@praxis.guard/auditor-cli 0.0.47 → 0.0.49
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/adapters/claude-desktop.d.ts.map +1 -1
- package/dist/adapters/claude-desktop.js +14 -2
- package/dist/adapters/claude-desktop.js.map +1 -1
- package/dist/cli/doctor.d.ts +22 -0
- package/dist/cli/doctor.d.ts.map +1 -1
- package/dist/cli/doctor.js +21 -4
- package/dist/cli/doctor.js.map +1 -1
- package/dist/mcp/guard-schemas.d.ts.map +1 -1
- package/dist/mcp/guard-schemas.js +13 -7
- package/dist/mcp/guard-schemas.js.map +1 -1
- package/dist/telemetry/guard-events.d.ts.map +1 -1
- package/dist/telemetry/guard-events.js +5 -1
- package/dist/telemetry/guard-events.js.map +1 -1
- package/dist/telemetry/redact-guard-event.d.ts +36 -0
- package/dist/telemetry/redact-guard-event.d.ts.map +1 -0
- package/dist/telemetry/redact-guard-event.js +146 -0
- package/dist/telemetry/redact-guard-event.js.map +1 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claude-desktop.d.ts","sourceRoot":"","sources":["../../src/adapters/claude-desktop.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACd,MAAM,YAAY,CAAC;AAOpB;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAchD;AAyCD;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,QAAQ,CAAC,EAAE,EAAG,gBAAgB,CAAU;IACxC,QAAQ,CAAC,KAAK,oBAAoB;IAElC,eAAe,IAAI,OAAO;IAQpB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IA4CpD,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"claude-desktop.d.ts","sourceRoot":"","sources":["../../src/adapters/claude-desktop.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACd,MAAM,YAAY,CAAC;AAOpB;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAchD;AAyCD;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,QAAQ,CAAC,EAAE,EAAG,gBAAgB,CAAU;IACxC,QAAQ,CAAC,KAAK,oBAAoB;IAElC,eAAe,IAAI,OAAO;IAQpB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IA4CpD,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;CAqBtD"}
|
|
@@ -123,10 +123,22 @@ export class ClaudeDesktopAdapter {
|
|
|
123
123
|
async status(opts) {
|
|
124
124
|
const cfgPath = opts?.mcpConfigPath?.trim() || claudeDesktopConfigPath();
|
|
125
125
|
const config = await readJson(cfgPath).catch(() => null);
|
|
126
|
+
const mcpConfigured = hasConfiguredMcpServer(config);
|
|
127
|
+
// Claude Desktop is MCP-only: it has no pre-tool hook API, so guard is advisory.
|
|
128
|
+
// The model must choose to call it; nothing forces it, and commands routed through
|
|
129
|
+
// other connectors are never seen. Surface this so "configured" is not read as
|
|
130
|
+
// "enforced". Hard enforcement is planned via the MCP gateway (see TODOS.md).
|
|
131
|
+
const warnings = mcpConfigured
|
|
132
|
+
? [
|
|
133
|
+
"Claude Desktop is MCP-only: guard is advisory. The model must choose to call it; " +
|
|
134
|
+
"there is no enforced pre-tool hook. Treat as monitoring, not a hard gate. " +
|
|
135
|
+
"Hard enforcement is planned via the MCP gateway.",
|
|
136
|
+
]
|
|
137
|
+
: [];
|
|
126
138
|
return {
|
|
127
139
|
installed: this.detectInstalled(),
|
|
128
|
-
mcp: { configured:
|
|
129
|
-
warnings
|
|
140
|
+
mcp: { configured: mcpConfigured, path: cfgPath },
|
|
141
|
+
warnings,
|
|
130
142
|
};
|
|
131
143
|
}
|
|
132
144
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claude-desktop.js","sourceRoot":"","sources":["../../src/adapters/claude-desktop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAIpC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QACnG,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QACzH;YACE,gFAAgF;YAChF,uEAAuE;YACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAiB,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb;YACE,mBAAmB,QAAQ,KAAK,GAAG,EAAE;YACrC,sCAAsC;YACtC,6DAA6D;SAC9D,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAa;IACtD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAsB;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAY,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,MAAiB,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,OAAQ,GAAe,CAAC,iBAAiB,KAAK,UAAU,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACtB,EAAE,GAAG,gBAAyB,CAAC;IAC/B,KAAK,GAAG,gBAAgB,CAAC;IAElC,eAAe;QACb,8EAA8E;QAC9E,qFAAqF;QACrF,MAAM,GAAG,GAAG,uBAAuB,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAmB;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAY,QAAQ;YAC9B,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAa;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAqB,CAAC;QAC7C,MAAM,aAAa,GACjB,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ;YACpE,CAAC,CAAE,OAAO,CAAC,cAAc,CAAa;YACtC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,WAAW,GACf,aAAa,CAAC,GAAG,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC;YAC7F,CAAC,CAAE,aAAa,CAAC,GAAe;YAChC,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,GAAG;YACxB,GAAG,aAAa;YAChB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,GAAG,EAAE,EAAE,GAAG,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE;SACvD,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO;YACP,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,wCAAwC;oBAC1C,CAAC,CAAC,mCAAmC;gBACvC,CAAC,CAAC,8CAA8C;SACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB;QAC5B,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;YACjC,GAAG,EAAE,EAAE,UAAU,EAAE,
|
|
1
|
+
{"version":3,"file":"claude-desktop.js","sourceRoot":"","sources":["../../src/adapters/claude-desktop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAIpC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QACnG,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QACzH;YACE,gFAAgF;YAChF,uEAAuE;YACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAiB,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb;YACE,mBAAmB,QAAQ,KAAK,GAAG,EAAE;YACrC,sCAAsC;YACtC,6DAA6D;SAC9D,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAa;IACtD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAsB;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAY,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,MAAiB,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,OAAQ,GAAe,CAAC,iBAAiB,KAAK,UAAU,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACtB,EAAE,GAAG,gBAAyB,CAAC;IAC/B,KAAK,GAAG,gBAAgB,CAAC;IAElC,eAAe;QACb,8EAA8E;QAC9E,qFAAqF;QACrF,MAAM,GAAG,GAAG,uBAAuB,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAmB;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAY,QAAQ;YAC9B,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAa;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAqB,CAAC;QAC7C,MAAM,aAAa,GACjB,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ;YACpE,CAAC,CAAE,OAAO,CAAC,cAAc,CAAa;YACtC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,WAAW,GACf,aAAa,CAAC,GAAG,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC;YAC7F,CAAC,CAAE,aAAa,CAAC,GAAe;YAChC,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,GAAG;YACxB,GAAG,aAAa;YAChB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,GAAG,EAAE,EAAE,GAAG,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE;SACvD,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO;YACP,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,wCAAwC;oBAC1C,CAAC,CAAC,mCAAmC;gBACvC,CAAC,CAAC,8CAA8C;SACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB;QAC5B,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACrD,iFAAiF;QACjF,mFAAmF;QACnF,+EAA+E;QAC/E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,aAAa;YAC5B,CAAC,CAAC;gBACE,mFAAmF;oBACjF,4EAA4E;oBAC5E,kDAAkD;aACrD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;YACjC,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE;YACjD,QAAQ;SACT,CAAC;IACJ,CAAC;CACF"}
|
package/dist/cli/doctor.d.ts
CHANGED
|
@@ -1,2 +1,24 @@
|
|
|
1
|
+
import type { AgentAdapter, AgentStatus } from "../adapters/types.js";
|
|
2
|
+
export type Readiness = {
|
|
3
|
+
ready: boolean;
|
|
4
|
+
readySetup: boolean;
|
|
5
|
+
enforced: boolean;
|
|
6
|
+
};
|
|
7
|
+
/**
|
|
8
|
+
* Compute doctor readiness from adapter statuses + auth.
|
|
9
|
+
*
|
|
10
|
+
* readySetup : at least one adapter has every declared surface configured.
|
|
11
|
+
* enforced : at least one READY adapter declares a pre-tool hook (Cursor /
|
|
12
|
+
* Claude Code / Codex). adapterReady already requires that hook to
|
|
13
|
+
* be configured, so a ready hook-adapter is genuinely enforcing.
|
|
14
|
+
* If the only ready adapters lack upsertHook (Claude Desktop is
|
|
15
|
+
* MCP-only), governance is advisory: the model must choose to call
|
|
16
|
+
* guard and can be bypassed.
