@orygn/opa-mcp 0.3.0 → 0.5.0

package/dist/config.js

@@ -6,9 +6,17 @@
  * Cursor, VS Code) pass config via the `env` object in their JSON.
  */
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { isAbsolute, join } from 'node:path';
 import { z } from 'zod';
 import { resolveOpaBinary } from './lib/resolve-binary.js';
+import { DEFAULT_MAX_OUTPUT_BYTES } from './lib/subprocess.js';
+/**
+ * Node clamps a timer of 2^31 ms or more to 1 ms, with only a process warning.
+ * A large value reads as "effectively no timeout" and produced the opposite:
+ * every subprocess and every HTTP call timed out immediately.
+ */
+const MAX_TIMER_MS = 2_147_483_647;
+const TIMER_TOO_LARGE = 'Timeout must be below 2147483647 ms (about 24 days). Node clamps anything larger to 1 ms, which times out every call immediately.';
 const ConfigSchema = z.object({
     /** Base URL of a running OPA server (used by `opa_*` runtime tools). */
     opaUrl: z
@@ -27,16 +35,36 @@ const ConfigSchema = z.object({
     /** Path to the `conftest` binary. Defaults to `conftest` on PATH. */
     conftestBinary: z.string().default('conftest'),
     /** Hard timeout in ms for any spawned subprocess (opa, regal). */
-    subprocessTimeoutMs: z.coerce.number().int().positive().default(30_000),
+    subprocessTimeoutMs: z.coerce
+        .number()
+        .int()
+        .positive()
+        .max(MAX_TIMER_MS, TIMER_TOO_LARGE)
+        .default(30_000),
     /** HTTP request timeout for OPA REST API calls. */
-    httpTimeoutMs: z.coerce.number().int().positive().default(15_000),
+    httpTimeoutMs: z.coerce
+        .number()
+        .int()
+        .positive()
+        .max(MAX_TIMER_MS, TIMER_TOO_LARGE)
+        .default(15_000),
     /**
      * Allow-listed root directories for file path inputs. Tools that accept
      * filesystem paths reject anything outside these roots. Empty by
      * default -- file-based tools refuse to read from disk until the
      * operator explicitly opts in via `OPA_MCP_ALLOWED_PATHS`.
      */
-    allowedPaths: z.array(z.string()).default([]),
+    allowedPaths: z
+        .array(
+    // A relative root is resolved against the server's working directory,
+    // which for a stdio server is wherever the client happened to launch it.
+    // The same configuration would then permit different directories on
+    // different machines, so it is refused rather than guessed at, which is
+    // what the documentation has always said happens.
+    z.string().refine(isAbsolute, {
+        message: 'must be an absolute path',
+    }))
+        .default([]),
     /** Path to the log file. Defaults to OS tmpdir + orygn-opa-mcp.log. */
     logFile: z.string().default(join(tmpdir(), 'orygn-opa-mcp.log')),
     /** Log level for the file logger. */
@@ -47,6 +75,21 @@ const ConfigSchema = z.object({
      * write to a file path the agent specifies.
      */
     maxResponseBytes: z.coerce.number().int().positive().default(100_000),
+    /**
+     * Maximum bytes captured from a subprocess's stdout and stderr, each counted
+     * separately. On overflow the stream is clamped and the child is killed.
+     *
+     * This is a memory bound, distinct from `maxResponseBytes`, which trims the
+     * response after the output has already been read into the heap. A capture
+     * past V8's max string length cannot be decoded at all, and the throw would
+     * land in an async callback where no tool can catch it.
+     */
+    maxSubprocessBytes: z.coerce
+        .number()
+        .int()
+        .positive()
+        .max(DEFAULT_MAX_OUTPUT_BYTES * 8, 'OPA_MCP_MAX_SUBPROCESS_BYTES is too large to decode safely; keep it well under 512 MiB.')
+        .default(DEFAULT_MAX_OUTPUT_BYTES),
 });
 function parseAllowedPaths(raw) {
     if (!raw)
@@ -69,21 +112,38 @@ const ENV_VAR_NAMES = {
     logFile: 'OPA_MCP_LOG_FILE',
     logLevel: 'OPA_MCP_LOG_LEVEL',
     maxResponseBytes: 'OPA_MCP_MAX_RESPONSE_BYTES',
+    maxSubprocessBytes: 'OPA_MCP_MAX_SUBPROCESS_BYTES',
 };
+/**
+ * Read an environment variable, treating an empty or blank value as unset.
+ *
+ * A shell that expands an unset variable leaves an empty string behind, and
+ * `OPA_BINARY=""` was taken as a real path: it is not the literal default
+ * `opa`, so binary resolution skipped the bundled build and every tool call
+ * tried to spawn nothing. Blank means "not configured" for every variable here.
+ */
+function env(name) {
+    const raw = process.env[name];
+    if (raw === undefined)
+        return undefined;
+    const trimmed = raw.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
 export function loadConfig() {
     const allowedPaths = parseAllowedPaths(process.env['OPA_MCP_ALLOWED_PATHS']);
     const parsed = ConfigSchema.safeParse({
-        opaUrl: process.env['OPA_URL'],
-        opaToken: process.env['OPA_TOKEN'],
-        opaBinary: process.env['OPA_BINARY'],
-        regalBinary: process.env['REGAL_BINARY'],
-        conftestBinary: process.env['CONFTEST_BINARY'],
-        subprocessTimeoutMs: process.env['OPA_MCP_TIMEOUT_MS'],
-        httpTimeoutMs: process.env['OPA_MCP_HTTP_TIMEOUT_MS'],
+        opaUrl: env('OPA_URL'),
+        opaToken: env('OPA_TOKEN'),
+        opaBinary: env('OPA_BINARY'),
+        regalBinary: env('REGAL_BINARY'),
+        conftestBinary: env('CONFTEST_BINARY'),
+        subprocessTimeoutMs: env('OPA_MCP_TIMEOUT_MS'),
+        httpTimeoutMs: env('OPA_MCP_HTTP_TIMEOUT_MS'),
         allowedPaths,
-        logFile: process.env['OPA_MCP_LOG_FILE'],
-        logLevel: process.env['OPA_MCP_LOG_LEVEL'],
-        maxResponseBytes: process.env['OPA_MCP_MAX_RESPONSE_BYTES'],
+        logFile: env('OPA_MCP_LOG_FILE'),
+        logLevel: env('OPA_MCP_LOG_LEVEL'),
+        maxResponseBytes: env('OPA_MCP_MAX_RESPONSE_BYTES'),
+        maxSubprocessBytes: env('OPA_MCP_MAX_SUBPROCESS_BYTES'),
     });
     if (!parsed.success) {
         console.error('opa-mcp: invalid configuration');

