@minionry/minion 0.7.36

package/dist/server/mcp/security-patterns.js

@@ -0,0 +1,314 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { resolve } from 'node:path';
+export { classifyRisk, isDeployMode, isSensitivePath, requiresAIReview } from './security-analysis.js';
+export const SENSITIVE_PATHS = [
+    { pattern: /^(Write|Edit):\s*\/etc\//i, reason: 'System configuration - verify user intent' },
+    { pattern: /^(Write|Edit):\s*\/(bin|sbin|usr\/bin|usr\/sbin|usr\/local\/bin|usr\/local\/sbin)\//i, reason: 'System binaries - verify user intent' },
+    { pattern: /^(Write|Edit):\s*\/boot\//i, reason: 'Boot directory - verify user intent' },
+    { pattern: /^(Write|Edit):\s*\/root\//i, reason: 'Root home - verify user intent' },
+    { pattern: /^(Write|Edit):\s*\/System\//i, reason: 'macOS system - verify user intent' },
+    { pattern: /^(Write|Edit):\s*\/Library\/(LaunchDaemons|LaunchAgents)\//i, reason: 'macOS launch services - verify user intent' },
+    { pattern: /^(Write|Edit):\s*.*\/\.ssh\//i, reason: 'SSH configuration - verify user intent' },
+    { pattern: /^(Write|Edit):\s*.*\/\.gnupg\//i, reason: 'GPG keys - verify user intent' },
+    { pattern: /^(Write|Edit):\s*.*\/\.aws\/(credentials|config)/i, reason: 'AWS credentials - verify user intent' },
+    { pattern: /^(Write|Edit):\s*.*\/(\.env|\.env\.local|\.env\.production)$/i, reason: 'Environment secrets - verify user intent' },
+    { pattern: /^(Write|Edit):\s*.*\/(\.bash_profile|\.bashrc|\.zshrc|\.profile|\.zprofile)$/i, reason: 'Shell profile - verify user intent' },
+];
+export const CRITICAL_THREATS = [
+    {
+        pattern: /rm\s+-rf\s+(\/|~)($|\s|;|&&|\|\|)/i,
+        reason: 'Deleting root (/) or home (~) directory is never a legitimate dev task'
+    },
+    {
+        pattern: /:\(\)\{.*\}|:\(\)\{.*:\|:/i,
+        reason: 'Fork bomb detected - would cause system resource exhaustion'
+    },
+    {
+        pattern: /dd\s+if=\/dev\/zero\s+of=\/dev\/sd/i,
+        reason: 'Attempting to overwrite disk device - would destroy data'
+    },
+    {
+        pattern: /mkfs\./i,
+        reason: 'Attempting to format filesystem - would destroy all data'
+    },
+    {
+        pattern: /eval.*\$\(.*base64.*\)/i,
+        reason: 'Obfuscated code execution via base64 - common malware technique'
+    },
+    {
+        pattern: />\s*\/dev\/sd[a-z]/i,
+        reason: 'Direct write to disk device - would corrupt filesystem'
+    },
+    {
+        pattern: /chmod\s+000\s+\//i,
+        reason: 'Attempting to make system directories inaccessible'
+    },
+    {
+        pattern: /\/dev\/tcp\//i,
+        reason: 'Reverse shell via /dev/tcp - classic backdoor technique'
+    },
+    {
+        pattern: /(?:^|[\s;|&`("'/])(?:nc|ncat|netcat)\b.*-[elp].*\b\d+\b/i,
+        reason: 'Netcat listener/reverse shell - common backdoor technique'
+    },
+];
+export const GIT_SDK_SAFE_TOOLS = [
+    { pattern: /^git_stage:/i, reason: 'SDK git stage — local index mutation inside the repo' },
+    { pattern: /^git_unstage:/i, reason: 'SDK git unstage — local index mutation inside the repo' },
+    { pattern: /^git_commit:/i, reason: 'SDK git commit — records staged changes locally' },
+    { pattern: /^git_checkout:/i, reason: 'SDK git checkout — local branch switch (refuses on a dirty tree)' },
+    { pattern: /^git_branch_create:/i, reason: 'SDK git branch create — local ref creation' },
+    { pattern: /^git_branch_delete:/i, reason: 'SDK git branch delete — local ref removal' },
