@provos/ironcurtain 0.7.2 → 0.9.0

package/dist/signal/signal-transport.js

@@ -17,9 +17,9 @@ export class SignalSessionTransport extends BaseTransport {
     exitResolve = null;
     /** Session label assigned by the daemon after construction. */
     sessionLabel = 0;
-    constructor(daemon) {
-        super();
-        this.daemon = daemon;
+    constructor(options) {
+        super(options);
+        this.daemon = options.daemon;
     }
     /**
      * Implements the session lifecycle. The returned promise resolves when

package/dist/signal/signal-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"signal-transport.js","sourceRoot":"","sources":["../../src/signal/signal-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAG7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAEvC,MAAM,OAAO,sBAAuB,SAAQ,aAAa;IAC/C,OAAO,GAAmB,IAAI,CAAC;IACtB,MAAM,CAAkB;IACjC,WAAW,GAAwB,IAAI,CAAC;IAEhD,+DAA+D;IAC/D,YAAY,GAAG,CAAC,CAAC;IAEjB,YAAY,MAAuB;QACjC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,UAAU,CAAC,OAAgB;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,uEAAuE;IAEvE,uBAAuB;QACrB,OAAO,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;YAChC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,uDAAuD;oBACvD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,KAAK,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAC/F,MAAM;gBACR,KAAK,kBAAkB;oBACrB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,KAAK,wBAAwB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACjG,MAAM;YACV,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,uBAAuB;QACrB,OAAO,CAAC,OAAO,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;YAChC,MAAM,CAAC,IAAI,CACT,mDAAmD,KAAK,GAAG;gBACzD,SAAS,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,QAAQ,OAAO,CAAC,YAAY,GAAG,CACjF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC;IACJ,CAAC;IAED,8BAA8B;QAC5B,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,KAAK,mCAAmC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"signal-transport.js","sourceRoot":"","sources":["../../src/signal/signal-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAA6B,MAAM,8BAA8B,CAAC;AAGxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAMvC,MAAM,OAAO,sBAAuB,SAAQ,aAAa;IAC/C,OAAO,GAAmB,IAAI,CAAC;IACtB,MAAM,CAAkB;IACjC,WAAW,GAAwB,IAAI,CAAC;IAEhD,+DAA+D;IAC/D,YAAY,GAAG,CAAC,CAAC;IAEjB,YAAY,OAAsC;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,UAAU,CAAC,OAAgB;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,uEAAuE;IAEvE,uBAAuB;QACrB,OAAO,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;YAChC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,uDAAuD;oBACvD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,KAAK,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAC/F,MAAM;gBACR,KAAK,kBAAkB;oBACrB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,KAAK,wBAAwB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACjG,MAAM;YACV,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,uBAAuB;QACrB,OAAO,CAAC,OAAO,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;YAChC,MAAM,CAAC,IAAI,CACT,mDAAmD,KAAK,GAAG;gBACzD,SAAS,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,QAAQ,OAAO,CAAC,YAAY,GAAG,CACjF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC;IACJ,CAAC;IAED,8BAA8B;QAC5B,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,KAAK,mCAAmC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC;IACJ,CAAC;CACF"}

