@orygn/opa-mcp 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -17,6 +17,51 @@ not part of the public surface and may change in minor releases.
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-09-03
+
+### Security
+
+- Policies evaluated through this server no longer receive the server's environment.
+  Rego exposes the environment of the `opa` process through `opa.runtime().env`, and
+  child processes inherited `process.env`, so any evaluated policy could read
+  `OPA_TOKEN`, the `GITHUB_TOKEN` the README asks users to set for
+  `rego_playground_share`, and everything else the operator's client passed in.
+  `rego_eval` accepts inline source, so `OPA_MCP_ALLOWED_PATHS` never applied and no
+  filesystem access was needed; a policy arriving through a README, an issue, or a
+  diff was enough. `conftest_test` was affected the same way, and is the likelier
+  route to third-party policy. Children now get an explicit allow-list containing no
+  secret. `OPA_MCP_PASSTHROUGH_ENV` opts individual variables back in, and anything
+  named there is readable by evaluated policy by design.
+
+  On Windows, libuv copies a fixed set of variables to every child regardless of what
+  is requested. `USERNAME`, `USERDOMAIN` and `LOGONSERVER` cannot be removed, so they
+  are blanked rather than left to disclose the operating-system user and domain.
+
+### Fixed
+
+- A subprocess that produces very large output no longer takes the server down.
+  stdout and stderr were captured without a size limit, and decoding a capture past
+  V8's maximum string length throws inside an async `close` handler, where no tool's
+  `try`/`catch` can reach it and the process exits. A policy iterating
+  `numbers.range(1, 1000)` under `--explain full` produced 518 MiB in under seven
+  seconds, so the 30-second timeout never applied; `opa` buffers its result and writes
+  it in one burst at exit, which means the runs that complete comfortably are the
+  dangerous ones. Capture is now capped per stream, the child is stopped on overflow,
+  and the tool returns the new `OUTPUT_TOO_LARGE` error code. Configurable with
+  `OPA_MCP_MAX_SUBPROCESS_BYTES`, default 32 MiB.
+
+- `rego_test_multiroot` reports `OUTPUT_TOO_LARGE` and `TIMEOUT` through the same mapper as
+  every other tool. It carried its own copy of the failure ladder, and a run killed for
+  producing too much output reported `OPA_BINARY_NOT_FOUND`, sending the caller after an
+  install problem that did not exist. This is the same defect that was fixed for timeouts in
+  0.3.0, in the one place that did not share the fix.
+
+### Added
+
+- `OPA_MCP_MAX_SUBPROCESS_BYTES` and `OPA_MCP_PASSTHROUGH_ENV` environment variables.
+- `OUTPUT_TOO_LARGE` error code.
+
+
 ## [0.3.0] - 2026-08-05
 
 ### Changed
@@ -983,7 +1028,19 @@ wrappers end-to-end. CI matrix: Ubuntu, macOS, and Windows on Node
 20 and 22, plus CodeQL security scanning and weekly Dependabot updates
 for npm, GitHub Actions, and Docker base images.
 
-[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.12...HEAD
+[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.2.1...v0.3.0
+[0.2.1]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.2.0...v0.2.1
+[0.2.0]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.20...v0.2.0
+[0.1.20]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.19...v0.1.20
+[0.1.19]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.18...v0.1.19
+[0.1.18]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.17...v0.1.18
+[0.1.17]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.16...v0.1.17
+[0.1.16]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.15...v0.1.16
+[0.1.15]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.14...v0.1.15
+[0.1.14]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.13...v0.1.14
+[0.1.13]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.12...v0.1.13
 [0.1.12]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.11...v0.1.12
 [0.1.11]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.10...v0.1.11
 [0.1.10]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.9...v0.1.10
@@ -994,6 +1051,6 @@ for npm, GitHub Actions, and Docker base images.
 [0.1.5]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.4...v0.1.5
 [0.1.4]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.3...v0.1.4
 [0.1.3]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.2...v0.1.3
-[0.1.2]: https://github.com/OrygnsCode/opa-mcp-server/releases/tag/v0.1.2
-[0.1.1]: https://github.com/OrygnsCode/opa-mcp-server/releases/tag/v0.1.1
+[0.1.2]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/OrygnsCode/opa-mcp-server/releases/tag/v0.1.0