+    { pattern: /^git_tag_create:/i, reason: 'SDK git tag create — local ref creation' },
+    { pattern: /^git_worktree_create:/i, reason: 'SDK git worktree create — path validated handler-side (S9)' },
+    { pattern: /^git_worktree_remove:/i, reason: 'SDK git worktree remove — only a registered worktree (S9)' },
+    { pattern: /^git_worktree_switch:/i, reason: 'SDK git worktree switch — repoints the calling context only' },
+    { pattern: /^git_merge_run:/i, reason: 'SDK git merge — local branch merge' },
+    { pattern: /^git_merge_abort:/i, reason: 'SDK git merge abort — restores the pre-merge state' },
+    { pattern: /^git_merge_complete:/i, reason: 'SDK git merge complete — commits a conflict resolution' },
+    { pattern: /^git_merge_stash_pop:/i, reason: 'SDK git merge stash pop — restores the pre-merge stash' },
+    { pattern: /^git_merge_discard_blockers:/i, reason: 'SDK git merge discard — paths isSafeDiscardPath-validated (S9)' },
+    { pattern: /^git_generate_commit_message:/i, reason: 'SDK git AI op — generation only, no repo mutation (D10)' },
+    { pattern: /^git_pr_generate_description:/i, reason: 'SDK git AI op — generation only, no repo mutation (D10)' },
+];
+export const GIT_SDK_REMOTE_REVIEW_TOOLS = [
+    { pattern: /^git_push:/i, reason: 'SDK git push — network egress under the user\'s ambient git identity (S8)' },
+    { pattern: /^git_pull:/i, reason: 'SDK git pull — network fetch + local merge under ambient git identity (S8)' },
+    { pattern: /^git_tag_push:/i, reason: 'SDK git tag push — network egress under ambient git identity (S8)' },
+    { pattern: /^git_pr_create:/i, reason: 'SDK PR create — gh/glab shell-out under the user\'s ambient provider auth (S8)' },
+];
+export const SAFE_OPERATIONS = [
+    { pattern: /^Read:/i },
+    { pattern: /^Glob:/i },
+    { pattern: /^Grep:/i },
+    { pattern: /^Write:\s*\/Users\/[^/]+\//i },
+    { pattern: /^Edit:\s*\/Users\/[^/]+\//i },
+    { pattern: /^Write:\s*\/home\/[^/]+\//i },
+    { pattern: /^Edit:\s*\/home\/[^/]+\//i },
+    { pattern: /^Bash:\s*(npm|yarn|pnpm|bun)\s+(install|ci|run|test|build|dev|start|lint|format)($|\s)/i },
+    { pattern: /^Bash:\s*(npm|yarn|pnpm|bun)\s+(ls|list|view|info|why|outdated|audit|ping|prefix|root|bin|version|pack)($|\s)/i },
+    { pattern: /^Bash:\s*git\s+(status|log|diff|show|branch|clone|pull|fetch|add|stash|checkout)($|\s)/i },
+    { pattern: /^Bash:\s*git\s+(describe|blame|rev-parse|rev-list|merge-base|ls-files|ls-tree|check-ignore|shortlog|count-objects|cat-file|symbolic-ref|for-each-ref|name-rev|reflog|grep)($|\s)/i },
+    { pattern: /^Bash:\s*docker\s+(build|run|ps|logs|compose|images)($|\s)/i },
+    { pattern: /^Bash:\s*(pytest|cargo\s+(build|test|run|check)|go\s+(build|test|run|mod))($|\s)/i },
+    { pattern: /^Bash:\s*(mkdir|cd|ls|pwd|cat|head|tail|wc|sort|uniq|grep|find|which|echo|env)($|\s)/i },
+    { pattern: /^Bash:\s*rm\s+-rf\s+(\.\/)?node_modules($|\s)/i },
+    { pattern: /^Bash:\s*rm\s+-rf\s+(\.\/)?dist($|\s)/i },
+    { pattern: /^Bash:\s*rm\s+-rf\s+(\.\/)?build($|\s)/i },
+    { pattern: /^Bash:\s*rm\s+-rf\s+(\.\/)?\.cache($|\s)/i },
+    { pattern: /^Bash:\s*rm\s+-rf\s+(\.\/)?\.next($|\s)/i },
+    { pattern: /^Bash:\s*rm\s+-rf\s+(\.\/)?target($|\s)/i },
+    { pattern: /^Bash:\s*rm\s+-rf\s+(\.\/)?__pycache__($|\s)/i },
+    { pattern: /^(Write|Edit):\s*\/tmp\//i },
+    { pattern: /^(Write|Edit):\s*\/var\/tmp\//i },
