@provos/ironcurtain 0.7.2 → 0.9.0

package/dist/trusted-process/mcp-proxy-server.js

@@ -37,16 +37,16 @@ import { appendFileSync, existsSync, mkdtempSync, readFileSync, writeFileSync, u
 import { atomicWriteJsonSync } from '../escalation/escalation-watcher.js';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { tmpdir } from 'node:os';
+import { tmpdir, homedir } from 'node:os';
 import { v4 as uuidv4 } from 'uuid';
 import { loadGeneratedPolicy, extractServerDomainAllowlists, getPackageGeneratedDir } from '../config/index.js';
 import { PolicyEngine, extractAnnotatedPaths } from './policy-engine.js';
-import { getPathRoles } from '../types/argument-roles.js';
+import { getPathRoles, expandTilde } from '../types/argument-roles.js';
 import { AuditLog } from './audit-log.js';
 import { prepareToolArgs, rewriteResultContent } from './path-utils.js';
 import { CONTAINER_WORKSPACE_DIR } from '../docker/agent-adapter.js';
 import { extractPolicyRoots, toMcpRoots, directoryForPath } from './policy-roots.js';
-import { checkSandboxAvailability, resolveSandboxConfig, writeServerSettings, wrapServerCommand, cleanupSettingsFiles, annotateSandboxViolation, } from './sandbox-integration.js';
+import { checkSandboxAvailability, resolveSandboxConfig, writeServerSettings, wrapServerCommand, cleanupSettingsFiles, annotateSandboxViolation, discoverNodePaths, rewriteServerSettings, } from './sandbox-integration.js';
 import { ROOTS_REFRESH_TIMEOUT_MS } from './mcp-client-manager.js';
 import { CallCircuitBreaker } from './call-circuit-breaker.js';
 import { autoApprove, extractArgsForAutoApprove, readUserContext } from './auto-approver.js';
@@ -57,21 +57,43 @@ import { extractMcpErrorMessage } from './mcp-error-utils.js';
 import { updateServerContext, formatServerContext } from './server-context.js';
 import { permissiveJsonSchemaValidator } from './permissive-output-validator.js';
 import { VERSION } from '../version.js';
+import { buildTrustedServerSet } from '../memory/memory-annotations.js';
 import { loadToolDescriptionHints, applyToolDescriptionHints } from './tool-description-hints.js';
+import { createApprovalWhitelist, extractWhitelistCandidates, } from './approval-whitelist.js';
+import { getProviderForServer } from '../auth/oauth-registry.js';
+import { loadClientCredentials } from '../auth/oauth-provider.js';
+import { OAuthTokenProvider } from '../auth/oauth-token-provider.js';
+import { loadOAuthToken } from '../auth/oauth-token-store.js';
+import { writeGWorkspaceCredentialFile } from './gworkspace-credentials.js';
+import { TokenFileRefresher } from './token-file-refresher.js';
+import { proxyAnnotations, proxyPolicyRules, proxyToolDefinitions, handleVirtualProxyTool, createControlApiClient, } from '../docker/proxy-tools.js';
+/**
+ * Pending whitelist candidates keyed by escalation ID.
+ * Populated when a request file is written with candidates;
+ * consumed when the response comes back with a selection.
+ * Module-level state — the proxy is a singleton process.
+ */
+const pendingWhitelistCandidates = new Map();
 /**
  * Adds a root to a client's root list and waits for the server to
  * fetch the updated list. No-op if the root URI is already present.
  * Times out after ROOTS_REFRESH_TIMEOUT_MS if the server never requests
  * the updated list (e.g. servers that don't implement Roots protocol).
+ *
+ * Returns `'added'` when the server acknowledged the update (called
+ * `roots/list`), `'timeout'` when the server didn't respond in time,
+ * or `false` when the root was already present.
  */
 async function addRootToClient(state, root) {
     if (state.roots.some((r) => r.uri === root.uri))
-        return;
+        return false;
     state.roots.push(root);
     let timer;
+    let outcome = 'timeout';
     const refreshed = new Promise((resolve) => {
         state.rootsRefreshed = () => {
             clearTimeout(timer);
+            outcome = 'added';
             resolve();
         };
     });
@@ -84,6 +106,28 @@ async function addRootToClient(state, root) {
     });
     await state.client.sendRootsListChanged();
     await Promise.race([refreshed, timeout]);
+    return outcome;
+}
+/**
+ * Delay before retrying a tool call that returned "access denied" immediately
+ * after roots expansion. The filesystem server needs time to async-validate
+ * (fs.realpath, fs.stat) the new roots after receiving the rootsListChanged
+ * notification. Exported for test access.
