@mxf-dev/core 2.0.5 → 3.1.0

package/dist/protocols/mcp/security/BrowserTargetGuard.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Fail-closed network policy for Puppeteer pages used by MXF web tools.
+ *
+ * Checking only the top-level URL is insufficient: redirects, scripts, images,
+ * frames, and fetch/XHR requests can each target a different host. Every browser
+ * request is therefore checked immediately before Puppeteer continues it.
+ */
+import type { HTTPRequest, Page } from 'puppeteer';
+/** Reject a top-level browser target before allocating a browser or page. */
+export declare const requireAllowedBrowserTarget: (rawUrl: string) => Promise<void>;
+export declare const guardBrowserRequest: (request: HTTPRequest) => Promise<void>;
+/** Install the target policy before the first navigation on a Puppeteer page. */
+export declare const installBrowserTargetGuard: (page: Page) => Promise<void>;
+//# sourceMappingURL=BrowserTargetGuard.d.ts.map

package/dist/protocols/mcp/security/BrowserTargetGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserTargetGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/BrowserTargetGuard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAcnD,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAK9E,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAU,SAAS,WAAW,KAAG,OAAO,CAAC,IAAI,CAqB5E,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,GAAU,MAAM,IAAI,KAAG,OAAO,CAAC,IAAI,CASxE,CAAC"}

package/dist/protocols/mcp/security/BrowserTargetGuard.js

@@ -0,0 +1,55 @@
+/**
+ * Fail-closed network policy for Puppeteer pages used by MXF web tools.
+ *
+ * Checking only the top-level URL is insufficient: redirects, scripts, images,
+ * frames, and fetch/XHR requests can each target a different host. Every browser
+ * request is therefore checked immediately before Puppeteer continues it.
+ */
+import { checkHttpTarget } from './HttpTargetGuard.js';
+const BROWSER_LOCAL_PROTOCOLS = new Set(['about:', 'blob:', 'data:']);
+const isBrowserLocalUrl = (rawUrl) => {
+    try {
+        return BROWSER_LOCAL_PROTOCOLS.has(new URL(rawUrl).protocol);
+    }
+    catch {
+        return rawUrl === 'about:blank';
+    }
+};
+/** Reject a top-level browser target before allocating a browser or page. */
+export const requireAllowedBrowserTarget = async (rawUrl) => {
+    const decision = await checkHttpTarget(rawUrl);
+    if (!decision.allowed) {
+        throw new Error(decision.reason ?? `Browser target '${rawUrl}' is not allowed`);
+    }
+};
+export const guardBrowserRequest = async (request) => {
+    if (request.isInterceptResolutionHandled()) {
+        return;
+    }
+    const rawUrl = request.url();
+    if (isBrowserLocalUrl(rawUrl)) {
+        await request.continue();
+        return;
+    }
+    const decision = await checkHttpTarget(rawUrl);
+    if (request.isInterceptResolutionHandled()) {
+        return;
+    }
+    if (!decision.allowed) {
+        await request.abort('blockedbyclient');
+        return;
+    }
+    await request.continue();
+};
+/** Install the target policy before the first navigation on a Puppeteer page. */
+export const installBrowserTargetGuard = async (page) => {
+    await page.setRequestInterception(true);
+    page.on('request', (request) => {
+        void guardBrowserRequest(request).catch(async () => {
+            if (!request.isInterceptResolutionHandled()) {
+                await request.abort('blockedbyclient');
+            }
+        }).catch(() => undefined);
+    });
+};
+//# sourceMappingURL=BrowserTargetGuard.js.map

package/dist/protocols/mcp/security/BrowserTargetGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserTargetGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/BrowserTargetGuard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtE,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAW,EAAE;IAClD,IAAI,CAAC;QACD,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,MAAM,KAAK,aAAa,CAAC;IACpC,CAAC;AACL,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,mBAAmB,MAAM,kBAAkB,CAAC,CAAC;IACpF,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,OAAoB,EAAiB,EAAE;IAC7E,IAAI,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;QACzC,OAAO;IACX,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;QACzC,OAAO;IACX,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvC,OAAO;IACX,CAAC;IAED,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,IAAU,EAAiB,EAAE;IACzE,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAoB,EAAE,EAAE;QACxC,KAAK,mBAAmB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YAC/C,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;gBAC1C,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC3C,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACP,CAAC,CAAC"}

package/dist/protocols/mcp/security/ExternalMcpRegistrationPolicy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Policy for caller-supplied stdio MCP server registrations.
+ *
+ * A stdio registration is equivalent to asking the host to execute a command.
+ * It is therefore off by default and may only be exposed by a server entry
+ * point after that entry point has independently established an administrator
+ * principal. Built-in, server-owned configurations do not pass through this
+ * policy because their commands come from source-controlled configuration.
+ */
+export declare const UNSAFE_STDIO_MCP_ENV = "MXF_UNSAFE_STDIO_MCP_ENABLED";
+/**
+ * True only for the exact, explicit opt-in value.
+ */
+export declare const isUnsafeStdioMcpEnabled: () => boolean;
+/**
+ * External server payloads historically omitted transport and were treated as
+ * stdio, so an absent transport must remain on the dangerous side of the gate.
+ */
+export declare const isStdioMcpTransport: (transport: unknown) => boolean;
+/**
+ * Fail closed when a caller-controlled registration would execute a process.
+ */
+export declare const assertUnsafeStdioMcpEnabled: (transport: unknown) => void;
+//# sourceMappingURL=ExternalMcpRegistrationPolicy.d.ts.map

package/dist/protocols/mcp/security/ExternalMcpRegistrationPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalMcpRegistrationPolicy.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/ExternalMcpRegistrationPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAEnE;;GAEG;AACH,eAAO,MAAM,uBAAuB,QAAO,OAE1C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAAI,WAAW,OAAO,KAAG,OAExD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,WAAW,OAAO,KAAG,IAOhE,CAAC"}