+    { pattern: /^(ExitPlanMode|EnterPlanMode|TodoWrite|AskUserQuestion):/i },
+    { pattern: /^Bash:\s*(tsc|tsx|node|bun|deno|npx|bunx)\s/i },
+    { pattern: /^Bash:\s*(vitest|jest|mocha|tap)\s/i },
+    { pattern: /^Bash:\s*(biome|eslint|prettier|tslint)\s+(check|lint|format)/i },
+    { pattern: /^Bash:\s*(make|cmake|ninja|meson)($|\s)/i },
+    { pattern: /^Bash:\s*git\s+(commit|push|tag|remote|rebase|merge|cherry-pick|reset|revert)($|\s)/i },
+    { pattern: /^Bash:\s*git\s+(worktree|submodule|config|clean|gc)($|\s)/i },
+    { pattern: /^Bash:\s*(uname|hostname|whoami|id|groups|uptime|df|du|free|top|ps|lsof|stat|file|readlink)($|\s)/i },
+    { pattern: /^Bash:\s*(touch|basename|dirname|realpath|mktemp|tee|tr|cut|paste|comm|diff|patch)($|\s)/i },
+    { pattern: /^Bash:\s*(tar|gzip|gunzip|zip|unzip|bzip2)\s/i },
+    { pattern: /^Bash:\s*(ruby|python3?|php|java|javac|scala|kotlinc|swift|rustc|gcc|g\+\+|clang)\s/i },
+    { pattern: /^Bash:\s*(pip|pip3|gem|bundle|composer|maven|gradle|sbt|cargo|rustup)\s/i },
+    { pattern: /^Bash:\s*(gh|hub)\s+(pr|issue|repo|release|run|api)\s/i },
+    { pattern: /^Bash:\s*(flyctl|fly)\s+(status|logs|ssh|deploy|apps|machines|secrets)($|\s)/i },
+    { pattern: /^Bash:\s*(terraform|tofu)\s+(init|plan|apply|validate|fmt|show|output)($|\s)/i },
+    { pattern: /^Bash:\s*wc($|\s)/i },
+    { pattern: /^WebFetch:/i },
+    { pattern: /^WebSearch:/i },
+    { pattern: /^Agent:/i },
+    { pattern: /^NotebookEdit:/i },
+    ...GIT_SDK_SAFE_TOOLS,
+];
+export const NEEDS_AI_REVIEW = [
+    {
+        pattern: /(curl|wget).*\|.*(?:bash|sh)/i,
+        reason: 'Pipe to shell - verify source is trusted and user intended this'
+    },
+    { pattern: /sudo/i, reason: 'Elevated privileges - verify user intended this action' },
+    { pattern: /rm\s+-rf/i, reason: 'Recursive deletion - verify target matches user intent' },
+    { pattern: /\|\s*(nc|netcat|ncat)\b/i, reason: 'Pipe to netcat - potential data exfiltration' },
+    { pattern: /\bscp\b.*@/i, reason: 'SCP to remote host - potential data exfiltration' },
+    { pattern: /\|\s*curl\b/i, reason: 'Pipe to curl - potential data exfiltration' },
+    { pattern: /curl\b.*-d\s*@/i, reason: 'Curl with file upload - potential data exfiltration' },
+    {
+        pattern: /^(Write|Edit):\s*(?!\/tmp\/|\/var\/tmp\/)/i,
+        reason: 'File modification - verify aligns with user request'
+    },
+    { pattern: /\/dev\/tcp\//i, reason: 'Potential reverse shell via /dev/tcp' },
+    { pattern: /\b(nc|netcat|ncat)\b.*-e\s/i, reason: 'Netcat with -e flag - potential reverse shell' },
+    {
+        pattern: /\bsocket\b.*\bconnect\b.*\b(dup2|subprocess|exec)\b/i,
+        reason: 'Programmatic reverse shell pattern (socket+connect+exec)'
+    },
+    { pattern: /\bperl\b.*\bsocket\b.*\bexec\b/i, reason: 'Perl reverse shell pattern' },
+    {
+        pattern: /\b(base64|base32)\b.*-d.*\|\s*(bash|sh)\b/i,
+        reason: 'Decoded payload piped to shell - obfuscated command execution'
+    },
+    { pattern: /\\x[0-9a-f]{2}.*\|\s*(bash|sh)\b/i, reason: 'Hex-encoded payload piped to shell' },
+    { pattern: /\bexec\b.*\b(base64|b64decode)\b/i, reason: 'Exec with base64 decoding - obfuscated code execution' },
+    {
+        pattern: /\bprintf\b.*\\x[0-9a-f].*\|\s*(bash|sh)\b/i,
+        reason: 'Printf hex payload piped to shell'
+    },
+    { pattern: /169\.254\.169\.254/i, reason: 'AWS/Azure IMDS access - potential credential theft' },
