {
+    if (isRecord(value))
+        return value;
+    if (typeof value !== 'string')
+        return undefined;
+    try {
+        const parsed = JSON.parse(value);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function parsePermissionRequestHookArgs(args) {
+    if (!isRecord(args))
+        return { kind: 'malformed', reason: 'arguments are not an object' };
+    const subagentId = substitutedIdentifier(args.agent_id);
+    if (!subagentId)
+        return { kind: 'main-agent' };
+    const toolName = substitutedIdentifier(args.tool_name);
+    if (!toolName)
+        return { kind: 'malformed', reason: 'tool_name is missing' };
+    const toolInput = toolInputObject(args.tool_input);
+    if (!toolInput)
+        return { kind: 'malformed', reason: 'tool_input is not a JSON object' };
+    const subagentType = substitutedIdentifier(args.agent_type);
+    return {
+        kind: 'subagent',
+        toolName,
+        toolInput,
+        requester: { subagentId, ...(subagentType ? { subagentType } : {}) },
+    };
+}
+export function toPermissionPromptResponse(verdict, input) {
+    if (verdict.behavior === 'deny')
+        return { behavior: 'deny', message: verdict.message };
+    return { behavior: 'allow', updatedInput: verdict.updatedInput ?? input, message: verdict.caution };
+}
+export function toPermissionRequestHookOutput(verdict) {
+    const decision = verdict.behavior === 'deny'
+        ? { behavior: 'deny', message: verdict.message }
+        : { behavior: 'allow', ...(verdict.updatedInput ? { updatedInput: verdict.updatedInput } : {}) };
+    return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision } };
+}
+export const NO_HOOK_DECISION = Object.freeze({});
+export function decidePermissionModeGuard(args) {
+    if (!isRecord(args))
+        return { verdict: 'none' };
+    const permissionMode = substitutedIdentifier(args.permission_mode);
+    if (!permissionMode)
+        return { verdict: 'none' };
+    const toolName = substitutedIdentifier(args.tool_name);
+    if (toolName && MODE_GUARD_SKIPPED_TOOLS.includes(toolName))
+        return { verdict: 'none', permissionMode };
+    return { verdict: BOUNCER_GOVERNED_MODES.has(permissionMode) ? 'none' : 'ask', permissionMode };
+}
+export function toPermissionModeGuardOutput(decision) {
+    if (decision.verdict === 'none')
+        return NO_HOOK_DECISION;
+    return {
+        hookSpecificOutput: {
+            hookEventName: 'PreToolUse',
+            permissionDecision: 'ask',
+            permissionDecisionReason: `Minionry sends this call to its Security Bouncer: the ${decision.permissionMode} permission mode would otherwise approve it without review.`,
+        },
+    };
+}
+function canonicalJson(value) {
+    return JSON.stringify(value ?? null, (_key, nested) => isRecord(nested) ? Object.fromEntries(Object.keys(nested).sort().map((key) => [key, nested[key]])) : nested);
+}
+export function permissionDecisionKey(toolName, input) {
+    return createHash('sha256').update(toolName).update('\0').update(canonicalJson(input)).digest('hex');
+}
+export const PERMISSION_JOIN_WINDOW_MS = 25;
+export class PermissionDecisionCoalescer {
+    joinWindow;
+    inFlight = new Map();
+    constructor(joinWindow = () => new Promise((resolve) => setTimeout(resolve, PERMISSION_JOIN_WINDOW_MS))) {
+        this.joinWindow = joinWindow;
+    }
+    decide(key, requester, review) {
+        const joined = this.inFlight.get(key);
+        if (joined) {
+            joined.requester ??= requester;
+            return joined.decision;
+        }
+        const entry = { requester };
+        entry.decision = this.joinWindow()
+            .then(() => review(entry.requester))
+            .finally(() => {
+            if (this.inFlight.get(key) === entry)
+                this.inFlight.delete(key);
+        });
+        this.inFlight.set(key, entry);
+        return entry.decision;
+    }
+}