package/README.md

@@ -22,10 +22,20 @@ environment.
 +--------------------+  52 tools  +-----------------+            +---------------------+
 ```
 
-> **Status:** v0.3.0. Tool surface, error codes, and
+> **Status:** v0.4.0. Tool surface, error codes, and
 > environment variables follow [SemVer](https://semver.org/) from
 > v0.1.0 forward.
 
+> **Upgrading to 0.4.0:** subprocesses no longer inherit the server's
+> environment. A policy that read a variable through `opa.runtime().env`
+> will no longer see it; name the variable in `OPA_MCP_PASSTHROUGH_ENV` if
+> it is genuinely needed. See the security section for why.
+
+> **Upgrading to 0.3.0:** the bundled OPA is now 1.19, so Rego v0 policies
+> no longer parse (`if` is required before a rule body, `contains` before a
+> partial set). Run `rego_migrate_v1` to convert them. If you supply your own
+> binary via `OPA_BINARY` or `PATH`, nothing changes.
+
 ---
 
 ## Table of contents
@@ -225,8 +235,9 @@ which opa && which regal                                    # macOS / Linux
 Get-Command opa, regal | Select-Object Source              # Windows
 ```
 
-This does not affect the **Docker** or **MCPB** install paths; those
-ship `opa` and `regal` inside the bundle and bypass `PATH` entirely.
+This does not affect the **Docker** install path, which ships `opa` and
+`regal` in the image and bypasses `PATH` entirely. The **MCPB** bundle
+carries neither and resolves `opa` the same way the npm install does.
 See [Troubleshooting](#troubleshooting) for full detail.
 
 ## Configuration
@@ -235,20 +246,22 @@ The server reads its configuration from environment variables. Every
 variable is optional; defaults are sensible for a local OPA on
 `http://localhost:8181`.
 
