@provos/ironcurtain 0.4.0 → 0.5.0

package/dist/trusted-process/index.js

@@ -9,6 +9,8 @@ import { autoApprove } from './auto-approver.js';
 import { prepareToolArgs } from './path-utils.js';
 import { extractPolicyRoots, toMcpRoots, directoryForPath } from './policy-roots.js';
 import * as logger from '../logger.js';
+import { extractMcpErrorMessage } from './mcp-error-utils.js';
+import { updateServerContext, formatServerContext } from './server-context.js';
 export class TrustedProcess {
     config;
     policyEngine;
@@ -19,6 +21,7 @@ export class TrustedProcess {
     onEscalation;
     autoApproveModel = null;
     lastUserMessage = null;
+    serverContextMap = new Map();
     constructor(config, options) {
         this.config = config;
         const { compiledPolicy, toolAnnotations, dynamicLists } = loadGeneratedPolicy(config.generatedDir, getPackageGeneratedDir());
@@ -28,7 +31,9 @@ export class TrustedProcess {
         const policyRoots = extractPolicyRoots(compiledPolicy, config.allowedDirectory);
         this.mcpRoots = toMcpRoots(policyRoots);
         this.mcpManager = new MCPClientManager();
-        this.auditLog = new AuditLog(config.auditLogPath);
+        this.auditLog = new AuditLog(config.auditLogPath, {
+            redact: config.userConfig.auditRedaction.enabled,
+        });
         this.escalation = new EscalationHandler();
         this.onEscalation = options?.onEscalation;
     }
@@ -40,10 +45,21 @@ export class TrustedProcess {
         this.lastUserMessage = message;
     }
     async initialize() {
+        const failedServers = [];
         for (const [name, serverConfig] of Object.entries(this.config.mcpServers)) {
             logger.info(`Connecting to MCP server: ${name}...`);
-            await this.mcpManager.connect(name, serverConfig, this.mcpRoots);
-            logger.info(`Connected to MCP server: ${name}`);
+            try {
+                await this.mcpManager.connect(name, serverConfig, this.mcpRoots);
+                logger.info(`Connected to MCP server: ${name}`);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                logger.warn(`Failed to connect to MCP server '${name}': ${msg} — skipping`);
+                failedServers.push(name);
+            }
+        }
+        if (failedServers.length > 0) {
+            logger.warn(`Unavailable MCP servers: ${failedServers.join(', ')}. Their tools will not be available.`);
         }
         // Create auto-approve model if enabled
         const autoApproveConfig = this.config.userConfig.autoApprove;
@@ -117,9 +133,10 @@ export class TrustedProcess {
                 }
                 // Fall through to human escalation if not auto-approved
                 if (!autoApproved) {
+                    const escalationContext = formatServerContext(this.serverContextMap, transportRequest.serverName);
                     escalationResult = this.onEscalation
-                        ? await this.onEscalation(transportRequest, evaluation.reason)
-                        : await this.escalation.prompt(transportRequest, evaluation.reason);
+                        ? await this.onEscalation(transportRequest, evaluation.reason, escalationContext)
+                        : await this.escalation.prompt(transportRequest, evaluation.reason, escalationContext);
                     if (escalationResult === 'approved') {
                         policyDecision.status = 'allow';
                         policyDecision.reason = 'Approved by human during escalation';
@@ -158,6 +175,7 @@ export class TrustedProcess {
                 }
                 else {
                     resultStatus = 'success';
+                    updateServerContext(this.serverContextMap, transportRequest.serverName, transportRequest.toolName, transportRequest.arguments);
                 }
             }
             else {
@@ -167,7 +185,7 @@ export class TrustedProcess {
         }
         catch (err) {
             resultStatus = 'error';
-            resultError = err instanceof Error ? err.message : String(err);
+            resultError = extractMcpErrorMessage(err);
             resultContent = { error: resultError };
         }
         const durationMs = Date.now() - startTime;