package/dist/server/mcp/security-analysis.js

@@ -175,7 +175,7 @@ const READ_ONLY_DISQUALIFIERS = [
     /^(env|nice|timeout|nohup|stdbuf|ionice|setsid|chroot|doas)(\s|$)/i,
 ];
 const SENSITIVE_READ_TARGETS = /(\/etc\/(shadow|passwd|sudoers)|\.ssh\/|\.aws\/|\.gnupg\/|\.docker\/config|\.kube\/config|\.git-credentials|\.npmrc|\.netrc|\.pypirc|authorized_keys|id_rsa|id_ed25519|id_ecdsa|\.env(\.|\b)|credentials|\.pem\b|\.p12\b|\.keystore\b)/i;
-const CREDENTIAL_FILE_PATHS = /(\/etc\/(?:shadow|sudoers)\b|[~/]\.ssh\/|[~/]\.aws\/|[~/]\.gnupg\/|\.git-credentials\b|\.netrc\b|\.pypirc\b|authorized_keys\b|\bid_(?:rsa|ed25519|ecdsa|dsa)\b|\.pem\b|\.p12\b|\.pfx\b|\.keystore\b)/i;
+const CREDENTIAL_FILE_PATHS = /(\/etc\/(?:shadow|sudoers)\b|[~/]\.ssh(?![\w-])|[~/]\.aws(?![\w-])|[~/]\.gnupg(?![\w-])|[~/]\.docker\/config|[~/]\.kube\/config|\.git-credentials\b|\.netrc\b|\.pypirc\b|authorized_keys\b|\bid_(?:rsa|ed25519|ecdsa|dsa)\b|\.pem\b|\.p12\b|\.pfx\b|\.keystore\b|\.config\/(?:google-chrome|chromium|BraveSoftware|microsoft-edge)(?![\w-])|Application Support\/(?:Google\/Chrome|Chromium|BraveSoftware|Microsoft Edge|Firefox)(?![\w-])|[~/]\.mozilla\/firefox(?![\w-])|\bLogin Data\b|\bcookies\.sqlite\b)/i;
 function segmentIsReadOnly(rawSegment) {
     const segment = unwrapCommandPrefix(rawSegment.trim()).replace(/^\[\[?\s/, 'test ');
     if (READ_ONLY_DISQUALIFIERS.some((p) => p.test(segment)))
@@ -304,6 +304,8 @@ export function requiresAIReview(operation) {
     const op = normalizeOperation(operation);
     if (matchesPattern(op, SENSITIVE_PATHS))
         return true;
+    if (namesCredentialStore(op))
+        return true;
     if (/^Bash:/i.test(op) && containsAnyExpansion(op) && !bashExpansionIsReadOnlySafe(op)) {
         return true;
     }
@@ -330,6 +332,12 @@ export function requiresAIReview(operation) {
 export function isSensitivePath(operation) {
     return matchesPattern(operation, SENSITIVE_PATHS);
 }
+export function namesCredentialStore(operation) {
+    const op = normalizeOperation(operation);
+    if (!/^Bash:/i.test(op))
+        return false;
+    return CREDENTIAL_FILE_PATHS.test(op);
+}
 export function classifyRisk(operation) {
     const criticalThreat = matchesPattern(operation, CRITICAL_THREATS);
     if (criticalThreat) {