-| Variable                     | Default                      | Purpose                                                                                                                                                                                                                                                                 |
-| ---------------------------- | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `OPA_URL`                    | `http://localhost:8181`      | Base URL of an OPA REST endpoint, used by `opa_*` tools.                                                                                                                                                                                                                |
-| `OPA_TOKEN`                  | _(unset)_                    | Bearer token for OPA, if your instance requires auth. Treated as a secret. Never echoed in logs or tool responses.                                                                                                                                                      |
-| `OPA_BINARY`                 | `opa` (on `PATH`)            | Path to the `opa` CLI, used by `rego_*` tools.                                                                                                                                                                                                                          |
-| `REGAL_BINARY`               | `regal` (on `PATH`)          | Path to the `regal` linter. Only required by `rego_lint`.                                                                                                                                                                                                               |
-| `CONFTEST_BINARY`            | `conftest` (on `PATH`)       | Path to the `conftest` binary. Only required by `conftest_*` tools. Returns `CONFTEST_NOT_FOUND` if absent.                                                                                                                                                             |
-| `OPA_MCP_ALLOWED_PATHS`      | _(unset)_                    | Comma- or semicolon-separated list of directories the server is allowed to read policies from. **When unset, file-based tools refuse to read from disk.**                                                                                                               |
-| `OPA_MCP_LOG_FILE`           | `<tmpdir>/orygn-opa-mcp.log` | Path the server appends logs to. The server never writes to stdout; that channel is reserved for the MCP protocol.                                                                                                                                                      |
-| `OPA_MCP_LOG_LEVEL`          | `info`                       | One of `debug`, `info`, `warn`, `error`.                                                                                                                                                                                                                                |
-| `OPA_MCP_MAX_RESPONSE_BYTES` | `100000`                     | Hard cap on a single tool response. Larger payloads are truncated with a `__truncated: true` marker.                                                                                                                                                                    |
-| `OPA_MCP_TIMEOUT_MS`         | `30000`                      | Hard timeout for any spawned subprocess (`opa`, `regal`). After this, the child gets `SIGTERM` and then `SIGKILL`.                                                                                                                                                      |
-| `OPA_MCP_HTTP_TIMEOUT_MS`    | `15000`                      | Timeout for HTTP requests to the OPA REST API.                                                                                                                                                                                                                          |
-| `OPA_MCP_NO_TELEMETRY`       | _(unset)_                    | Set to `1` to disable the anonymous startup ping. The ping sends the server version, OS platform, and a random install ID. The install ID is stored at `~/.orygn/opa-mcp/install-id` and is generated once on first run. No policy content or file paths are ever sent. |
+| Variable                       | Default                      | Purpose                                                                                                                                                                                                                                                                                      |
+| ------------------------------ | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `OPA_URL`                      | `http://localhost:8181`      | Base URL of an OPA REST endpoint, used by `opa_*` tools.                                                                                                                                                                                                                                     |
+| `OPA_TOKEN`                    | _(unset)_                    | Bearer token for OPA, if your instance requires auth. Treated as a secret. Never echoed in logs or tool responses.                                                                                                                                                                           |
+| `OPA_BINARY`                   | `opa` (on `PATH`)            | Path to the `opa` CLI, used by `rego_*` tools.                                                                                                                                                                                                                                               |
+| `REGAL_BINARY`                 | `regal` (on `PATH`)          | Path to the `regal` linter. Required by `rego_lint`, `rego_fix`, and `rego_security_audit`.                                                                                                                                                                                                  |
+| `CONFTEST_BINARY`              | `conftest` (on `PATH`)       | Path to the `conftest` binary. Only required by `conftest_*` tools. Returns `CONFTEST_NOT_FOUND` if absent.                                                                                                                                                                                  |
+| `OPA_MCP_ALLOWED_PATHS`        | _(unset)_                    | Comma- or semicolon-separated list of directories the server is allowed to read policies from. **When unset, file-based tools refuse to read from disk.**                                                                                                                                    |
+| `OPA_MCP_LOG_FILE`             | `<tmpdir>/orygn-opa-mcp.log` | Path the server appends logs to. The server never writes to stdout; that channel is reserved for the MCP protocol.                                                                                                                                                                           |
+| `OPA_MCP_LOG_LEVEL`            | `info`                       | One of `debug`, `info`, `warn`, `error`.                                                                                                                                                                                                                                                     |
+| `OPA_MCP_MAX_RESPONSE_BYTES`   | `100000`                     | Hard cap on a single tool response. Larger payloads are truncated with a `__truncated: true` marker.                                                                                                                                                                                         |
+| `OPA_MCP_TIMEOUT_MS`           | `30000`                      | Hard timeout for any spawned subprocess (`opa`, `regal`). After this, the child gets `SIGTERM` and then `SIGKILL`.                                                                                                                                                                           |
+| `OPA_MCP_HTTP_TIMEOUT_MS`      | `15000`                      | Timeout for HTTP requests to the OPA REST API.                                                                                                                                                                                                                                               |
+| `OPA_MCP_NO_TELEMETRY`         | _(unset)_                    | Set to `1` to disable the anonymous startup ping. The ping sends the server version, OS platform, and a random install ID. The install ID is stored at `~/.orygn/opa-mcp/install-id` and is generated once on first run. No policy content or file paths are ever sent.                      |
+| `OPA_MCP_MAX_SUBPROCESS_BYTES` | `33554432` (32 MiB)          | Maximum bytes captured from a subprocess's stdout and stderr, counted separately. On overflow the stream is clamped, the child is stopped, and the tool returns `OUTPUT_TOO_LARGE`. Distinct from `OPA_MCP_MAX_RESPONSE_BYTES`, which trims the reply after the output is already in memory. |
+| `OPA_MCP_PASSTHROUGH_ENV`      | _(unset)_                    | Comma-separated variable names to pass through to `opa`, `regal` and `conftest`. Everything else is withheld. **Anything named here is readable by any policy the server evaluates**, via `opa.runtime().env`, so use it only for values that are safe in that position.                     |
 