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvE,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEjE;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;CACtE,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;CAC/C,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACrD,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,eAAe,GACnB,mIAAmI,CAAC;AAEtI,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC;SAClC,OAAO,CAAC,MAAM,CAAC;IAElB,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM;SACpB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC;SAClC,OAAO,CAAC,MAAM,CAAC;IAElB;;;;;OAKG;IACH,YAAY,EAAE,CAAC;SACZ,KAAK;IACJ,sEAAsE;IACtE,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,kDAAkD;IAClD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;QAC5B,OAAO,EAAE,0BAA0B;KACpC,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IAEd,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAErE;;;;;;;;OAQG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CACF,wBAAwB,GAAG,CAAC,EAC5B,yFAAyF,CAC1F;SACA,OAAO,CAAC,wBAAwB,CAAC;CACrC,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;IAC9C,kBAAkB,EAAE,8BAA8B;CACnD,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;QACtB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;QAChC,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAC;QACtC,mBAAmB,EAAE,GAAG,CAAC,oBAAoB,CAAC;QAC9C,aAAa,EAAE,GAAG,CAAC,yBAAyB,CAAC;QAC7C,YAAY;QACZ,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAChC,QAAQ,EAAE,GAAG,CAAC,mBAAmB,CAAC;QAClC,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,CAAC;QACnD,kBAAkB,EAAE,GAAG,CAAC,8BAA8B,CAAC;KACxD,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/constants.d.ts