package/dist/trusted-process/approval-whitelist.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Ephemeral approval whitelist -- session-scoped in-memory store
+ * of approval patterns extracted from user-approved escalations.
+ *
+ * Security invariant: only converts escalate -> allow, never overrides deny.
+ * Entries are never persisted to disk.
+ */
+import type { ArgumentRole } from '../types/argument-roles.js';
+import type { ToolAnnotation } from '../pipeline/types.js';
+/** Unique identifier for a whitelist entry, for audit trail linkage. */
+export type WhitelistEntryId = string & {
+    readonly __brand: 'WhitelistEntryId';
+};
+/**
+ * A constraint on a single argument role's value.
+ * Discriminated union by `kind`.
+ */
+export type WhitelistConstraint = {
+    readonly kind: 'directory';
+    readonly role: ArgumentRole;
+    /** Resolved real path of the containing directory. */
+    readonly directory: string;
+} | {
+    readonly kind: 'domain';
+    readonly role: ArgumentRole;
+    /** Extracted domain (e.g., "github.com"). */
+    readonly domain: string;
+} | {
+    readonly kind: 'exact';
+    readonly role: ArgumentRole;
+    /** Exact value to match (case-insensitive for identifier roles). */
+    readonly value: string;
+};
+/**
+ * A whitelist pattern extracted from an approved escalation.
+ * Matches future calls to the same server/tool with arguments
+ * satisfying all constraints.
+ */
+export interface WhitelistPattern {
+    readonly id: WhitelistEntryId;
+    readonly serverName: string;
+    readonly toolName: string;
+    readonly constraints: readonly WhitelistConstraint[];
+    /** ISO 8601 timestamp when the pattern was created. */
+    readonly createdAt: string;
+    /** The escalation ID that produced this pattern (for audit linkage). */
+    readonly sourceEscalationId: string;
+    /** The original escalation reason (preserved for audit). */
+    readonly originalReason: string;
+    /** Human-readable description of the pattern. */
+    readonly description: string;
+}
+/**
+ * JSON-serializable candidate description for IPC.
+ * Included in the escalation request file so the user sees
+ * exactly what will be whitelisted.
+ */
+export interface WhitelistCandidateIpc {
+    /** Human-readable summary, e.g. "Allow write_file within /home/user/Documents" */
+    readonly description: string;
+    /** Warning for zero-constraint side-effectful patterns. */
+    readonly warning?: string;
+}
+/**
+ * Result of a whitelist match check.
+ */
+export type WhitelistMatchResult = {
+    readonly matched: false;
+} | {
+    readonly matched: true;
+    readonly patternId: WhitelistEntryId;
+    readonly pattern: WhitelistPattern;
+};
+/** Default whitelist options: select the first (and currently only) candidate. */
+export declare const DEFAULT_WHITELIST_OPTIONS: {
+    readonly whitelistSelection: 0;
+};
+/**
+ * The ephemeral whitelist store. Session-scoped, in-memory only.
+ */
+export interface ApprovalWhitelist {
+    /**
+     * Adds a pattern to the whitelist.
+     * Returns the pattern ID for audit linkage.
+     */
+    add(pattern: Omit<WhitelistPattern, 'id'>): WhitelistEntryId;
+    /**
+     * Checks whether a tool call matches any whitelist pattern.
+     * Returns the matching pattern if found.
+     */
+    match(serverName: string, toolName: string, resolvedArgs: Record<string, unknown>, annotation: ToolAnnotation): WhitelistMatchResult;
+    /** Returns all active patterns (for diagnostics/testing). */
+    entries(): readonly WhitelistPattern[];
+    /** Number of active patterns. */
+    readonly size: number;
+}
+/**
+ * Extracts whitelist candidate patterns from an escalated tool call.
+ *
+ * Only generates constraints for the role(s) that caused the escalation,
+ * as identified by `escalatedRoles` on the EvaluationResult.
+ *
+ * Falls back to all resource-identifier roles when `escalatedRoles` is
+ * undefined (defensive robustness for future structural escalation paths).
+ *
+ * Returns both:
+ * - WhitelistPattern[] (full patterns, stored in proxy memory -- without id, added on whitelist.add())
+ * - WhitelistCandidateIpc[] (descriptions, serialized into IPC file)
+ */
+export declare function extractWhitelistCandidates(serverName: string, toolName: string, args: Record<string, unknown>, annotation: ToolAnnotation, escalatedRoles: readonly ArgumentRole[] | undefined, escalationId: string, escalationReason: string): {
+    patterns: Array<Omit<WhitelistPattern, 'id'>>;
+    ipcs: WhitelistCandidateIpc[];
+};
+/**
+ * Creates an in-memory approval whitelist.
+ */
+export declare function createApprovalWhitelist(): ApprovalWhitelist;

