@praxis.guard/auditor-cli 0.0.62 → 0.0.64

package/dist/mcp/evaluate-guard-tier.js

@@ -0,0 +1,42 @@
+import { defaultApprovalBlock } from "./guard-approval-block.js";
+import { tierToPolicyDecision } from "./guard-mode.js";
+export function riskScore(skipped, tier) {
+    if (skipped)
+        return 0;
+    if (tier === "READ")
+        return 0;
+    if (tier === "MUTATE")
+        return 60;
+    return 95;
+}
+export function resolveTierDecision(input) {
+    const { mode, skipped, tier } = input;
+    let enforceDecision = tierToPolicyDecision(tier, skipped);
+    const approvalBlock = defaultApprovalBlock();
+    if (skipped) {
+        return { enforceDecision: "allow", approvalBlock };
+    }
+    if (tier === "DESTRUCTIVE") {
+        return {
+            enforceDecision: "block",
+            approvalBlock: {
+                ...approvalBlock,
+                instructions: "DESTRUCTIVE actions cannot be approved via guard. Escalate outside the agent loop.",
+            },
+        };
+    }
+    if (tier === "READ") {
+        return { enforceDecision: "allow", approvalBlock };
+    }
+    if (mode === "shadow") {
+        return {
+            enforceDecision: "require_approval",
+            approvalBlock: {
+                ...approvalBlock,
+                instructions: "Shadow mode: no approval request created. Re-call with mode enforce to coordinate human approval.",
+            },
+        };
+    }
+    return { enforceDecision, approvalBlock };
+}
+//# sourceMappingURL=evaluate-guard-tier.js.map

package/dist/mcp/evaluate-guard-tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-tier.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-tier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAsB,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAQ3E,MAAM,UAAU,SAAS,CAAC,OAAgB,EAAE,IAAU;IACpD,IAAI,OAAO;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,oFAAoF;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,mGAAmG;aACtG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC"}

package/dist/mcp/evaluate-guard.d.ts

@@ -1,9 +1,6 @@
-import { loadPoliciesV1 } from "../policy/index.js";
 import type { GuardInput } from "./guard-schemas.js";
-export type PolicyState = {
-    policy: Awaited<ReturnType<typeof loadPoliciesV1>>;
-    policyRevision: number | null;
-};
+import type { PolicyState } from "./evaluate-guard-tier.js";
+export type { PolicyState } from "./evaluate-guard-tier.js";
 export declare function evaluateGuard(input: GuardInput, policyState: PolicyState): Promise<{
     response: Record<string, unknown>;
     startedAt: number;

package/dist/mcp/evaluate-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-guard.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AAkBvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AA+CF,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAwKnE"}
+{"version":3,"file":"evaluate-guard.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI5D,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBnE"}