package/dist/trusted-process/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAQvC,MAAM,OAAO,cAAc;IAWf;IAVF,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,QAAQ,CAAY;IACpB,QAAQ,CAAW;IACnB,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IAClC,gBAAgB,GAA2B,IAAI,CAAC;IAChD,eAAe,GAAkB,IAAI,CAAC;IAE9C,YACU,MAAyB,EACjC,OAA+B;QADvB,WAAM,GAAN,MAAM,CAAmB;QAGjC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAC3E,MAAM,CAAC,YAAY,EACnB,sBAAsB,EAAE,CACzB,CAAC;QACF,0BAA0B,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEpE,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,cAAc,EACd,eAAe,EACf,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,sBAAsB,EACtB,YAAY,CACb,CAAC;QAEF,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAK,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7D,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,gCAAgC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,kDAAkD,CAAC;YACzI,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;gBACjC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE;gBACtE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,eAAe,CACzD,OAAO,CAAC,SAAS,EACjB,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC;QACF,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAErE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAmB;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,gBAAmD,CAAC;QACxD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,aAAsB,CAAC;QAC3B,IAAI,YAA4C,CAAC;QACjD,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,kEAAkE;YAClE,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACvC,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC;wBACE,WAAW,EAAE,IAAI,CAAC,eAAe;wBACjC,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACrD,gBAAgB,EAAE,UAAU,CAAC,MAAM;qBACpC,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBAEF,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACtC,YAAY,GAAG,IAAI,CAAC;wBACpB,gBAAgB,GAAG,UAAU,CAAC;wBAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,kBAAkB,UAAU,CAAC,SAAS,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;gBAED,wDAAwD;gBACxD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,gBAAgB,GAAG,IAAI,CAAC,YAAY;wBAClC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC;wBAC9D,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;oBAEtE,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;wBACpC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,qCAAqC,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;wBAC/B,cAAc,CAAC,MAAM,GAAG,mCAAmC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAED,+DAA+D;gBAC/D,wEAAwE;gBACxE,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,UAAU,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE;4BACzD,GAAG,EAAE,UAAU,GAAG,EAAE;4BACpB,IAAI,EAAE,qBAAqB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC/C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAA6C,CAAC;gBAC/C,aAAa,GAAG,SAAS,CAAC;gBAE1B,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,OAAO,CAAC;oBACvB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;oBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC3B,WAAW,GAAG,OAAO;6BAClB,MAAM,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;6BACvF,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC;6BACrD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,GAAG,SAAS,CAAC;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChE,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,WAAW,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,0FAA0F;QAC1F,MAAM,UAAU,GAAe;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,cAAc;YACd,gBAAgB;YAChB,MAAM,EAAE;gBACN,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC/D,KAAK,EAAE,WAAW;aACnB;YACD,UAAU;YACV,YAAY,EAAE,YAAY,IAAI,SAAS;SACxC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9B,kCAAkC;QAClC,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,cAAc;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trusted-process/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAyB,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAYtG,MAAM,OAAO,cAAc;IAYf;IAXF,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,QAAQ,CAAY;IACpB,QAAQ,CAAW;IACnB,UAAU,CAAoB;IAC9B,YAAY,CAAsB;IAClC,gBAAgB,GAA2B,IAAI,CAAC;IAChD,eAAe,GAAkB,IAAI,CAAC;IACtC,gBAAgB,GAAqB,IAAI,GAAG,EAAE,CAAC;IAEvD,YACU,MAAyB,EACjC,OAA+B;QADvB,WAAM,GAAN,MAAM,CAAmB;QAGjC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAC3E,MAAM,CAAC,YAAY,EACnB,sBAAsB,EAAE,CACzB,CAAC;QACF,0BAA0B,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEpE,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,cAAc,EACd,eAAe,EACf,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,sBAAsB,EACtB,YAAY,CACb,CAAC;QAEF,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC;gBAC5E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC1G,CAAC;QAED,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7D,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,0CAA0C;gBAC1C,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,gCAAgC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,kDAAkD,CAAC;YACzI,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;gBACjC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE;gBACtE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,eAAe,CACzD,OAAO,CAAC,SAAS,EACjB,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC;QACF,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAErE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAmB;YACrC,MAAM,EAAE,UAAU,CAAC,QAAQ;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,gBAAmD,CAAC;QACxD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,aAAsB,CAAC;QAC3B,IAAI,YAA4C,CAAC;QACjD,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,kEAAkE;YAClE,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACvC,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,MAAM,WAAW,CAClC;wBACE,WAAW,EAAE,IAAI,CAAC,eAAe;wBACjC,QAAQ,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE;wBACrD,gBAAgB,EAAE,UAAU,CAAC,MAAM;qBACpC,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBAEF,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACtC,YAAY,GAAG,IAAI,CAAC;wBACpB,gBAAgB,GAAG,UAAU,CAAC;wBAC9B,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,kBAAkB,UAAU,CAAC,SAAS,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;gBAED,wDAAwD;gBACxD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;oBAClG,gBAAgB,GAAG,IAAI,CAAC,YAAY;wBAClC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC;wBACjF,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;oBAEzF,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;wBACpC,cAAc,CAAC,MAAM,GAAG,OAAO,CAAC;wBAChC,cAAc,CAAC,MAAM,GAAG,qCAAqC,CAAC;oBAChE,CAAC;yBAAM,CAAC;wBACN,cAAc,CAAC,MAAM,GAAG,MAAM,CAAC;wBAC/B,cAAc,CAAC,MAAM,GAAG,mCAAmC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAED,+DAA+D;gBAC/D,wEAAwE;gBACxE,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,UAAU,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE;4BACzD,GAAG,EAAE,UAAU,GAAG,EAAE;4BACpB,IAAI,EAAE,qBAAqB;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAC/C,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAA6C,CAAC;gBAC/C,aAAa,GAAG,SAAS,CAAC;gBAE1B,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,OAAO,CAAC;oBACvB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;oBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC3B,WAAW,GAAG,OAAO;6BAClB,MAAM,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;6BACvF,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC;6BACrD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,YAAY,GAAG,SAAS,CAAC;oBACzB,mBAAmB,CACjB,IAAI,CAAC,gBAAgB,EACrB,gBAAgB,CAAC,UAAU,EAC3B,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,SAAS,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAChE,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,OAAO,CAAC;YACvB,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;YAC1C,aAAa,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,0FAA0F;QAC1F,MAAM,UAAU,GAAe;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,cAAc;YACd,gBAAgB;YAChB,MAAM,EAAE;gBACN,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC/D,KAAK,EAAE,WAAW;aACnB;YACD,UAAU;YACV,YAAY,EAAE,YAAY,IAAI,SAAS;SACxC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9B,kCAAkC;QAClC,OAAO;YACL,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,cAAc;YACd,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/trusted-process/mcp-client-manager.js