package/dist/trusted-process/approval-whitelist.js

@@ -0,0 +1,237 @@
+/**
+ * Ephemeral approval whitelist -- session-scoped in-memory store
+ * of approval patterns extracted from user-approved escalations.
+ *
+ * Security invariant: only converts escalate -> allow, never overrides deny.
+ * Entries are never persisted to disk.
+ */
+import { dirname } from 'node:path';
+import { v4 as uuidv4 } from 'uuid';
+import { resolveRealPath, getRoleDefinition, isWithinDirectory } from '../types/argument-roles.js';
+import { extractDomainForRole } from './domain-utils.js';
+import { extractAnnotatedPaths, collectDistinctRoles } from './policy-engine.js';
+/** Default whitelist options: select the first (and currently only) candidate. */
+export const DEFAULT_WHITELIST_OPTIONS = { whitelistSelection: 0 };
+// ---------------------------------------------------------------------------
+// History-rewriting roles excluded from directory generalization
+// ---------------------------------------------------------------------------
+const HISTORY_REWRITING_ROLES = new Set(['write-history', 'delete-history']);
+// ---------------------------------------------------------------------------
+// Constraint matching
+// ---------------------------------------------------------------------------
+/**
+ * Checks whether a single constraint is satisfied by the tool call's arguments.
+ */
+function constraintMatches(constraint, args, annotation) {
+    // Find all argument values for the constraint's role
+    const values = extractAnnotatedPaths(args, annotation, [constraint.role]);
+    if (values.length === 0)
+        return false;
+    switch (constraint.kind) {
+        case 'directory':
+            return values.every((v) => {
+                try {
+                    return isWithinDirectory(v, constraint.directory);
+                }
+                catch {
+                    return false;
+                }
+            });
+        case 'domain': {
+            const roleDef = getRoleDefinition(constraint.role);
+            return values.every((v) => {
+                try {
+                    const normalized = roleDef.canonicalize(v);
+                    const domain = extractDomainForRole(normalized, constraint.role);
+                    return domain.toLowerCase() === constraint.domain.toLowerCase();
+                }
+                catch {
+                    return false;
+                }
+            });
+        }
+        case 'exact':
+            return values.every((v) => v.toLowerCase() === constraint.value.toLowerCase());
+    }
+}
+// ---------------------------------------------------------------------------
+// Pattern extraction
+// ---------------------------------------------------------------------------
+/**
+ * Extracts whitelist candidate patterns from an escalated tool call.
+ *
+ * Only generates constraints for the role(s) that caused the escalation,
+ * as identified by `escalatedRoles` on the EvaluationResult.
+ *
+ * Falls back to all resource-identifier roles when `escalatedRoles` is
+ * undefined (defensive robustness for future structural escalation paths).
+ *
+ * Returns both:
+ * - WhitelistPattern[] (full patterns, stored in proxy memory -- without id, added on whitelist.add())
+ * - WhitelistCandidateIpc[] (descriptions, serialized into IPC file)
+ */
+export function extractWhitelistCandidates(serverName, toolName, args, annotation, escalatedRoles, escalationId, escalationReason) {
+    // Determine which roles to extract constraints for
+    const rolesToExtract = escalatedRoles ?? collectDistinctRoles(annotation);
+    const constraints = buildConstraints(rolesToExtract, args, annotation);
+    const description = buildDescription(serverName, toolName, constraints);
+    const warning = buildWarning(constraints);
+    const pattern = {
+        serverName,
+        toolName,
+        constraints,
+        createdAt: new Date().toISOString(),
+        sourceEscalationId: escalationId,
+        originalReason: escalationReason,
+        description,
+    };
+    const ipc = {
+        description,
+        ...(warning ? { warning } : {}),
+    };
+    // Phase 1: returns a single candidate pattern. The array-based return type and
+    // whitelistSelection index in the IPC protocol are designed to support future
+    // multi-candidate expansion (e.g., "allow this directory" vs "allow this exact file").
+    return { patterns: [pattern], ipcs: [ipc] };
+}
+/**
+ * Builds constraints from escalated roles and argument values.
+ */
+function buildConstraints(roles, args, annotation) {
+    const constraints = [];
+    const seen = new Set();
+    for (const role of roles) {
+        const roleDef = getRoleDefinition(role);