package/dist/mcp/evaluate-guard.js

@@ -1,201 +1,24 @@
-import { v4 as uuidv4 } from "uuid";
-import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
-import { rememberResolvedWorkspaceRoot, resolveGuardStorageRootFromHints, } from "../bridge/guard-storage-root.js";
-import { evaluateMcpProposal, evaluateShellProposal } from "../shell/evaluate.js";
-import { sendGuardEvent } from "../telemetry/guard-events.js";
-import { getInstallId } from "../cli/install-id.js";
-import { evaluatePolicyWithDaemon } from "../daemon/client.js";
-import { daemonModeEnabled } from "../daemon/paths.js";
-import { resolveGuardAuditStatus } from "./guard-audit-status.js";
-import { applyGuardMode, tierToPolicyDecision } from "./guard-mode.js";
 import { resetHeartbeatIdle } from "./guard-heartbeat.js";
-import { defaultApprovalBlock, resolveEnforceMutateApproval, } from "./guard-approval-block.js";
-function riskScore(skipped, tier) {
-    if (skipped)
-        return 0;
-    if (tier === "READ")
-        return 0;
-    if (tier === "MUTATE")
-        return 60;
-    return 95;
-}
-function resolveTierDecision(input) {
-    const { mode, skipped, tier } = input;
-    let enforceDecision = tierToPolicyDecision(tier, skipped);
-    const approvalBlock = defaultApprovalBlock();
-    if (skipped) {
-        return { enforceDecision: "allow", approvalBlock };
-    }
-    if (tier === "DESTRUCTIVE") {
-        return {
-            enforceDecision: "block",
-            approvalBlock: {
-                ...approvalBlock,
-                instructions: "DESTRUCTIVE actions cannot be approved via guard. Escalate outside the agent loop.",
-            },
-        };
-    }
-    if (tier === "READ") {
-        return { enforceDecision: "allow", approvalBlock };
-    }
-    if (mode === "shadow") {
-        return {
-            enforceDecision: "require_approval",
-            approvalBlock: {
-                ...approvalBlock,
-                instructions: "Shadow mode: no approval request created. Re-call with mode enforce to coordinate human approval.",
-            },
-        };
-    }
-    return { enforceDecision, approvalBlock };
-}
+import { emitGuardEvaluationTelemetry } from "./evaluate-guard-telemetry.js";
+import { buildGuardResponse, runGuardEvaluation } from "./evaluate-guard-run.js";
 export async function evaluateGuard(input, policyState) {
-    const startedAt = performance.now();
-    const event_id = uuidv4();
     resetHeartbeatIdle();
-    policyState.policy = await loadPoliciesV1();
-    policyState.policyRevision = await readPoliciesV1Revision();
-    const storageRoot = resolveGuardStorageRootFromHints({
-        cwd: input.proposal.cwd,
-        workspaceRoot: input.context?.workspace_root,
-        workspaceRoots: input.context?.workspace_roots,
-    });
-    rememberResolvedWorkspaceRoot(storageRoot);
-    const shellCommand = input.proposal.kind === "shell"
-        ? input.proposal.raw_command ?? input.proposal.argv.join(" ")
-        : null;
-    const shellResult = input.proposal.kind === "shell" && shellCommand
-        ? evaluateShellProposal(policyState.policy, shellCommand)
-        : null;
-    const mcpResult = input.proposal.kind === "mcp"
-        ? evaluateMcpProposal(policyState.policy, input.proposal.argv)
-        : null;
-    let skipped = shellResult?.skipped ?? mcpResult?.skipped ?? true;
-    let evaluation = shellResult?.evaluation ?? mcpResult.evaluation;
-    const analysis = shellResult?.analysis;
-    const argv = evaluation.argv;
-    if (daemonModeEnabled()) {
-        try {
-            const daemonEvaluation = await evaluatePolicyWithDaemon(argv);
-            skipped = daemonEvaluation.skipped;
-            evaluation = {
-                ...evaluation,
-                tier: daemonEvaluation.tier,
-                classification: daemonEvaluation.classification,
-                flags: daemonEvaluation.flags,
-                reasons: daemonEvaluation.skipped
-                    ? [{ code: "skipped", message: "No policy entry matched in the native daemon." }]
-                    : [
-                        {
-                            code: "policy_match",
-                            message: "Matched policy entry in the native daemon.",
-                            details: {
-                                tool: daemonEvaluation.classification.tool,
-                                command_path: daemonEvaluation.classification.command_path,
