@provos/ironcurtain 0.1.0

package/dist/trusted-process/call-circuit-breaker.js

@@ -0,0 +1,61 @@
+/**
+ * CallCircuitBreaker -- Proxy-level rate limiter for MCP tool calls.
+ *
+ * Protects against runaway sandbox code that hammers the same tool
+ * with identical arguments. Uses a sliding-window approach: if the
+ * same (tool, argsHash) pair appears more than `threshold` times
+ * within `windowMs`, the call is denied.
+ *
+ * Runs AFTER policy evaluation so every call is always audited.
+ */
+import { computeHash } from '../hash.js';
+const DEFAULT_CONFIG = {
+    windowMs: 60_000,
+    threshold: 20,
+};
+export class CallCircuitBreaker {
+    config;
+    windows = new Map();
+    constructor(config) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /**
+     * Check whether a tool call should be allowed.
+     *
+     * @returns `{ allowed: true }` or `{ allowed: false, reason: string }`
+     */
+    check(toolName, args) {
+        const argsHash = computeHash(args);
+        const key = `${toolName}:${argsHash}`;
+        const now = Date.now();
+        const cutoff = now - this.config.windowMs;
+        let timestamps = this.windows.get(key);
+        if (!timestamps) {
+            timestamps = [];
+            this.windows.set(key, timestamps);
+        }
+        // Prune entries older than the window
+        const firstValid = timestamps.findIndex((t) => t > cutoff);
+        if (firstValid > 0) {
+            timestamps.splice(0, firstValid);
+        }
+        else if (firstValid === -1) {
+            timestamps.length = 0;
+        }
+        if (timestamps.length >= this.config.threshold) {
+            return {
+                allowed: false,
+                reason: `CIRCUIT BREAKER: Tool '${toolName}' called ${this.config.threshold} times ` +
+                    `with identical arguments within ${this.config.windowMs / 1000}s window. ` +
+                    'Try a different approach.',
+            };
+        }
+        timestamps.push(now);
+        return { allowed: true };
+    }
+    /** Reset all state. */
+    reset() {
+        this.windows.clear();
+    }
+}
+//# sourceMappingURL=call-circuit-breaker.js.map

package/dist/trusted-process/call-circuit-breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-circuit-breaker.js","sourceRoot":"","sources":["../../src/trusted-process/call-circuit-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAOzC,MAAM,cAAc,GAAyB;IAC3C,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,EAAE;CACd,CAAC;AAMF,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAuB;IACtC,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE9C,YAAY,MAAsC;QAChD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CACH,QAAgB,EAChB,IAA6B;QAE7B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE1C,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;QAED,sCAAsC;QACtC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAC3D,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,0BAA0B,QAAQ,YAAY,IAAI,CAAC,MAAM,CAAC,SAAS,SAAS;oBAC5E,mCAAmC,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,YAAY;oBAC1E,2BAA2B;aAC9B,CAAC;QACJ,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uBAAuB;IACvB,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/trusted-process/escalation.d.ts

@@ -0,0 +1,7 @@
+import type { ToolCallRequest } from '../types/mcp.js';
+export declare class EscalationHandler {
+    private rl;
+    private getReadline;
+    prompt(request: ToolCallRequest, reason: string): Promise<'approved' | 'denied'>;
+    close(): void;
+}

package/dist/trusted-process/escalation.js

@@ -0,0 +1,38 @@
+import { createInterface } from 'node:readline';
+export class EscalationHandler {
+    rl = null;
+    getReadline() {
+        if (!this.rl) {
+            this.rl = createInterface({
+                input: process.stdin,
+                output: process.stderr,
+            });
+        }
+        return this.rl;
+    }
+    async prompt(request, reason) {
+        const rl = this.getReadline();
+        process.stderr.write('\n========================================\n');
+        process.stderr.write('  ESCALATION: Human approval required\n');
+        process.stderr.write('========================================\n');
+        process.stderr.write(`  Tool:      ${request.serverName}/${request.toolName}\n`);
+        process.stderr.write(`  Arguments: ${JSON.stringify(request.arguments, null, 2)}\n`);
+        process.stderr.write(`  Reason:    ${reason}\n`);
+        process.stderr.write('========================================\n');
+        return new Promise((resolve) => {
+            rl.question('  Approve? (y/N): ', (answer) => {
+                const approved = answer.trim().toLowerCase() === 'y';
+                process.stderr.write(approved ? '  -> APPROVED\n' : '  -> DENIED\n');
+                process.stderr.write('========================================\n\n');
+                resolve(approved ? 'approved' : 'denied');
+            });
+        });
+    }
+    close() {
+        if (this.rl) {
+            this.rl.close();
+            this.rl = null;
+        }
+    }
+}
+//# sourceMappingURL=escalation.js.map

