@provos/ironcurtain 0.3.1 → 0.4.1

package/dist/signal/signal-container.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Manages the signal-cli-rest-api Docker container.
+ *
+ * Unlike agent containers (per-session, ephemeral, --network=none),
+ * the signal-cli container is a long-lived background service that
+ * needs network access to communicate with Signal servers.
+ *
+ * Delegates to DockerManager for all Docker CLI operations.
+ */
+import type { DockerManager } from '../docker/types.js';
+/** Configuration for the signal-cli Docker container. */
+export interface SignalContainerConfig {
+    /** Docker image name with tag. */
+    readonly image: string;
+    /** Host port to bind the REST API to. */
+    readonly port: number;
+    /** Host directory for signal-cli persistent data. */
+    readonly dataDir: string;
+    /** Container name for identification. */
+    readonly containerName: string;
+}
+/** Manages the signal-cli-rest-api Docker container. */
+export interface SignalContainerManager {
+    /** Ensures the container is running. Returns the REST API base URL. Idempotent. */
+    ensureRunning(): Promise<string>;
+    /** Polls GET /v1/health until the REST API responds. */
+    waitForHealthy(baseUrl: string, timeoutMs?: number): Promise<void>;
+    /** Stops and removes the container. */
+    teardown(): Promise<void>;
+    /** Pulls the latest version of the configured Docker image. */
+    pullImage(): Promise<void>;
+    /** Returns true if the container exists (running or stopped). */
+    exists(): Promise<boolean>;
+    /** Returns true if the container is currently running. */
+    isRunning(): Promise<boolean>;
+}
+export declare function createSignalContainerManager(docker: DockerManager, config: SignalContainerConfig): SignalContainerManager;

package/dist/signal/signal-container.js

@@ -0,0 +1,112 @@
+/**
+ * Manages the signal-cli-rest-api Docker container.
+ *
+ * Unlike agent containers (per-session, ephemeral, --network=none),
+ * the signal-cli container is a long-lived background service that
+ * needs network access to communicate with Signal servers.
+ *
+ * Delegates to DockerManager for all Docker CLI operations.
+ */
+import { mkdirSync } from 'node:fs';
+import { getSignalDataDir } from './signal-config.js';
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export function createSignalContainerManager(docker, config) {
+    const resolvedDataDir = config.dataDir || getSignalDataDir();
+    return {
+        async ensureRunning() {
+            const baseUrl = `http://127.0.0.1:${config.port}`;
+            // Pull latest image (fast no-op when already up to date)
+            try {
+                await docker.pullImage(config.image);
+            }
+            catch {
+                // Offline or registry unavailable - continue with cached image
+            }
+            // If container exists, check whether its image is current.
+            // If outdated, remove it so we recreate with the new image.
+            if (await docker.containerExists(config.containerName)) {
+                const containerId = await docker.getImageId(config.containerName);
+                const imageId = await docker.getImageId(config.image);
+                const outdated = containerId && imageId && containerId !== imageId;
+                if (outdated) {
+                    if (await docker.isRunning(config.containerName)) {
+                        await docker.stop(config.containerName);
+                    }
+                    await docker.remove(config.containerName);
+                    // Fall through to create below
+                }
+                else if (await docker.isRunning(config.containerName)) {
+                    return baseUrl;
+                }
+                else {
+                    await docker.start(config.containerName);
+                    return baseUrl;
+                }
+            }
+            // Create new container via DockerManager.create()
+            mkdirSync(resolvedDataDir, { recursive: true });
+            await docker.create({
+                image: config.image,
+                name: config.containerName,
+                network: 'bridge',
+                ports: [`127.0.0.1:${config.port}:8080`],
+                restartPolicy: 'unless-stopped',
+                // The signal-cli-rest-api entrypoint needs capabilities for:
+                //   CHOWN, FOWNER - jsonrpc2-helper creates FIFOs and sets permissions
+                //   DAC_OVERRIDE  - root writes config to UID-1000-owned volume
+                //   SETUID/SETGID - usermod/groupmod + setpriv to drop privileges
+                //   KILL          - supervisor manages signal-cli child process
+                capAdd: ['CHOWN', 'DAC_OVERRIDE', 'FOWNER', 'SETUID', 'SETGID', 'KILL'],
+                mounts: [
+                    {
+                        source: resolvedDataDir,
+                        target: '/home/.local/share/signal-cli',
+                        readonly: false,
+                    },
+                ],
+                env: {
+                    MODE: 'json-rpc',
+                    // Skip recursive chown on data dir - it's already owned by
+                    // UID 1000 (matching the container's signal-api user).
+                    SIGNAL_CLI_CHOWN_ON_STARTUP: 'false',
+                },
+                command: [],
+            });
+            await docker.start(config.containerName);
+            return baseUrl;
+        },
+        async waitForHealthy(baseUrl, timeoutMs = 30_000) {
+            const start = Date.now();
+            let delay = 500;
+            while (Date.now() - start < timeoutMs) {
+                try {
+                    const resp = await fetch(`${baseUrl}/v1/health`);
+                    if (resp.status === 204)
+                        return;
+                }
+                catch {
+                    // Container starting up
+                }
+                await sleep(delay);
+                delay = Math.min(delay * 1.5, 3000);
+            }
+            throw new Error(`signal-cli container did not become healthy within ${timeoutMs}ms`);
+        },
+        async teardown() {
+            await docker.stop(config.containerName);
+            await docker.remove(config.containerName);
+        },
+        async pullImage() {
+            await docker.pullImage(config.image);
+        },
+        async exists() {
+            return docker.containerExists(config.containerName);
+        },
+        async isRunning() {
+            return docker.isRunning(config.containerName);
+        },
+    };
+}
+//# sourceMappingURL=signal-container.js.map