@@ -10,7 +10,7 @@ export class MCPClientManager {
         const transport = new StdioClientTransport({
             command: config.command,
             args: config.args,
-            env: config.env ? { ...process.env, ...config.env } : undefined,
+            env: { ...process.env, ...config.env },
         });
         const client = new Client({ name: 'ironcurtain', version: VERSION }, roots ? { capabilities: { roots: { listChanged: true } } } : {});
         // Mutable copy -- addRoot() pushes to this array.
@@ -28,7 +28,19 @@ export class MCPClientManager {
                 return { roots: mutableRoots };
             });
         }
-        await client.connect(transport);
+        try {
+            await client.connect(transport);
+        }
+        catch (err) {
+            // Clean up the spawned subprocess so it doesn't leak.
+            try {
+                await client.close();
+            }
+            catch {
+                // best-effort
+            }
+            throw err;
+        }
         this.servers.set(name, managed);
     }
     /**

package/dist/trusted-process/mcp-client-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-client-manager.js","sourceRoot":"","sources":["../../src/trusted-process/mcp-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE/G,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAc9C,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAuB,EAAE,KAAiB;QACpE,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAC5F,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAChE,CAAC;QAEF,kDAAkD;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,MAAM,OAAO,GAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAE1E,0DAA0D;QAC1D,6DAA6D;QAC7D,kEAAkE;QAClE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,EAAE;gBACpD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;oBACzB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;gBACrC,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,IAAa;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,OAAO;QAE3B,cAAc;QACd,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO;QACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExB,6DAA6D;QAC7D,IAAI,KAAoC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC9C,MAAM,CAAC,cAAc,GAAG,GAAG,EAAE;gBAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAgB,EAAE,IAA6B;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,2FAA2F;QAC3F,oEAAoE;QACpE,uFAAuF;QACvF,uFAAuF;QACvF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"mcp-client-manager.js","sourceRoot":"","sources":["../../src/trusted-process/mcp-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE/G,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAc9C,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAuB,EAAE,KAAiB;QACpE,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;SACnE,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAChE,CAAC;QAEF,kDAAkD;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,MAAM,OAAO,GAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAE1E,0DAA0D;QAC1D,6DAA6D;QAC7D,kEAAkE;QAClE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,EAAE;gBACpD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;oBACzB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;gBACrC,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,IAAa;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,OAAO;QAE3B,cAAc;QACd,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO;QACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExB,6DAA6D;QAC7D,IAAI,KAAoC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC9C,MAAM,CAAC,cAAc,GAAG,GAAG,EAAE;gBAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAgB,EAAE,IAA6B;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,2FAA2F;QAC3F,oEAAoE;QACpE,uFAAuF;QACvF,uFAAuF;QACvF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/trusted-process/mcp-error-utils.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Extracts a meaningful error message from an MCP server error.
+ *
+ * Schema validation errors (code -32602) often wrap the real server error
+ * inside `err.data`. This function digs into the data to surface
+ * the original message instead of the opaque schema mismatch text.
+ *
+ * For other McpError instances, strips the "MCP error -NNNNN: " prefix.
+ * Falls back to err.message or String(err) for non-MCP errors.
+ */
+export declare function extractMcpErrorMessage(err: unknown): string;