package/dist/trusted-process/escalation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalation.js","sourceRoot":"","sources":["../../src/trusted-process/escalation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AAGhE,MAAM,OAAO,iBAAiB;IACpB,EAAE,GAAqB,IAAI,CAAC;IAE5B,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,MAAc;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,MAAM,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAEnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;gBACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBACrE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;CACF"}

package/dist/trusted-process/index.d.ts

@@ -0,0 +1,32 @@
+import type { IronCurtainConfig } from '../config/types.js';
+import type { ToolCallRequest, ToolCallResult } from '../types/mcp.js';
+export type EscalationPromptFn = (request: ToolCallRequest, reason: string) => Promise<'approved' | 'denied'>;
+export interface TrustedProcessOptions {
+    onEscalation?: EscalationPromptFn;
+}
+export declare class TrustedProcess {
+    private config;
+    private policyEngine;
+    private mcpManager;
+    private mcpRoots;
+    private auditLog;
+    private escalation;
+    private onEscalation?;
+    constructor(config: IronCurtainConfig, options?: TrustedProcessOptions);
+    initialize(): Promise<void>;
+    listTools(serverName: string): Promise<{
+        name: string;
+        description?: string;
+        inputSchema: unknown;
+    }[]>;
+    /**
+     * Handles a tool call request through the full trusted process lifecycle:
+     *   1. Evaluate policy (allow / deny / escalate)
+     *   2. If escalated, prompt the human for approval
+     *   3. If allowed, forward to the real MCP server
+     *   4. Log the complete decision trace to the audit log
+     *   5. Return the result to the caller
+     */
+    handleToolCall(request: ToolCallRequest): Promise<ToolCallResult>;
+    shutdown(): Promise<void>;
+}