package/dist/signal/signal-container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-container.js","sourceRoot":"","sources":["../../src/signal/signal-container.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAmCtD,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,MAAqB,EACrB,MAA6B;IAE7B,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;IAE7D,OAAO;QACL,KAAK,CAAC,aAAa;YACjB,MAAM,OAAO,GAAG,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;YAElD,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;YAED,2DAA2D;YAC3D,4DAA4D;YAC5D,IAAI,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBACvD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBAClE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,WAAW,IAAI,OAAO,IAAI,WAAW,KAAK,OAAO,CAAC;gBAEnE,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;wBACjD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;oBAC1C,CAAC;oBACD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;oBAC1C,+BAA+B;gBACjC,CAAC;qBAAM,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;oBACxD,OAAO,OAAO,CAAC;gBACjB,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;oBACzC,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,kDAAkD;YAClD,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,MAAM,CAAC,MAAM,CAAC;gBAClB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,aAAa;gBAC1B,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,CAAC,aAAa,MAAM,CAAC,IAAI,OAAO,CAAC;gBACxC,aAAa,EAAE,gBAAgB;gBAC/B,6DAA6D;gBAC7D,uEAAuE;gBACvE,gEAAgE;gBAChE,kEAAkE;gBAClE,gEAAgE;gBAChE,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACvE,MAAM,EAAE;oBACN;wBACE,MAAM,EAAE,eAAe;wBACvB,MAAM,EAAE,+BAA+B;wBACvC,QAAQ,EAAE,KAAK;qBAChB;iBACF;gBACD,GAAG,EAAE;oBACH,IAAI,EAAE,UAAU;oBAChB,2DAA2D;oBAC3D,uDAAuD;oBACvD,2BAA2B,EAAE,OAAO;iBACrC;gBACD,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,SAAS,GAAG,MAAM;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,KAAK,GAAG,GAAG,CAAC;YAChB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC;oBACjD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;wBAAE,OAAO;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;gBACD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,IAAI,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACxC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,SAAS;YACb,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,SAAS;YACb,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/signal/signal-transport.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Signal session transport - thin adapter implementing the Transport interface.
+ *
+ * One SignalSessionTransport exists per session. It does not own the
+ * WebSocket or manage identity verification - those responsibilities
+ * belong to the SignalBotDaemon. The transport's job is to:
+ *
+ * 1. Block run() until close() is called (session lifetime)
+ * 2. Create callback factories that bridge session events to the daemon
+ */
+import type { Transport } from '../session/transport.js';
+import type { Session, DiagnosticEvent, EscalationRequest } from '../session/types.js';
+import type { SignalBotDaemon } from './signal-bot-daemon.js';
+export declare class SignalSessionTransport implements Transport {
+    private session;
+    private readonly daemon;
+    private exitResolve;
+    constructor(daemon: SignalBotDaemon);
+    /**
+     * Starts the transport. The returned promise resolves when
+     * close() is called, which signals that the session is done.
+     * This follows the same contract as CliTransport.run().
+     */
+    run(session: Session): Promise<void>;
+    /**
+     * Signals the transport to stop. Resolves the run() promise.
+     * Does NOT call daemon.endCurrentSession() - the daemon owns
+     * session lifecycle and calls this method, not the other way around.
+     */
+    close(): void;
+    createDiagnosticHandler(): (event: DiagnosticEvent) => void;
+    createEscalationHandler(): (request: EscalationRequest) => void;
+    createEscalationExpiredHandler(): () => void;
+}