+    { pattern: /metadata\.google\.internal/i, reason: 'GCP metadata access - potential credential theft' },
+    {
+        pattern: />>\s*~?\/?.*\/(authorized_keys|\.bashrc|\.bash_profile|\.zshrc|\.profile)/i,
+        reason: 'Appending to sensitive file - potential persistence mechanism'
+    },
+    { pattern: /\bld\.so\.preload\b/i, reason: 'LD_PRELOAD injection - shared library hijacking' },
+    { pattern: /wget\b.*--post-file/i, reason: 'wget file upload - potential data exfiltration' },
+    {
+        pattern: /pip3?\b.*--(?:extra-)?index-url[=\s]+https?:\/\/(?!pypi\.org)/i,
+        reason: 'pip install from non-PyPI index - potential supply chain attack'
+    },
+    {
+        pattern: /\b(npm|yarn|pnpm|bun)\b.*--registry[=\s]+https?:\/\/(?!registry\.npmjs\.org)/i,
+        reason: 'Package install from non-npmjs registry - potential supply chain attack'
+    },
+    {
+        pattern: /\b(node|bun|deno)\s+(-e|--eval|-p)\b[\s\S]*(child_process|execSync|spawnSync|\.exec\s*\(|\beval\s*\(|fetch\s*\(|https?:\/\/)/i,
+        reason: 'Inline JavaScript with subprocess/network access - verify user intent'
+    },
+    {
+        pattern: /\b(python3?|ruby|perl|php)\s+(-c|-e|-r)\b[\s\S]*(\bexec\s*\(|\beval\s*\(|os\.system|subprocess|__import__|\bsocket\b|urllib|https?:\/\/)/i,
+        reason: 'Inline script code with dynamic execution or system access - verify user intent'
+    },
+    { pattern: /\bclaude\b.*\bmcp\b.*\badd\b/i, reason: 'Adding MCP server - verify source is trusted' },
+    ...GIT_SDK_REMOTE_REVIEW_TOOLS,
+];
+export const BROWSER_SAFE_TOOLS = [
+    { pattern: /^browser_snapshot:/i, reason: 'Browser DOM snapshot — read-only' },
+    { pattern: /^browser_console_messages:/i, reason: 'Browser console messages — read-only' },
+    { pattern: /^browser_take_screenshot:/i, reason: 'Browser screenshot — read-only' },
+    { pattern: /^browser_network_request:/i, reason: 'Browser network request inspection — read-only' },
+    { pattern: /^browser_network_requests:/i, reason: 'Browser network request listing — read-only' },
+    { pattern: /^browser_tabs:/i, reason: 'Browser tab listing — read-only' },
+    { pattern: /^browser_wait_for:/i, reason: 'Browser wait-for predicate — read-only' },
+];
+export const BROWSER_EVAL_THREATS = [
+    {
+        pattern: /^browser_(evaluate|run_code_unsafe):.*document\s*\.\s*cookie/i,
+        reason: 'JS payload reads document.cookie — credential exfiltration vector',
+    },
+    {
+        pattern: /^browser_(evaluate|run_code_unsafe):.*(localStorage|sessionStorage)\s*\.\s*(getItem|valueOf|toString)/i,
+        reason: 'JS payload reads localStorage/sessionStorage — token exfiltration vector',
+    },
+    {
+        pattern: /^browser_(evaluate|run_code_unsafe):.*JSON\s*\.\s*stringify\s*\(\s*(localStorage|sessionStorage)/i,
+        reason: 'JS payload serializes localStorage — bulk credential exfiltration vector',
+    },
+    {
+        pattern: /^browser_(evaluate|run_code_unsafe):.*credentials\s*:\s*\\?["']include\\?["']/i,
+        reason: 'JS payload calls fetch with credentials:include — exfiltrates session cookies',
+    },
+    {
+        pattern: /^browser_(evaluate|run_code_unsafe):.*withCredentials\s*=\s*true/i,
+        reason: 'JS payload sets XHR withCredentials — exfiltrates session cookies',
+    },
+    {
+        pattern: /^browser_(evaluate|run_code_unsafe):.*navigator\s*\.\s*sendBeacon/i,