 Paths in `OPA_MCP_ALLOWED_PATHS` and the `*_BINARY` variables must be
 absolute. Relative paths and missing binaries are rejected with structured
@@ -269,7 +282,8 @@ Stable error codes: `INVALID_INPUT`, `INVALID_REGO`, `INVALID_BUNDLE`,
 `OPA_AUTH_FAILED`, `POLICY_NOT_FOUND`, `DATA_NOT_FOUND`, `PATH_NOT_ALLOWED`,
 `PATH_NOT_FOUND`, `DEPENDENCY_CONFLICT`, `NO_TESTS_FOUND`,
 `COVERAGE_BELOW_THRESHOLD`, `OPA_VERSION_UNSUPPORTED`, `VERIFY_INCONCLUSIVE`,
-`Z3_INIT_ERROR`, `GITHUB_TOKEN_MISSING`, `GIST_CREATE_FAILED`, `TIMEOUT`,
+`Z3_INIT_ERROR`, `GITHUB_TOKEN_MISSING`, `GIST_CREATE_FAILED`,
+`OUTPUT_TOO_LARGE`, `TIMEOUT`,
 `CANCELLED`, `UNKNOWN_ERROR`.
 
 ### Category A: Authoring & static analysis
@@ -295,7 +309,7 @@ Operate on Rego source code without needing a running OPA server. Wrap
 ```jsonc
 // Input
 {
-  "source": "package x\nallow{input.user==\"admin\"}"
+  "source": "package x\nallow if input.user==\"admin\""
 }
 
 // Output (ok)
@@ -441,7 +455,7 @@ YAML/JSON/HCL/TOML/INI against Rego policies using
 // Input
 {
   "inlineConfig": "apiVersion: v1\nkind: Pod\nspec:\n  containers:\n  - name: app\n    image: nginx:latest",
-  "inlinePolicy": "package main\ndeny[msg] { input.spec.containers[_].image == \"nginx:latest\"; msg := \"pin your image tag\" }"
+  "inlinePolicy": "package main\ndeny contains msg if { input.spec.containers[_].image == \"nginx:latest\"; msg := \"pin your image tag\" }"
 }
 
 // Output
@@ -567,18 +581,28 @@ Agent: Done. Policy `rbac` is live on staging at $OPA_URL.
 └───────────────────────────────────────────────────────────────────────────────────────┘
 ```
 
-Three things worth knowing if you're going to operate this:
+Four things worth knowing if you're going to operate this:
 
 1. **stdout is the protocol channel.** The server logs to a file via
    `lib/logger.ts` and never writes to stdout. If you see stray stdout
    bytes, the client disconnects; the MCP transport layer is strict.
 2. **No tool throws.** Every tool catches its own exceptions and returns
    a structured `{ ok: false, error: ... }` envelope. The agent sees a
-   stable error vocabulary, not a stack trace.
-3. **Subprocesses are tightly bounded.** `lib/subprocess.ts` runs `opa`
-   and `regal` with `shell: false`, a hard timeout, and `SIGTERM`-then-
-   `SIGKILL` escalation. There is no path through the server where an
-   agent can construct a shell command.
+   stable error vocabulary, not a stack trace. Decoding subprocess output
+   happens inside an async callback, where a throw would bypass those
+   handlers entirely, so that path is bounded by bytes rather than left to
+   a `try`/`catch` that could not see it.
+3. **Subprocesses are bounded in time, size, and environment.**
+   `lib/subprocess.ts` runs the binaries with `shell: false`, a hard
+   timeout with `SIGTERM`-then-`SIGKILL` escalation, and a per-stream byte
+   cap. There is no path through the server where an agent can construct a
+   shell command. The timeout alone is not enough: `opa` buffers a result
+   in memory and writes it in one burst at exit, so a command that finishes
+   well inside the timeout can still deliver hundreds of megabytes.
+4. **Children do not inherit the server's environment.** `lib/child-env.ts`
+   builds an explicit allow-list instead. Rego can read its interpreter's
+   environment through `opa.runtime().env`, so anything passed down is
+   readable by any policy the server evaluates.
 
 ## Security
 
@@ -588,8 +612,18 @@ be exposed on the network.
 