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.3.0";
+export declare const SERVER_VERSION = "0.4.0";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.3.0';
+export const SERVER_VERSION = '0.4.0';
 //# sourceMappingURL=constants.js.map

package/dist/lib/bundle-signatures.d.ts

@@ -0,0 +1,23 @@
+export interface SignaturesSummary {
+    /** JWT `alg` header, e.g. `RS256`. */
+    algorithm: string;
+    /** Number of files the signature covers. */
+    filesSigned: number;
+    keyId?: string;
+    scope?: string;
+}
+/**
+ * Read the summary of a `.signatures.json` file. Throws on any shape OPA
+ * would not have written, so a caller never reports a file it cannot read.
+ */
+export declare function readSignaturesSummary(path: string): Promise<SignaturesSummary>;
+export declare function isKeyOrAlgorithmError(output: string): boolean;
+export type VerificationFailureReason = 'key_invalid' | 'not_a_bundle' | 'signature_invalid' | 'scope_mismatch' | 'file_modified' | 'file_missing' | 'file_added' | 'unsigned' | 'signatures_malformed' | 'file_unparseable' | 'bundle_load_error' | 'unknown';
+export interface VerificationFailure {
+    reason: VerificationFailureReason;
+    summary: string;
+    hint?: string;
+}
+/** Classify OPA's stdout+stderr from a failed verification. */
+export declare function classifyVerificationFailure(output: string): VerificationFailure;
+//# sourceMappingURL=bundle-signatures.d.ts.map

package/dist/lib/bundle-signatures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-signatures.d.ts","sourceRoot":"","sources":["../../src/lib/bundle-signatures.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0BpF;AASD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,cAAc,GACd,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,YAAY,GACZ,UAAU,GACV,sBAAsB,GACtB,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,CAAC;AAEd,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,yBAAyB,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAuFD,+DAA+D;AAC/D,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAW/E"}