+ */
+export const ROOTS_RACE_RETRY_DELAY_MS = 200;
+/**
+ * Checks whether an MCP tool call result looks like a roots-race "access denied"
+ * error -- the filesystem server rejected the call because it hasn't finished
+ * processing the updated roots yet.
+ */
+function isRootsRaceError(result) {
+    if (!('isError' in result) || !result.isError)
+        return false;
+    const text = extractTextFromContent(result.content);
+    if (!text)
+        return false;
+    const lower = text.toLowerCase();
+    return lower.includes('access denied') || lower.includes('outside allowed directories');
 }
 /** Appends a timestamped line to the session log file. */
 function logToSessionFile(sessionLogPath, message) {
@@ -114,7 +158,7 @@ function getMissingEnvVars(args) {
     return missing;
 }
 /** Extracts concatenated text from MCP content blocks. */
-function extractTextFromContent(content) {
+export function extractTextFromContent(content) {
     if (!Array.isArray(content))
         return undefined;
     const texts = content
@@ -201,13 +245,21 @@ function cleanupEscalationFiles(requestPath, responsePath) {
 }
 /**
  * Reads and parses the escalation response file if it exists.
- * Returns the decision, or undefined if the file is not present.
+ * Returns the response data, or undefined if the file is not present.
  */
 function readEscalationResponse(responsePath) {
     if (!existsSync(responsePath))
         return undefined;
-    const response = JSON.parse(readFileSync(responsePath, 'utf-8'));
-    return response.decision;
+    const raw = JSON.parse(readFileSync(responsePath, 'utf-8'));
+    // Validate whitelistSelection: must be an integer if present, discard otherwise
+    let whitelistSelection;
+    if (typeof raw.whitelistSelection === 'number' && Number.isInteger(raw.whitelistSelection)) {
+        whitelistSelection = raw.whitelistSelection;
+    }
+    return {
+        decision: raw.decision,
+        ...(whitelistSelection !== undefined ? { whitelistSelection } : {}),
+    };
 }
 /**
  * Waits for a human decision via file-based IPC.
@@ -224,17 +276,17 @@ async function waitForEscalationDecision(escalationDir, request) {
     atomicWriteJsonSync(requestPath, request);
     const deadline = Date.now() + getEscalationTimeoutMs();
     while (Date.now() < deadline) {
-        const decision = readEscalationResponse(responsePath);
-        if (decision) {
+        const response = readEscalationResponse(responsePath);
+        if (response) {
             cleanupEscalationFiles(requestPath, responsePath);
-            return decision;
+            return response;
         }
         await new Promise((r) => setTimeout(r, ESCALATION_POLL_INTERVAL_MS));
     }
     // Final check -- response may have arrived between last poll and deadline
-    const lateDecision = readEscalationResponse(responsePath);
+    const lateResponse = readEscalationResponse(responsePath);
     cleanupEscalationFiles(requestPath, responsePath);
-    return lateDecision ?? 'denied';
+    return lateResponse ?? { decision: 'denied' };
 }
 /**
  * Creates the auto-approve LLM model from environment variables.
@@ -303,12 +355,17 @@ export function parseProxyEnvConfig() {
     const allServersConfig = JSON.parse(serversConfigJson);
     const protectedPaths = JSON.parse(protectedPathsJson);
     // When SERVER_FILTER is set, only connect to that single backend server.
+    // Special case: SERVER_FILTER=proxy with no matching backend enters virtual-only mode.
     const serverFilter = process.env.SERVER_FILTER;
-    const serversConfig = serverFilter
-        ? { [serverFilter]: allServersConfig[serverFilter] }
-        : allServersConfig;
+    const isVirtualOnly = serverFilter === 'proxy' && !allServersConfig[serverFilter];
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- isVirtualOnly is defensive; TS can't prove it's false at runtime
+    const serversConfig = isVirtualOnly
+        ? {}
+        : serverFilter
+            ? { [serverFilter]: allServersConfig[serverFilter] }
+            : allServersConfig;
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- defensive: Record index may be undefined at runtime
-    if (serverFilter && !allServersConfig[serverFilter]) {
+    if (serverFilter && !allServersConfig[serverFilter] && !isVirtualOnly) {
         process.stderr.write(`SERVER_FILTER: unknown server "${serverFilter}"\n`);
         process.exit(1);
     }
@@ -376,6 +433,28 @@ export function resolveServerSandboxConfigs(serversConfig, allowedDirectory, san
     }
     return { resolvedSandboxConfigs, settingsDir, serverCwdPaths };
 }
+/**
+ * Validates that all argument keys exist in the tool's inputSchema.