 - File-based tools refuse to read anything outside `OPA_MCP_ALLOWED_PATHS`.
   When that variable is unset, file tools return `PATH_NOT_ALLOWED`.
-- Subprocesses run with `shell: false` and a hard timeout.
-- `OPA_TOKEN` is never echoed in tool responses or log entries.
+- Subprocesses run with `shell: false`, a hard timeout, and a byte cap on
+  captured output.
+- **Evaluated policy cannot read the server's environment.** Rego exposes the
+  environment of the `opa` process through `opa.runtime().env`, so a child that
+  inherited `process.env` would hand `OPA_TOKEN`, `GITHUB_TOKEN`, and every
+  other variable to any policy it evaluated. Since `rego_eval` accepts inline
+  source, no filesystem access is needed to reach that, which puts it one
+  prompt injection away from any untrusted Rego an agent reads. Children get an
+  explicit allow-list instead (`lib/child-env.ts`), containing no secret.
+  `OPA_MCP_PASSTHROUGH_ENV` opts individual variables back in.
+- `OPA_TOKEN` is never echoed in tool responses or log entries, and is not
+  passed to any child process.
 - Releases are published with
   [npm provenance](https://docs.npmjs.com/generating-provenance-statements);
   the Docker image is built reproducibly from the committed `Dockerfile`.
@@ -634,8 +668,9 @@ is not enough -- the spawned server gets a reduced `PATH`. The
 [`examples/`](./examples) configs already include these env vars; just
 edit the placeholder paths.
 
-This issue does **not** affect the Docker or MCPB install paths. Those
-bundle `opa` and `regal` and bypass `PATH` entirely.
+This issue does **not** affect the Docker install path, which bundles
+`opa` and `regal` and bypasses `PATH` entirely. The MCPB bundle resolves
+`opa` from `OPA_BINARY` or `PATH`, so it can hit this.
 
 **The server starts, then the client says "disconnected."**
 
@@ -716,7 +751,7 @@ Breaking changes will be:
 
 Pinned versions of the upstream toolchain (`opa` and `regal`) are treated
 as part of the build, not as a dependency the operator manages. The
-Dockerfile, MCPB bundle, and CI all use the same pin; bumps go through
+Dockerfile and CI use the same pin; bumps go through
 Dependabot or a manual PR.
 
 ## License

package/dist/config.d.ts

@@ -31,6 +31,16 @@ declare const ConfigSchema: z.ZodObject<{
      * write to a file path the agent specifies.
      */
     maxResponseBytes: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Maximum bytes captured from a subprocess's stdout and stderr, each counted
+     * separately. On overflow the stream is clamped and the child is killed.
+     *
+     * This is a memory bound, distinct from `maxResponseBytes`, which trims the
+     * response after the output has already been read into the heap. A capture
+     * past V8's max string length cannot be decoded at all, and the throw would
+     * land in an async callback where no tool can catch it.
+     */
+    maxSubprocessBytes: z.ZodDefault<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     opaUrl: string;
     opaBinary: string;
@@ -40,8 +50,9 @@ declare const ConfigSchema: z.ZodObject<{
     httpTimeoutMs: number;
     allowedPaths: string[];
     logFile: string;
-    logLevel: "debug" | "info" | "warn" | "error";
+    logLevel: "error" | "debug" | "info" | "warn";
     maxResponseBytes: number;
+    maxSubprocessBytes: number;
     opaToken?: string | undefined;
 }, {
     opaUrl?: string | undefined;
@@ -53,8 +64,9 @@ declare const ConfigSchema: z.ZodObject<{
     httpTimeoutMs?: number | undefined;
     allowedPaths?: string[] | undefined;
     logFile?: string | undefined;
-    logLevel?: "debug" | "info" | "warn" | "error" | undefined;
+    logLevel?: "error" | "debug" | "info" | "warn" | undefined;
     maxResponseBytes?: number | undefined;
+    maxSubprocessBytes?: number | undefined;
 }>;
 export type Config = z.infer<typeof ConfigSchema>;
 export declare function loadConfig(): Config;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IASxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAGlE,mDAAmD;;IAGnD;;;;;OAKG;;IAGH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAyBlD,wBAAgB,UAAU,IAAI,MAAM,CAqCnC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IASxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAGlE,mDAAmD;;IAGnD;;;;;OAKG;;IAGH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;IAGH;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AA0BlD,wBAAgB,UAAU,IAAI,MAAM,CAsCnC"}