package/dist/lib/bundle-signatures.js

@@ -0,0 +1,152 @@
+/**
+ * Helpers for OPA bundle signatures.
+ *
+ * `opa sign` writes `{ "signatures": ["<JWT>"] }` with exactly one JWT. Its
+ * header carries the algorithm and its payload lists every signed file as
+ * `{ name, hash, algorithm }`, plus whatever extra claims (`keyid`, `scope`)
+ * were supplied through a claims file. Reading that summary back is how the
+ * sign tool describes what it just produced, and it is deliberately not a
+ * verification: nothing here checks the signature, only OPA does that.
+ */
+import { readFile } from 'node:fs/promises';
+function base64UrlDecode(segment) {
+    const b64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+    return Buffer.from(padded, 'base64').toString('utf8');
+}
+/**
+ * Read the summary of a `.signatures.json` file. Throws on any shape OPA
+ * would not have written, so a caller never reports a file it cannot read.
+ */
+export async function readSignaturesSummary(path) {
+    const raw = await readFile(path, 'utf8');
+    const parsed = JSON.parse(raw);
+    const sigs = parsed.signatures;
+    if (!Array.isArray(sigs) || sigs.length !== 1 || typeof sigs[0] !== 'string') {
+        throw new Error('expected exactly one JWT in "signatures"');
+    }
+    const parts = sigs[0].split('.');
+    if (parts.length !== 3)
+        throw new Error('signature is not a JWT');
+    const header = JSON.parse(base64UrlDecode(parts[0]));
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    if (typeof header.alg !== 'string')
+        throw new Error('JWT header has no alg');
+    if (!Array.isArray(payload.files))
+        throw new Error('JWT payload has no files array');
+    const summary = {
+        algorithm: header.alg,
+        filesSigned: payload.files.length,
+    };
+    if (typeof payload.keyid === 'string')
+        summary.keyId = payload.keyid;
+    if (typeof payload.scope === 'string')
+        summary.scope = payload.scope;
+    return summary;
+}
+/**
+ * `opa sign` and `opa build` both print these when the key file is not a PEM
+ * key or the algorithm is not one OPA knows. They are the caller's input, not
+ * the bundle, so the tools report them as INVALID_INPUT.
+ */
+const KEY_OR_ALGORITHM_ERROR = /failed to parse PEM block|unknown signature algorithm/i;
+export function isKeyOrAlgorithmError(output) {
+    return KEY_OR_ALGORITHM_ERROR.test(output);
+}
+/**
+ * Each pattern is text OPA 1.19 prints, on stdout, for that failure.
+ *
+ * The order follows what OPA does while loading a signed bundle: it reads the
+ * key and algorithm, checks the JWT against the key, compares the scope claim,
+ * then reads every file. A Rego file is hashed as written, so its digest is
+ * compared before it is parsed. A data file or `.manifest` is hashed by parsed
+ * value, so one that no longer parses fails BEFORE its digest is compared;
+ * that is why an unparseable data file is `file_unparseable` (possibly
+ * modified) and not a load error of signed content. Rego parse errors come
+ * last, after the signature and every digest passed. Where messages overlap,
+ * the more specific rule is listed first.
+ */
+const FAILURE_RULES = [
+    {
+        reason: 'key_invalid',
+        pattern: KEY_OR_ALGORITHM_ERROR,
+        summary: 'the verification key or algorithm could not be used',
+        hint: 'verificationKey must be a PEM public key, and signingAlg one OPA supports. For an HMAC-signed bundle pass signingAlg (HS256, HS384 or HS512) so the file is read as the secret rather than as PEM.',
+    },
+    {
+        reason: 'not_a_bundle',
+        pattern: /archive read failed|bundle read failed/i,
+        summary: 'the path is not a bundle directory or a .tar.gz archive',
+    },
+    {
+        reason: 'signature_invalid',
+        pattern: /failed to verify JWT signature|verification error/i,
+        summary: 'the signature does not verify with this key',
+        hint: 'Check the key and pass signingAlg matching how the bundle was signed. OPA verifies against the single key given regardless of the signature keyid claim, so this is the key or the algorithm, not the key id.',
+    },
+    {
+        reason: 'scope_mismatch',
+        pattern: /scope mismatch/i,
+        summary: 'the scope given does not match the scope claim in the signature',
+        hint: 'Pass scope with exactly the value the bundle was signed with, and no scope if it was signed without one.',
+    },
+    {
+        reason: 'file_modified',
+        pattern: /digest mismatch/i,
+        summary: 'a signed file was modified after signing',
+    },
+    {
+        reason: 'file_missing',
+        pattern: /specified in bundle signatures but not found/i,
+        summary: 'a file the signature covers is missing from the bundle',
+    },
+    {
+        reason: 'file_added',
+        pattern: /not included in bundle signature/i,
+        summary: 'the bundle contains a file the signature does not cover',
+        hint: 'A directory signature names files under the directory name given to opa, so this is also what a directory reports when verified under a different name than it was signed with. Moving it elsewhere under the same name is fine; renaming it is not. For an artifact that survives renaming, build a signed archive with opa_bundle_build.',
+    },
+    {
+        reason: 'unsigned',
+        pattern: /missing \.signatures\.json/i,
+        summary: 'the bundle has no .signatures.json',
+    },
+    {
+        reason: 'signatures_malformed',
+        pattern: /signatures decode|missing JWT|base64 decode JWT|split compact JWT|unexpected end of JSON input|\.signatures\.json/i,
+        summary: '.signatures.json is not a valid signature file',
+    },
+    {
+        reason: 'file_unparseable',
+        pattern: /yaml:/i,
+        summary: 'a data file or .manifest could not be parsed, so its digest was never compared',
+        hint: 'OPA hashes data files by parsed value and stops at the first one it cannot parse, before comparing digests. The file may have been modified after signing. Restore it, or fix it and sign again.',
+    },
+    {
+        reason: 'bundle_load_error',
+        pattern: /rego_\w+_error|errors? occurred|manifest roots/i,
+        summary: 'the bundle could not be loaded, so verification did not complete',
+        hint: 'OPA parses Rego after the signature and every digest passed, so the policy is signed and unmodified but does not load under Rego v1. A policy written for Rego v0 verifies with v0Compatible.',
+    },
+    {
+        // A JWT payload that decodes but is not JSON: OPA prints only the JSON
+        // error, with none of the prefixes matched above.
+        reason: 'signatures_malformed',
+        pattern: /invalid character/i,
+        summary: '.signatures.json is not a valid signature file',
+    },
+];
+/** Classify OPA's stdout+stderr from a failed verification. */
+export function classifyVerificationFailure(output) {
+    for (const rule of FAILURE_RULES) {
+        if (rule.pattern.test(output)) {
+            const { pattern: _pattern, ...failure } = rule;
+            return failure;
+        }
+    }
+    return {
+        reason: 'unknown',
+        summary: 'OPA rejected the bundle for a reason this tool does not recognise',
+    };
+}
+//# sourceMappingURL=bundle-signatures.js.map