+ * Returns null if valid, or an error message listing unknown and valid keys.
+ * Skips validation when the schema has no properties or allows additional properties.
+ */
+export function validateToolArguments(args, inputSchema) {
+    const properties = inputSchema.properties;
+    if (!properties || typeof properties !== 'object')
+        return null;
+    if (inputSchema.additionalProperties)
+        return null;
+    const validKeys = new Set(Object.keys(properties));
+    const unknownKeys = Object.keys(args).filter((k) => !validKeys.has(k));
+    if (unknownKeys.length === 0)
+        return null;
+    const unknownList = unknownKeys.map((k) => `"${k}"`).join(', ');
+    const validList = [...validKeys]
+        .sort()
+        .map((k) => `"${k}"`)
+        .join(', ');
+    return `Unknown argument(s): ${unknownList}. Valid parameters are: ${validList}`;
+}
 /** Builds a lookup map from tool name to ProxiedTool for routing. */
 export function buildToolMap(allTools) {
     const toolMap = new Map();
@@ -401,6 +480,8 @@ export function buildAuditEntry(request, argsForTransport, policyDecision, resul
         durationMs,
         sandboxed: options.sandboxed || undefined,
         autoApproved: options.autoApproved || undefined,
+        whitelistApproved: options.whitelistApproved || undefined,
+        whitelistPatternId: options.whitelistPatternId,
     };
 }
 /**
@@ -418,9 +499,11 @@ export async function handleCallTool(toolName, rawArgs, deps) {
             isError: true,
         };
     }
-    // Annotation-driven normalization: split into transport vs policy args
+    // Annotation-driven normalization: split into transport vs policy args.
+    // Trusted servers skip annotation lookup and prepareToolArgs — use raw args directly.
     const annotation = deps.policyEngine.getAnnotation(toolInfo.serverName, toolInfo.name, rawArgs);
-    if (!annotation) {
+    const isTrusted = !annotation && deps.policyEngine.isTrustedServer(toolInfo.serverName);
+    if (!annotation && !isTrusted) {
         return {
             content: [
                 {
@@ -431,34 +514,66 @@ export async function handleCallTool(toolName, rawArgs, deps) {
             isError: true,
         };
     }
-    // Enrich git tool args with the locally tracked working directory when
-    // the agent omits the `path` argument. The git MCP server tracks its own
-    // CWD (set via git_set_working_dir) and uses it implicitly, but the
-    // policy engine needs the explicit path to resolve sandbox containment
-    // and the default remote URL for domain-based policy rules.
-    // The serverContextMap mirrors the git server's working directory from
-    // successful git_set_working_dir / git_clone calls, avoiding an RPC.
-    let effectiveRawArgs = rawArgs;
-    const hasEffectivePath = 'path' in rawArgs && typeof rawArgs.path === 'string' && rawArgs.path.trim() !== '';
-    if (toolInfo.serverName === 'git' && 'path' in annotation.args && !hasEffectivePath) {
-        const gitWorkDir = deps.serverContextMap.get('git')?.workingDirectory;
-        if (!gitWorkDir) {
-            const errorMsg = 'Git server has no working directory set. Call git_set_working_dir first.';
-            deps.auditLog.log(buildAuditEntry({
+    // Validate argument names against the tool's schema.
+    // Skip for trusted servers (check directly, not via isTrusted which also requires missing annotation).