+        const values = extractAnnotatedPaths(args, annotation, [role]);
+        for (const value of values) {
+            const constraint = buildConstraintForRole(role, roleDef.category, value);
+            if (!constraint)
+                continue;
+            // Deduplicate constraints with identical kind/role/value
+            const key = constraintKey(constraint);
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            constraints.push(constraint);
+        }
+    }
+    return constraints;
+}
+/** Returns a stable string key for deduplication. */
+function constraintKey(c) {
+    switch (c.kind) {
+        case 'directory':
+            return `dir:${c.role}:${c.directory}`;
+        case 'domain':
+            return `dom:${c.role}:${c.domain}`;
+        case 'exact':
+            return `exact:${c.role}:${c.value}`;
+    }
+}
+/**
+ * Builds a single constraint for a role and value, applying the
+ * appropriate generalization for the role's category.
+ */
+function buildConstraintForRole(role, category, value) {
+    switch (category) {
+        case 'path': {
+            // History-rewriting roles are excluded from directory generalization
+            if (HISTORY_REWRITING_ROLES.has(role))
+                return undefined;
+            try {
+                // Note: resolveRealPath uses realpath for existing paths and path.resolve
+                // for non-existent ones. If a file is created after whitelisting, the resolved
+                // real path at match time may differ (e.g., through new symlinks). This is
+                // acceptable for phase 1 -- the constraint still provides meaningful scoping.
+                const resolvedPath = resolveRealPath(value);
+                const dir = dirname(resolvedPath);
+                return { kind: 'directory', role, directory: dir };
+            }
+            catch {
+                return undefined;
+            }
+        }
+        case 'url': {
+            try {
+                const roleDef = getRoleDefinition(role);
+                const normalized = roleDef.canonicalize(value);
+                const domain = extractDomainForRole(normalized, role);
+                return { kind: 'domain', role, domain };
+            }
+            catch {
+                return undefined;
+            }
+        }
+        case 'identifier':
+            return { kind: 'exact', role, value: value.toLowerCase() };
+        default:
+            return undefined;
+    }
+}
+/**
+ * Builds a human-readable description from constraints.
+ */
+function buildDescription(serverName, toolName, constraints) {
+    if (constraints.length === 0) {
+        return `Allow ${serverName}/${toolName} (exact tool match only)`;
+    }
+    const parts = constraints.map((c) => {
+        switch (c.kind) {
+            case 'directory':
+                return `${c.role} within ${c.directory}`;
+            case 'domain':
+                return `${c.role} domain ${c.domain}`;
+            case 'exact':
+                return `${c.role}=${c.value}`;
+        }
+    });
+    return `Allow ${serverName}/${toolName} ${parts.join(', ')}`;
+}
+/**
+ * Generates a warning for zero-constraint tools.
+ */
+function buildWarning(constraints) {
+    if (constraints.length === 0) {
+        return 'Whitelisting will auto-approve ALL future calls to this tool for this session.';
+    }
+    return undefined;
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Creates an in-memory approval whitelist.
+ */
+export function createApprovalWhitelist() {
+    const patterns = [];
+    return {
+        add(patternData) {
+            const id = uuidv4();
+            const pattern = { ...patternData, id };
+            patterns.push(pattern);
+            return id;
+        },
+        match(serverName, toolName, resolvedArgs, annotation) {
+            for (const pattern of patterns) {
+                if (pattern.serverName !== serverName)
+                    continue;
+                if (pattern.toolName !== toolName)
+                    continue;
+                // All constraints must match (AND semantics)
+                const allMatch = pattern.constraints.length === 0 ||
+                    pattern.constraints.every((c) => constraintMatches(c, resolvedArgs, annotation));
+                if (allMatch) {
+                    return { matched: true, patternId: pattern.id, pattern };
+                }
+            }
+            return { matched: false };
+        },
+        entries() {
+            return patterns;
+        },
+        get size() {
+            return patterns.length;
+        },
+    };
+}
+//# sourceMappingURL=approval-whitelist.js.map