|
|
17
|
+
* ready : readySetup AND authenticated.
|
|
18
|
+
*/
|
|
19
|
+
export declare function resolveReadiness(adapterStatuses: {
|
|
20
|
+
adapter: AgentAdapter;
|
|
21
|
+
status: AgentStatus;
|
|
22
|
+
}[], hasAuth: boolean): Readiness;
|
|
1
23
|
export declare function runDoctor(): Promise<void>;
|
|
2
24
|
//# sourceMappingURL=doctor.d.ts.map
|
package/dist/cli/doctor.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAUtE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,EAAE,EACjE,OAAO,EAAE,OAAO,GACf,SAAS,CAOX;AA2DD,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAiG/C"}
|
package/dist/cli/doctor.js
CHANGED
|
@@ -10,6 +10,24 @@ import { credentialsPath, readCredentialsFileMode, resolveGuardToken } from "./c
|
|
|
10
10
|
import { getInstallId } from "./install-id.js";
|
|
11
11
|
import { functionsHttpUrl } from "./policies-callable-url.js";
|
|
12
12
|
import { readPoliciesMetaFile } from "./policies-meta.js";
|
|
13
|
+
/**
|
|
14
|
+
* Compute doctor readiness from adapter statuses + auth.
|
|
15
|
+
*
|
|
16
|
+
* readySetup : at least one adapter has every declared surface configured.
|
|
17
|
+
* enforced : at least one READY adapter declares a pre-tool hook (Cursor /
|
|
18
|
+
* Claude Code / Codex). adapterReady already requires that hook to
|
|
19
|
+
* be configured, so a ready hook-adapter is genuinely enforcing.
|
|
20
|
+
* If the only ready adapters lack upsertHook (Claude Desktop is
|
|
21
|
+
* MCP-only), governance is advisory: the model must choose to call
|
|
22
|
+
* guard and can be bypassed.
|
|
23
|
+
* ready : readySetup AND authenticated.
|
|
24
|
+
*/
|
|
25
|
+
export function resolveReadiness(adapterStatuses, hasAuth) {
|
|
26
|
+
const readyAdapters = adapterStatuses.filter(({ adapter, status }) => adapterReady(adapter, status));
|
|
27
|
+
const readySetup = readyAdapters.length > 0;
|
|
28
|
+
const enforced = readyAdapters.some(({ adapter }) => typeof adapter.upsertHook === "function");
|
|
29
|
+
return { ready: readySetup && hasAuth, readySetup, enforced };
|
|
30
|
+
}
|
|
13
31
|
function adapterReady(adapter, status) {
|
|
14
32
|
// For an adapter to count as "ready", every surface it declares MUST be configured.
|
|
15
33
|
// Cursor (hook + mcp + cloud) requires all three; Claude Desktop (mcp only) just needs MCP.
|
|
@@ -131,11 +149,10 @@ export async function runDoctor() {
|
|
|
131
149
|
else {
|
|
132
150
|
lines.push("Remote revision: (skip — not authenticated; run `auditor login`)");
|
|
133
151
|
}
|
|
134
|
-
// "Ready" = at least one adapter has all its declared surfaces configured.