package/dist/server/mcp/security-audit.js

@@ -1,7 +1,7 @@
 // Copyright (c) 2025-present Minionry, Inc.
 // SPDX-License-Identifier: LicenseRef-Minionry-Software
 import { createHash } from 'node:crypto';
-import { appendFileSync, existsSync, mkdirSync, readFileSync, } from 'node:fs';
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, } from 'node:fs';
 import { join } from 'node:path';
 import { SPACE_DIRNAME, SPACE_LAYOUT } from '../services/space-layout.js';
 const DEFAULT_LOG_SUBDIR = join(SPACE_DIRNAME, SPACE_LAYOUT.logs);
@@ -46,7 +46,7 @@ export class SecurityAuditLogger {
             return [];
         let content;
         try {
-            content = readFileSync(this.logFile, 'utf-8');
+            content = this.readTail(opts?.limit);
         }
         catch (error) {
             console.error('[SecurityAudit] Failed to read log:', error);
@@ -64,6 +64,26 @@ export class SecurityAuditLogger {
         }
         return entries;
     }
+    readTail(limit) {
+        if (!limit || limit <= 0)
+            return readFileSync(this.logFile, 'utf-8');
+        const BYTES_PER_ENTRY_ESTIMATE = 2048;
+        const want = limit * BYTES_PER_ENTRY_ESTIMATE;
+        const { size } = statSync(this.logFile);
+        if (size <= want)
+            return readFileSync(this.logFile, 'utf-8');
+        const fd = openSync(this.logFile, 'r');
+        try {
+            const buf = Buffer.allocUnsafe(want);
+            readSync(fd, buf, 0, want, size - want);
+            const text = buf.toString('utf-8');
+            const firstBreak = text.indexOf('\n');
+            return firstBreak === -1 ? '' : text.slice(firstBreak + 1);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
     logDecision(operation, decision, confidence, reasoning, metadata) {
         this.log({
             timestamp: new Date().toISOString(),