package/dist/trusted-process/approval-whitelist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-whitelist.js","sourceRoot":"","sources":["../../src/trusted-process/approval-whitelist.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAyEjF,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,kBAAkB,EAAE,CAAC,EAAW,CAAC;AA8B5E,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,MAAM,uBAAuB,GAA8B,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAExG,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;GAEG;AACH,SAAS,iBAAiB,CACxB,UAA+B,EAC/B,IAA6B,EAC7B,UAA0B;IAE1B,qDAAqD;IACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,OAAO,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,CAAC,CAAC;QACL,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;oBACjE,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAClE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,QAAgB,EAChB,IAA6B,EAC7B,UAA0B,EAC1B,cAAmD,EACnD,YAAoB,EACpB,gBAAwB;IAExB,mDAAmD;IACnD,MAAM,cAAc,GAAG,cAAc,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAE1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAiC;QAC5C,UAAU;QACV,QAAQ;QACR,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,kBAAkB,EAAE,YAAY;QAChC,cAAc,EAAE,gBAAgB;QAChC,WAAW;KACZ,CAAC;IAEF,MAAM,GAAG,GAA0B;QACjC,WAAW;QACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC;IAEF,+EAA+E;IAC/E,8EAA8E;IAC9E,uFAAuF;IACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,KAA8B,EAC9B,IAA6B,EAC7B,UAA0B;IAE1B,MAAM,WAAW,GAA0B,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,yDAAyD;YACzD,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,qDAAqD;AACrD,SAAS,aAAa,CAAC,CAAsB;IAC3C,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACxC,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACrC,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAkB,EAAE,QAAgB,EAAE,KAAa;IACjF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,qEAAqE;YACrE,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxD,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,+EAA+E;gBAC/E,2EAA2E;gBAC3E,8EAA8E;gBAC9E,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;gBAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACtD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,YAAY;YACf,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,UAAkB,EAAE,QAAgB,EAAE,WAA2C;IACzG,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,UAAU,IAAI,QAAQ,0BAA0B,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,WAAW;gBACd,OAAO,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;YAC3C,KAAK,QAAQ;gBACX,OAAO,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;YACxC,KAAK,OAAO;gBACV,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,UAAU,IAAI,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,WAA2C;IAC/D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,OAAO;QACL,GAAG,CAAC,WAAyC;YAC3C,MAAM,EAAE,GAAG,MAAM,EAAsB,CAAC;YACxC,MAAM,OAAO,GAAqB,EAAE,GAAG,WAAW,EAAE,EAAE,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,CACH,UAAkB,EAClB,QAAgB,EAChB,YAAqC,EACrC,UAA0B;YAE1B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;oBAAE,SAAS;gBAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;oBAAE,SAAS;gBAE5C,6CAA6C;gBAC7C,MAAM,QAAQ,GACZ,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;oBAChC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;gBAEnF,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;gBAC3D,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,OAAO;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,IAAI;YACN,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/trusted-process/gworkspace-credentials.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Google Workspace credential file management.
+ *
+ * Writes credential files in the format expected by
+ * @alanse/mcp-server-google-workspace's auth.ts.
+ *
+ * SECURITY: The refresh_token field is intentionally omitted.
+ * This prevents the MCP server from independently refreshing tokens,
+ * which would cause refresh token rotation races in multi-session
+ * environments. IronCurtain's OAuthTokenProvider is the sole token
+ * authority.
+ *
+ * The file is written atomically (write to .tmp, rename) to prevent
+ * the MCP server from reading a partial file during a refresh cycle.
+ */
+/** The filename the MCP server expects in its GWORKSPACE_CREDS_DIR. */
+export declare const GWORKSPACE_CREDENTIAL_FILENAME = ".gworkspace-credentials.json";
+/**
+ * Shape of the credential file read by the MCP server's auth.ts.
+ * Mirrors the subset of Google OAuth2 token response that the server needs.
+ */
+export interface GWorkspaceCredentialFile {
+    readonly access_token: string;
+    readonly expiry_date: number;
+    readonly token_type: 'Bearer';
+    readonly scope: string;
+}
+/**
+ * Writes a Google Workspace credential file for the MCP server.
+ *
+ * Creates the directory if it does not exist. Writes atomically via
+ * a temporary file + rename to prevent the MCP server from reading
+ * a partial file. File permissions are set to 0o600 (owner-only).
+ *
+ * @param credsDir - Directory to write the credential file into
+ * @param accessToken - OAuth2 access token (short-lived)
+ * @param expiresAt - Token expiry timestamp in milliseconds since epoch
+ * @param scopes - OAuth2 scopes granted to this token
+ */
+export declare function writeGWorkspaceCredentialFile(credsDir: string, accessToken: string, expiresAt: number, scopes: readonly string[]): void;