package/dist/lib/bundle-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-signatures.js","sourceRoot":"","sources":["../../src/lib/bundle-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAW5C,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAsB,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAIpD,CAAC;IACF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAErF,MAAM,OAAO,GAAsB;QACjC,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;KAClC,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACrE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACrE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,wDAAwD,CAAC;AAExF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAsBD;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAA6D;IAC9E;QACE,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,qDAAqD;QAC9D,IAAI,EAAE,oMAAoM;KAC3M;IACD;QACE,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,yCAAyC;QAClD,OAAO,EAAE,yDAAyD;KACnE;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,oDAAoD;QAC7D,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,+MAA+M;KACtN;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,iEAAiE;QAC1E,IAAI,EAAE,0GAA0G;KACjH;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,0CAA0C;KACpD;IACD;QACE,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,4UAA4U;KACnV;IACD;QACE,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EACL,oHAAoH;QACtH,OAAO,EAAE,gDAAgD;KAC1D;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,gFAAgF;QACzF,IAAI,EAAE,kMAAkM;KACzM;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,kEAAkE;QAC3E,IAAI,EAAE,+LAA+L;KACtM;IACD;QACE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EAAE,gDAAgD;KAC1D;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,mEAAmE;KAC7E,CAAC;AACJ,CAAC"}

package/dist/lib/child-env.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Builds the environment handed to `opa`, `regal` and `conftest`.
+ *
+ * Rego can read its interpreter's environment: `opa.runtime().env` returns the
+ * whole thing. So every variable this server passes down is readable by any
+ * policy it evaluates, and `rego_eval` takes inline source -- no filesystem
+ * access, so `OPA_MCP_ALLOWED_PATHS` never applies. Untrusted Rego reaches an
+ * agent through a README, an issue, or a pull request diff, which makes a
+ * pass-through of `process.env` a prompt injection away from handing over
+ * `OPA_TOKEN`, the `GITHUB_TOKEN` this project's own README asks users to put in
+ * their client config, and whatever else the operator's shell happens to hold.
+ *
+ * So the child gets an explicit allow-list instead. It holds no cloud or
+ * repository token, which is what motivated the list, but it is not free of
+ * credentials: a proxy URL can embed one, and `HTTP_PROXY` and its siblings are
+ * on the list because dropping them breaks every user behind a corporate proxy.
+ * An operator who would rather lose proxy support than expose those credentials
+ * to evaluated policy can name them in `OPA_MCP_BLOCK_ENV`.
+ *
+ * Measured against the bundled OPA 1.19.0, `version`, `eval`, `check`, `test`
+ * and `build` all succeed with a completely empty environment, so the entries
+ * below exist for correctness in real-world setups (proxies, custom CA bundles,
+ * tool config discovery), not to make the binaries run.
+ *
+ * Operators who genuinely need a variable in policy can name it in
+ * `OPA_MCP_PASSTHROUGH_ENV`, which is opt-in precisely because it undoes this.
+ */
+/**
+ * Build the child environment: the allow-list, plus any opted-in passthrough,
+ * plus `extra` from the caller (which wins, since it is explicit intent).
+ *
+ * @param extra   Variables the calling command needs. Readable by evaluated
+ *                policy like everything else here, so pass secrets only when the
+ *                command actually requires them. `OPA_MCP_BLOCK_ENV` removes a
+ *                name even when it appears here.
+ * @param source  Environment to read from. Injectable for testing.
+ */
+export declare function buildChildEnv(extra?: Record<string, string>, source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Exposed for tests and for documenting the surface. */
+export declare const ALLOWED_CHILD_ENV_VARS: readonly string[];
+//# sourceMappingURL=child-env.d.ts.map