|
|
135
|
-
const readySetup = adapterStatuses.some(({ adapter, status }) => adapterReady(adapter, status));
|
|
136
152
|
const readyAuth = !!token;
|
|
137
|
-
const ready =
|
|
138
|
-
|
|
153
|
+
const { ready, readySetup, enforced } = resolveReadiness(adapterStatuses, readyAuth);
|
|
154
|
+
const modeSuffix = ready ? (enforced ? " (enforced)" : " (advisory only)") : "";
|
|
155
|
+
lines.push(`Ready: ${ready ? "yes" : "no"}${modeSuffix} (setup=${readySetup ? "ok" : "missing"}, auth=${readyAuth ? "ok" : "missing"})`);
|
|
139
156
|
process.stdout.write(`${lines.join("\n")}\n`);
|
|
140
157
|
}
|
|
141
158
|
//# sourceMappingURL=doctor.js.map
|
package/dist/cli/doctor.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAI1D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,eAAiE,EACjE,OAAgB;IAEhB,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CACnE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAC9B,CAAC;IACF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC/F,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB,EAAE,MAAmB;IAC9D,oFAAoF;IACpF,4FAA4F;IAC5F,MAAM,UAAU,GACd,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;IACxF,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAe,EACf,OAAqB,EACrB,MAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;QAC1C,IAAI,WAAW,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC;YACnD,KAAK,CAAC,IAAI,CACR,sBAAsB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sCAAsC,KAAK,WAAW,CAAC,IAAI,GAAG,CAC5G,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,WAAW,CAAC,UAAU,IAAI,aAAa,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,WAAW,CAAC,QAAQ,IAAI,WAAW,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAC5K,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC;YACrD,KAAK,CAAC,IAAI,CACR,uBAAuB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gDAAgD,KAAK,YAAY,CAAC,IAAI,GAAG,CACxH,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,YAAY,CAAC,UAAU,IAAI,aAAa,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,CAAC,QAAQ,IAAI,WAAW,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAChL,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qCAAqC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC9F,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,wBAAwB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC9D,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,mBAAmB;YACpC,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,qDAAqD,CAAC;IAE9D,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,eAAe,YAAY,EAAE,EAAE;QAC/B,sEAAsE;QACtE,SAAS,OAAO,CAAC,OAAO,EAAE;QAC1B,gBAAgB,UAAU,EAAE;QAC5B,kBAAkB,YAAY,EAAE;QAChC,kBAAkB,QAAQ,EAAE;QAC5B,IAAI;YACF,CAAC,CAAC,4BAA4B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,uEAAuE;QAC3E,eAAe,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE;QACnD,cAAc,SAAS,EAAE;QACzB,2BAA2B,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,EAAE;KAC5F,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,eAAe,GAAqD,EAAE,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACxD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,QAAQ,eAAe,EAAE,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,CAAC,IAAI,CACR,WAAW;QACT,CAAC,CAAC,SAAS,WAAW,YAAY,KAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACF,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,KAAK;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IAEpE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAuB;gBAChD,GAAG,EAAE,eAAe;gBACpB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACtB,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,qCAAqC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,CAC/E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,wBAAwB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,KAAK,CAAC,IAAI,CACR,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,UAAU,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAC7H,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-schemas.d.ts","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;EAAgC,CAAC;AAC7D,eAAO,MAAM,kBAAkB;;;EAA2B,CAAC;AAS3D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,sBAAsB,
|
|
1
|
+
{"version":3,"file":"guard-schemas.d.ts","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;EAAgC,CAAC;AAC7D,eAAO,MAAM,kBAAkB;;;EAA2B,CAAC;AAS3D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,sBAAsB,QAQwD,CAAC;AAE5F,eAAO,MAAM,2BAA2B,QAKmE,CAAC"}
|
|
@@ -29,11 +29,17 @@ export const GuardInputSchema = z.object({
|
|
|
29
29
|
})
|
|
30
30
|
.optional(),
|
|
31
31
|
});
|
|
32
|
-
export const GUARD_TOOL_DESCRIPTION = "
|
|
33
|
-
"
|
|
34
|
-
"
|
|
35
|
-
"
|
|
36
|
-
|
|
37
|
-
"
|
|
38
|
-
"
|
|
32
|
+
export const GUARD_TOOL_DESCRIPTION = "Praxis policy gatekeeper. Call this BEFORE you run any shell command or state-changing " +
|
|
33
|
+
"action on the user's behalf, including actions you would run via other tools or connectors. " +
|
|
34
|
+
"Pass the exact `argv` you intend to run with `mode: \"enforce\"`. Then obey the response: " +
|
|
35
|
+