-                                verb: daemonEvaluation.classification.verb,
-                                tier: daemonEvaluation.tier,
-                            },
-                        },
-                    ],
-            };
-        }
-        catch (error) {
-            if (process.env.PRAXIS_GUARD_SPAWN_FALLBACK !== "1")
-                throw error;
-        }
-    }
-    const tier = evaluation.tier;
-    const reasons = [...evaluation.reasons];
-    const policyReasons = [...evaluation.reasons];
-    let { enforceDecision, approvalBlock } = resolveTierDecision({
-        mode: input.mode,
-        skipped,
-        tier,
-    });
-    let approvalRequestId = null;
-    const hookApprovalRequestId = input.context?.approval?.request_id?.trim() || null;
-    const hookWaitMs = input.context?.wait_ms ?? 0;
-    const redeemHookApproval = !skipped &&
-        tier !== "DESTRUCTIVE" &&
-        input.mode === "enforce" &&
-        hookApprovalRequestId !== null &&
-        hookWaitMs > 0;
-    if (redeemHookApproval ||
-        (!skipped && tier !== "DESTRUCTIVE" && tier !== "READ" && input.mode === "enforce")) {
-        const mutate = await resolveEnforceMutateApproval({
-            guardInput: input,
-            argv,
-            storageRoot,
-            eventId: event_id,
-            policyRevision: policyState.policyRevision,
-            reasons,
-            approval_fingerprint: analysis?.approval_fingerprint_payload ?? null,
-        });
-        enforceDecision = mutate.enforceDecision;
-        approvalBlock = mutate.approvalBlock;
-        approvalRequestId = mutate.approvalRequestId;
-    }
-    const { decision, shadow } = applyGuardMode({
-        mode: input.mode,
-        skipped,
-        tier,
-        policyReasons,
-        enforceDecision,
-    });
-    const response = {
-        mode: input.mode,
-        decision,
-        skipped,
-        tier,
-        risk_score: riskScore(skipped, tier),
-        reasons,
-        shadow,
-        approval: approvalBlock,
-        audit: {
-            event_id,
-            timestamp: new Date().toISOString(),
-            latency_ms: performance.now() - startedAt,
-        },
-        execution: {
-            attempted: false,
-            result: null,
-        },
-    };
-    const firstReason = reasons.find((r) => typeof r?.message === "string")?.message ??
-        reasons.find((r) => typeof r?.code === "string")?.code ??
-        null;
-    const actionVerb = argv[1] ?? null;
-    const actionResource = argv.length > 2 ? argv.slice(2).join(" ") : null;
-    const status = resolveGuardAuditStatus({ skipped, decision });
-    void sendGuardEvent({
-        ts: new Date().toISOString(),
-        status,
-        skipped,
-        ...(skipped
-            ? {
-                skip_reason: input.proposal.kind === "shell" ? "no_governed_invocation" : "mcp_policy_unmatched",
-            }
-            : {}),
-        tool: "auditor-mcp",
-        command_path: argv[0] ?? null,
-        verb: actionVerb,
-        resource: actionResource,
-        reason: firstReason,
-        cmd: shellCommand ?? argv.join(" "),
-        tier,
-        decision,
-        latency_ms: performance.now() - startedAt,
-        event_id,
-        installId: getInstallId(),
-        kind: input.proposal.kind,
-        ...(policyState.policyRevision !== null
-            ? { policy_revision: policyState.policyRevision }
-            : {}),
-        ...(approvalRequestId ? { approval_request_id: approvalRequestId } : {}),
-        meta: {
-            invocation_count: analysis?.invocations.length ?? null,
-        },
+    const result = await runGuardEvaluation(input, policyState);
+    const response = buildGuardResponse(input, result);
+    emitGuardEvaluationTelemetry({
+        guardInput: input,
+        policyState,
+        startedAt: result.startedAt,
+        eventId: result.eventId,
+        skipped: result.skipped,
+        tier: result.tier,
+        decision: result.decision,
+        argv: result.evaluation.argv,
+        shellCommand: result.proposal.shellCommand,
+        reasons: result.reasons,
+        approvalRequestId: result.approvalRequestId,
+        invocationCount: result.proposal.analysis?.invocations.length ?? null,
     });
-    return { response, startedAt };
+    return { response, startedAt: result.startedAt };
 }
 //# sourceMappingURL=evaluate-guard.js.map