+    if (!deps.policyEngine.isTrustedServer(toolInfo.serverName)) {
+        const validationError = validateToolArguments(rawArgs, toolInfo.inputSchema);
+        if (validationError) {
+            deps.auditLog.log({
+                timestamp: new Date().toISOString(),
                 requestId: uuidv4(),
                 serverName: toolInfo.serverName,
                 toolName: toolInfo.name,
                 arguments: rawArgs,
-                timestamp: new Date().toISOString(),
-            }, rawArgs, { status: 'deny', rule: 'git-path-enrichment-failed', reason: errorMsg }, { status: 'denied', error: errorMsg }, 0, {}));
+                policyDecision: { status: 'deny', rule: 'invalid-arguments', reason: validationError },
+                result: { status: 'denied', error: validationError },
+                durationMs: 0,
+            });
             return {
-                content: [{ type: 'text', text: `Error: ${errorMsg}` }],
+                content: [{ type: 'text', text: validationError }],
                 isError: true,
             };
         }
-        effectiveRawArgs = { ...rawArgs, path: gitWorkDir };
     }
-    const { argsForTransport, argsForPolicy } = prepareToolArgs(effectiveRawArgs, annotation, deps.allowedDirectory, CONTAINER_WORKSPACE_DIR);
+    let argsForTransport;
+    let argsForPolicy;
+    if (isTrusted) {
+        // Trusted server with no annotation: use raw args for both transport and policy
+        argsForTransport = rawArgs;
+        argsForPolicy = rawArgs;
+    }
+    else {
+        // annotation is guaranteed non-null here: we returned early if both are falsy
+        const resolvedAnnotation = annotation;
+        // Enrich git tool args with the locally tracked working directory when
+        // the agent omits the `path` argument. The git MCP server tracks its own
+        // CWD (set via git_set_working_dir) and uses it implicitly, but the
+        // policy engine needs the explicit path to resolve sandbox containment
+        // and the default remote URL for domain-based policy rules.
+        // The serverContextMap mirrors the git server's working directory from
+        // successful git_set_working_dir / git_clone calls, avoiding an RPC.
+        let effectiveRawArgs = rawArgs;
+        const hasEffectivePath = 'path' in rawArgs && typeof rawArgs.path === 'string' && rawArgs.path.trim() !== '';
+        if (toolInfo.serverName === 'git' && 'path' in resolvedAnnotation.args && !hasEffectivePath) {
+            const gitWorkDir = deps.serverContextMap.get('git')?.workingDirectory;
+            if (!gitWorkDir) {
+                const errorMsg = 'Git server has no working directory set. Call git_set_working_dir first.';
+                deps.auditLog.log(buildAuditEntry({
+                    requestId: uuidv4(),
+                    serverName: toolInfo.serverName,
+                    toolName: toolInfo.name,
+                    arguments: rawArgs,
+                    timestamp: new Date().toISOString(),
+                }, rawArgs, { status: 'deny', rule: 'git-path-enrichment-failed', reason: errorMsg }, { status: 'denied', error: errorMsg }, 0, {}));
+                return {
+                    content: [{ type: 'text', text: `Error: ${errorMsg}` }],
+                    isError: true,
+                };
+            }
+            effectiveRawArgs = { ...rawArgs, path: gitWorkDir };
+        }
+        ({ argsForTransport, argsForPolicy } = prepareToolArgs(effectiveRawArgs, resolvedAnnotation, deps.allowedDirectory, CONTAINER_WORKSPACE_DIR));
+    }
     const request = {
         requestId: uuidv4(),
         serverName: toolInfo.serverName,
@@ -474,6 +589,9 @@ export async function handleCallTool(toolName, rawArgs, deps) {
     };
     let escalationResult;
     let autoApproved = false;
+    let whitelistApproved = false;
+    let whitelistPatternId;
+    let rootsExpanded = false;
     const serverSandboxConfig = deps.resolvedSandboxConfigs.get(toolInfo.serverName);
     const serverIsSandboxed = serverSandboxConfig?.sandboxed === true;
     function logAudit(result, durationMs, overrideEscalation) {
@@ -481,73 +599,114 @@ export async function handleCallTool(toolName, rawArgs, deps) {
             escalationResult: overrideEscalation ?? escalationResult,
             sandboxed: serverIsSandboxed,
             autoApproved,
+            whitelistApproved: whitelistApproved || undefined,
+            whitelistPatternId,
         });
         deps.auditLog.log(entry);
     }
     if (evaluation.decision === 'escalate') {
-        if (!deps.escalationDir) {
-            logAudit({ status: 'denied', error: evaluation.reason }, 0, 'denied');
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: `ESCALATION REQUIRED: ${evaluation.reason}. Action denied (no escalation handler).`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-        // Try auto-approve before falling through to human escalation
-        if (deps.autoApproveModel) {
-            const userContext = readUserContext(deps.escalationDir);
-            if (userContext) {
-                const isPtySession = process.env.IRONCURTAIN_PTY_SESSION === '1';
-                if (isUserContextTrusted(userContext, isPtySession)) {
-                    const autoResult = await autoApprove({
-                        userMessage: userContext.userMessage,
-                        toolName: `${toolInfo.serverName}/${toolInfo.name}`,
-                        escalationReason: evaluation.reason,
-                        arguments: extractArgsForAutoApprove(argsForPolicy, annotation),
-                    }, deps.autoApproveModel);
-                    if (autoResult.decision === 'approve') {
-                        autoApproved = true;
-                        escalationResult = 'approved';
-                        policyDecision.status = 'allow';
-                        policyDecision.reason = `Auto-approved: ${autoResult.reasoning}`;
-                    }
-                }
-            }
+        // Annotation is guaranteed non-null here: trusted servers always allow (never escalate),
+        // and missing-annotation returns early above. Narrow the type for TypeScript.