package/dist/trusted-process/mcp-error-utils.js

@@ -0,0 +1,50 @@
+import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+/**
+ * Extracts a meaningful error message from an MCP server error.
+ *
+ * Schema validation errors (code -32602) often wrap the real server error
+ * inside `err.data`. This function digs into the data to surface
+ * the original message instead of the opaque schema mismatch text.
+ *
+ * For other McpError instances, strips the "MCP error -NNNNN: " prefix.
+ * Falls back to err.message or String(err) for non-MCP errors.
+ */
+export function extractMcpErrorMessage(err) {
+    if (!(err instanceof McpError)) {
+        return err instanceof Error ? err.message : String(err);
+    }
+    // Schema validation errors wrap the real error in `data`
+    if (err.code === ErrorCode.InvalidParams && err.data != null) {
+        const extracted = extractFromData(err.data);
+        if (extracted)
+            return extracted;
+    }
+    // Strip the "MCP error -NNNNN: " prefix from the message
+    return stripMcpPrefix(err.message);
+}
+function extractFromData(data) {
+    if (typeof data === 'string' && data.length > 0)
+        return data;
+    if (typeof data === 'object' && data !== null) {
+        const obj = data;
+        if (typeof obj.message === 'string' && obj.message.length > 0)
+            return obj.message;
+        if (typeof obj.error === 'string' && obj.error.length > 0)
+            return obj.error;
+        // MCP content array: [{ type: "text", text: "..." }]
+        if (Array.isArray(obj.content)) {
+            for (const item of obj.content) {
+                const entry = item;
+                if (entry.type === 'text' && typeof entry.text === 'string') {
+                    return entry.text;
+                }
+            }
+        }
+    }
+    return undefined;
+}
+function stripMcpPrefix(message) {
+    const match = message.match(/^MCP error -\d+: (.+)$/s);
+    return match ? match[1] : message;
+}
+//# sourceMappingURL=mcp-error-utils.js.map

package/dist/trusted-process/mcp-error-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-error-utils.js","sourceRoot":"","sources":["../../src/trusted-process/mcp-error-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,yDAAyD;IACzD,IAAI,GAAG,CAAC,IAAI,KAAM,SAAS,CAAC,aAAwB,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IAED,yDAAyD;IACzD,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAA+B,CAAC;QAE5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QAClF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAE5E,qDAAqD;QACrD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,IAA+B,CAAC;gBAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC5D,OAAO,KAAK,CAAC,IAAI,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACpC,CAAC"}