package/dist/config.js

@@ -9,6 +9,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { z } from 'zod';
 import { resolveOpaBinary } from './lib/resolve-binary.js';
+import { DEFAULT_MAX_OUTPUT_BYTES } from './lib/subprocess.js';
 const ConfigSchema = z.object({
     /** Base URL of a running OPA server (used by `opa_*` runtime tools). */
     opaUrl: z
@@ -47,6 +48,21 @@ const ConfigSchema = z.object({
      * write to a file path the agent specifies.
      */
     maxResponseBytes: z.coerce.number().int().positive().default(100_000),
+    /**
+     * Maximum bytes captured from a subprocess's stdout and stderr, each counted
+     * separately. On overflow the stream is clamped and the child is killed.
+     *
+     * This is a memory bound, distinct from `maxResponseBytes`, which trims the
+     * response after the output has already been read into the heap. A capture
+     * past V8's max string length cannot be decoded at all, and the throw would
+     * land in an async callback where no tool can catch it.
+     */
+    maxSubprocessBytes: z.coerce
+        .number()
+        .int()
+        .positive()
+        .max(DEFAULT_MAX_OUTPUT_BYTES * 8, 'OPA_MCP_MAX_SUBPROCESS_BYTES is too large to decode safely; keep it well under 512 MiB.')
+        .default(DEFAULT_MAX_OUTPUT_BYTES),
 });
 function parseAllowedPaths(raw) {
     if (!raw)
@@ -69,6 +85,7 @@ const ENV_VAR_NAMES = {
     logFile: 'OPA_MCP_LOG_FILE',
     logLevel: 'OPA_MCP_LOG_LEVEL',
     maxResponseBytes: 'OPA_MCP_MAX_RESPONSE_BYTES',
+    maxSubprocessBytes: 'OPA_MCP_MAX_SUBPROCESS_BYTES',
 };
 export function loadConfig() {
     const allowedPaths = parseAllowedPaths(process.env['OPA_MCP_ALLOWED_PATHS']);
@@ -84,6 +101,7 @@ export function loadConfig() {
         logFile: process.env['OPA_MCP_LOG_FILE'],
         logLevel: process.env['OPA_MCP_LOG_LEVEL'],
         maxResponseBytes: process.env['OPA_MCP_MAX_RESPONSE_BYTES'],
+        maxSubprocessBytes: process.env['OPA_MCP_MAX_SUBPROCESS_BYTES'],
     });
     if (!parsed.success) {
         console.error('opa-mcp: invalid configuration');

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvE,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEjE;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;CACtE,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;CAC/C,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACrD,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvE,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEjE;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAErE;;;;;;;;OAQG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CACF,wBAAwB,GAAG,CAAC,EAC5B,yFAAyF,CAC1F;SACA,OAAO,CAAC,wBAAwB,CAAC;CACrC,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;IAC9C,kBAAkB,EAAE,8BAA8B;CACnD,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACrD,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC3D,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;KAChE,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/constants.d.ts

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.3.0";
+export declare const SERVER_VERSION = "0.4.0";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.3.0';
+export const SERVER_VERSION = '0.4.0';
 //# sourceMappingURL=constants.js.map