+        const resolvedAnnotation = annotation;
+        const whitelistMatch = deps.whitelist.match(toolInfo.serverName, toolInfo.name, argsForPolicy, resolvedAnnotation);
+        if (whitelistMatch.matched) {
+            whitelistApproved = true;
+            whitelistPatternId = whitelistMatch.patternId;
+            escalationResult = 'approved';
+            policyDecision.status = 'allow';
+            policyDecision.reason = `Whitelist-approved: ${whitelistMatch.pattern.description}`;
         }
-        if (!autoApproved) {
-            const escalationId = uuidv4();
-            const decision = await waitForEscalationDecision(deps.escalationDir, {
-                escalationId,
-                serverName: request.serverName,
-                toolName: request.toolName,
-                arguments: argsForTransport,
-                reason: evaluation.reason,
-                context: formatServerContext(deps.serverContextMap, toolInfo.serverName),
-            });
-            if (decision === 'denied') {
+        if (!whitelistApproved) {
+            if (!deps.escalationDir) {
                 logAudit({ status: 'denied', error: evaluation.reason }, 0, 'denied');
                 return {
-                    content: [{ type: 'text', text: `ESCALATION DENIED: ${evaluation.reason}` }],
+                    content: [
+                        {
+                            type: 'text',
+                            text: `ESCALATION REQUIRED: ${evaluation.reason}. Action denied (no escalation handler).`,
+                        },
+                    ],
                     isError: true,
                 };
             }
-            escalationResult = 'approved';
-            policyDecision.status = 'allow';
-            policyDecision.reason = 'Approved by human during escalation';
+            const escalationId = uuidv4();
+            // Try auto-approve before falling through to human escalation
+            if (deps.autoApproveModel) {
+                const userContext = readUserContext(deps.escalationDir);
+                if (userContext) {
+                    const isPtySession = process.env.IRONCURTAIN_PTY_SESSION === '1';
+                    if (isUserContextTrusted(userContext, isPtySession)) {
+                        const autoResult = await autoApprove({
+                            userMessage: userContext.userMessage,
+                            toolName: `${toolInfo.serverName}/${toolInfo.name}`,
+                            escalationReason: evaluation.reason,
+                            arguments: extractArgsForAutoApprove(argsForPolicy, annotation),
+                        }, deps.autoApproveModel);
+                        if (autoResult.decision === 'approve') {
+                            autoApproved = true;
+                            escalationResult = 'approved';
+                            policyDecision.status = 'allow';
+                            policyDecision.reason = `Auto-approved: ${autoResult.reasoning}`;
+                        }
+                    }
+                }
+            }
+            if (!autoApproved) {
+                // Extract whitelist candidates just before human escalation (avoids
+                // wasted work when auto-approve succeeds).