package/dist/mcp/evaluate-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate-guard.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AACvF,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,2BAA2B,CAAC;AAQnC,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAU;IAC7C,IAAI,OAAO;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,oFAAoF;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,mGAAmG;aACtG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,WAAwB;IAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAC1B,kBAAkB,EAAE,CAAC;IAErB,WAAW,CAAC,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAE5D,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;QACvB,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc;QAC5C,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe;KAC/C,CAAC,CAAC;IACH,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAChB,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC7B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY;QAC7C,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;QAC3B,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,OAAO,GAAG,WAAW,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC;IACjE,IAAI,UAAU,GAAG,WAAW,EAAE,UAAU,IAAI,SAAU,CAAC,UAAU,CAAC;IAClE,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAE7B,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC9D,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC;YACnC,UAAU,GAAG;gBACX,GAAG,UAAU;gBACb,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,cAAc,EAAE,gBAAgB,CAAC,cAAc;gBAC/C,KAAK,EAAE,gBAAgB,CAAC,KAAK;gBAC7B,OAAO,EAAE,gBAAgB,CAAC,OAAO;oBAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;oBACjF,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,4CAA4C;4BACrD,OAAO,EAAE;gCACP,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,YAAY,EAAE,gBAAgB,CAAC,cAAc,CAAC,YAAY;gCAC1D,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,IAAI,EAAE,gBAAgB,CAAC,IAAI;6BAC5B;yBACF;qBACF;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG;gBAAE,MAAM,KAAK,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAS,UAAU,CAAC,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC;QAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;KACL,CAAC,CAAC;IACH,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAE5C,MAAM,qBAAqB,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAClF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC;IAC/C,MAAM,kBAAkB,GACtB,CAAC,OAAO;QACR,IAAI,KAAK,aAAa;QACtB,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,qBAAqB,KAAK,IAAI;QAC9B,UAAU,GAAG,CAAC,CAAC;IAEjB,IACE,kBAAkB;QAClB,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EACnF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,UAAU,EAAE,KAAK;YACjB,IAAI;YACJ,WAAW;YACX,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,OAAO;YACP,oBAAoB,EAAE,QAAQ,EAAE,4BAA4B,IAAI,IAAI;SACrE,CAAC,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;QACJ,aAAa;QACb,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QACpC,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE;YACL,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;SAC1C;QACD,SAAS,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IAEF,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;QACtD,IAAI,CAAC;IACP,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9D,KAAK,cAAc,CAAC;QAClB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,OAAO;QACP,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,WAAW,EACT,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB;aACtF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;QACzC,QAAQ;QACR,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACzB,GAAG,CAAC,WAAW,CAAC,cAAc,KAAK,IAAI;YACrC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,cAAc,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,EAAE;YACJ,gBAAgB,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;SACvD;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"evaluate-guard.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIjF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,WAAwB;IAExB,kBAAkB,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnD,4BAA4B,CAAC;QAC3B,UAAU,EAAE,KAAK;QACjB,WAAW;QACX,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;QAC5B,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;KACtE,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC"}