package/dist/protocols/mcp/security/ExternalMcpRegistrationPolicy.js

@@ -0,0 +1,33 @@
+/**
+ * Policy for caller-supplied stdio MCP server registrations.
+ *
+ * A stdio registration is equivalent to asking the host to execute a command.
+ * It is therefore off by default and may only be exposed by a server entry
+ * point after that entry point has independently established an administrator
+ * principal. Built-in, server-owned configurations do not pass through this
+ * policy because their commands come from source-controlled configuration.
+ */
+export const UNSAFE_STDIO_MCP_ENV = 'MXF_UNSAFE_STDIO_MCP_ENABLED';
+/**
+ * True only for the exact, explicit opt-in value.
+ */
+export const isUnsafeStdioMcpEnabled = () => {
+    return process.env[UNSAFE_STDIO_MCP_ENV] === 'true';
+};
+/**
+ * External server payloads historically omitted transport and were treated as
+ * stdio, so an absent transport must remain on the dangerous side of the gate.
+ */
+export const isStdioMcpTransport = (transport) => {
+    return transport === undefined || transport === null || transport === '' || transport === 'stdio';
+};
+/**
+ * Fail closed when a caller-controlled registration would execute a process.
+ */
+export const assertUnsafeStdioMcpEnabled = (transport) => {
+    if (isStdioMcpTransport(transport) && !isUnsafeStdioMcpEnabled()) {
+        throw new Error(`Caller-supplied stdio MCP registration is disabled. ` +
+            `An administrator must explicitly set ${UNSAFE_STDIO_MCP_ENV}=true to expose this unsafe capability.`);
+    }
+};
+//# sourceMappingURL=ExternalMcpRegistrationPolicy.js.map

package/dist/protocols/mcp/security/ExternalMcpRegistrationPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExternalMcpRegistrationPolicy.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/ExternalMcpRegistrationPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAEnE;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAY,EAAE;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC;AACxD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,SAAkB,EAAW,EAAE;IAC/D,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,OAAO,CAAC;AACtG,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,SAAkB,EAAQ,EAAE;IACpE,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACX,sDAAsD;YACtD,wCAAwC,oBAAoB,yCAAyC,CACxG,CAAC;IACN,CAAC;AACL,CAAC,CAAC"}

package/dist/protocols/mcp/security/HttpTargetGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HttpTargetGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/HttpTargetGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAyBH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAkHD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA6F9E"}
+{"version":3,"file":"HttpTargetGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/HttpTargetGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAyBH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAyLD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA6F9E"}

package/dist/protocols/mcp/security/HttpTargetGuard.js

@@ -92,6 +92,67 @@ function ipv4InCidr(address, cidr) {
     const mask = (0xffffffff << (32 - prefix)) >>> 0;
     return (addressInt & mask) === (networkInt & mask);
 }
+/**
+ * Decode an IPv6 literal into its eight 16-bit words.
+ *
+ * Node's `isIP()` tells us that a value is IPv6, but it does not expose the
+ * embedded IPv4 address from mapped forms. Browsers and operating systems
+ * accept both dotted (`::ffff:127.0.0.1`) and hexadecimal
+ * (`::ffff:7f00:1`) spellings, so matching only the dotted text leaves a
+ * loopback/metadata bypass.
+ */
+function parseIpv6Words(address) {
+    let normalized = address.toLowerCase();
+    const embeddedIpv4 = normalized.match(/^(.*:)(\d{1,3}(?:\.\d{1,3}){3})$/);
+    if (embeddedIpv4) {
+        const ipv4 = ipv4ToInt(embeddedIpv4[2]);
+        if (ipv4 === null) {
+            return null;
+        }
+        normalized = `${embeddedIpv4[1]}${(ipv4 >>> 16).toString(16)}:${(ipv4 & 0xffff).toString(16)}`;
+    }
+    const compressedParts = normalized.split('::');
+    if (compressedParts.length > 2) {
+        return null;
+    }
+    const parseSide = (side) => {
+        if (side.length === 0) {
+            return [];
+        }
+        const words = side.split(':');
+        if (words.some(word => !/^[0-9a-f]{1,4}$/.test(word))) {
+            return null;
+        }
+        return words.map(word => Number.parseInt(word, 16));
+    };
+    const left = parseSide(compressedParts[0]);
+    const right = parseSide(compressedParts[1] ?? '');
+    if (!left || !right) {
+        return null;
+    }
+    if (compressedParts.length === 1) {
+        return left.length === 8 ? left : null;
+    }
+    const omittedWordCount = 8 - left.length - right.length;
+    if (omittedWordCount < 1) {
+        return null;
+    }
+    return [...left, ...Array(omittedWordCount).fill(0), ...right];
+}
+/** Return the dotted IPv4 address carried by an IPv4-mapped IPv6 literal. */
+function mappedIpv4Address(address) {
+    const words = parseIpv6Words(address);
+    if (!words || words.length !== 8 ||
+        words.slice(0, 5).some(word => word !== 0) || words[5] !== 0xffff) {
+        return null;
+    }
+    return [
+        words[6] >>> 8,
+        words[6] & 0xff,
+        words[7] >>> 8,
+        words[7] & 0xff
+    ].join('.');
+}
 /**
  * Is this address one the server must not be steered into?
  *
@@ -109,6 +170,13 @@ function matchBlockedRange(address) {
     }
     if (version === 6) {
         const normalized = address.toLowerCase();
+        // IPv4-mapped addresses have multiple equivalent textual forms. Decode
+        // the address instead of applying a dotted-quad-only regex, then run the
+        // embedded address through the complete IPv4 policy.
+        const mappedIpv4 = mappedIpv4Address(normalized);
+        if (mappedIpv4) {
+            return matchBlockedRange(mappedIpv4);
+        }
         // IPv6 loopback
         if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
             return 'IPv6 loopback';
@@ -125,12 +193,6 @@ function matchBlockedRange(address) {
         if (/^fe[89ab][0-9a-f]:/.test(normalized)) {
             return 'IPv6 link-local address';
         }
-        // IPv4-mapped (::ffff:127.0.0.1) — re-check the embedded IPv4 address,
-        // otherwise ::ffff:169.254.169.254 would walk straight past this guard.
-        const mapped = normalized.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
-        if (mapped) {
-            return matchBlockedRange(mapped[1]);
-        }
         return null;
     }
     return null;