+                const { patterns: candidatePatterns, ipcs: candidateIpcs } = extractWhitelistCandidates(toolInfo.serverName, toolInfo.name, argsForPolicy, resolvedAnnotation, evaluation.escalatedRoles, escalationId, evaluation.reason);
+                if (candidatePatterns.length > 0) {
+                    // Store full patterns in proxy memory, keyed by escalation ID
+                    pendingWhitelistCandidates.set(escalationId, candidatePatterns);
+                }
+                try {
+                    const response = await waitForEscalationDecision(deps.escalationDir, {
+                        escalationId,
+                        serverName: request.serverName,
+                        toolName: request.toolName,
+                        arguments: argsForTransport,
+                        reason: evaluation.reason,
+                        context: formatServerContext(deps.serverContextMap, toolInfo.serverName),
+                        whitelistCandidates: candidateIpcs.length > 0 ? candidateIpcs : undefined,
+                    });
+                    if (response.decision === 'denied') {
+                        logAudit({ status: 'denied', error: evaluation.reason }, 0, 'denied');
+                        return {
+                            content: [{ type: 'text', text: `ESCALATION DENIED: ${evaluation.reason}` }],
+                            isError: true,
+                        };
+                    }
+                    escalationResult = 'approved';
+                    policyDecision.status = 'allow';
+                    policyDecision.reason = 'Approved by human during escalation';
+                    // Handle whitelist selection from the response
+                    if (response.whitelistSelection !== undefined) {
+                        const storedPatterns = pendingWhitelistCandidates.get(escalationId);
+                        if (storedPatterns &&
+                            response.whitelistSelection >= 0 &&
+                            response.whitelistSelection < storedPatterns.length) {
+                            const selectedPattern = storedPatterns[response.whitelistSelection];
+                            deps.whitelist.add(selectedPattern);
+                        }
+                    }
+                }
+                finally {
+                    // Issue 12: ensure cleanup even if waitForEscalationDecision throws
+                    pendingWhitelistCandidates.delete(escalationId);
+                }
+            }
         }
         // Expand roots for approved path arguments only (skip URLs, opaques)
         const state = deps.clientStates.get(toolInfo.serverName);
-        if (state) {
+        if (state && annotation) {
             const pathValues = extractAnnotatedPaths(argsForTransport, annotation, getPathRoles());
             for (const p of pathValues) {
-                await addRootToClient(state, {
+                const result = await addRootToClient(state, {
                     uri: `file://${directoryForPath(p)}`,
                     name: 'escalation-approved',
                 });
+                if (result === 'added')
+                    rootsExpanded = true;
             }
         }
     }
@@ -567,6 +726,20 @@ export async function handleCallTool(toolName, rawArgs, deps) {
             isError: true,
         };
     }
+    // Virtual proxy tools: handle locally, no backend forwarding
+    if (toolInfo.serverName === 'proxy' && deps.controlApiClient) {
+        const startTime = Date.now();
+        try {
+            const result = await handleVirtualProxyTool(toolInfo.name, argsForTransport, deps.controlApiClient);
+            logAudit({ status: 'success' }, Date.now() - startTime);
+            return { content: [{ type: 'text', text: JSON.stringify(result) }] };
+        }
+        catch (err) {
+            const errorMessage = err instanceof Error ? err.message : String(err);
+            logAudit({ status: 'error', error: errorMessage }, Date.now() - startTime);
+            return { content: [{ type: 'text', text: `Error: ${errorMessage}` }], isError: true };
+        }
+    }
     // Policy allows -- forward to the real MCP server with transport args
     const startTime = Date.now();
     try {
@@ -580,10 +753,18 @@ export async function handleCallTool(toolName, rawArgs, deps) {
         // CompatibilityCallToolResultSchema accepts the legacy `toolResult` response format
         // (protocol version 2024-10-07). Output schema validation is intentionally
         // bypassed by the permissiveJsonSchemaValidator injected at Client construction time.
-        const result = await client.callTool({
-            name: toolInfo.name,
-            arguments: argsForTransport,
-        }, CompatibilityCallToolResultSchema, { timeout: getEscalationTimeoutMs() });
+        const callToolArgs = { name: toolInfo.name, arguments: argsForTransport };
+        const callToolOpts = { timeout: getEscalationTimeoutMs() };
+        let result = await client.callTool(callToolArgs, CompatibilityCallToolResultSchema, callToolOpts);
+        // Race condition mitigation: after roots expansion the filesystem server
+        // has been notified but may not have finished async-validating the new
+        // roots (fs.realpath, fs.stat). Retry once after a short delay.
+        if (rootsExpanded && isRootsRaceError(result)) {
+            const initialError = extractTextFromContent(result.content) ?? 'access denied (roots race)';
+            logAudit({ status: 'error', error: `Roots race detected, retrying: ${initialError}` }, Date.now() - startTime);
+            await new Promise((r) => setTimeout(r, ROOTS_RACE_RETRY_DELAY_MS));
+            result = await client.callTool(callToolArgs, CompatibilityCallToolResultSchema, callToolOpts);
+        }
         // Reverse-rewrite host sandbox paths to container workspace paths in results
         const rewrittenContent = deps.allowedDirectory
             ? rewriteResultContent(result.content, deps.allowedDirectory, CONTAINER_WORKSPACE_DIR)
@@ -639,8 +820,16 @@ async function main() {
         toolAnnotationsDir,
         fallbackDir: getPackageGeneratedDir(),
     });
+    // Merge proxy tool annotations and policy rules into the loaded artifacts
+    // so the PolicyEngine can evaluate proxy tool calls.