package/dist/lib/child-env.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Builds the environment handed to `opa`, `regal` and `conftest`.
+ *
+ * Rego can read its interpreter's environment: `opa.runtime().env` returns the
+ * whole thing. So every variable this server passes down is readable by any
+ * policy it evaluates, and `rego_eval` takes inline source -- no filesystem
+ * access, so `OPA_MCP_ALLOWED_PATHS` never applies. Untrusted Rego reaches an
+ * agent through a README, an issue, or a pull request diff, which makes a
+ * pass-through of `process.env` a prompt injection away from handing over
+ * `OPA_TOKEN`, the `GITHUB_TOKEN` this project's own README asks users to put in
+ * their client config, and whatever else the operator's shell happens to hold.
+ *
+ * So the child gets an explicit allow-list instead. Nothing on it is a secret.
+ * Measured against the bundled OPA 1.19.0, `version`, `eval`, `check`, `test`
+ * and `build` all succeed with a completely empty environment, so the entries
+ * below exist for correctness in real-world setups (proxies, custom CA bundles,
+ * tool config discovery), not to make the binaries run.
+ *
+ * Operators who genuinely need a variable in policy can name it in
+ * `OPA_MCP_PASSTHROUGH_ENV`, which is opt-in precisely because it undoes this.
+ */
+/**
+ * Build the child environment: the allow-list, plus any opted-in passthrough,
+ * plus `extra` from the caller (which wins, since it is explicit intent).
+ *
+ * @param extra   Variables the calling command needs. Readable by evaluated
+ *                policy like everything else here, so pass secrets only when the
+ *                command actually requires them.
+ * @param source  Environment to read from. Injectable for testing.
+ */
+export declare function buildChildEnv(extra?: Record<string, string>, source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Exposed for tests and for documenting the surface. */
+export declare const ALLOWED_CHILD_ENV_VARS: readonly string[];
+//# sourceMappingURL=child-env.d.ts.map

package/dist/lib/child-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA0GH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CAanB;AAED,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAY,CAAC"}

package/dist/lib/child-env.js

@@ -0,0 +1,144 @@
+/**
+ * Builds the environment handed to `opa`, `regal` and `conftest`.
+ *
+ * Rego can read its interpreter's environment: `opa.runtime().env` returns the
+ * whole thing. So every variable this server passes down is readable by any
+ * policy it evaluates, and `rego_eval` takes inline source -- no filesystem
+ * access, so `OPA_MCP_ALLOWED_PATHS` never applies. Untrusted Rego reaches an
+ * agent through a README, an issue, or a pull request diff, which makes a
+ * pass-through of `process.env` a prompt injection away from handing over
+ * `OPA_TOKEN`, the `GITHUB_TOKEN` this project's own README asks users to put in
+ * their client config, and whatever else the operator's shell happens to hold.
+ *
+ * So the child gets an explicit allow-list instead. Nothing on it is a secret.
+ * Measured against the bundled OPA 1.19.0, `version`, `eval`, `check`, `test`
+ * and `build` all succeed with a completely empty environment, so the entries
+ * below exist for correctness in real-world setups (proxies, custom CA bundles,
+ * tool config discovery), not to make the binaries run.
+ *
+ * Operators who genuinely need a variable in policy can name it in
+ * `OPA_MCP_PASSTHROUGH_ENV`, which is opt-in precisely because it undoes this.
+ */
+/** Vars every platform benefits from. Locale keeps output formatting stable. */
+const COMMON = ['PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_NUMERIC', 'TZ'];
+/** POSIX home and temp. Regal and Conftest look under HOME for config. */
+const POSIX = ['HOME', 'TMPDIR', 'SHELL', 'USER', 'LOGNAME'];
+/**
+ * Windows equivalents. A Go binary starts without these, but process creation
+ * and temp-file handling are better behaved with them present.
+ */
+const WINDOWS = [
+    'PATHEXT',
+    'SystemRoot',
+    'SystemDrive',
+    'COMSPEC',
+    'windir',
+    'TEMP',
+    'TMP',
+    'USERPROFILE',
+    'HOMEDRIVE',
+    'HOMEPATH',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'PROCESSOR_ARCHITECTURE',
+    'NUMBER_OF_PROCESSORS',
+];
+/**
+ * Proxy and TLS trust. Without these, `http.send`, bundle downloads and remote
+ * schema fetches fail behind a corporate proxy or a custom CA.
+ *
+ * A proxy URL can embed credentials, so these are the least inert entries here.
+ * They are included because breaking every corporate user is the worse trade,
+ * and they are the operator's own infrastructure credentials rather than the
+ * cloud and repository tokens that motivated this module.
+ */
+const NETWORK = [
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'ALL_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+    'all_proxy',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+];