package/dist/protocols/mcp/security/HttpTargetGuard.js.map

@@ -1 +1 @@
-{"version":3,"file":"HttpTargetGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/HttpTargetGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAc3D;;;GAGG;AACH,MAAM,mBAAmB,GAA0C;IAC/D,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7C,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACvD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACpD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE;IACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,sCAAsC,EAAE;IACxE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC1D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC3D,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC3D,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACpD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE;IAC1C,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE;CAC5C,CAAC;AAEF,sEAAsE;AACtE,SAAS,SAAS,CAAC,OAAe;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,0EAA0E;QAC1E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;IAC/B,CAAC;IAED,0EAA0E;IAC1E,yDAAyD;IACzD,OAAO,KAAK,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,sDAAsD;AACtD,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAE9B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACtC,IAAI,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC,IAAI,CAAC;YACtB,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAEzC,gBAAgB;QAChB,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAC;QAC3B,CAAC;QACD,sBAAsB;QACtB,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC1D,OAAO,0BAA0B,CAAC;QACtC,CAAC;QACD,mCAAmC;QACnC,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,2BAA2B,CAAC;QACvC,CAAC;QACD,wBAAwB;QACxB,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,yBAAyB,CAAC;QACrC,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACjF,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,MAAM,uBAAuB;SAC5C,CAAC;IACN,CAAC;IAED,6EAA6E;IAC7E,4BAA4B;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,aAAa,GAAG,CAAC,QAAQ,wCAAwC;SAC5E,CAAC;IACN,CAAC;IAED,uEAAuE;IACvE,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;IAE7E,wCAAwC;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACV,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EACF,qBAAqB,QAAQ,aAAa,OAAO,YAAY;oBAC7D,kDAAkD;oBAClD,oEAAoE;gBACxE,iBAAiB,EAAE,CAAC,QAAQ,CAAC;aAChC,CAAC;QACN,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,+EAA+E;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChE,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EACF,qBAAqB,QAAQ,8BAA8B;gBAC3D,kDAAkD;gBAClD,oEAAoE;SAC3E,CAAC;IACN,CAAC;IAED,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,yEAAyE;QACzE,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EACF,sBAAsB,QAAQ,KAAK;gBACnC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,QAAQ,mCAAmC;SAC1D,CAAC;IACN,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACV,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EACF,qBAAqB,QAAQ,oBAAoB,OAAO,IAAI;oBAC5D,KAAK,OAAO,4DAA4D;oBACxE,oEAAoE;gBACxE,iBAAiB,EAAE,SAAS;aAC/B,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"HttpTargetGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/HttpTargetGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAc3D;;;GAGG;AACH,MAAM,mBAAmB,GAA0C;IAC/D,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7C,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACvD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACpD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE;IACzC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,sCAAsC,EAAE;IACxE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC1D,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC3D,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC3D,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACpD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE;IAC1C,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE;CAC5C,CAAC;AAEF,sEAAsE;AACtE,SAAS,SAAS,CAAC,OAAe;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,0EAA0E;QAC1E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;IAC/B,CAAC;IAED,0EAA0E;IAC1E,yDAAyD;IACzD,OAAO,KAAK,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,sDAAsD;AACtD,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAe;IACnC,IAAI,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1E,IAAI,YAAY,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,UAAU,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAmB,EAAE;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACxD,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC5B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QACd,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;QACf,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QACd,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;KAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAE9B,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACtC,IAAI,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC,IAAI,CAAC;YACtB,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAEzC,uEAAuE;QACvE,yEAAyE;QACzE,qDAAqD;QACrD,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACb,OAAO,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,gBAAgB;QAChB,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAC;QAC3B,CAAC;QACD,sBAAsB;QACtB,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC1D,OAAO,0BAA0B,CAAC;QACtC,CAAC;QACD,mCAAmC;QACnC,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,2BAA2B,CAAC;QACvC,CAAC;QACD,wBAAwB;QACxB,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,yBAAyB,CAAC;QACrC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,MAAM,uBAAuB;SAC5C,CAAC;IACN,CAAC;IAED,6EAA6E;IAC7E,4BAA4B;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,aAAa,GAAG,CAAC,QAAQ,wCAAwC;SAC5E,CAAC;IACN,CAAC;IAED,uEAAuE;IACvE,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;IAE7E,wCAAwC;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACV,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EACF,qBAAqB,QAAQ,aAAa,OAAO,YAAY;oBAC7D,kDAAkD;oBAClD,oEAAoE;gBACxE,iBAAiB,EAAE,CAAC,QAAQ,CAAC;aAChC,CAAC;QACN,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,+EAA+E;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChE,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EACF,qBAAqB,QAAQ,8BAA8B;gBAC3D,kDAAkD;gBAClD,oEAAoE;SAC3E,CAAC;IACN,CAAC;IAED,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,yEAAyE;QACzE,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EACF,sBAAsB,QAAQ,KAAK;gBACnC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACH,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,QAAQ,mCAAmC;SAC1D,CAAC;IACN,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACV,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EACF,qBAAqB,QAAQ,oBAAoB,OAAO,IAAI;oBAC5D,KAAK,OAAO,4DAA4D;oBACxE,oEAAoE;gBACxE,iBAAiB,EAAE,SAAS;aAC/B,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC"}

package/dist/protocols/mcp/security/McpSecurityGuard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"McpSecurityGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AA+ID,qBAAa,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAgB;IAEpC;;;;;;;OAOG;gBACS,WAAW,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,QAAQ;IAMtG;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,uBAAuB;IA8DnF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAmE7B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAUhB;;OAEG;IACH,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,oBAAoB;IAiFjG;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO;IAKxE;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU;IAK/F;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAOvC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAahC;;OAEG;IACH,OAAO,CAAC,UAAU;CAcrB;AAOD,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAQvE"}
+{"version":3,"file":"McpSecurityGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AA+ID,qBAAa,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAgB;IAEpC;;;;;;;OAOG;gBACS,WAAW,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,QAAQ;IAMtG;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,uBAAuB;IAgEnF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAmE7B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAUhB;;OAEG;IACH,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,oBAAoB;IAiFjG;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO;IAKxE;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU;IAK/F;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAOvC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAahC;;OAEG;IACH,OAAO,CAAC,UAAU;CAcrB;AAOD,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAQvE"}

package/dist/protocols/mcp/security/McpSecurityGuard.js

@@ -200,17 +200,19 @@ export class McpSecurityGuard {
         // This prevents bypass via `echo hello; rm -rf /` where only `echo` was validated.
         const parsed = parseCommand(command);
         const effectiveCommands = extractEffectiveCommands(command);
-        // Subshell constructs ($() or backticks) cannot be safely parsed — the parser
-        // detects their presence but doesn't extract commands inside them. Require
-        // confirmation so agents can't bypass validation with `echo $(rm -rf /)`.
+        // Subshell constructs ($() or backticks) are run by the shell but never
+        // reach this parser, so the commands inside them are checked against
+        // neither the block rules nor the configured allowlist. `git status
+        // $(bash -c ...)` would pass on the strength of `git`. They are denied
+        // outright; an agent that needs a value from one command can run it as
+        // its own command first.
         if (parsed.hasSubshells) {
             const destructiveWarnings = getDestructiveWarnings(command);
             const warningMessages = destructiveWarnings.length > 0
                 ? destructiveWarnings.map(w => w.warning)
                 : undefined;
             return {
-                allowed: true,
-                requiresConfirmation: true,
+                allowed: false,
                 reason: 'Command contains subshell constructs ($() or backticks) that cannot be statically validated',
                 riskLevel: 'high',
                 warnings: warningMessages