package/dist/mcp/gateway-call-handler.d.ts

@@ -0,0 +1,9 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import type { GatewayConnection } from "./gateway-connection.js";
+export declare function handleGatewayCallTool(input: {
+    exposed: string;
+    args: Record<string, unknown>;
+    ids: string[];
+    byId: Map<string, GatewayConnection>;
+}): Promise<CallToolResult>;
+//# sourceMappingURL=gateway-call-handler.d.ts.map

package/dist/mcp/gateway-call-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-call-handler.d.ts","sourceRoot":"","sources":["../../src/mcp/gateway-call-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAKzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAmCjE,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CACtC,GAAG,OAAO,CAAC,cAAc,CAAC,CAyC1B"}

package/dist/mcp/gateway-call-handler.js

@@ -0,0 +1,61 @@
+import { parseExposedToolName } from "./gateway-config.js";
+import { evaluateGatewayCall } from "./gateway-evaluate.js";
+import { gatewayBlockedResult, gatewayTextResult } from "./gateway-call-results.js";
+import { logGatewayErr, truncGatewayErr } from "./gateway-log.js";
+async function forwardWithReconnect(input) {
+    const { conn, serverId, tool, args, tier } = input;
+    try {
+        return await conn.callTool(tool, args);
+    }
+    catch (e) {
+        logGatewayErr(`downstream "${serverId}" call failed: ${truncGatewayErr(e)}; reconnecting`);
+        const ok = await conn.reconnect();
+        if (ok && tier === "READ") {
+            try {
+                return await conn.callTool(tool, args);
+            }
+            catch (e2) {
+                return gatewayTextResult(`Praxis gateway: downstream "${serverId}" error after reconnect: ${truncGatewayErr(e2)}`, true);
+            }
+        }
+        return gatewayTextResult(`Praxis gateway: downstream "${serverId}" call failed` +
+            (ok ? " (reconnected; not retried to avoid double-execution)" : " and is unavailable") +
+            `: ${truncGatewayErr(e)}`, true);
+    }
+}
+export async function handleGatewayCallTool(input) {
+    try {
+        const parsed = parseExposedToolName(input.exposed, input.ids);
+        if (!parsed) {
+            return gatewayTextResult(`Praxis gateway: unknown tool "${input.exposed}".`, true);
+        }
+        const conn = input.byId.get(parsed.serverId);
+        if (!conn) {
+            return gatewayTextResult(`Praxis gateway: downstream "${parsed.serverId}" is not connected.`, true);
+        }
+        if (!conn.tools.some((t) => t.name === parsed.tool)) {
+            return gatewayTextResult(`Praxis gateway: "${parsed.serverId}" does not expose a tool named "${parsed.tool}".`, true);
+        }
+        const decision = await evaluateGatewayCall({
+            serverId: parsed.serverId,
+            tool: parsed.tool,
+            toolInput: input.args,
+        });
+        if (decision.decision === "block") {
+            return gatewayBlockedResult(parsed.serverId, parsed.tool, decision);
+        }
+        return forwardWithReconnect({
+            conn,
+            serverId: parsed.serverId,
+            tool: parsed.tool,
+            args: input.args,
+            tier: decision.tier,
+        });
+    }
+    catch (e) {
+        logGatewayErr(`gating error for "${input.exposed}": ${truncGatewayErr(e)}`);
+        return gatewayTextResult("Praxis gateway: guard evaluation failed; blocking this call (fail-closed). " +
+            "To restore direct tools: run `auditor setup gateway --revert --apply`, then relaunch Claude Desktop.", true);
+    }
+}
+//# sourceMappingURL=gateway-call-handler.js.map

package/dist/mcp/gateway-call-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-call-handler.js","sourceRoot":"","sources":["../../src/mcp/gateway-call-handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEpF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,KAAK,UAAU,oBAAoB,CAAC,KAMnC;IACC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,aAAa,CAAC,eAAe,QAAQ,kBAAkB,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC3F,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,EAAE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,OAAO,iBAAiB,CACtB,+BAA+B,QAAQ,4BAA4B,eAAe,CAAC,EAAE,CAAC,EAAE,EACxF,IAAI,CACL,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,iBAAiB,CACtB,+BAA+B,QAAQ,eAAe;YACpD,CAAC,EAAE,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,qBAAqB,CAAC;YACtF,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,EAC3B,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,iBAAiB,CAAC,iCAAiC,KAAK,CAAC,OAAO,IAAI,EAAE,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,iBAAiB,CAAC,+BAA+B,MAAM,CAAC,QAAQ,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,iBAAiB,CACtB,oBAAoB,MAAM,CAAC,QAAQ,mCAAmC,MAAM,CAAC,IAAI,IAAI,EACrF,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,KAAK,CAAC,IAAI;SACtB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,oBAAoB,CAAC;YAC1B,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,aAAa,CAAC,qBAAqB,KAAK,CAAC,OAAO,MAAM,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,iBAAiB,CACtB,6EAA6E;YAC3E,sGAAsG,EACxG,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/mcp/gateway-call-results.d.ts

@@ -0,0 +1,5 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import type { evaluateGatewayCall } from "./gateway-evaluate.js";
+export declare function gatewayTextResult(text: string, isError: boolean): CallToolResult;
+export declare function gatewayBlockedResult(serverId: string, tool: string, d: Awaited<ReturnType<typeof evaluateGatewayCall>>): CallToolResult;
+//# sourceMappingURL=gateway-call-results.d.ts.map

package/dist/mcp/gateway-call-results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-call-results.d.ts","sourceRoot":"","sources":["../../src/mcp/gateway-call-results.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc,CAEhF;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,GACjD,cAAc,CAehB"}

package/dist/mcp/gateway-call-results.js

@@ -0,0 +1,14 @@
+export function gatewayTextResult(text, isError) {
+    return { content: [{ type: "text", text }], isError };
+}
+export function gatewayBlockedResult(serverId, tool, d) {
+    const reason = d.reasons[0] ?? "policy";
+    if (d.inlineApproval) {
+        return gatewayTextResult(`Praxis guard requires human approval for ${serverId}__${tool} (tier=${d.tier}). ` +
+            `Approve at ${d.inlineApproval.open_url} then retry this exact tool call. ` +
+            `(request ${d.inlineApproval.request_id})`, true);
+    }
+    return gatewayTextResult(`Praxis guard blocked ${serverId}__${tool} (tier=${d.tier}): ${reason}. ` +
+        (d.tier === "DESTRUCTIVE" ? "Destructive actions cannot be auto-approved." : ""), true);
+}
+//# sourceMappingURL=gateway-call-results.js.map