+/**
+ * Where the tools look for their own config and credentials. These name file
+ * locations; they are not themselves secrets. Conftest reads registry auth from
+ * the Docker config file, so `conftest_pull` and `conftest_push` need these.
+ */
+const TOOL_CONFIG = [
+    'XDG_CONFIG_HOME',
+    'XDG_CACHE_HOME',
+    'XDG_DATA_HOME',
+    'DOCKER_CONFIG',
+    'REGISTRY_AUTH_FILE',
+];
+const ALLOWED = [...COMMON, ...POSIX, ...WINDOWS, ...NETWORK, ...TOOL_CONFIG];
+/** Names an operator opted into via OPA_MCP_PASSTHROUGH_ENV. */
+function passthroughNames(source) {
+    const raw = source['OPA_MCP_PASSTHROUGH_ENV'];
+    if (!raw)
+        return [];
+    return raw
+        .split(/[;,]/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+/**
+ * Windows treats variable names case-insensitively, and the casing in
+ * `process.env` follows whatever the parent used, so an exact-key lookup would
+ * silently miss `Path` where the list says `PATH`.
+ */
+function lookup(source, name) {
+    const direct = source[name];
+    if (direct !== undefined)
+        return direct;
+    if (process.platform !== 'win32')
+        return undefined;
+    const wanted = name.toLowerCase();
+    for (const key of Object.keys(source)) {
+        if (key.toLowerCase() === wanted)
+            return source[key];
+    }
+    return undefined;
+}
+/**
+ * Windows-only identity variables that libuv copies from the parent no matter
+ * what environment is requested -- spawning with `{}` still delivers them, and
+ * measurably so. They are not secrets, but they name the operating-system user,
+ * the Windows domain and the domain controller, which is more than an untrusted
+ * policy needs to know about the machine evaluating it.
+ *
+ * They cannot be removed, only overwritten, so they are blanked. None of the
+ * three binaries reads them: every representative `opa` command succeeds with a
+ * completely empty environment on both platforms.
+ */
+const WINDOWS_IDENTITY_TO_BLANK = ['USERNAME', 'USERDOMAIN', 'LOGONSERVER'];
+/**
+ * Build the child environment: the allow-list, plus any opted-in passthrough,
+ * plus `extra` from the caller (which wins, since it is explicit intent).
+ *
+ * @param extra   Variables the calling command needs. Readable by evaluated
+ *                policy like everything else here, so pass secrets only when the
+ *                command actually requires them.
+ * @param source  Environment to read from. Injectable for testing.
+ */
+export function buildChildEnv(extra, source = process.env) {
+    const env = {};
+    if (process.platform === 'win32') {
+        for (const name of WINDOWS_IDENTITY_TO_BLANK)
+            env[name] = '';
+    }
+    for (const name of [...ALLOWED, ...passthroughNames(source)]) {
+        const value = lookup(source, name);
+        if (value !== undefined)
+            env[name] = value;
+    }
+    return extra ? { ...env, ...extra } : env;
+}
+/** Exposed for tests and for documenting the surface. */
+export const ALLOWED_CHILD_ENV_VARS = ALLOWED;
+//# sourceMappingURL=child-env.js.map

package/dist/lib/child-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,gFAAgF;AAChF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,GAAG;IACd,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,QAAQ;IACR,MAAM;IACN,KAAK;IACL,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,cAAc;IACd,wBAAwB;IACxB,sBAAsB;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG;IACd,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,eAAe;IACf,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,oBAAoB;CACrB,CAAC;AAEF,MAAM,OAAO,GAAsB,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;AAEjG,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,MAAyB;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAyB,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA8B,EAC9B,SAA4B,OAAO,CAAC,GAAG;IAEvC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,yBAAyB;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAsB,OAAO,CAAC"}

package/dist/lib/conftest-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4BD;;;;;;GAMG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuChF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAWrE;;;OAGG;YACW,cAAc;IAyC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA2BvB"}
+{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4BD;;;;;;GAMG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuChF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYrE;;;OAGG;YACW,cAAc;IAyC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA2BvB"}

package/dist/lib/conftest-cli.js

@@ -151,6 +151,7 @@ export class ConftestCli {
         const opts = {
             args,
             timeoutMs: this.config.subprocessTimeoutMs,
+            maxOutputBytes: this.config.maxSubprocessBytes,
         };
         if (signal !== undefined)
             opts.signal = signal;