+    toolAnnotations.servers.proxy = {
+        inputHash: 'hardcoded',
+        tools: proxyAnnotations,
+    };
+    compiledPolicy.rules = [...proxyPolicyRules, ...compiledPolicy.rules];
     const serverDomainAllowlists = extractServerDomainAllowlists(serversConfig);
-    const policyEngine = new PolicyEngine(compiledPolicy, toolAnnotations, protectedPaths, allowedDirectory, serverDomainAllowlists, dynamicLists);
+    const trustedServers = buildTrustedServerSet(serversConfig);
+    const policyEngine = new PolicyEngine(compiledPolicy, toolAnnotations, protectedPaths, allowedDirectory, serverDomainAllowlists, dynamicLists, trustedServers);
     const auditLog = new AuditLog(auditLogPath, { redact: auditRedaction });
     const circuitBreaker = new CallCircuitBreaker();
     const autoApproveModel = await createAutoApproveModel(sessionLogPath);
@@ -649,9 +838,12 @@ async function main() {
     // ── Sandbox availability & config resolution ──────────────────────
     const { sandboxAvailable } = validateSandboxAvailability(sandboxPolicy, sessionLogPath, process.platform);
     const { resolvedSandboxConfigs, settingsDir, serverCwdPaths } = resolveServerSandboxConfigs(serversConfig, allowedDirectory, sandboxAvailable, sandboxPolicy);
+    // Discover node/npm paths once for all sandboxed servers with denyRead: ["~"]
+    const dynamicNodePaths = discoverNodePaths();
     // ── Connect to real MCP servers ───────────────────────────────────
     const clientStates = new Map();
     const allTools = [];
+    const tokenRefreshers = new Map();
     for (const [serverName, config] of Object.entries(serversConfig)) {
         // Skip servers whose args reference env vars (Docker -e VAR_NAME syntax)
         // that aren't set — the server will fail to start without them.
@@ -663,14 +855,110 @@ async function main() {
                 logToSessionFile(sessionLogPath, `[proxy] ${warning}`);
             continue;
         }
+        // ── OAuth token injection for servers backed by OAuth providers ──
+        const oauthEnv = {};
+        const oauthProvider = getProviderForServer(serverName);
+        if (oauthProvider) {
+            const clientCreds = loadClientCredentials(oauthProvider);
+            if (!clientCreds) {
+                const warning = `Skipping MCP server "${serverName}": no OAuth credentials. Run 'ironcurtain auth import ${oauthProvider.id} <file>'`;
+                process.stderr.write(`WARNING: ${warning}\n`);
+                if (sessionLogPath)
+                    logToSessionFile(sessionLogPath, `[proxy] ${warning}`);
+                continue;
+            }
+            const tokenProvider = new OAuthTokenProvider(oauthProvider, clientCreds);
+            if (!tokenProvider.isAuthorized()) {
+                const warning = `Skipping MCP server "${serverName}": not authorized. Run 'ironcurtain auth ${oauthProvider.id}'`;
+                process.stderr.write(`WARNING: ${warning}\n`);
+                if (sessionLogPath)
+                    logToSessionFile(sessionLogPath, `[proxy] ${warning}`);
+                continue;
+            }
+            try {
+                const accessToken = await tokenProvider.getValidAccessToken();
+                const storedToken = loadOAuthToken(oauthProvider.id);
+                if (!storedToken) {
+                    throw new Error(`Token file disappeared after validation for "${oauthProvider.id}"`);
+                }
+                // Create per-session credential directory
+                const credsDir = join(settingsDir, `${serverName}-creds`);
+                writeGWorkspaceCredentialFile(credsDir, accessToken, storedToken.expiresAt, storedToken.scopes);
+                // Inject env vars for the MCP server
+                oauthEnv.GWORKSPACE_CREDS_DIR = credsDir;
+                oauthEnv.CLIENT_ID = clientCreds.clientId;
+                oauthEnv.CLIENT_SECRET = clientCreds.clientSecret;
+                // Redirect npm cache into the credential directory for npx sandbox compatibility
+                oauthEnv.npm_config_cache = join(credsDir, '.npm-cache');
+                // Start proactive token refresh
+                const refresher = new TokenFileRefresher({
+                    providerId: oauthProvider.id,
+                    getAccessToken: async () => {
+                        // Force refresh: match the refresher's 10-min threshold
+                        // (getValidAccessToken's 5-min threshold would skip near-expiry tokens)