package/dist/trusted-process/mcp-proxy-server.d.ts

@@ -19,10 +19,124 @@
  *   ESCALATION_DIR     -- (optional) directory for file-based escalation IPC
  *   SESSION_LOG_PATH   -- (optional) path for capturing child process stderr
  *   SANDBOX_POLICY     -- (optional) "enforce" | "warn" (default: "warn")
+ *   AUDIT_REDACTION    -- (optional) "true" to redact PII/credentials in audit log entries
  *   SERVER_FILTER      -- (optional) when set, only connect to this single server name
  *   AUTO_APPROVE_ENABLED   -- (optional) "true" to enable auto-approval of escalations
  *   AUTO_APPROVE_MODEL_ID  -- (optional) qualified model ID for auto-approve LLM
  *   AUTO_APPROVE_API_KEY   -- (optional) API key for the auto-approve model's provider
  *   AUTO_APPROVE_LLM_LOG_PATH -- (optional) path to JSONL file for auto-approve LLM logging
  */
-export {};
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { PolicyEngine } from './policy-engine.js';
+import { AuditLog } from './audit-log.js';
+import { type ResolvedSandboxConfig } from './sandbox-integration.js';
+import type { ToolCallRequest, PolicyDecision } from '../types/mcp.js';
+import type { AuditEntry } from '../types/audit.js';
+import { type McpRoot } from './mcp-client-manager.js';
+import { CallCircuitBreaker } from './call-circuit-breaker.js';
+import { type ServerContextMap } from './server-context.js';
+import type { LanguageModelV3 } from '@ai-sdk/provider';
+import type { MCPServerConfig, SandboxAvailabilityPolicy } from '../config/types.js';
+export interface ProxiedTool {
+    serverName: string;
+    name: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+}
+export interface ClientState {
+    client: Client;
+    roots: McpRoot[];
+    rootsRefreshed?: () => void;
+}
+/** Parsed environment configuration for the proxy server. */
+export interface ProxyEnvConfig {
+    auditLogPath: string;
+    serversConfig: Record<string, MCPServerConfig>;
+    generatedDir: string;
+    protectedPaths: string[];
+    sessionLogPath: string | undefined;
+    allowedDirectory: string | undefined;
+    containerWorkspaceDir: string | undefined;
+    escalationDir: string | undefined;
+    serverCredentials: Record<string, string>;
+    sandboxPolicy: SandboxAvailabilityPolicy;
+    auditRedaction: boolean;
+}
+/** Result of sandbox availability validation. */
+export interface SandboxValidationResult {
+    sandboxAvailable: boolean;
+}
+/** MCP tool call response shape returned by handleCallTool. */
+export interface ToolCallResponse {
+    content: unknown;
+    isError?: boolean;
+    [key: string]: unknown;
+}
+/** Dependencies injected into handleCallTool for testability. */
+export interface CallToolDeps {
+    toolMap: Map<string, ProxiedTool>;
+    policyEngine: PolicyEngine;
+    auditLog: AuditLog;
+    circuitBreaker: CallCircuitBreaker;
+    clientStates: Map<string, ClientState>;
+    resolvedSandboxConfigs: Map<string, ResolvedSandboxConfig>;
+    allowedDirectory: string | undefined;
+    containerWorkspaceDir: string | undefined;
+    escalationDir: string | undefined;
+    autoApproveModel: LanguageModelV3 | null;
+    serverContextMap: ServerContextMap;
+}
+/**
+ * Reads and validates proxy environment variables.
+ * Returns a typed config object or calls process.exit(1) on missing required vars.
+ */
+export declare function parseProxyEnvConfig(): ProxyEnvConfig;
+/**
+ * Validates sandbox availability against the configured policy.
+ * Logs warnings to session log. Throws when enforce mode is active
+ * but sandboxing is unavailable.
+ */
+export declare function validateSandboxAvailability(sandboxPolicy: SandboxAvailabilityPolicy, sessionLogPath: string | undefined, platform: string): SandboxValidationResult;
+/**
+ * Resolves per-server sandbox configurations and writes srt settings
+ * files for sandboxed servers. Returns the config map and the temp
+ * settings directory path.
+ */
+export declare function resolveServerSandboxConfigs(serversConfig: Record<string, MCPServerConfig>, allowedDirectory: string | undefined, sandboxAvailable: boolean, sandboxPolicy: SandboxAvailabilityPolicy): {
+    resolvedSandboxConfigs: Map<string, ResolvedSandboxConfig>;
+    settingsDir: string;
+    serverCwdPaths: Map<string, string>;
+};
+/** Builds a lookup map from tool name to ProxiedTool for routing. */
+export declare function buildToolMap(allTools: ProxiedTool[]): Map<string, ProxiedTool>;
+/**
+ * Creates an audit entry and logs it. Extracted so the audit shape
+ * construction is testable independently.
+ */
+export declare function buildAuditEntry(request: ToolCallRequest, argsForTransport: Record<string, unknown>, policyDecision: PolicyDecision, result: AuditEntry['result'], durationMs: number, options: {
+    escalationResult?: 'approved' | 'denied';
+    sandboxed?: boolean;
+    autoApproved?: boolean;
+}): AuditEntry;
+/**
+ * Handles a single tool call request: policy evaluation, escalation,
+ * circuit breaker check, and forwarding to the real MCP server.
+ *
+ * This is the core security logic extracted from the CallTool handler
+ * for independent unit testing.
+ */
+export declare function handleCallTool(toolName: string, rawArgs: Record<string, unknown>, deps: CallToolDeps): Promise<ToolCallResponse>;
+/**
+ * Selects and validates the proxy transport based on environment variables.
+ * Returns 'tcp', 'uds', or 'stdio' along with the transport options.
+ */
+export declare function selectTransportConfig(): {
+    kind: 'tcp';
+    port: number;
+    portFilePath: string | undefined;
+} | {
+    kind: 'uds';
+    socketPath: string;
+} | {
+    kind: 'stdio';
+};