package/dist/protocols/mcp/security/McpSecurityGuard.js.map

@@ -1 +1 @@
-{"version":3,"file":"McpSecurityGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAEtF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;AAyBhE;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACrB,MAAM,EAAE;QACJ,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;YAChD,uBAAuB;YACvB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW;YAC7C,kBAAkB;YAClB,SAAS,EAAE,OAAO,EAAE,UAAU;YAC9B,kBAAkB;YAClB,MAAM,EAAE,aAAa,EAAE,aAAa;YACpC,UAAU;YACV,OAAO,EAAE,cAAc,EAAE,OAAO;YAChC,sBAAsB;YACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;SAClC;QACD,UAAU,EAAE;YACR,wBAAwB;YACxB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC5C,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;YAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;YAC1C,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE;SACjD;KACJ;IACD,KAAK,EAAE;QACH,sCAAsC;QACtC,OAAO,EAAE;YACL,kBAAkB;YAClB,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;YACnD,uBAAuB;YACvB,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU;YACnD,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;YACjC,WAAW;YACX,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO;YACnC,kBAAkB;YAClB,UAAU,EAAE,gBAAgB,EAAE,SAAS;YACvC,sBAAsB;YACtB,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;SACzC;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;SAC5C;KACJ;IACD,KAAK,EAAE;QACH,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO;YACxC,uBAAuB;YACvB,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW;YAClD,UAAU,EAAE,QAAQ,EAAE,OAAO;YAC7B,mDAAmD;YACnD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;YACnD,kBAAkB;YAClB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;YACrD,UAAU;YACV,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc;YAC9C,sBAAsB;YACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY;SAC5C;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;YACzC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;YACtC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;YAC5C,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;SACzC;KACJ;CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAC9B,yBAAyB;IACzB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IACtC,uBAAuB;IACvB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;IAC7B,kBAAkB;IAClB,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;IACxC,qBAAqB;IACrB,SAAS,EAAE,SAAS,EAAE,UAAU;IAChC,yBAAyB;IACzB,YAAY,EAAE,aAAa,EAAE,aAAa;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG;IAClB,kBAAkB;IAClB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACpD,kBAAkB;IAClB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;IAC3C,qBAAqB;IACrB,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;IACvC,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACjD,oBAAoB;IACpB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACtD,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;IAC7B,0BAA0B;IAC1B,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI;IAC3D,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACtB,sCAAsC;IACtC,YAAY,EAAE;QACV,MAAM,EAAE;YACJ,SAAS,EAAE,mBAAmB,EAAE,cAAc;YAC9C,UAAU,EAAE,WAAW,EAAE,iBAAiB;SAC7C;QACD,KAAK,EAAE;YACH,uBAAuB,EAAE,uBAAuB;YAChD,mBAAmB,EAAE,yBAAyB;YAC9C,iBAAiB,EAAE,sBAAsB;SAC5C;QACD,KAAK,EAAE;YACH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW;YAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;SAC5C;KACJ;IACD,kCAAkC;IAClC,cAAc,EAAE;QACZ,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC3C,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;QAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC;KACrD;CACJ,CAAC;AAEF,MAAM,OAAO,gBAAgB;IACjB,QAAQ,CAAkB;IAC1B,WAAW,CAAS;IACpB,YAAY,GAAa,EAAE,CAAC;IAEpC;;;;;;;OAOG;IACH,YAAY,WAAmB,EAAE,sBAAiC,EAAE,gBAAkC;QAClG,IAAI,CAAC,QAAQ,GAAG,gBAAgB,IAAI,QAAQ,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAe,EAAE,OAAwB;QACrD,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEvD,8EAA8E;QAC9E,mFAAmF;QACnF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAE5D,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBACzC,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,oBAAoB,EAAE,IAAI;gBAC1B,MAAM,EAAE,6FAA6F;gBACrG,SAAS,EAAE,MAAM;gBACjB,QAAQ,EAAE,eAAe;aAC5B,CAAC;QACN,CAAC;QAED,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;YAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,CAAC,CAAC,SAAS,CAAC;QAEhB,0EAA0E;QAC1E,IAAI,qBAAqB,GAA4B;YACjD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,eAAe;SAC5B,CAAC;QAEF,gDAAgD;QAChD,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,kDAAkD;gBAClD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACpD,CAAC;YACD,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;iBAAM,IAAI,MAAM,CAAC,oBAAoB,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;gBACpF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,cAAc,CAAC,UAAU,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;YAC1E,qBAAqB,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACvD,CAAC;QAED,OAAO,qBAAqB,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,qBAAqB,CACzB,gBAAwB,EACxB,qBAA6B,EAC7B,QAAyB;QAEzB,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAElD,wCAAwC;QACxC,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,qCAAqC;YACrC,IAAI,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qCAAqC;oBAC7C,SAAS,EAAE,MAAM;iBACpB,CAAC;YACN,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,SAAS,EAAE;oBAC1D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAyC,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAE3G,yBAAyB;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,OAAO,mBAAmB,IAAI,CAAC,QAAQ,EAAE;oBAC7D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,WAAW,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACrC,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,oBAAoB,EAAE,IAAI;oBAC1B,MAAM,EAAE,YAAY,UAAU,CAAC,OAAO,yBAAyB;oBAC/D,SAAS,EAAE,UAAU,CAAC,SAAgB;iBACzC,CAAC;YACN,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,OAAO;YACH,OAAO,EAAE,IAAI;YACb,oBAAoB,EAAE,IAAI;YAC1B,MAAM,EAAE,uCAAuC;YAC/C,SAAS,EAAE,QAAQ;SACtB,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,KAA8C;QAC3D,QAAQ,KAAK,EAAE,CAAC;YACZ,KAAK,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,aAAqB,EAAE,SAAsC;QACtE,IAAI,CAAC;YACD,mBAAmB;YACnB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAEjD,oCAAoC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,mDAAmD;gBACnD,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;oBACnE,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,yCAAyC;iBACpD,CAAC;YACN,CAAC;YAED,sBAAsB;YACtB,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAuD,CAAC,IAAI,EAAE,CAAC;YACxH,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACjC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,aAAa,OAAO,aAAa;qBAC5C,CAAC;gBACN,CAAC;YACL,CAAC;YAED,8CAA8C;YAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,eAAe,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,0DAA0D;YAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,MAAM,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAyD,CAAC,IAAI,EAAE,CAAC;gBAC9H,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;oBACrC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBACrD,IAAI,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAC7C,OAAO;4BACH,OAAO,EAAE,SAAS,KAAK,MAAM,EAAE,iCAAiC;4BAChE,MAAM,EAAE,SAAS,KAAK,MAAM;gCACxB,CAAC,CAAC,8BAA8B,SAAS,8BAA8B;gCACvE,CAAC,CAAC,SAAS;4BACf,YAAY;yBACf,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,yEAAyE;gBACzE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,+EAA+E;wBACvF,YAAY;qBACf,CAAC;gBACN,CAAC;YACL,CAAC;YAED,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,YAAY;aACf,CAAC;QAEN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe,EAAE,OAAwB;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe,EAAE,OAAwB;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,SAAS,IAAI,KAAK,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAe;QAC5C,MAAM,QAAQ,GAAG;YACb,kBAAkB,EAAG,uBAAuB;YAC5C,aAAa,EAAQ,8BAA8B;YACnD,cAAc,EAAO,2BAA2B;YAChD,aAAa,EAAQ,gCAAgC;YACrD,eAAe,EAAM,sBAAsB;YAC3C,iBAAiB,CAAI,sBAAsB;SAC9C,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,OAAe;QAC9B,WAAW;QACX,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,+BAA+B;QAC/B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;YACnD,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACJ;AAED;;GAEG;AACH,IAAI,qBAAqB,GAA4B,IAAI,CAAC;AAE1D,MAAM,UAAU,gBAAgB,CAAC,WAAoB;IACjD,IAAI,CAAC,qBAAqB,IAAI,WAAW,EAAE,CAAC;QACxC,qBAAqB