package/dist/mcp/gateway-call-results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-call-results.js","sourceRoot":"","sources":["../../src/mcp/gateway-call-results.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAgB;IAC9D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,IAAY,EACZ,CAAkD;IAElD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IACxC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,iBAAiB,CACtB,4CAA4C,QAAQ,KAAK,IAAI,UAAU,CAAC,CAAC,IAAI,KAAK;YAChF,cAAc,CAAC,CAAC,cAAc,CAAC,QAAQ,oCAAoC;YAC3E,YAAY,CAAC,CAAC,cAAc,CAAC,UAAU,GAAG,EAC5C,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CACtB,wBAAwB,QAAQ,KAAK,IAAI,UAAU,CAAC,CAAC,IAAI,MAAM,MAAM,IAAI;QACvE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE,CAAC,EAClF,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/mcp/gateway-connection-lib.d.ts

@@ -0,0 +1,54 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import type { GatewayServer } from "./gateway-config.js";
+import type { GatewayConnection } from "./gateway-connection.js";
+export declare const GATEWAY_CONNECT_TIMEOUT_MS = 10000;
+export declare function listToolsWithTimeout(client: Client, serverId: string): Promise<{
+    [x: string]: unknown;
+    tools: {
+        inputSchema: {
+            [x: string]: unknown;
+            type: "object";
+            properties?: Record<string, object> | undefined;
+            required?: string[] | undefined;
+        };
+        name: string;
+        description?: string | undefined;
+        outputSchema?: {
+            [x: string]: unknown;
+            type: "object";
+            properties?: Record<string, object> | undefined;
+            required?: string[] | undefined;
+        } | undefined;
+        annotations?: {
+            title?: string | undefined;
+            readOnlyHint?: boolean | undefined;
+            destructiveHint?: boolean | undefined;
+            idempotentHint?: boolean | undefined;
+            openWorldHint?: boolean | undefined;
+        } | undefined;
+        execution?: {
+            taskSupport?: "optional" | "required" | "forbidden" | undefined;
+        } | undefined;
+        _meta?: Record<string, unknown> | undefined;
+        icons?: {
+            src: string;
+            mimeType?: string | undefined;
+            sizes?: string[] | undefined;
+            theme?: "light" | "dark" | undefined;
+        }[] | undefined;
+        title?: string | undefined;
+    }[];
+    _meta?: {
+        [x: string]: unknown;
+        progressToken?: string | number | undefined;
+        "io.modelcontextprotocol/related-task"?: {
+            taskId: string;
+        } | undefined;
+    } | undefined;
+    nextCursor?: string | undefined;
+}>;
+export declare function connectClientWithTimeout(client: Client, spawn: () => StdioClientTransport, serverId: string, label: string): Promise<void>;
+export declare function newGatewayClient(server: GatewayServer): Client;
+export declare function refreshGatewayConnection(server: GatewayServer, spawn: () => StdioClientTransport, conn: GatewayConnection, attachListChanged: (client: Client) => void, notifyToolsChanged: () => void): Promise<Client | null>;
+//# sourceMappingURL=gateway-connection-lib.d.ts.map

package/dist/mcp/gateway-connection-lib.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-connection-lib.d.ts","sourceRoot":"","sources":["../../src/mcp/gateway-connection-lib.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAkBjD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;sBAoC44lB,CAAC;oBAA8D,CAAC;;;mBAAwF,CAAC;oBAA8C,CAAC;;;sBAAoG,CAAC;oBAA8D,CAAC;;mBAA0E,CAAC;iBAAyB,CAAC;wBAAkD,CAAC;2BAAsD,CAAC;0BAAqD,CAAC;yBAAoD,CAAC;;iBAAuE,CAAC;uBAA+B,CAAC;;aAAiG,CAAC;aAAwD,CAAC;;oBAAyD,CAAC;iBAA2C,CAAC;iBAA6C,CAAC;;aAA8E,CAAC;;;;qBAAgH,CAAC;8CAAiF,CAAC;;;;;GAlCryoB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,oBAAoB,EACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE9D;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,oBAAoB,EACjC,IAAI,EAAE,iBAAiB,EACvB,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,EAC3C,kBAAkB,EAAE,MAAM,IAAI,GAC7B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxB"}