"if `decision` is `block`, do NOT run the command; if `require_approval`, call `guard_wait` " +
|
|
36
|
+
"and wait for it to resolve; only proceed when `decision` is `allow`. " +
|
|
37
|
+
"(`mode: \"shadow\"` is a dry-run whose `decision` is always `allow`; the real verdict is in the " +
|
|
38
|
+
"`shadow` field. Use `enforce` for actual gating.) " +
|
|
39
|
+
"For a MUTATE after approval, pass `context.approval.request_id` (and optional `grant`).";
|
|
40
|
+
export const GUARD_WAIT_TOOL_DESCRIPTION = "Wait for a MUTATE approval, redeem the grant, and record a signed execution ticket. Uses enforce " +
|
|
41
|
+
"semantics. When `guard` returns `require_approval`, you MUST call `guard_wait` (not `guard` again) " +
|
|
42
|
+
"with the same `proposal`, `context.wait_ms` (e.g. 120000), and `context.approval.request_id` from " +
|
|
43
|
+
"the response. If it returns `require_approval`, call `guard_wait` again until it resolves. Direct the " +
|
|
44
|
+
"human to `approval.open_url` when shown. Do not run the command until `guard_wait` resolves to `allow`.";
|
|
39
45
|
//# sourceMappingURL=guard-schemas.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-schemas.js","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IACF,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GACjC,
|
|
1
|
+
{"version":3,"file":"guard-schemas.js","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IACF,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GACjC,yFAAyF;IACzF,8FAA8F;IAC9F,4FAA4F;IAC5F,6FAA6F;IAC7F,uEAAuE;IACvE,kGAAkG;IAClG,oDAAoD;IACpD,yFAAyF,CAAC;AAE5F,MAAM,CAAC,MAAM,2BAA2B,GACtC,mGAAmG;IACnG,qGAAqG;IACrG,oGAAoG;IACpG,wGAAwG;IACxG,yGAAyG,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-events.d.ts","sourceRoot":"","sources":["../../src/telemetry/guard-events.ts"],"names":[],"mappings":"AAAA,KAAK,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"guard-events.d.ts","sourceRoot":"","sources":["../../src/telemetry/guard-events.ts"],"names":[],"mappings":"AAAA,KAAK,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA2BjD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuE9E"}
|
|
@@ -4,6 +4,7 @@ import { getInstallId } from "../cli/install-id.js";
|
|
|
4
4
|
import { prodFunctionUrl } from "../cli/function-url.js";
|
|
5
5
|
import { AUDITOR_CLI_VERSION } from "../runtime/version.js";
|
|
6
6
|
import { resolveAgentHost } from "./agent-host.js";
|
|
7
|
+
import { redactGuardEventPayload } from "./redact-guard-event.js";
|
|
7
8
|
function getGuardEventUrl() {
|
|
8
9
|
if (process.env.PRAXIS_GUARD_EVENT_URL)
|
|
9
10
|
return process.env.PRAXIS_GUARD_EVENT_URL;
|
|
@@ -54,8 +55,11 @@ export async function sendGuardEvent(payload) {
|
|
|
54
55
|
const installId = typeof payload.installId === "string" && payload.installId.trim().length > 0
|
|
55
56
|
? payload.installId.trim()
|
|
56
57
|
: getInstallId();
|
|
58
|
+
// Redact secret-bearing fields at the egress boundary (single chokepoint for
|
|
59
|
+
// all callers). Omits on skip events, best-effort scrubs on governed events.
|
|
60
|
+
const redacted = redactGuardEventPayload(payload);
|
|
57
61
|
const body = {
|
|
58
|
-
...
|
|
62
|
+
...redacted,
|
|
59
63
|
installId,
|
|
60
64
|
agent: typeof payload.agent === "string" ? payload.agent : resolveAgentHost(),
|
|
61
65
|
version: AUDITOR_CLI_VERSION,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-events.js","sourceRoot":"","sources":["../../src/telemetry/guard-events.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"guard-events.js","sourceRoot":"","sources":["../../src/telemetry/guard-events.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,SAAS,gBAAgB;IACvB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAClF,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC5D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/E,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,uBAAuB,CAAC,IAA6B;IAC5D,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,IAAI,CAAC;QACH,cAAc,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA0B;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,uBAAuB,CAAC;YACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,oBAAoB;YAC3B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,uBAAuB,CAAC;YACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;SAC3C,CAAC,CAAC;QAEH,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC1E,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE;YAC1B,CAAC,CAAC,YAAY,EAAE,CAAC;QACrB,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG;YACX,GAAG,QAAQ;YACX,SAAS;YACT,KAAK,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,EAAE;YAC7E,OAAO,EAAE,mBAAmB;SAC7B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;QAC3E,CAAC;QAED,uBAAuB,CAAC;YACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,UAAU;YACjB,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;QAC/D,uBAAuB,CAAC;YACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,OAAO;YACd,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Egress redaction for guard telemetry.