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"McpSecurityGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAEtF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;AAyBhE;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACrB,MAAM,EAAE;QACJ,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;YAChD,uBAAuB;YACvB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW;YAC7C,kBAAkB;YAClB,SAAS,EAAE,OAAO,EAAE,UAAU;YAC9B,kBAAkB;YAClB,MAAM,EAAE,aAAa,EAAE,aAAa;YACpC,UAAU;YACV,OAAO,EAAE,cAAc,EAAE,OAAO;YAChC,sBAAsB;YACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;SAClC;QACD,UAAU,EAAE;YACR,wBAAwB;YACxB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC5C,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;YAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;YAC1C,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE;SACjD;KACJ;IACD,KAAK,EAAE;QACH,sCAAsC;QACtC,OAAO,EAAE;YACL,kBAAkB;YAClB,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;YACnD,uBAAuB;YACvB,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU;YACnD,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;YACjC,WAAW;YACX,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO;YACnC,kBAAkB;YAClB,UAAU,EAAE,gBAAgB,EAAE,SAAS;YACvC,sBAAsB;YACtB,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;SACzC;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;SAC5C;KACJ;IACD,KAAK,EAAE;QACH,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO;YACxC,uBAAuB;YACvB,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW;YAClD,UAAU,EAAE,QAAQ,EAAE,OAAO;YAC7B,mDAAmD;YACnD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;YACnD,kBAAkB;YAClB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;YACrD,UAAU;YACV,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc;YAC9C,sBAAsB;YACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY;SAC5C;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;YACzC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;YACtC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;YAC5C,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;SACzC;KACJ;CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAC9B,yBAAyB;IACzB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IACtC,uBAAuB;IACvB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;IAC7B,kBAAkB;IAClB,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;IACxC,qBAAqB;IACrB,SAAS,EAAE,SAAS,EAAE,UAAU;IAChC,yBAAyB;IACzB,YAAY,EAAE,aAAa,EAAE,aAAa;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG;IAClB,kBAAkB;IAClB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACpD,kBAAkB;IAClB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;IAC3C,qBAAqB;IACrB,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;IACvC,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACjD,oBAAoB;IACpB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACtD,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;IAC7B,0BAA0B;IAC1B,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI;IAC3D,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACtB,sCAAsC;IACtC,YAAY,EAAE;QACV,MAAM,EAAE;YACJ,SAAS,EAAE,mBAAmB,EAAE,cAAc;YAC9C,UAAU,EAAE,WAAW,EAAE,iBAAiB;SAC7C;QACD,KAAK,EAAE;YACH,uBAAuB,EAAE,uBAAuB;YAChD,mBAAmB,EAAE,yBAAyB;YAC9C,iBAAiB,EAAE,sBAAsB;SAC5C;QACD,KAAK,EAAE;YACH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW;YAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;SAC5C;KACJ;IACD,kCAAkC;IAClC,cAAc,EAAE;QACZ,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC3C,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;QAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC;KACrD;CACJ,CAAC;AAEF,MAAM,OAAO,gBAAgB;IACjB,QAAQ,CAAkB;IAC1B,WAAW,CAAS;IACpB,YAAY,GAAa,EAAE,CAAC;IAEpC;;;;;;;OAOG;IACH,YAAY,WAAmB,EAAE,sBAAiC,EAAE,gBAAkC;QAClG,IAAI,CAAC,QAAQ,GAAG,gBAAgB,IAAI,QAAQ,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAe,EAAE,OAAwB;QACrD,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEvD,8EAA8E;QAC9E,mFAAmF;QACnF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAE5D,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,yBAAyB;QACzB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBACzC,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,6FAA6F;gBACrG,SAAS,EAAE,MAAM;gBACjB,QAAQ,EAAE,eAAe;aAC5B,CAAC;QACN,CAAC;QAED,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;YAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,CAAC,CAAC,SAAS,CAAC;QAEhB,0EAA0E;QAC1E,IAAI,qBAAqB,GAA4B;YACjD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,eAAe;SAC5B,CAAC;QAEF,gDAAgD;QAChD,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,kDAAkD;gBAClD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACpD,CAAC;YACD,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;iBAAM,IAAI,MAAM,CAAC,oBAAoB,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;gBACpF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,cAAc,CAAC,UAAU,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;YAC1E,qBAAqB,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACvD,CAAC;QAED,OAAO,qBAAqB,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,qBAAqB,CACzB,gBAAwB,EACxB,qBAA6B,EAC7B,QAAyB;QAEzB,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAElD,wCAAwC;QACxC,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,qCAAqC;YACrC,IAAI,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qCAAqC;oBAC7C,SAAS,EAAE,MAAM;iBACpB,CAAC;YACN,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,SAAS,EAAE;oBAC1D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAyC,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAE3G,yBAAyB;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,OAAO,mBAAmB,IAAI,CAAC,QAAQ,EAAE;oBAC7D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,WAAW,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACrC,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,oBAAoB,EAAE,IAAI;oBAC1B,MAAM,EAAE,YAAY,UAAU,CAAC,OAAO,yBAAyB;oBAC/D,SAAS,EAAE,UAAU,CAAC,SAAgB;iBACzC,CAAC;YACN,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,OAAO;YACH,OAAO,EAAE,IAAI;YACb,oBAAoB,EAAE,IAAI;YAC1B,MAAM,EAAE,uCAAuC;YAC/C,SAAS,EAAE,QAAQ;SACtB,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,KAA8C;QAC3D,QAAQ,KAAK,EAAE,CAAC;YACZ,KAAK,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,aAAqB,EAAE,SAAsC;QACtE,IAAI,CAAC;YACD,mBAAmB;YACnB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAEjD,oCAAoC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,mDAAmD;gBACnD,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;oBACnE,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,yCAAyC;iBACpD,CAAC;YACN,CAAC;YAED,sBAAsB;YACtB,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAuD,CAAC,IAAI,EAAE,CAAC;YACxH,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACjC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,aAAa,OAAO,aAAa;qBAC5C,CAAC;gBACN,CAAC;YACL,CAAC;YAED,8CAA8C;YAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,eAAe,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,0DAA0D;YAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,MAAM,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAyD,CAAC,IAAI,EAAE,CAAC;gBAC9H,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;oBACrC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBACrD,IAAI,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAC7C,OAAO;4BACH,OAAO,EAAE,SAAS,KAAK,MAAM,EAAE,iCAAiC;4BAChE,MAAM,EAAE,SAAS,KAAK,MAAM;gCACxB,CAAC,CAAC,8BAA8B,SAAS,8BAA8B;gCACvE,CAAC,CAAC,SAAS;4BACf,YAAY;yBACf,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,yEAAyE;gBACzE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,+EAA+E;wBACvF,YAAY;qBACf,CAAC;gBACN,CAAC;YACL,CAAC;YAED,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,YAAY;aACf,CAAC;QAEN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe,EAAE,OAAwB;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe,EAAE,OAAwB;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,SAAS,IAAI,KAAK,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAe;QAC5C,MAAM,QAAQ,GAAG;YACb,kBAAkB,EAAG,uBAAuB;YAC5C,aAAa,EAAQ,8BAA8B;YACnD,cAAc,EAAO,2BAA2B;YAChD,aAAa,EAAQ,gCAAgC;YACrD,eAAe,EAAM,sBAAsB;YAC3C,iBAAiB,CAAI,sBAAsB;SAC9C,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,OAAe;QAC9B,WAAW;QACX,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,+BAA+B;QAC/B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;YACnD,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACJ;AAED;;GAEG;AACH,IAAI,qBAAqB,GAA4B,IAAI,CAAC;AAE1D,MAAM,UAAU,gBAAgB,CAAC,WAAoB;IACjD,IAAI,CAAC,qBAAqB,IAAI,WAAW,EAAE,CAAC;QACxC,qBAAqB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC"}