package/dist/server/mcp/security-patterns.js

@@ -1,7 +1,7 @@
 // Copyright (c) 2025-present Minionry, Inc.
 // SPDX-License-Identifier: LicenseRef-Minionry-Software
 import { resolve } from 'node:path';
-export { classifyRisk, isDeployMode, isSensitivePath, requiresAIReview } from './security-analysis.js';
+export { classifyRisk, isDeployMode, isSensitivePath, namesCredentialStore, requiresAIReview, } from './security-analysis.js';
 export const SENSITIVE_PATHS = [
     { pattern: /^(Write|Edit):\s*\/etc\//i, reason: 'System configuration - verify user intent' },
     { pattern: /^(Write|Edit):\s*\/(bin|sbin|usr\/bin|usr\/sbin|usr\/local\/bin|usr\/local\/sbin)\//i, reason: 'System binaries - verify user intent' },
@@ -181,6 +181,78 @@ export const NEEDS_AI_REVIEW = [
         reason: 'Inline script code with dynamic execution or system access - verify user intent'
     },
     { pattern: /\bclaude\b.*\bmcp\b.*\badd\b/i, reason: 'Adding MCP server - verify source is trusted' },
+    {
+        pattern: /(?:^|[\s;|&`("'])history\s+-c\b/i,
+        reason: 'Clearing shell history - potential cover-up of a prior operation'
+    },
+    {
+        pattern: /(?:^|[\s;|&`("'])(?:rm|shred|truncate|unlink)\b[^\n;|&]*[~/.](?:bash_history|zsh_history|sh_history|python_history)\b/i,
+        reason: 'Destroying shell history - potential cover-up of a prior operation'
+    },
+    {
+        pattern: /(?:(?:^|[\s;|&`("'])(?:truncate|shred|rm)\b[^\n;|&]*|>\s*)\/var\/log\//i,
+        reason: 'Truncating or deleting a system log - potential audit-trail tampering'
+    },
+    {
+        pattern: /\bsystemctl\s+(?:stop|disable|mask)\s+\S*(?:auditd|rsyslog|syslog|journald|falco|osquery|wazuh)\S*/i,
+        reason: 'Stopping an audit/monitoring service - potential oversight disabling'
+    },
+    {
+        pattern: /\bservice\s+\S*(?:auditd|rsyslog|syslog|falco|osquery|wazuh)\S*\s+(?:stop|disable)\b/i,
+        reason: 'Stopping an audit/monitoring service - potential oversight disabling'
+    },
+    {
+        pattern: /(?:^|[\s;|&`("'])(?:auditctl\s+-[eD]\b|launchctl\s+(?:unload|bootout|disable)\b)/i,
+        reason: 'Disabling audit or launch services - potential oversight disabling'
+    },
+    {
+        pattern: /(?:^|[\s;|&`("'/])(?:ngrok|cloudflared|localtunnel|bore|frpc|pagekite)\b/i,
+        reason: 'Dev tunnel - exposes a local service to the public internet; verify user intent'
+    },
+    {
+        pattern: /(?:^|[\s;|&`("'/])tailscale\s+funnel\b/i,
+        reason: 'Tailscale funnel - exposes a local service publicly; verify user intent'
+    },
+    {
+        pattern: /\bssh\b[^\n;|&]*\s-R\s*\S/i,
+        reason: 'SSH remote port forward - exposes a local port to a remote host'
+    },
+    {
+        pattern: /(?:^|[\s;|&`("'/])socat\b[^\n]*(?:EXEC|SYSTEM):/i,
+        reason: 'socat with EXEC/SYSTEM - bind or reverse shell'
+    },
+    {
+        pattern: /(?:^|[\s;|&`("'/])socat\b[^\n]*TCP\d?-LISTEN/i,
+        reason: 'socat listener - potential bind shell'
+    },
+    {
+        pattern: /\b(?:npm|yarn|pnpm|bun)\s+config\s+set\s+(?:@\S+:)?registry\b/i,
+        reason: 'Persisting a non-default npm registry - potential supply chain redirection'
+    },
+    {
+        pattern: /\bpip3?\s+config\s+set\b[^\n]*index-url\b/i,
+        reason: 'Persisting a non-default pip index - potential supply chain redirection'
+    },
+    {
+        pattern: /\bgit\s+push\b[^\n;|&]*\s(?:--force(?!-with-lease)|-f)(?=\s|$)/i,
+        reason: 'Force-push overwrites remote history - verify the branch and user intent'
+    },
+    {
+        pattern: /\bkubectl\s+delete\s+(?:ns|namespace|deployment|statefulset|pvc|persistentvolumeclaim|secret)\b/i,
+        reason: 'Kubernetes resource teardown - verify the target matches user intent'
+    },
+    {
+        pattern: /\b(?:terraform|tofu)\s+destroy\b/i,
+        reason: 'Terraform destroy - tears down managed infrastructure; verify user intent'
+    },
+    {
+        pattern: /\baws\s+s3\s+(?:rb|rm)\b[^\n]*(?:--force|--recursive)\b/i,
+        reason: 'Recursive S3 bucket deletion - verify the target matches user intent'
+    },
+    {
+        pattern: /\baws\s+(?:ec2\s+terminate-instances|rds\s+delete-db-(?:instance|cluster))\b/i,
+        reason: 'Cloud instance/database teardown - verify the target matches user intent'
+    },
     ...GIT_SDK_REMOTE_REVIEW_TOOLS,
 ];
 export const BROWSER_SAFE_TOOLS = [