|
|
3
|
+
*
|
|
4
|
+
* Every guard event funnels through `sendGuardEvent` (the single network sink).
|
|
5
|
+
* Command lines and tool inputs can carry secrets (Authorization headers,
|
|
6
|
+
* exported tokens, connection strings). This is a security product, so customer
|
|
7
|
+
* secrets must not be exfiltrated into our own telemetry pipeline.
|
|
8
|
+
*
|
|
9
|
+
* Two modes, keyed off the event's governance signal:
|
|
10
|
+
*
|
|
11
|
+
* ungoverned-skip event ──▶ OMIT the secret-bearing fields entirely
|
|
12
|
+
* (skipped===true || (we don't need them; omitting beats scrubbing)
|
|
13
|
+
* governed===false)
|
|
14
|
+
*
|
|
15
|
+
* governed event ──▶ best-effort SCRUB of known secret patterns
|
|
16
|
+
* (neither signal set: (keep the audit detail, minus the secrets)
|
|
17
|
+
* the governed shell/mcp
|
|
18
|
+
* hook senders set no
|
|
19
|
+
* skip signal, so the
|
|
20
|
+
* DEFAULT is scrub, not
|
|
21
|
+
* omit)
|
|
22
|
+
*
|
|
23
|
+
* This is best-effort scrubbing, NOT a secrets boundary. Pattern redaction
|
|
24
|
+
* misses positional secrets (`mysql -u root hunter2`), base64 blobs, custom
|
|
25
|
+
* `--header` values, heredocs, and env-substituted values. Defense-in-depth.
|
|
26
|
+
*
|
|
27
|
+
* Never throws: telemetry must not break guard. Any internal error degrades to
|
|
28
|
+
* dropping the risky fields rather than sending them raw.
|
|
29
|
+
*/
|
|
30
|
+
/**
|
|
31
|
+
* Return a copy of the payload with secret-bearing fields omitted (skip events)
|
|
32
|
+
* or scrubbed (governed events). Never throws; on internal error, drops the
|
|
33
|
+
* secret fields so nothing raw escapes.
|
|
34
|
+
*/
|
|
35
|
+
export declare function redactGuardEventPayload(payload: Record<string, unknown>): Record<string, unknown>;
|
|
36
|
+
//# sourceMappingURL=redact-guard-event.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"redact-guard-event.d.ts","sourceRoot":"","sources":["../../src/telemetry/redact-guard-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA8FH;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBzB"}
|
|
@@ -0,0 +1,146 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Egress redaction for guard telemetry.
|
|
3
|
+
*
|
|
4
|
+
* Every guard event funnels through `sendGuardEvent` (the single network sink).
|
|
5
|
+
* Command lines and tool inputs can carry secrets (Authorization headers,
|
|
6
|
+
* exported tokens, connection strings). This is a security product, so customer
|
|
7
|
+
* secrets must not be exfiltrated into our own telemetry pipeline.
|
|
8
|
+
*
|
|
9
|
+
* Two modes, keyed off the event's governance signal:
|
|
10
|
+
*
|
|
11
|
+
* ungoverned-skip event ──▶ OMIT the secret-bearing fields entirely
|
|
12
|
+
* (skipped===true || (we don't need them; omitting beats scrubbing)
|
|
13
|
+
* governed===false)
|
|
14
|
+
*
|
|
15
|
+
* governed event ──▶ best-effort SCRUB of known secret patterns
|
|
16
|
+
* (neither signal set: (keep the audit detail, minus the secrets)
|
|
17
|
+
* the governed shell/mcp
|
|
18
|
+
* hook senders set no
|
|
19
|
+
* skip signal, so the
|
|
20
|
+
* DEFAULT is scrub, not
|
|
21
|
+
* omit)
|
|
22
|
+
*
|
|
23
|
+
* This is best-effort scrubbing, NOT a secrets boundary. Pattern redaction
|
|
24
|
+
* misses positional secrets (`mysql -u root hunter2`), base64 blobs, custom
|
|
25
|
+
* `--header` values, heredocs, and env-substituted values. Defense-in-depth.
|
|
26
|
+
*
|
|
27
|
+
* Never throws: telemetry must not break guard. Any internal error degrades to
|
|
28
|
+
* dropping the risky fields rather than sending them raw.