package/dist/mcp/gateway-connection-lib.js

@@ -0,0 +1,39 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { AUDITOR_CLI_VERSION } from "../runtime/version.js";
+export const GATEWAY_CONNECT_TIMEOUT_MS = 10_000;
+function withTimeout(p, ms, label) {
+    return new Promise((resolve, reject) => {
+        const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+        p.then((v) => {
+            clearTimeout(t);
+            resolve(v);
+        }, (e) => {
+            clearTimeout(t);
+            reject(e);
+        });
+    });
+}
+export async function listToolsWithTimeout(client, serverId) {
+    return withTimeout(client.listTools(), GATEWAY_CONNECT_TIMEOUT_MS, `listTools ${serverId}`);
+}
+export async function connectClientWithTimeout(client, spawn, serverId, label) {
+    await withTimeout(client.connect(spawn()), GATEWAY_CONNECT_TIMEOUT_MS, `${label} ${serverId}`);
+}
+export function newGatewayClient(server) {
+    return new Client({ name: `praxis-gateway-client-${server.id}`, version: AUDITOR_CLI_VERSION });
+}
+export async function refreshGatewayConnection(server, spawn, conn, attachListChanged, notifyToolsChanged) {
+    const client = newGatewayClient(server);
+    try {
+        await connectClientWithTimeout(client, spawn, server.id, "reconnect");
+        const listed = await listToolsWithTimeout(client, server.id);
+        conn.tools = listed.tools;
+        attachListChanged(client);
+        notifyToolsChanged();
+        return client;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=gateway-connection-lib.js.map

package/dist/mcp/gateway-connection-lib.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-connection-lib.js","sourceRoot":"","sources":["../../src/mcp/gateway-connection-lib.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAI5D,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAEjD,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU,EAAE,KAAa;IAC9D,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE;YACJ,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;YACJ,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACzE,OAAO,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,0BAA0B,EAAE,aAAa,QAAQ,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,KAAiC,EACjC,QAAgB,EAChB,KAAa;IAEb,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,0BAA0B,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAqB,EACrB,KAAiC,EACjC,IAAuB,EACvB,iBAA2C,EAC3C,kBAA8B;IAE9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,kBAAkB,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/mcp/gateway-connection.d.ts

@@ -0,0 +1,16 @@
+import { type CallToolResult, type Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { GatewayServer } from "./gateway-config.js";
+/**
+ * One downstream MCP server, abstracted so tests can inject fakes without
+ * spawning real subprocesses. The real implementation is `connectStdioServer`.
+ */
+export interface GatewayConnection {
+    readonly id: string;
+    tools: Tool[];
+    callTool(tool: string, args: Record<string, unknown>): Promise<CallToolResult>;
+    reconnect(): Promise<boolean>;
+    onToolsChanged?(listener: () => void): void;
+}
+/** Real stdio-backed connection to a downstream MCP server. */
+export declare function connectStdioServer(server: GatewayServer): Promise<GatewayConnection>;
+//# sourceMappingURL=gateway-connection.d.ts.map

package/dist/mcp/gateway-connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-connection.d.ts","sourceRoot":"","sources":["../../src/mcp/gateway-connection.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,IAAI,EACV,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;CAC7C;AAkBD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA8C1F"}