package/dist/server/mcp/server.js

@@ -4,8 +4,9 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { Agent } from 'undici';
-import { reviewEnginePermission, sdkRunReviewContextFromEnv, setRemoteDecisionCache, } from './bouncer-integration.js';
+import { formatDenialMessage, reviewEnginePermission, sdkRunReviewContextFromEnv, setRemoteDecisionCache, } from './bouncer-integration.js';
 import { sweepClassifierTranscripts } from './classifier/ClaudeBouncerClassifier.js';
+import { BOUNCER_MCP_SERVER_NAME, decidePermissionModeGuard, NO_HOOK_DECISION, PERMISSION_MODE_GUARD_TOOL, PERMISSION_PROMPT_TOOL, PERMISSION_REQUEST_HOOK_TOOL, PermissionDecisionCoalescer, parsePermissionRequestHookArgs, permissionDecisionKey, toPermissionModeGuardOutput, toPermissionPromptResponse, toPermissionRequestHookOutput, } from './permission-channels.js';
 const REMOTE_CACHE_TIMEOUT_MS = 400;
 function installRemoteDecisionCache() {
     const port = process.env.MINIONRY_PORT;
@@ -42,7 +43,7 @@ function installRemoteDecisionCache() {
 }
 const askUserQuestionDispatcher = new Agent({ headersTimeout: 0, bodyTimeout: 0 });
 const server = new Server({
-    name: 'minionry-bouncer',
+    name: BOUNCER_MCP_SERVER_NAME,
     version: '1.0.0',
 }, {
     capabilities: {
@@ -53,7 +54,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
     return {
         tools: [
             {
-                name: 'approval_prompt',
+                name: PERMISSION_PROMPT_TOOL,
                 description: 'Analyze and approve/deny tool use requests from Claude Code. Integrates with Minionry security bouncer for AI-powered risk analysis.',
                 inputSchema: {
                     type: 'object',
@@ -70,6 +71,32 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
                     required: ['tool_name', 'input'],
                 },
             },
+            {
+                name: PERMISSION_REQUEST_HOOK_TOOL,
+                description: 'Internal: answers Claude Code PermissionRequest hooks for subagent tool calls. Called by the hook, never by the model.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        tool_name: { type: 'string', description: 'Name of the tool being requested' },
+                        tool_input: { description: 'Tool input parameters, JSON-encoded by the hook' },
+                        agent_id: { type: 'string', description: 'The requesting subagent; empty for the main agent' },
+                        agent_type: { type: 'string', description: 'The requesting subagent type' },
+                    },
+                },
+            },
+            {
+                name: PERMISSION_MODE_GUARD_TOOL,
+                description: 'Internal: answers Claude Code PreToolUse hooks so no permission mode approves a call without the Bouncer. Called by the hook, never by the model.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        tool_name: { type: 'string', description: 'Name of the tool about to run' },
+                        agent_id: { type: 'string', description: 'The calling subagent; empty for the main agent' },
+                        agent_type: { type: 'string', description: 'The calling subagent type' },
+                        permission_mode: { type: 'string', description: 'The permission mode the call runs in' },
+                    },
+                },
+            },
         ],
     };
 });
@@ -81,7 +108,7 @@ async function bridgeAskUserQuestion(input) {
     const toolUseId = process.env.MINIONRY_CURRENT_TOOL_USE_ID || `aq-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
     if (!port || !tabId || !secret || !capabilityToken) {
         console.error('[MCP Bouncer] AskUserQuestion: missing routing context (port/tabId/secret/capability token) — passing through with no answers');
-        return { behavior: 'allow', updatedInput: input };
+        return { behavior: 'allow' };
     }
     try {
         const requestOptions = {
@@ -97,7 +124,7 @@ async function bridgeAskUserQuestion(input) {
         const res = await fetch(`http://127.0.0.1:${port}/internal/ask-user-question`, requestOptions);
         if (!res.ok) {
             console.error(`[MCP Bouncer] AskUserQuestion bridge returned ${res.status} — passing through with no answers`);
-            return { behavior: 'allow', updatedInput: input };
+            return { behavior: 'allow' };
         }
         const json = (await res.json());
         const answers = json.answers && typeof json.answers === 'object' ? json.answers : {};
@@ -108,76 +135,79 @@ async function bridgeAskUserQuestion(input) {
     }
     catch (err) {
         console.error(`[MCP Bouncer] AskUserQuestion bridge failed: ${err instanceof Error ? err.message : String(err)} — passing through with no answers`);
-        return { behavior: 'allow', updatedInput: input };
+        return { behavior: 'allow' };
     }
 }
-function toMcpResponse(decision, input) {
+function verdictFromDecision(decision) {