|
|
29
|
+
*/
|
|
30
|
+
/** Fields that can carry secrets across the 8 sendGuardEvent callers. */
|
|
31
|
+
const SECRET_FIELDS = [
|
|
32
|
+
"cmd",
|
|
33
|
+
"argv",
|
|
34
|
+
"governed_argv",
|
|
35
|
+
"resource",
|
|
36
|
+
"tool_input",
|
|
37
|
+
"toolInputPreview",
|
|
38
|
+
];
|
|
39
|
+
/** Cap field size before regex to avoid catastrophic backtracking / huge payloads. */
|
|
40
|
+
const MAX_FIELD_LEN = 8192;
|
|
41
|
+
/** Bound recursion into nested tool_input objects. */
|
|
42
|
+
const MAX_DEPTH = 6;
|
|
43
|
+
/**
|
|
44
|
+
* Sensitive identifier matcher, used for two structured cases that inline string
|
|
45
|
+
* scrubbing cannot reach:
|
|
46
|
+
* - object keys: `{ GITHUB_TOKEN: "secret" }` (key and value are separate)
|
|
47
|
+
* - argv flags: `["--with-token", "ghp_..."]` (flag and value are separate elements)
|
|
48
|
+
* "key" only matches as a standalone word or _/- suffix so "monkey" / "keyboard" don't trip it.
|
|
49
|
+
*/
|
|
50
|
+
const SENSITIVE_KEY_RE = /(?:password|passwd|pwd|token|secret|credential|api[-_]?key|auth|(?:^|[_-])key)/i;
|
|
51
|
+
const SCRUB_PATTERNS = [
|
|
52
|
+
// Bearer / token auth headers
|
|
53
|
+
[/\bbearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]"],
|
|
54
|
+
// --password=x, --token x, --secret=x, --key x, --api-key x (flag + value)
|
|
55
|
+
[
|
|
56
|
+
/(--?(?:password|passwd|pwd|token|secret|api[-_]?key|key|auth)[=\s]+)(\S+)/gi,
|
|
57
|
+
"$1[REDACTED]",
|
|
58
|
+
],
|
|
59
|
+
// KEY=VALUE for sensitive-looking env keys
|
|
60
|
+
[
|
|
61
|
+
/\b([A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIAL)[A-Za-z0-9_]*)=(\S+)/g,
|
|
62
|
+
"$1=[REDACTED]",
|
|
63
|
+
],
|
|
64
|
+
// credentials embedded in a URL: scheme://user:pass@host
|
|
65
|
+
[/([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s@]+)(@)/gi, "$1[REDACTED]$3"],
|
|
66
|
+
];
|
|
67
|
+
function scrubString(value) {
|
|
68
|
+
let out = value.length > MAX_FIELD_LEN ? value.slice(0, MAX_FIELD_LEN) : value;
|
|
69
|
+
for (const [pattern, replacement] of SCRUB_PATTERNS) {
|
|
70
|
+
out = out.replace(pattern, replacement);
|
|
71
|
+
}
|
|
72
|
+
return out;
|
|
73
|
+
}
|
|
74
|
+
/** True for an argv element that names a secret (`--token`, `--with-token`, `--api-key`). */
|
|
75
|
+
function isSensitiveFlag(element) {
|
|
76
|
+
if (typeof element !== "string" || !element.startsWith("-"))
|
|
77
|
+
return false;
|
|
78
|
+
return SENSITIVE_KEY_RE.test(element.replace(/^--?/, ""));
|
|
79
|
+
}
|
|
80
|
+
/** Scrub an array: scrub each element, then redact the value AFTER a sensitive flag. */
|
|
81
|
+
function scrubArray(arr, depth) {
|
|
82
|
+
const out = arr.map((v) => scrubValue(v, depth + 1));
|
|
83
|
+
for (let i = 0; i < arr.length - 1; i++) {
|
|
84
|
+
if (isSensitiveFlag(arr[i]))
|
|
85
|
+
out[i + 1] = "[REDACTED]";
|
|
86
|
+
}
|
|
87
|
+
return out;
|
|
88
|
+
}
|
|
89
|
+
/**
|
|
90
|
+
* Recursively scrub string leaves of strings / arrays / plain objects.