+        reason: 'JS payload uses sendBeacon — covert data exfiltration channel',
+    },
+    {
+        pattern: /^browser_(evaluate|run_code_unsafe):.*btoa\s*\(\s*document/i,
+        reason: 'JS payload base64-encodes document content — exfiltration staging',
+    },
+];
+export const BROWSER_LOCALHOST_PATTERNS = [
+    /^https?:\/\/localhost(:\d+)?(\/|$)/i,
+    /^https?:\/\/127\.\d+\.\d+\.\d+(:\d+)?(\/|$)/i,
+    /^https?:\/\/\[::1\](:\d+)?(\/|$)/i,
+    /^https?:\/\/[^/]+\.local(:\d+)?(\/|$)/i,
+    /^https?:\/\/host\.docker\.internal(:\d+)?(\/|$)/i,
+    /^about:/i,
+    /^chrome:\/\/newtab/i,
+];
+export function isLocalhostUrl(url) {
+    return BROWSER_LOCALHOST_PATTERNS.some((p) => p.test(url));
+}
+export function extractOrigin(url) {
+    try {
+        const u = new URL(url);
+        return `${u.protocol}//${u.host}`.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function entryMatches(host, origin, entry) {
+    const e = entry.trim().toLowerCase();
+    if (!e)
+        return false;
+    if (e.startsWith('http://') || e.startsWith('https://')) {
+        return e === origin;
+    }
+    if (e.startsWith('*.')) {
+        const suffix = e.slice(1);
+        return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === e;
+}
+export function isOriginAllowlisted(url, allowlist) {
+    const origin = extractOrigin(url);
+    if (!origin)
+        return false;
+    let host;
+    try {
+        host = new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    return allowlist.some((entry) => entryMatches(host, origin, entry));
+}
+export const DEPLOY_PATTERNS = [
+    {
+        pattern: /\b(cat|head|tail|less|more)\b.*\.(env|pem|key|crt|p12|pfx|jks)\b/i,
+        reason: 'Deploy execution reading credential/certificate files — verify intent'
+    },
+    {
+        pattern: /\bgit\b.*\bpush\b/i,
+        reason: 'Deploy execution attempting git push — verify this is intended'
+    },
+    {
+        pattern: /\b(nc|netcat|ncat|socat)\b.*(\blisten\b|\s-l\b)/i,
+        reason: 'Deploy execution opening network listener — potential backdoor'
+    },
+    {
+        pattern: /\b(kill|killall|pkill)\b/i,
+        reason: 'Deploy execution attempting process termination — verify intent'
+    },
+    {
+        pattern: /\b(ssh|scp|sftp)\b.*@/i,
+        reason: 'Deploy execution initiating SSH/SCP connection — verify intent'
+    },
+    {
+        pattern: /\b(crontab|systemctl|launchctl)\b/i,
+        reason: 'Deploy execution manipulating scheduled tasks — verify intent'
+    },
+];
+export function matchesPattern(operation, patterns) {
+    for (const pattern of patterns) {
+        if (pattern.pattern.test(operation)) {
+            return pattern;
+        }
+    }
+    return null;
+}
+export function normalizeOperation(operation) {
+    const match = operation.match(/^(Write|Edit|Read):\s*(\S+)/i);
+    if (match?.[2].includes('..')) {
+        const [, tool, rawPath] = match;
+        const normalizedPath = resolve(rawPath);
+        return `${tool}: ${normalizedPath}`;
+    }
+    return operation;
+}

package/dist/server/mcp/server.js

@@ -0,0 +1,194 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { Agent } from 'undici';
+import { reviewEnginePermission, sdkRunReviewContextFromEnv, setRemoteDecisionCache, } from './bouncer-integration.js';
+import { sweepClassifierTranscripts } from './classifier/ClaudeBouncerClassifier.js';
+const REMOTE_CACHE_TIMEOUT_MS = 400;
+function installRemoteDecisionCache() {