     if (decision.decision === 'deny') {
-        return {
-            behavior: 'deny',
-            message: `🚫 ${decision.reasoning}${decision.alternative ? `\n\nAlternative: ${decision.alternative}` : ''}`,
-        };
+        return { behavior: 'deny', message: formatDenialMessage(decision) };
     }
-    return {
-        behavior: 'allow',
-        updatedInput: input,
-        message: decision.decision === 'warn_allow'
-            ? `⚠️  Allowed with caution: ${decision.reasoning}`
-            : undefined,
-    };
+    return decision.decision === 'warn_allow'
+        ? { behavior: 'allow', caution: `⚠️  Allowed with caution: ${decision.reasoning}` }
+        : { behavior: 'allow' };
 }
-server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    if (request.params.name !== 'approval_prompt') {
-        throw new Error(`Unknown tool: ${request.params.name}`);
-    }
-    const { tool_name, input } = request.params.arguments;
-    if (tool_name === 'AskUserQuestion') {
+async function reviewPermission(toolName, input, requester) {
+    if (toolName === 'AskUserQuestion') {
         console.error('[MCP Bouncer] AskUserQuestion received — bridging to web UI');
-        const response = await bridgeAskUserQuestion(input);
-        return {
-            content: [{ type: 'text', text: JSON.stringify(response) }],
-        };
+        return bridgeAskUserQuestion(input);
     }
-    console.error(`[MCP Bouncer] Analyzing ${tool_name} request...`);
+    const from = requester ? ` from subagent ${requester.subagentType ?? '(unknown type)'} ${requester.subagentId}` : '';
+    console.error(`[MCP Bouncer] Analyzing ${toolName} request${from}...`);
     const sdkRunContext = sdkRunReviewContextFromEnv(process.env);
     try {
         const decision = await reviewEnginePermission({
-            toolName: tool_name,
+            toolName,
             input,
             context: {
                 purpose: `Tool use request from Claude`,
                 workingDirectory: process.cwd(),
                 userRequest: process.env.BOUNCER_USER_PROMPT,
                 ...(sdkRunContext ?? {}),
+                ...(requester ?? {}),
             },
         });
         console.error(`[MCP Bouncer] Decision: ${decision.decision} (${decision.confidence}% confidence)`);
         console.error(`[MCP Bouncer] Reasoning: ${decision.reasoning}`);
-        const response = toMcpResponse(decision, input);
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify(response),
-                },
-            ],
-        };
+        return verdictFromDecision(decision);
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
         console.error(`[MCP Bouncer] Error: ${errorMessage}`);
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify({
-                        behavior: 'deny',
-                        message: `Security analysis failed: ${errorMessage}. Denying for safety.`,
-                    }),
-                },
-            ],
-        };
+        return { behavior: 'deny', message: `Security analysis failed: ${errorMessage}. Denying for safety.` };
+    }
+}
+const permissionDecisions = new PermissionDecisionCoalescer();
+function decidePermission(toolName, input, requester) {
+    return permissionDecisions.decide(permissionDecisionKey(toolName, input), requester, (who) => reviewPermission(toolName, input, who));
+}
+function textResult(value) {
+    return { content: [{ type: 'text', text: JSON.stringify(value) }] };
+}
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    if (request.params.name === PERMISSION_PROMPT_TOOL) {
+        const { tool_name, input } = request.params.arguments;
+        const verdict = await decidePermission(tool_name, input);
+        return textResult(toPermissionPromptResponse(verdict, input));
+    }
+    if (request.params.name === PERMISSION_REQUEST_HOOK_TOOL) {
+        const call = parsePermissionRequestHookArgs(request.params.arguments);
+        if (call.kind === 'malformed') {
+            console.error(`[MCP Bouncer] PermissionRequest hook: ${call.reason} — no decision`);
+        }
+        if (call.kind !== 'subagent')
+            return textResult(NO_HOOK_DECISION);
+        const verdict = await decidePermission(call.toolName, call.toolInput, call.requester);
+        return textResult(toPermissionRequestHookOutput(verdict));
+    }
+    if (request.params.name === PERMISSION_MODE_GUARD_TOOL) {
+        const decision = decidePermissionModeGuard(request.params.arguments);
+        if (decision.verdict === 'ask') {
+            const args = request.params.arguments;
+            console.error(`[MCP Bouncer] Mode guard: ${String(args?.tool_name)} runs in ${decision.permissionMode} (${String(args?.agent_type || 'main agent')}) — asking the Bouncer`);
+        }
+        return textResult(toPermissionModeGuardOutput(decision));
     }
+    throw new Error(`Unknown tool: ${request.params.name}`);
 });
 async function main() {
     installRemoteDecisionCache();