package/dist/trusted-process/index.js

@@ -0,0 +1,151 @@
+import { loadGeneratedPolicy, extractServerDomainAllowlists } from '../config/index.js';
+import { PolicyEngine } from './policy-engine.js';
+import { MCPClientManager } from './mcp-client-manager.js';
+import { AuditLog } from './audit-log.js';
+import { EscalationHandler } from './escalation.js';
+import { prepareToolArgs } from './path-utils.js';
+import { extractPolicyRoots, toMcpRoots, directoryForPath } from './policy-roots.js';
+import * as logger from '../logger.js';
+export class TrustedProcess {
+    config;
+    policyEngine;
+    mcpManager;
+    mcpRoots;
+    auditLog;
+    escalation;
+    onEscalation;
+    constructor(config, options) {
+        this.config = config;
+        const { compiledPolicy, toolAnnotations } = loadGeneratedPolicy(config.generatedDir);
+        const serverDomainAllowlists = extractServerDomainAllowlists(config.mcpServers);
+        this.policyEngine = new PolicyEngine(compiledPolicy, toolAnnotations, config.protectedPaths, config.allowedDirectory, serverDomainAllowlists);
+        const policyRoots = extractPolicyRoots(compiledPolicy, config.allowedDirectory);
+        this.mcpRoots = toMcpRoots(policyRoots);
+        this.mcpManager = new MCPClientManager();
+        this.auditLog = new AuditLog(config.auditLogPath);
+        this.escalation = new EscalationHandler();
+        this.onEscalation = options?.onEscalation;
+    }
+    async initialize() {
+        for (const [name, serverConfig] of Object.entries(this.config.mcpServers)) {
+            logger.info(`Connecting to MCP server: ${name}...`);
+            await this.mcpManager.connect(name, serverConfig, this.mcpRoots);
+            logger.info(`Connected to MCP server: ${name}`);
+        }
+    }
+    async listTools(serverName) {
+        return this.mcpManager.listTools(serverName);
+    }
+    /**
+     * Handles a tool call request through the full trusted process lifecycle:
+     *   1. Evaluate policy (allow / deny / escalate)
+     *   2. If escalated, prompt the human for approval
+     *   3. If allowed, forward to the real MCP server
+     *   4. Log the complete decision trace to the audit log
+     *   5. Return the result to the caller
+     */
+    async handleToolCall(request) {
+        const startTime = Date.now();
+        // Annotation-driven normalization: split into transport vs policy args
+        const annotation = this.policyEngine.getAnnotation(request.serverName, request.toolName);
+        const { argsForTransport, argsForPolicy } = prepareToolArgs(request.arguments, annotation, this.config.allowedDirectory);
+        const policyRequest = { ...request, arguments: argsForPolicy };
+        const transportRequest = { ...request, arguments: argsForTransport };
+        // Step 1: Evaluate request against the policy rule chain
+        const evaluation = this.policyEngine.evaluate(policyRequest);
+        const policyDecision = {
+            status: evaluation.decision,
+            rule: evaluation.rule,
+            reason: evaluation.reason,
+        };
+        let escalationResult;
+        let resultContent;
+        let resultStatus;
+        let resultError;
+        try {
+            // Step 2: Handle escalation via human approval
+            if (evaluation.decision === 'escalate') {
+                escalationResult = this.onEscalation
+                    ? await this.onEscalation(transportRequest, evaluation.reason)
+                    : await this.escalation.prompt(transportRequest, evaluation.reason);
+                if (escalationResult === 'approved') {
+                    policyDecision.status = 'allow';
+                    policyDecision.reason = 'Approved by human during escalation';
+                    // Expand roots to include target directories so the filesystem
+                    // server accepts the forwarded call.
+                    const paths = Object.values(transportRequest.arguments).filter((v) => typeof v === 'string');
+                    for (const p of paths) {
+                        const dir = directoryForPath(p);
+                        await this.mcpManager.addRoot(transportRequest.serverName, {
+                            uri: `file://${dir}`,
+                            name: 'escalation-approved',
+                        });
+                    }
+                }
+                else {
+                    policyDecision.status = 'deny';
+                    policyDecision.reason = 'Denied by human during escalation';
+                }
+            }
+            // Step 3: Forward to MCP server or deny (using transport args)
+            if (policyDecision.status === 'allow') {
+                const mcpResult = await this.mcpManager.callTool(transportRequest.serverName, transportRequest.toolName, transportRequest.arguments);
+                resultContent = mcpResult;
+                if (mcpResult.isError) {