package/dist/protocols/mcp/security/McpToolPolicy.d.ts

@@ -26,6 +26,18 @@
  * cannot widen it by passing arguments.
  */
 export declare function getShellAllowedCommands(): string[];
+/**
+ * Enforce MXF_SHELL_ALLOWED_COMMANDS against a full command line.
+ *
+ * Applies to every agent-driven command, whether it arrives through
+ * shell_execute or through a host tool that calls executeShellCommand.
+ * Wrappers and env prefixes (`sudo cmd`, `FOO=bar cmd`, `timeout 5 cmd`) are
+ * resolved to the command they run, and compound lines (`a && b`) are checked
+ * command by command, so an allowlisted wrapper cannot smuggle another binary.
+ *
+ * @throws Error when an allowlist is configured and any effective command is not on it
+ */
+export declare function assertCommandAllowlisted(commandLine: string): void;
 /**
  * Is a command allowlist configured at all?
  */
@@ -68,6 +80,12 @@ export declare function getWorkspaceRoot(): string | undefined;
  * @throws Error when MXF_WORKSPACE_ROOT is not configured
  */
 export declare function requireWorkspaceRoot(consumer: string): string;
+/**
+ * Resolve a caller path under MXF_WORKSPACE_ROOT and reject lexical and symlink
+ * escapes. Non-existent leaf paths are checked through their nearest existing
+ * ancestor so create/write operations cannot traverse an existing symlink.
+ */
+export declare function resolveWorkspacePath(candidate: string | undefined, consumer: string): string;
 /**
  * May api_fetch reach loopback and private-network addresses?
  *

package/dist/protocols/mcp/security/McpToolPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"McpToolPolicy.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpToolPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkFH;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAC9B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAY7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}
+{"version":3,"file":"McpToolPolicy.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpToolPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAoFH;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAclE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAC9B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAY7D;AAMD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GACjB,MAAM,CA+BR;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}

package/dist/protocols/mcp/security/McpToolPolicy.js

@@ -45,6 +45,8 @@
  *                                addresses. Default false. Only for local dev.
  */
 import * as path from 'path';
+import { extractEffectiveCommands } from '../tools/shell/ShellCommandParser.js';
+import * as fs from 'fs';
 /**
  * Environment variables always forwarded to a shell child.
  *
@@ -103,6 +105,30 @@ function parseBoolean(value, fallback) {
 export function getShellAllowedCommands() {
     return parseList(process.env.MXF_SHELL_ALLOWED_COMMANDS);
 }
+/**
+ * Enforce MXF_SHELL_ALLOWED_COMMANDS against a full command line.
+ *
+ * Applies to every agent-driven command, whether it arrives through
+ * shell_execute or through a host tool that calls executeShellCommand.
+ * Wrappers and env prefixes (`sudo cmd`, `FOO=bar cmd`, `timeout 5 cmd`) are
+ * resolved to the command they run, and compound lines (`a && b`) are checked
+ * command by command, so an allowlisted wrapper cannot smuggle another binary.
+ *
+ * @throws Error when an allowlist is configured and any effective command is not on it
+ */
+export function assertCommandAllowlisted(commandLine) {
+    if (!hasShellAllowlist()) {
+        return;
+    }
+    const allowedCommands = getShellAllowedCommands();
+    for (const effectiveCommand of extractEffectiveCommands(commandLine)) {
+        const baseCommand = effectiveCommand.trim().split(/\s+/)[0];
+        if (!allowedCommands.includes(baseCommand)) {
+            throw new Error(`Command '${baseCommand}' is not in the configured allowlist ` +
+                `(MXF_SHELL_ALLOWED_COMMANDS). Allowed: ${allowedCommands.join(', ')}`);
+        }
+    }
+}
 /**
  * Is a command allowlist configured at all?
  */
@@ -187,6 +213,40 @@ export function requireWorkspaceRoot(consumer) {
     }
     return root;
 }
+const isWithinPath = (root, candidate) => (candidate === root || candidate.startsWith(`${root}${path.sep}`));
+/**
+ * Resolve a caller path under MXF_WORKSPACE_ROOT and reject lexical and symlink
+ * escapes. Non-existent leaf paths are checked through their nearest existing
+ * ancestor so create/write operations cannot traverse an existing symlink.
+ */
+export function resolveWorkspacePath(candidate, consumer) {
+    const configuredRoot = requireWorkspaceRoot(consumer);
+    const realRoot = fs.realpathSync(configuredRoot);
+    const resolved = candidate && candidate.trim().length > 0
+        ? path.resolve(realRoot, candidate.trim())
+        : realRoot;
+    if (!isWithinPath(realRoot, resolved)) {
+        throw new Error(`${consumer} path is outside MXF_WORKSPACE_ROOT`);
+    }
+    let existingAncestor = resolved;
+    while (!fs.existsSync(existingAncestor)) {
+        const parent = path.dirname(existingAncestor);
+        if (parent === existingAncestor) {
+            throw new Error(`${consumer} path has no existing workspace ancestor`);
+        }
+        existingAncestor = parent;
+    }
+    const realAncestor = fs.realpathSync(existingAncestor);
+    if (!isWithinPath(realRoot, realAncestor)) {
+        throw new Error(`${consumer} path escapes MXF_WORKSPACE_ROOT through a symlink`);
+    }
+    const suffix = path.relative(existingAncestor, resolved);
+    const finalPath = path.resolve(realAncestor, suffix);
+    if (!isWithinPath(realRoot, finalPath)) {
+        throw new Error(`${consumer} path is outside MXF_WORKSPACE_ROOT`);
+    }
+    return finalPath;
+}
 /**
  * May api_fetch reach loopback and private-network addresses?
  *