package/dist/signal/signal-transport.js

@@ -0,0 +1,70 @@
+/**
+ * Signal session transport - thin adapter implementing the Transport interface.
+ *
+ * One SignalSessionTransport exists per session. It does not own the
+ * WebSocket or manage identity verification - those responsibilities
+ * belong to the SignalBotDaemon. The transport's job is to:
+ *
+ * 1. Block run() until close() is called (session lifetime)
+ * 2. Create callback factories that bridge session events to the daemon
+ */
+import { formatEscalationBanner } from './format.js';
+export class SignalSessionTransport {
+    session = null;
+    daemon;
+    exitResolve = null;
+    constructor(daemon) {
+        this.daemon = daemon;
+    }
+    /**
+     * Starts the transport. The returned promise resolves when
+     * close() is called, which signals that the session is done.
+     * This follows the same contract as CliTransport.run().
+     */
+    async run(session) {
+        this.session = session;
+        return new Promise((resolve) => {
+            this.exitResolve = resolve;
+        });
+    }
+    /**
+     * Signals the transport to stop. Resolves the run() promise.
+     * Does NOT call daemon.endCurrentSession() - the daemon owns
+     * session lifecycle and calls this method, not the other way around.
+     */
+    close() {
+        this.session = null;
+        this.exitResolve?.();
+        this.exitResolve = null;
+    }
+    // --- Callback factories (wired into SessionOptions by the daemon) ---
+    createDiagnosticHandler() {
+        return (event) => {
+            switch (event.kind) {
+                case 'tool_call':
+                    // Don't send every tool call - too noisy for messaging
+                    break;
+                case 'budget_warning':
+                    this.daemon.sendSignalMessage(`[Budget warning] ${event.message}`).catch(() => { });
+                    break;
+                case 'budget_exhausted':
+                    this.daemon.sendSignalMessage(`[Budget exhausted] ${event.message}`).catch(() => { });
+                    break;
+            }
+        };
+    }
+    createEscalationHandler() {
+        return (request) => {
+            this.daemon.setPendingEscalation(request.escalationId);
+            const banner = formatEscalationBanner(request);
+            this.daemon.sendSignalMessage(banner).catch(() => { });
+        };
+    }
+    createEscalationExpiredHandler() {
+        return () => {
+            this.daemon.clearPendingEscalation();
+            this.daemon.sendSignalMessage('Escalation expired (timed out).').catch(() => { });
+        };
+    }
+}
+//# sourceMappingURL=signal-transport.js.map

package/dist/signal/signal-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-transport.js","sourceRoot":"","sources":["../../src/signal/signal-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,OAAO,sBAAsB;IACzB,OAAO,GAAmB,IAAI,CAAC;IACtB,MAAM,CAAkB;IACjC,WAAW,GAAwB,IAAI,CAAC;IAEhD,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,OAAgB;QACxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,uEAAuE;IAEvE,uBAAuB;QACrB,OAAO,CAAC,KAAK,EAAE,EAAE;YACf,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,uDAAuD;oBACvD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,oBAAoB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACnF,MAAM;gBACR,KAAK,kBAAkB;oBACrB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACrF,MAAM;YACV,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,uBAAuB;QACrB,OAAO,CAAC,OAAO,EAAE,EAAE;YACjB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC;IACJ,CAAC;IAED,8BAA8B;QAC5B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,iCAAiC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnF,CAAC,CAAC;IACJ,CAAC;CACF"}