+    const port = process.env.MINIONRY_PORT;
+    const secret = process.env.MINIONRY_BOUNCER_SECRET;
+    const capabilityToken = process.env.MINIONRY_CAPABILITY_TOKEN;
+    if (!port || !secret || !capabilityToken)
+        return;
+    const url = `http://127.0.0.1:${port}/internal/bouncer/decision-cache`;
+    const headers = {
+        'content-type': 'application/json',
+        'x-minionry-bouncer-secret': secret,
+        'x-minionry-capability-token': capabilityToken,
+    };
+    setRemoteDecisionCache({
+        async get(key) {
+            const res = await fetch(`${url}?key=${encodeURIComponent(key)}`, {
+                headers,
+                signal: AbortSignal.timeout(REMOTE_CACHE_TIMEOUT_MS),
+            });
+            if (!res.ok)
+                return null;
+            const json = (await res.json());
+            return json.decision ?? null;
+        },
+        async set(key, decision, ttlMs) {
+            await fetch(url, {
+                method: 'PUT',
+                headers,
+                body: JSON.stringify({ key, decision, ttlMs }),
+                signal: AbortSignal.timeout(REMOTE_CACHE_TIMEOUT_MS),
+            });
+        },
+    });
+}
+const askUserQuestionDispatcher = new Agent({ headersTimeout: 0, bodyTimeout: 0 });
+const server = new Server({
+    name: 'minionry-bouncer',
+    version: '1.0.0',
+}, {
+    capabilities: {
+        tools: {},
+    },
+});
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+    return {
+        tools: [
+            {
+                name: 'approval_prompt',
+                description: 'Analyze and approve/deny tool use requests from Claude Code. Integrates with Minionry security bouncer for AI-powered risk analysis.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        tool_name: {
+                            type: 'string',
+                            description: 'Name of the tool being requested (e.g., "Bash", "Write", "Read")',
+                        },
+                        input: {
+                            type: 'object',
+                            description: 'Tool input parameters as JSON object',
+                        },
+                    },
+                    required: ['tool_name', 'input'],
+                },
+            },
+        ],
+    };
+});
+async function bridgeAskUserQuestion(input) {
+    const port = process.env.MINIONRY_PORT;
+    const tabId = process.env.MINIONRY_TAB_ID;
+    const secret = process.env.MINIONRY_BOUNCER_SECRET;
+    const capabilityToken = process.env.MINIONRY_CAPABILITY_TOKEN;
+    const toolUseId = process.env.MINIONRY_CURRENT_TOOL_USE_ID || `aq-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+    if (!port || !tabId || !secret || !capabilityToken) {
+        console.error('[MCP Bouncer] AskUserQuestion: missing routing context (port/tabId/secret/capability token) — passing through with no answers');
+        return { behavior: 'allow', updatedInput: input };
+    }
+    try {
+        const requestOptions = {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'x-minionry-bouncer-secret': secret,
+                'x-minionry-capability-token': capabilityToken,
+            },
+            body: JSON.stringify({ toolUseId, tabId, questions: input.questions }),
+        };
+        requestOptions.dispatcher = askUserQuestionDispatcher;
+        const res = await fetch(`http://127.0.0.1:${port}/internal/ask-user-question`, requestOptions);