package/dist/protocols/mcp/security/McpToolPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"McpToolPolicy.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpToolPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG;IACxB,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,6EAA6E;IAC7E,YAAY;IACZ,SAAS;IACT,SAAS;IACT,aAAa;IACb,MAAM;IACN,KAAK;CACR,CAAC;AAEF,sEAAsE;AACtE,SAAS,SAAS,CAAC,KAAyB;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,KAAK;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,KAAyB,EAAE,QAAiB;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACnC,OAAO,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC7B,OAAO,uBAAuB,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAC9B,WAAoC;IAEpC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,MAAM,gBAAgB,GAAG;QACrB,GAAG,mBAAmB;QACtB,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;KACtD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI,WAAW,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB;IACjC,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAClD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,kEAAkE;YAC7E,wDAAwD;YACxD,gEAAgE;YAChE,0EAA0E;YAC1E,0DAA0D,CAC7D,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB;IACjC,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC"}
+{"version":3,"file":"McpToolPolicy.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpToolPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG;IACxB,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,6EAA6E;IAC7E,YAAY;IACZ,SAAS;IACT,SAAS;IACT,aAAa;IACb,MAAM;IACN,KAAK;CACR,CAAC;AAEF,sEAAsE;AACtE,SAAS,SAAS,CAAC,KAAyB;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,KAAK;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,KAAyB,EAAE,QAAiB;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACnC,OAAO,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IACxD,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACvB,OAAO;IACX,CAAC;IACD,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;IAClD,KAAK,MAAM,gBAAgB,IAAI,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACX,YAAY,WAAW,uCAAuC;gBAC9D,0CAA0C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzE,CAAC;QACN,CAAC;IACL,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC7B,OAAO,uBAAuB,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAC9B,WAAoC;IAEpC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,MAAM,gBAAgB,GAAG;QACrB,GAAG,mBAAmB;QACtB,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;KACtD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,8DAA8D;IAC9D,IAAI,WAAW,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB;IACjC,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAClD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,kEAAkE;YAC7E,wDAAwD;YACxD,gEAAgE;YAChE,0EAA0E;YAC1E,0DAA0D,CAC7D,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAW,EAAE,CAAC,CAC/D,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CACnE,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAChC,SAA6B,EAC7B,QAAgB;IAEhB,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1C,CAAC,CAAC,QAAQ,CAAC;IAEf,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,qCAAqC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,gBAAgB,GAAG,QAAQ,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,gBAAgB,GAAG,MAAM,CAAC;IAC9B,CAAC;IAED,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,oDAAoD,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,qCAAqC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB;IACjC,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC"}

package/dist/protocols/mcp/services/ExternalMcpServerManager.d.ts

@@ -36,6 +36,10 @@ export interface ExternalServerConfig {
     command: string;
     /** Arguments for the command */
     args: string[];
+    /** Transport requested by a remote registration. Omitted means stdio. */
+    transport?: 'stdio' | 'http';
+    /** Endpoint for an HTTP transport registration. */
+    url?: string;
     /** Working directory for the process */
     workingDirectory?: string;
     /** Environment variables for the process */
@@ -79,6 +83,10 @@ export interface ExternalMcpTool {
     description: string;
     inputSchema: Record<string, any>;
     serverId: string;
+    /** Authoritative visibility scope assigned when the server was registered. */
+    scope: 'global' | 'channel' | 'agent';
+    /** Channel or agent identifier for non-global scopes. */
+    scopeId?: string;
 }
 /** How long to wait for a reply to a JSON-RPC request, per method. */
 declare const REQUEST_TIMEOUTS_MS: {
@@ -93,11 +101,19 @@ declare const REQUEST_TIMEOUTS_MS: {
 export declare class ExternalMcpServerManager extends EventEmitter {
     private servers;
     private serverScopes;
+    /**
+     * Channel ids which crossed their terminal deletion boundary in this
+     * process. Channel ids are reserved in persistence, so this tombstone never
+     * needs to be removed and closes register/delete races in both directions.
+     */
+    private retiredChannelIds;
     private autoCorrectionService;
     /** Injectable event emitter — decouples from direct EventBus.server dependency.
      *  Server-side: uses default ServerToolEventEmitter (wraps EventBus.server).
      *  Client-side: uses ClientToolEventEmitter (wraps EventBus.client + socketEmit). */
     private toolEventEmitter;
+    /** EventBus subscriptions owned by this manager instance. */
+    private eventSubscriptions;
     /** Delay before restarting a crashed server. Overridable for tests. */
     private restartDelayMs;
     /** Per-method JSON-RPC reply timeouts. Overridable for tests and tuning. */
@@ -152,6 +168,15 @@ export declare class ExternalMcpServerManager extends EventEmitter {
      * "not found" against it leaves the zombie in place forever.
      */
     unregisterChannelServer(channelId: string, serverId: string): Promise<void>;
+    /**
+     * Permanently retire a channel's MCP runtime in this process.
+     *
+     * The tombstone is installed before process cleanup, which makes concurrent
+     * registrations fail both before and after their asynchronous startup.
+     * Every known scoped record is removed, including orphaned records whose
+     * scope metadata or server entry is only partially present.
+     */
+    retireChannel(channelId: string): Promise<void>;
     /**
      * Unregister a server by its full id (global servers, and the SDK-facing
      * EXTERNAL_SERVER_UNREGISTER path). Also removes scope tracking — this