package/dist/mcp/gateway-connection.js

@@ -0,0 +1,54 @@
+import { StdioClientTransport, getDefaultEnvironment, } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { ToolListChangedNotificationSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { logGatewayErr, truncGatewayErr } from "./gateway-log.js";
+import { connectClientWithTimeout, listToolsWithTimeout, newGatewayClient, refreshGatewayConnection, } from "./gateway-connection-lib.js";
+function attachListChangedHandler(client, conn, getListener) {
+    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
+        try {
+            const re = await listToolsWithTimeout(client, conn.id);
+            conn.tools = re.tools;
+            getListener()?.();
+        }
+        catch (e) {
+            logGatewayErr(`tools/list_changed refresh for "${conn.id}" failed: ${truncGatewayErr(e)}`);
+        }
+    });
+}
+/** Real stdio-backed connection to a downstream MCP server. */
+export async function connectStdioServer(server) {
+    const spawn = () => new StdioClientTransport({
+        command: server.command,
+        args: server.args,
+        env: server.env ? { ...getDefaultEnvironment(), ...server.env } : undefined,
+    });
+    let client = newGatewayClient(server);
+    let toolsChangedListener = null;
+    const getListener = () => toolsChangedListener;
+    await connectClientWithTimeout(client, spawn, server.id, "connect");
+    const listed = await listToolsWithTimeout(client, server.id);
+    let conn;
+    const wireListChanged = (fresh) => attachListChangedHandler(fresh, conn, getListener);
+    conn = {
+        id: server.id,
+        tools: listed.tools,
+        onToolsChanged(listener) {
+            toolsChangedListener = listener;
+        },
+        async callTool(tool, args) {
+            return (await client.callTool({ name: tool, arguments: args }));
+        },
+        async reconnect() {
+            await client.close().catch(() => { });
+            const next = await refreshGatewayConnection(server, spawn, conn, wireListChanged, () => toolsChangedListener?.());
+            if (!next) {
+                logGatewayErr(`reconnect to "${server.id}" failed`);
+                return false;
+            }
+            client = next;
+            return true;
+        },
+    };
+    wireListChanged(client);
+    return conn;
+}
+//# sourceMappingURL=gateway-connection.js.map

package/dist/mcp/gateway-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-connection.js","sourceRoot":"","sources":["../../src/mcp/gateway-connection.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,iCAAiC,GAGlC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAcrC,SAAS,wBAAwB,CAC/B,MAAc,EACd,IAAuB,EACvB,WAAsC;IAEtC,MAAM,CAAC,sBAAsB,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC1E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;YACtB,WAAW,EAAE,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,aAAa,CAAC,mCAAmC,IAAI,CAAC,EAAE,aAAa,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAqB;IAC5D,MAAM,KAAK,GAAG,GAAG,EAAE,CACjB,IAAI,oBAAoB,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,qBAAqB,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC,CAAC;IAEL,IAAI,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,oBAAoB,GAAwB,IAAI,CAAC;IACrD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,oBAAoB,CAAC;IAE/C,MAAM,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE7D,IAAI,IAAwB,CAAC;IAC7B,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAE9F,IAAI,GAAG;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,cAAc,CAAC,QAAQ;YACrB,oBAAoB,GAAG,QAAQ,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI;YACvB,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAmB,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,SAAS;YACb,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,wBAAwB,CACzC,MAAM,EACN,KAAK,EACL,IAAI,EACJ,eAAe,EACf,GAAG,EAAE,CAAC,oBAAoB,EAAE,EAAE,CAC/B,CAAC;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,aAAa,CAAC,iBAAiB,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mcp/gateway-log.d.ts

@@ -0,0 +1,5 @@
+/** stderr only — stdout is the MCP protocol channel. */
+export declare function logGatewayErr(line: string): void;
+/** Bound downstream-supplied error text so a hostile downstream can't flood or spoof the result. */
+export declare function truncGatewayErr(e: unknown): string;
+//# sourceMappingURL=gateway-log.d.ts.map

package/dist/mcp/gateway-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-log.d.ts","sourceRoot":"","sources":["../../src/mcp/gateway-log.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAElD"}

package/dist/mcp/gateway-log.js

@@ -0,0 +1,9 @@
+/** stderr only — stdout is the MCP protocol channel. */
+export function logGatewayErr(line) {
+    process.stderr.write(`[auditor-gateway] ${line}\n`);
+}
+/** Bound downstream-supplied error text so a hostile downstream can't flood or spoof the result. */
+export function truncGatewayErr(e) {
+    return String(e).slice(0, 300);
+}
+//# sourceMappingURL=gateway-log.js.map

package/dist/mcp/gateway-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-log.js","sourceRoot":"","sources":["../../src/mcp/gateway-log.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC"}