package/dist/trusted-process/gworkspace-credentials.js

@@ -0,0 +1,45 @@
+/**
+ * Google Workspace credential file management.
+ *
+ * Writes credential files in the format expected by
+ * @alanse/mcp-server-google-workspace's auth.ts.
+ *
+ * SECURITY: The refresh_token field is intentionally omitted.
+ * This prevents the MCP server from independently refreshing tokens,
+ * which would cause refresh token rotation races in multi-session
+ * environments. IronCurtain's OAuthTokenProvider is the sole token
+ * authority.
+ *
+ * The file is written atomically (write to .tmp, rename) to prevent
+ * the MCP server from reading a partial file during a refresh cycle.
+ */
+import { mkdirSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** The filename the MCP server expects in its GWORKSPACE_CREDS_DIR. */
+export const GWORKSPACE_CREDENTIAL_FILENAME = '.gworkspace-credentials.json';
+/**
+ * Writes a Google Workspace credential file for the MCP server.
+ *
+ * Creates the directory if it does not exist. Writes atomically via
+ * a temporary file + rename to prevent the MCP server from reading
+ * a partial file. File permissions are set to 0o600 (owner-only).
+ *
+ * @param credsDir - Directory to write the credential file into
+ * @param accessToken - OAuth2 access token (short-lived)
+ * @param expiresAt - Token expiry timestamp in milliseconds since epoch
+ * @param scopes - OAuth2 scopes granted to this token
+ */
+export function writeGWorkspaceCredentialFile(credsDir, accessToken, expiresAt, scopes) {
+    mkdirSync(credsDir, { recursive: true });
+    const credential = {
+        access_token: accessToken,
+        expiry_date: expiresAt,
+        token_type: 'Bearer',
+        scope: scopes.join(' '),
+    };
+    const filePath = join(credsDir, GWORKSPACE_CREDENTIAL_FILENAME);
+    const tmpPath = filePath + '.tmp';
+    writeFileSync(tmpPath, JSON.stringify(credential, null, 2), { mode: 0o600 });
+    renameSync(tmpPath, filePath);
+}
+//# sourceMappingURL=gworkspace-credentials.js.map

package/dist/trusted-process/gworkspace-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gworkspace-credentials.js","sourceRoot":"","sources":["../../src/trusted-process/gworkspace-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC;AAe7E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,WAAmB,EACnB,SAAiB,EACjB,MAAyB;IAEzB,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzC,MAAM,UAAU,GAA6B;QAC3C,YAAY,EAAE,WAAW;QACzB,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IAElC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAChC,CAAC"}

package/dist/trusted-process/index.d.ts

@@ -1,6 +1,15 @@
 import type { IronCurtainConfig } from '../config/types.js';
 import type { ToolCallRequest, ToolCallResult } from '../types/mcp.js';
-export type EscalationPromptFn = (request: ToolCallRequest, reason: string, context?: Readonly<Record<string, string>>) => Promise<'approved' | 'denied'>;
+import { type WhitelistCandidateIpc } from './approval-whitelist.js';
+/** Result from an escalation callback, optionally including whitelist selection. */
+export interface EscalationResult {
+    readonly decision: 'approved' | 'denied';
+    /** Index into whitelistCandidates to whitelist. Absent = no whitelisting. */
+    readonly whitelistSelection?: number;
+}
+export type EscalationPromptFn = (request: ToolCallRequest, reason: string, context?: Readonly<Record<string, string>>, 
+/** Whitelist candidates for display to the user. */
+whitelistCandidates?: readonly WhitelistCandidateIpc[]) => Promise<EscalationResult>;
 export interface TrustedProcessOptions {
     onEscalation?: EscalationPromptFn;
 }
@@ -12,6 +21,7 @@ export declare class TrustedProcess {
     private auditLog;
     private escalation;
     private onEscalation?;
+    private readonly whitelist;
     private autoApproveModel;
     private lastUserMessage;
     private serverContextMap;