+                    resultStatus = 'error';
+                    const content = mcpResult.content;
+                    if (Array.isArray(content)) {
+                        resultError = content
+                            .filter((c) => c.type === 'text' && typeof c.text === 'string')
+                            .map((c) => c.text)
+                            .join('\n');
+                    }
+                }
+                else {
+                    resultStatus = 'success';
+                }
+            }
+            else {
+                resultContent = { denied: true, reason: policyDecision.reason };
+                resultStatus = 'denied';
+            }
+        }
+        catch (err) {
+            resultStatus = 'error';
+            resultError = err instanceof Error ? err.message : String(err);
+            resultContent = { error: resultError };
+        }
+        const durationMs = Date.now() - startTime;
+        // Step 4: Append-only audit log (records argsForTransport -- what was sent to MCP server)
+        const auditEntry = {
+            timestamp: new Date().toISOString(),
+            requestId: transportRequest.requestId,
+            serverName: transportRequest.serverName,
+            toolName: transportRequest.toolName,
+            arguments: transportRequest.arguments,
+            policyDecision,
+            escalationResult,
+            result: {
+                status: resultStatus,
+                content: resultStatus === 'success' ? resultContent : undefined,
+                error: resultError,
+            },
+            durationMs,
+        };
+        this.auditLog.log(auditEntry);
+        // Step 5: Return result to caller
+        return {
+            requestId: transportRequest.requestId,
+            status: resultStatus,
+            content: resultContent,
+            policyDecision,
+            durationMs,
+        };
+    }
+    async shutdown() {
+        this.escalation.close();
+        await this.mcpManager.closeAll();
+        await this.auditLog.close();
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/trusted-process/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAQvC,MAAM,OAAO,cAAc;IAQL;IAPZ,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,QAAQ,CAAY;IACpB,QAAQ,CAAW;IACnB,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IAE1C,YAAoB,MAAyB,EAAE,OAA+B;QAA1D,WAAM,GAAN,MAAM,CAAmB;QAC3C,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErF,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,cAAc,EAAE,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;QAE9I,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,UAAU;QACd,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAK,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzF,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzH,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAErE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAmB;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,gBAAmD,CAAC;QACxD,IAAI,aAAsB,CAAC;QAC3B,IAAI,YAA4C,CAAC;QACjD,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,+CAA+C;YAC/C,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACvC,gBAAgB,GAAG,IAAI,CAAC,YAAY;oBAClC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC;oBAC9D,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBAEtE,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;oBACpC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;oBAChC,cAAc,CAAC,MAAM,GAAG,qCAAqC,CAAC;oBAE9D,+DAA+D;oBAC/D,qCAAqC;oBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;wBACtB,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE;4BACzD,GAAG,EAAE,UAAU,GAAG,EAAE;4BACpB,IAAI,EAAE,qBAAqB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;oBAC/B,cAAc,CAAC,MAAM,GAAG,mCAAmC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC9C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CACiB,CAAC;gBAC9C,aAAa,GAAG,SAAS,CAAC;gBAE1B,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,OAAO,CAAC;oBACvB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;oBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC3B,WAAW,GAAG,OAAO;6BAClB,MAAM,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;6BACvF,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC;6BACrD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,GAAG,SAAS,CAAC;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChE,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,WAAW,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,0FAA0F;QAC1F,MAAM,UAAU,GAAe;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,cAAc;YACd,gBAAgB;YAChB,MAAM,EAAE;gBACN,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC/D,KAAK,EAAE,WAAW;aACnB;YACD,UAAU;SACX,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9B,kCAAkC;QAClC,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,cAAc;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/trusted-process/mcp-client-manager.d.ts