package/dist/server/routes/internal.js

@@ -254,7 +254,8 @@ const BROWSER_OP_HANDLERS = {
     },
     'tab.open': (host, p) => {
         const url = requireString(p, 'url');
-        return host.openTab(url);
+        const label = optionalString(p, 'agentLabel');
+        return host.openTab(url, { kind: 'agent', ...(label !== undefined ? { label } : {}) });
     },
     'tab.close': async (host, p) => {
         const id = requireString(p, 'id');
@@ -547,6 +548,10 @@ function bindBrowserOp(body, identity) {
     params.agentId = identity.agentId;
     if (identity.planId !== undefined)
         params.planId = identity.planId;
+    if (identity.agentLabel !== undefined)
+        params.agentLabel = identity.agentLabel;
+    else
+        delete params.agentLabel;
     if (typeof params.tabId !== 'string' || !params.tabId) {
         if (identity.defaultTabId !== undefined)
             params.tabId = identity.defaultTabId;

package/dist/server/routes/notifications.js

@@ -1,11 +1,8 @@
 // Copyright (c) 2025-present Minionry, Inc.
 // SPDX-License-Identifier: LicenseRef-Minionry-Software
 import { spawn } from 'node:child_process';
-import { existsSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
 import { Hono } from 'hono';
-import { resolveClaudeCommand } from '../engines/claude/claude-command.js';
-import { spacePath } from '../services/space-layout.js';
+import { resolveClaudeCommand, TOOL_LESS_CLAUDE_ARGS } from '../engines/claude/claude-command.js';
 export function createNotificationRoutes(workingDir) {
     const routes = new Hono();
     routes.post('/summarize', async (c) => {
@@ -27,10 +24,6 @@ export function createNotificationRoutes(workingDir) {
 }
 async function generateNotificationSummary(userPrompt, output, workingDir) {
     return new Promise((resolve) => {
-        const tempDir = spacePath(workingDir, 'tmp');
-        if (!existsSync(tempDir)) {
-            mkdirSync(tempDir, { recursive: true });
-        }
         let truncatedOutput = output;
         if (output.length > 4000) {
             const firstPart = output.slice(0, 2000);
@@ -55,19 +48,19 @@ Generate a notification summary following these rules:
 6. No emojis, no markdown, just plain text
 
 Respond with ONLY the summary text, nothing else.`;
-        const promptFile = join(tempDir, `notif-summary-${Date.now()}.txt`);
-        writeFileSync(promptFile, summaryPrompt);
         const systemPrompt = 'You are a notification summary assistant. Respond with only the summary text, no preamble or explanation.';
         const args = [
             '--print',
             '--model', 'haiku',
-            '--system-prompt', systemPrompt,
-            promptFile
+            ...TOOL_LESS_CLAUDE_ARGS,
+            '--system-prompt', systemPrompt
         ];
         const claude = spawn(resolveClaudeCommand(), args, {
             cwd: workingDir,
-            stdio: ['ignore', 'pipe', 'pipe']
+            stdio: ['pipe', 'pipe', 'pipe']
         });
+        claude.stdin?.on('error', () => { });
+        claude.stdin?.end(summaryPrompt);
         let stdout = '';
         let stderr = '';
         claude.stdout?.on('data', (data) => {
@@ -77,11 +70,6 @@ Respond with ONLY the summary text, nothing else.`;
             stderr += data.toString();
         });
         claude.on('close', (code) => {
-            try {
-                unlinkSync(promptFile);
-            }
-            catch {
-            }
             if (code === 0 && stdout.trim()) {
                 const summary = stdout.trim().slice(0, 150);
                 resolve(summary);