package/dist/lib/child-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA0HH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CAyBnB;AAED,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAY,CAAC"}

package/dist/lib/child-env.js

@@ -0,0 +1,176 @@
+/**
+ * Builds the environment handed to `opa`, `regal` and `conftest`.
+ *
+ * Rego can read its interpreter's environment: `opa.runtime().env` returns the
+ * whole thing. So every variable this server passes down is readable by any
+ * policy it evaluates, and `rego_eval` takes inline source -- no filesystem
+ * access, so `OPA_MCP_ALLOWED_PATHS` never applies. Untrusted Rego reaches an
+ * agent through a README, an issue, or a pull request diff, which makes a
+ * pass-through of `process.env` a prompt injection away from handing over
+ * `OPA_TOKEN`, the `GITHUB_TOKEN` this project's own README asks users to put in
+ * their client config, and whatever else the operator's shell happens to hold.
+ *
+ * So the child gets an explicit allow-list instead. It holds no cloud or
+ * repository token, which is what motivated the list, but it is not free of
+ * credentials: a proxy URL can embed one, and `HTTP_PROXY` and its siblings are
+ * on the list because dropping them breaks every user behind a corporate proxy.
+ * An operator who would rather lose proxy support than expose those credentials
+ * to evaluated policy can name them in `OPA_MCP_BLOCK_ENV`.
+ *
+ * Measured against the bundled OPA 1.19.0, `version`, `eval`, `check`, `test`
+ * and `build` all succeed with a completely empty environment, so the entries
+ * below exist for correctness in real-world setups (proxies, custom CA bundles,
+ * tool config discovery), not to make the binaries run.
+ *
+ * Operators who genuinely need a variable in policy can name it in
+ * `OPA_MCP_PASSTHROUGH_ENV`, which is opt-in precisely because it undoes this.
+ */
+/** Vars every platform benefits from. Locale keeps output formatting stable. */
+const COMMON = ['PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_NUMERIC', 'TZ'];
+/** POSIX home and temp. Regal and Conftest look under HOME for config. */
+const POSIX = ['HOME', 'TMPDIR', 'SHELL', 'USER', 'LOGNAME'];
+/**
+ * Windows equivalents. A Go binary starts without these, but process creation
+ * and temp-file handling are better behaved with them present.
+ */
+const WINDOWS = [
+    'PATHEXT',
+    'SystemRoot',
+    'SystemDrive',
+    'COMSPEC',
+    'windir',
+    'TEMP',
+    'TMP',
+    'USERPROFILE',
+    'HOMEDRIVE',
+    'HOMEPATH',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'PROCESSOR_ARCHITECTURE',
+    'NUMBER_OF_PROCESSORS',
+];
+/**
+ * Proxy and TLS trust. Without these, `http.send`, bundle downloads and remote
+ * schema fetches fail behind a corporate proxy or a custom CA.
+ *
+ * A proxy URL can embed credentials, so these are the least inert entries here.
+ * They are included because breaking every corporate user is the worse trade,
+ * and they are the operator's own infrastructure credentials rather than the
+ * cloud and repository tokens that motivated this module.
+ */
+const NETWORK = [
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'ALL_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+    'all_proxy',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+];
+/**
+ * Where the tools look for their own config and credentials. These name file
+ * locations; they are not themselves secrets. Conftest reads registry auth from
+ * the Docker config file, so `conftest_pull` and `conftest_push` need these.
+ */
+const TOOL_CONFIG = [
+    'XDG_CONFIG_HOME',
+    'XDG_CACHE_HOME',
+    'XDG_DATA_HOME',
+    'DOCKER_CONFIG',
+    'REGISTRY_AUTH_FILE',
+];
+const ALLOWED = [...COMMON, ...POSIX, ...WINDOWS, ...NETWORK, ...TOOL_CONFIG];
+/** Split a comma or semicolon separated list of variable names. */
+function nameList(raw) {
+    if (!raw)
+        return [];
+    return raw
+        .split(/[;,]/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+/** Names an operator opted into via OPA_MCP_PASSTHROUGH_ENV. */
+function passthroughNames(source) {
+    return nameList(source['OPA_MCP_PASSTHROUGH_ENV']);
+}
+/**
+ * Names an operator withheld via OPA_MCP_BLOCK_ENV.
+ *
+ * Applied last, so it overrides the allow-list, the passthrough list and the