@@ -0,0 +1,25 @@
+import type { MCPServerConfig } from '../config/types.js';
+export interface McpRoot {
+    uri: string;
+    name: string;
+}
+export declare class MCPClientManager {
+    private servers;
+    connect(name: string, config: MCPServerConfig, roots?: McpRoot[]): Promise<void>;
+    /**
+     * Adds a root directory to a connected server and waits for the
+     * server to fetch the updated root list. This ensures the server's
+     * allowed directories include the new root before any tool call
+     * that depends on it is forwarded.
+     *
+     * No-op if the root URI is already present.
+     */
+    addRoot(serverName: string, root: McpRoot): Promise<void>;
+    listTools(serverName: string): Promise<{
+        name: string;
+        description?: string;
+        inputSchema: unknown;
+    }[]>;
+    callTool(serverName: string, toolName: string, args: Record<string, unknown>): Promise<unknown>;
+    closeAll(): Promise<void>;
+}

package/dist/trusted-process/mcp-client-manager.js

@@ -0,0 +1,90 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { CompatibilityCallToolResultSchema, ListRootsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import * as logger from '../logger.js';
+export class MCPClientManager {
+    servers = new Map();
+    async connect(name, config, roots) {
+        const transport = new StdioClientTransport({
+            command: config.command,
+            args: config.args,
+            env: config.env ? { ...process.env, ...config.env } : undefined,
+        });
+        const client = new Client({ name: 'ironcurtain', version: '0.1.0' }, roots ? { capabilities: { roots: { listChanged: true } } } : {});
+        // Mutable copy -- addRoot() pushes to this array.
+        const mutableRoots = roots ? [...roots] : undefined;
+        const managed = { client, transport, roots: mutableRoots };
+        // When the server asks for roots, return the current set.
+        // If a rootsRefreshed callback is registered (from addRoot),
+        // resolve it so the caller knows the server has the latest roots.
+        if (mutableRoots) {
+            client.setRequestHandler(ListRootsRequestSchema, async () => {
+                if (managed.rootsRefreshed) {
+                    managed.rootsRefreshed();
+                    managed.rootsRefreshed = undefined;
+                }
+                return { roots: mutableRoots };
+            });
+        }
+        await client.connect(transport);
+        this.servers.set(name, managed);
+    }
+    /**
+     * Adds a root directory to a connected server and waits for the
+     * server to fetch the updated root list. This ensures the server's
+     * allowed directories include the new root before any tool call
+     * that depends on it is forwarded.
+     *
+     * No-op if the root URI is already present.
+     */
+    async addRoot(serverName, root) {
+        const server = this.servers.get(serverName);
+        if (!server?.roots)
+            return;
+        // Deduplicate
+        if (server.roots.some(r => r.uri === root.uri))
+            return;
+        server.roots.push(root);
+        // Wait for the server to call roots/list after we notify it.
+        const refreshed = new Promise(resolve => {
+            server.rootsRefreshed = resolve;
+        });
+        await server.client.sendRootsListChanged();
+        await refreshed;
+    }
+    async listTools(serverName) {
+        const server = this.servers.get(serverName);
+        if (!server) {
+            throw new Error(`MCP server "${serverName}" not connected`);
+        }
+        const result = await server.client.listTools();
+        return result.tools.map(tool => ({
+            name: tool.name,
+            description: tool.description,
+            inputSchema: tool.inputSchema,
+        }));
+    }
+    async callTool(serverName, toolName, args) {
+        const server = this.servers.get(serverName);
+        if (!server) {
+            throw new Error(`MCP server "${serverName}" not connected`);
+        }
+        // TODO(workaround): Remove once @cyanheads/git-mcp-server fixes outputSchema declarations.
+        // See the detailed comment in mcp-proxy-server.ts for full context.
+        // CompatibilityCallToolResultSchema bypasses client-side output schema validation that
+        // fails when servers declare outputSchema but return non-conforming structuredContent.
+        return server.client.callTool({ name: toolName, arguments: args }, CompatibilityCallToolResultSchema);
+    }
+    async closeAll() {
+        for (const [name, server] of this.servers) {
+            try {
+                await server.client.close();
+            }
+            catch (err) {
+                logger.error(`Error closing MCP server "${name}": ${err}`);
+            }
+        }
+        this.servers.clear();
+    }
+}
+//# sourceMappingURL=mcp-client-manager.js.map

package/dist/trusted-process/mcp-client-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-client-manager.js","sourceRoot":"","sources":["../../src/trusted-process/mcp-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAcvC,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,MAAuB,EACvB,KAAiB;QAEjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAA6B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAC1F,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAChE,CAAC;QAEF,kDAAkD;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,MAAM,OAAO,GAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAE1E,0DAA0D;QAC1D,6DAA6D;QAC7D,kEAAkE;QAClE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;gBAC1D,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;oBACzB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;gBACrC,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,IAAa;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,OAAO;QAE3B,cAAc;QACd,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExB,6DAA6D;QAC7D,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YAC5C,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC3C,MAAM,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAgB,EAAE,IAA6B;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,2FAA2F;QAC3F,oEAAoE;QACpE,uFAAuF;QACvF,uFAAuF;QACvF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/trusted-process/mcp-proxy-server.d.ts

@@ -0,0 +1,24 @@
+/**
+ * MCP Proxy Server -- The trusted process running as a standalone MCP server.
+ *
+ * Code Mode spawns this as a child process via stdio transport. It acts
+ * as the security boundary between the sandbox and real MCP servers:
+ *
+ * 1. Connects to real MCP servers as a client
+ * 2. Exposes their tools with passthrough schemas
+ * 3. Evaluates every tool call against the policy engine
+ * 4. Forwards allowed calls to real servers, denies or escalates others
+ * 5. Logs every request and decision to the append-only audit log
+ *
+ * Configuration via environment variables:
+ *   AUDIT_LOG_PATH     -- path to the audit log file
+ *   MCP_SERVERS_CONFIG -- JSON string of MCP server configs to proxy
+ *   GENERATED_DIR      -- path to the generated artifacts directory
+ *   PROTECTED_PATHS    -- JSON array of protected paths
+ *   ALLOWED_DIRECTORY  -- (optional) sandbox directory for structural containment check
+ *   ESCALATION_DIR     -- (optional) directory for file-based escalation IPC
+ *   SESSION_LOG_PATH   -- (optional) path for capturing child process stderr
+ *   SANDBOX_POLICY     -- (optional) "enforce" | "warn" (default: "warn")
+ *   SERVER_FILTER      -- (optional) when set, only connect to this single server name
+ */
+export {};