package/dist/trusted-process/mcp-proxy-server.d.ts

@@ -25,4 +25,114 @@
  *   AUTO_APPROVE_API_KEY   -- (optional) API key for the auto-approve model's provider
  *   AUTO_APPROVE_LLM_LOG_PATH -- (optional) path to JSONL file for auto-approve LLM logging
  */
-export {};
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { PolicyEngine } from './policy-engine.js';
+import { AuditLog } from './audit-log.js';
+import { type ResolvedSandboxConfig } from './sandbox-integration.js';
+import type { ToolCallRequest, PolicyDecision } from '../types/mcp.js';
+import type { AuditEntry } from '../types/audit.js';
+import { type McpRoot } from './mcp-client-manager.js';
+import { CallCircuitBreaker } from './call-circuit-breaker.js';
+import type { LanguageModelV3 } from '@ai-sdk/provider';
+import type { MCPServerConfig, SandboxAvailabilityPolicy } from '../config/types.js';
+export interface ProxiedTool {
+    serverName: string;
+    name: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+}
+export interface ClientState {
+    client: Client;
+    roots: McpRoot[];
+    rootsRefreshed?: () => void;
+}
+/** Parsed environment configuration for the proxy server. */
+export interface ProxyEnvConfig {
+    auditLogPath: string;
+    serversConfig: Record<string, MCPServerConfig>;
+    generatedDir: string;
+    protectedPaths: string[];
+    sessionLogPath: string | undefined;
+    allowedDirectory: string | undefined;
+    containerWorkspaceDir: string | undefined;
+    escalationDir: string | undefined;
+    serverCredentials: Record<string, string>;
+    sandboxPolicy: SandboxAvailabilityPolicy;
+}
+/** Result of sandbox availability validation. */
+export interface SandboxValidationResult {
+    sandboxAvailable: boolean;
+}
+/** MCP tool call response shape returned by handleCallTool. */
+export interface ToolCallResponse {
+    content: unknown;
+    isError?: boolean;
+    [key: string]: unknown;
+}
+/** Dependencies injected into handleCallTool for testability. */
+export interface CallToolDeps {
+    toolMap: Map<string, ProxiedTool>;
+    policyEngine: PolicyEngine;
+    auditLog: AuditLog;
+    circuitBreaker: CallCircuitBreaker;
+    clientStates: Map<string, ClientState>;
+    resolvedSandboxConfigs: Map<string, ResolvedSandboxConfig>;
+    allowedDirectory: string | undefined;
+    containerWorkspaceDir: string | undefined;
+    escalationDir: string | undefined;
+    autoApproveModel: LanguageModelV3 | null;
+}
+/**
+ * Reads and validates proxy environment variables.
+ * Returns a typed config object or calls process.exit(1) on missing required vars.
+ */
+export declare function parseProxyEnvConfig(): ProxyEnvConfig;
+/**
+ * Validates sandbox availability against the configured policy.
+ * Logs warnings to session log. Throws when enforce mode is active
+ * but sandboxing is unavailable.
+ */
+export declare function validateSandboxAvailability(sandboxPolicy: SandboxAvailabilityPolicy, sessionLogPath: string | undefined, platform: string): SandboxValidationResult;
+/**
+ * Resolves per-server sandbox configurations and writes srt settings
+ * files for sandboxed servers. Returns the config map and the temp
+ * settings directory path.
+ */
+export declare function resolveServerSandboxConfigs(serversConfig: Record<string, MCPServerConfig>, allowedDirectory: string | undefined, sandboxAvailable: boolean, sandboxPolicy: SandboxAvailabilityPolicy): {
+    resolvedSandboxConfigs: Map<string, ResolvedSandboxConfig>;
+    settingsDir: string;
+    serverCwdPaths: Map<string, string>;
+};
+/** Builds a lookup map from tool name to ProxiedTool for routing. */
+export declare function buildToolMap(allTools: ProxiedTool[]): Map<string, ProxiedTool>;
+/**
+ * Creates an audit entry and logs it. Extracted so the audit shape
+ * construction is testable independently.
+ */
+export declare function buildAuditEntry(request: ToolCallRequest, argsForTransport: Record<string, unknown>, policyDecision: PolicyDecision, result: AuditEntry['result'], durationMs: number, options: {
+    escalationResult?: 'approved' | 'denied';
+    sandboxed?: boolean;
+    autoApproved?: boolean;
+}): AuditEntry;
+/**
+ * Handles a single tool call request: policy evaluation, escalation,
+ * circuit breaker check, and forwarding to the real MCP server.
+ *
+ * This is the core security logic extracted from the CallTool handler
+ * for independent unit testing.
+ */
+export declare function handleCallTool(toolName: string, rawArgs: Record<string, unknown>, deps: CallToolDeps): Promise<ToolCallResponse>;
+/**
+ * Selects and validates the proxy transport based on environment variables.
+ * Returns 'tcp', 'uds', or 'stdio' along with the transport options.
+ */
+export declare function selectTransportConfig(): {
+    kind: 'tcp';
+    port: number;
+    portFilePath: string | undefined;
+} | {
+    kind: 'uds';
+    socketPath: string;
+} | {
+    kind: 'stdio';
+};