package/dist/protocols/mcp/services/ExternalMcpServerManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ExternalMcpServerManager.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/services/ExternalMcpServerManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAWtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAQ3D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IACxB,4CAA4C;IAC5C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KACpC,CAAC,CAAC;CACN;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;CACpB;AAYD,sEAAsE;AACtE,QAAA,MAAM,mBAAmB;;;;;CAKf,CAAC;AAyBX;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,YAAY;IACtD,OAAO,CAAC,OAAO,CA+BA;IAGf,OAAO,CAAC,YAAY,CAaL;IAEf,OAAO,CAAC,qBAAqB,CAAwB;IAErD;;yFAEqF;IACrF,OAAO,CAAC,gBAAgB,CAAkC;IAE1D,uEAAuE;IACvE,OAAO,CAAC,cAAc,CAAoC;IAE1D,4EAA4E;IAC5E,OAAO,CAAC,eAAe,CAAgF;IAEvG;;;;;OAKG;gBACS,OAAO,CAAC,EAAE;QAClB,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;QACrC,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,OAAO,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;KACjF;IAqBD;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA6M1B;;OAEG;IACU,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCxE;;;;;;;;;;OAUG;IACU,qBAAqB,CAC9B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,EACpF,mBAAmB,CAAC,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;KACtB,GACF,OAAO,CAAC,IAAI,CAAC;IAsChB;;;;;;;;OAQG;IACU,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxF;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D;;;;OAIG;YACW,YAAY;IAmC1B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAgB1B;;;;;;;;OAQG;IACU,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmGnG;;;;;;;;OAQG;IACU,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsElF;;OAEG;IACU,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoCnF;;OAEG;IACI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,oBAAoB,EAAE;IAoBzG;;;;;OAKG;IACU,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiEnH;;OAEG;IACI,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAU3D;;OAEG;IACI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAK9E;;OAEG;IACI,mBAAmB,IAAI,eAAe,EAAE;IAe/C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA2JjC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAqD1B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IA2CnB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAe7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;;;;;;;;;OAWG;YACW,kBAAkB;IAuDhC;;OAEG;YACW,mBAAmB;IAwEjC;;;;;;;;;;;;;OAaG;YACW,uBAAuB;IAmErC;;OAEG;YACW,2BAA2B;IAyBzC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAkCvB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAuB5B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAwBjC;;OAEG;IACU,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBtC;;OAEG;IACI,mBAAmB,IAAI,MAAM,EAAE;IAUtC;;OAEG;IACI,kBAAkB,IAAI,MAAM,EAAE;IAUrC;;OAEG;IACI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAQhE;;OAEG;IACU,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBlF;;;;;OAKG;IACU,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9D;;OAEG;IACU,mBAAmB,CAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,GAAG,EACV,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC,GAAG,CAAC;IA+Ef;;;;;OAKG;YACW,2BAA2B;CA4B5C"}
+{"version":3,"file":"ExternalMcpServerManager.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/services/ExternalMcpServerManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAWtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA2B3D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yEAAyE;IACzE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IACxB,4CAA4C;IAC5C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;KACpC,CAAC,CAAC;CACN;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;IACtC,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAYD,sEAAsE;AACtE,QAAA,MAAM,mBAAmB;;;;;CAKf,CAAC;AAyBX;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,YAAY;IACtD,OAAO,CAAC,OAAO,CA+BA;IAGf,OAAO,CAAC,YAAY,CAaL;IAEf;;;;OAIG;IACH,OAAO,CAAC,iBAAiB,CAAqB;IAE9C,OAAO,CAAC,qBAAqB,CAAwB;IAErD;;yFAEqF;IACrF,OAAO,CAAC,gBAAgB,CAAkC;IAE1D,6DAA6D;IAC7D,OAAO,CAAC,kBAAkB,CAA0C;IAEpE,uEAAuE;IACvE,OAAO,CAAC,cAAc,CAAoC;IAE1D,4EAA4E;IAC5E,OAAO,CAAC,eAAe,CAAgF;IAEvG;;;;;OAKG;gBACS,OAAO,CAAC,EAAE;QAClB,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;QACrC,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,OAAO,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;KACjF;IAqBD;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA8N1B;;OAEG;IACU,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CxE;;;;;;;;;;OAUG;IACU,qBAAqB,CAC9B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,EACpF,mBAAmB,CAAC,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;KACtB,GACF,OAAO,CAAC,IAAI,CAAC;IAkDhB;;;;;;;;OAQG;IACU,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxF;;;;;;;OAOG;IACU,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B5D;;;;;;OAMG;IACU,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D;;;;OAIG;YACW,YAAY;IAmC1B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAgB1B;;;;;;;;OAQG;IACU,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmGnG;;;;;;;;OAQG;IACU,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsElF;;OAEG;IACU,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoCnF;;OAEG;IACI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,oBAAoB,EAAE;IAsBzG;;;;;OAKG;IACU,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiEnH;;OAEG;IACI,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAU3D;;OAEG;IACI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAK9E;;OAEG;IACI,mBAAmB,IAAI,eAAe,EAAE;IAqB/C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA2JjC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAqD1B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IA2CnB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAe7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;;;;;;;;;OAWG;YACW,kBAAkB;IAuDhC;;OAEG;YACW,mBAAmB;IAwEjC;;;;;;;;;;;;;OAaG;YACW,uBAAuB;IAmErC;;OAEG;YACW,2BAA2B;IAyBzC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAkCvB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAuB5B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAwBjC;;OAEG;IACU,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IA8BtC;;OAEG;IACI,mBAAmB,IAAI,MAAM,EAAE;IAUtC;;OAEG;IACI,kBAAkB,IAAI,MAAM,EAAE;IAUrC;;OAEG;IACI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAQhE;;OAEG;IACU,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBlF;;;;;OAKG;IACU,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9D;;OAEG;IACU,mBAAmB,CAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,GAAG,EACV,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC,GAAG,CAAC;IA+Ef;;;;;OAKG;YACW,2BAA2B;CA4B5C"}