+ * caller's own `extra`. The point is to be able to say no to something this
+ * module would otherwise hand down, and a rule that could be overridden by the
+ * thing it is meant to restrain would not be worth having.
+ */
+function blockedNames(source) {
+    return nameList(source['OPA_MCP_BLOCK_ENV']);
+}
+/**
+ * Windows treats variable names case-insensitively, and the casing in
+ * `process.env` follows whatever the parent used, so an exact-key lookup would
+ * silently miss `Path` where the list says `PATH`.
+ */
+function lookup(source, name) {
+    const direct = source[name];
+    if (direct !== undefined)
+        return direct;
+    if (process.platform !== 'win32')
+        return undefined;
+    const wanted = name.toLowerCase();
+    for (const key of Object.keys(source)) {
+        if (key.toLowerCase() === wanted)
+            return source[key];
+    }
+    return undefined;
+}
+/**
+ * Windows-only identity variables that libuv copies from the parent no matter
+ * what environment is requested -- spawning with `{}` still delivers them, and
+ * measurably so. They are not secrets, but they name the operating-system user,
+ * the Windows domain and the domain controller, which is more than an untrusted
+ * policy needs to know about the machine evaluating it.
+ *
+ * They cannot be removed, only overwritten, so they are blanked. None of the
+ * three binaries reads them: every representative `opa` command succeeds with a
+ * completely empty environment on both platforms.
+ */
+const WINDOWS_IDENTITY_TO_BLANK = ['USERNAME', 'USERDOMAIN', 'LOGONSERVER'];
+/**
+ * Build the child environment: the allow-list, plus any opted-in passthrough,
+ * plus `extra` from the caller (which wins, since it is explicit intent).
+ *
+ * @param extra   Variables the calling command needs. Readable by evaluated
+ *                policy like everything else here, so pass secrets only when the
+ *                command actually requires them. `OPA_MCP_BLOCK_ENV` removes a
+ *                name even when it appears here.
+ * @param source  Environment to read from. Injectable for testing.
+ */
+export function buildChildEnv(extra, source = process.env) {
+    const env = {};
+    if (process.platform === 'win32') {
+        for (const name of WINDOWS_IDENTITY_TO_BLANK)
+            env[name] = '';
+    }
+    for (const name of [...ALLOWED, ...passthroughNames(source)]) {
+        const value = lookup(source, name);
+        if (value !== undefined)
+            env[name] = value;
+    }
+    const result = extra ? { ...env, ...extra } : env;
+    for (const name of blockedNames(source)) {
+        delete result[name];
+        if (process.platform === 'win32') {
+            const wanted = name.toLowerCase();
+            for (const key of Object.keys(result)) {
+                if (key.toLowerCase() === wanted)
+                    delete result[key];
+            }
+        }
+    }
+    return result;
+}
+/** Exposed for tests and for documenting the surface. */
+export const ALLOWED_CHILD_ENV_VARS = ALLOWED;
+//# sourceMappingURL=child-env.js.map

package/dist/lib/child-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,gFAAgF;AAChF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,GAAG;IACd,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,QAAQ;IACR,MAAM;IACN,KAAK;IACL,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,cAAc;IACd,wBAAwB;IACxB,sBAAsB;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG;IACd,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,eAAe;IACf,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,oBAAoB;CACrB,CAAC;AAEF,MAAM,OAAO,GAAsB,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;AAEjG,mEAAmE;AACnE,SAAS,QAAQ,CAAC,GAAuB;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,MAAyB;IACjD,OAAO,QAAQ,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,MAAyB;IAC7C,OAAO,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAyB,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA8B,EAC9B,SAA4B,OAAO,CAAC,GAAG;IAEvC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,yBAAyB;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAElD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;oBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAsB,OAAO,CAAC"}