|
|
91
|
+
* `keyHint` is the enclosing object key (if any): when it names a secret, the
|
|
92
|
+
* whole string value is replaced rather than pattern-scrubbed.
|
|
93
|
+
*/
|
|
94
|
+
function scrubValue(value, depth, keyHint) {
|
|
95
|
+
if (typeof value === "string") {
|
|
96
|
+
if (keyHint && SENSITIVE_KEY_RE.test(keyHint))
|
|
97
|
+
return "[REDACTED]";
|
|
98
|
+
return scrubString(value);
|
|
99
|
+
}
|
|
100
|
+
if (depth >= MAX_DEPTH)
|
|
101
|
+
return value;
|
|
102
|
+
if (Array.isArray(value))
|
|
103
|
+
return scrubArray(value, depth);
|
|
104
|
+
if (value && typeof value === "object") {
|
|
105
|
+
const out = {};
|
|
106
|
+
for (const [k, v] of Object.entries(value)) {
|
|
107
|
+
out[k] = scrubValue(v, depth + 1, k);
|
|
108
|
+
}
|
|
109
|
+
return out;
|
|
110
|
+
}
|
|
111
|
+
return value;
|
|
112
|
+
}
|
|
113
|
+
/** True when the event is an explicit ungoverned/skip event. */
|
|
114
|
+
function isUngovernedSkip(payload) {
|
|
115
|
+
return payload.skipped === true || payload.governed === false;
|
|
116
|
+
}
|
|
117
|
+
/**
|
|
118
|
+
* Return a copy of the payload with secret-bearing fields omitted (skip events)
|
|
119
|
+
* or scrubbed (governed events). Never throws; on internal error, drops the
|
|
120
|
+
* secret fields so nothing raw escapes.
|
|
121
|
+
*/
|
|
122
|
+
export function redactGuardEventPayload(payload) {
|
|
123
|
+
try {
|
|
124
|
+
const out = { ...payload };
|
|
125
|
+
const omit = isUngovernedSkip(payload);
|
|
126
|
+
for (const field of SECRET_FIELDS) {
|
|
127
|
+
if (!(field in out))
|
|
128
|
+
continue;
|
|
129
|
+
if (omit) {
|
|
130
|
+
delete out[field];
|
|
131
|
+
}
|
|
132
|
+
else {
|
|
133
|
+
out[field] = scrubValue(out[field], 0);
|
|
134
|
+
}
|
|
135
|
+
}
|
|
136
|
+
return out;
|
|
137
|
+
}
|
|
138
|
+
catch {
|
|
139
|
+
// Fail safe: never send raw secret fields if redaction itself failed.
|
|
140
|
+
const safe = { ...payload };
|
|
141
|
+
for (const field of SECRET_FIELDS)
|
|
142
|
+
delete safe[field];
|
|
143
|
+
return safe;
|
|
144
|
+
}
|
|
145
|
+
}
|
|
146
|
+
//# sourceMappingURL=redact-guard-event.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"redact-guard-event.js","sourceRoot":"","sources":["../../src/telemetry/redact-guard-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yEAAyE;AACzE,MAAM,aAAa,GAAG;IACpB,KAAK;IACL,MAAM;IACN,eAAe;IACf,UAAU;IACV,YAAY;IACZ,kBAAkB;CACV,CAAC;AAEX,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,sDAAsD;AACtD,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,gBAAgB,GACpB,iFAAiF,CAAC;AAEpF,MAAM,cAAc,GAA6C;IAC/D,8BAA8B;IAC9B,CAAC,mCAAmC,EAAE,mBAAmB,CAAC;IAC1D,2EAA2E;IAC3E;QACE,6EAA6E;QAC7E,cAAc;KACf;IACD,2CAA2C;IAC3C;QACE,0FAA0F;QAC1F,eAAe;KAChB;IACD,yDAAyD;IACzD,CAAC,kDAAkD,EAAE,gBAAgB,CAAC;CACvE,CAAC;AAEF,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,cAAc,EAAE,CAAC;QACpD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,wFAAwF;AACxF,SAAS,UAAU,CAAC,GAAc,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa,EAAE,OAAgB;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAC;QACnE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,OAAgC;IACxD,OAAO,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,GAAG,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC;gBAAE,SAAS;YAC9B,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,MAAM,IAAI,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|