+        if (!res.ok) {
+            console.error(`[MCP Bouncer] AskUserQuestion bridge returned ${res.status} — passing through with no answers`);
+            return { behavior: 'allow', updatedInput: input };
+        }
+        const json = (await res.json());
+        const answers = json.answers && typeof json.answers === 'object' ? json.answers : {};
+        return {
+            behavior: 'allow',
+            updatedInput: { questions: input.questions, answers },
+        };
+    }
+    catch (err) {
+        console.error(`[MCP Bouncer] AskUserQuestion bridge failed: ${err instanceof Error ? err.message : String(err)} — passing through with no answers`);
+        return { behavior: 'allow', updatedInput: input };
+    }
+}
+function toMcpResponse(decision, input) {
+    if (decision.decision === 'deny') {
+        return {
+            behavior: 'deny',
+            message: `🚫 ${decision.reasoning}${decision.alternative ? `\n\nAlternative: ${decision.alternative}` : ''}`,
+        };
+    }
+    return {
+        behavior: 'allow',
+        updatedInput: input,
+        message: decision.decision === 'warn_allow'
+            ? `⚠️  Allowed with caution: ${decision.reasoning}`
+            : undefined,
+    };
+}
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    if (request.params.name !== 'approval_prompt') {
+        throw new Error(`Unknown tool: ${request.params.name}`);
+    }
+    const { tool_name, input } = request.params.arguments;
+    if (tool_name === 'AskUserQuestion') {
+        console.error('[MCP Bouncer] AskUserQuestion received — bridging to web UI');
+        const response = await bridgeAskUserQuestion(input);
+        return {
+            content: [{ type: 'text', text: JSON.stringify(response) }],
+        };
+    }
+    console.error(`[MCP Bouncer] Analyzing ${tool_name} request...`);
+    const sdkRunContext = sdkRunReviewContextFromEnv(process.env);
+    try {
+        const decision = await reviewEnginePermission({
+            toolName: tool_name,
+            input,
+            context: {
+                purpose: `Tool use request from Claude`,
+                workingDirectory: process.cwd(),
+                userRequest: process.env.BOUNCER_USER_PROMPT,
+                ...(sdkRunContext ?? {}),
+            },
+        });
+        console.error(`[MCP Bouncer] Decision: ${decision.decision} (${decision.confidence}% confidence)`);
+        console.error(`[MCP Bouncer] Reasoning: ${decision.reasoning}`);
+        const response = toMcpResponse(decision, input);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify(response),
+                },
+            ],
+        };
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        console.error(`[MCP Bouncer] Error: ${errorMessage}`);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        behavior: 'deny',
+                        message: `Security analysis failed: ${errorMessage}. Denying for safety.`,
+                    }),
+                },
+            ],
+        };
+    }
+});
+async function main() {
+    installRemoteDecisionCache();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error('[MCP Bouncer] Server started and ready');
+    const swept = sweepClassifierTranscripts();
+    if (swept > 0)
+        console.error(`[MCP Bouncer] Swept ${swept} stale classifier transcript(s)`);
+}
+main().catch((error) => {
+    console.error('[MCP Bouncer] Fatal error:', error);
+    process.exit(1);
+});