+                        const token = await tokenProvider.forceRefresh();
+                        const stored = loadOAuthToken(oauthProvider.id);
+                        if (!stored) {
+                            throw new Error(`Token file missing for "${oauthProvider.id}"`);
+                        }
+                        return { accessToken: token, expiresAt: stored.expiresAt, scopes: stored.scopes };
+                    },
+                    writeCredentialFile: (token, expiry, scopes) => {
+                        writeGWorkspaceCredentialFile(credsDir, token, expiry, scopes);
+                    },
+                    logToSession: sessionLogPath ? (msg) => logToSessionFile(sessionLogPath, msg) : undefined,
+                }, storedToken.expiresAt);
+                refresher.start();
+                tokenRefreshers.set(serverName, refresher);
+                // Rewrite srt settings to allow the credential directory and
+                // node paths (for denyRead: ["~"] servers) in a single call
+                const resolvedOAuth = resolvedSandboxConfigs.get(serverName);
+                if (resolvedOAuth?.sandboxed) {
+                    const hasDenyHome = resolvedOAuth.config.denyRead.some((p) => expandTilde(p) === homedir());
+                    const extraAllowRead = hasDenyHome ? [...dynamicNodePaths, credsDir] : [credsDir];
+                    const settingsPath = join(settingsDir, `${serverName}.srt-settings.json`);
+                    rewriteServerSettings(settingsPath, {
+                        allowRead: extraAllowRead,
+                        allowWrite: [credsDir],
+                    });
+                }
+                if (sessionLogPath) {
+                    logToSessionFile(sessionLogPath, `[proxy] OAuth token prepared for "${serverName}" (provider: ${oauthProvider.id})`);
+                }
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const warning = `Skipping MCP server "${serverName}": OAuth token error: ${message}. Run 'ironcurtain auth ${oauthProvider.id}'`;
+                process.stderr.write(`WARNING: ${warning}\n`);
+                if (sessionLogPath)
+                    logToSessionFile(sessionLogPath, `[proxy] ${warning}`);
+                continue;
+            }
+        }
         const resolved = resolvedSandboxConfigs.get(serverName);
         if (!resolved)
             throw new Error(`Missing sandbox config for server "${serverName}"`);
+        // For non-OAuth sandboxed servers with denyRead: ["~"], inject node paths
+        if (!oauthProvider && resolved.sandboxed && dynamicNodePaths.length > 0) {
+            const hasDenyHome = resolved.config.denyRead.some((p) => expandTilde(p) === homedir());
+            if (hasDenyHome) {
+                const settingsPath = join(settingsDir, `${serverName}.srt-settings.json`);
+                rewriteServerSettings(settingsPath, { allowRead: dynamicNodePaths });
+            }
+        }
         const wrapped = wrapServerCommand(serverName, config.command, config.args, resolved, settingsDir);
         const transport = new StdioClientTransport({
             command: wrapped.command,
             args: wrapped.args,
-            env: { ...process.env, ...(config.env ?? {}), ...serverCredentials },
+            env: {
+                ...process.env,
+                // Strip NODE_OPTIONS for sandboxed servers to prevent IDE debugger preloads
+                // (e.g., Cursor/VS Code) from referencing paths under ~ that denyRead blocks.
+                ...(resolved.sandboxed ? { NODE_OPTIONS: '' } : {}),
+                ...(config.env ?? {}),
+                ...serverCredentials,
+                ...oauthEnv,
+            },
             stderr: 'pipe',
             // Sandboxed servers use a per-server temp dir as CWD (not the sandbox)
             // to prevent srt/bwrap ghost dotfiles from polluting the sandbox directory.
@@ -684,7 +972,7 @@ async function main() {
                 if (sessionLogPath) {
                     const lines = text.trimEnd();
                     if (lines) {
-                        const redacted = redactCredentials(lines, serverCredentials);
+                        const redacted = redactCredentials(redactCredentials(lines, serverCredentials), oauthEnv);
                         logToSessionFile(sessionLogPath, `[mcp:${serverName}] ${redacted}`);
                     }
                 }
@@ -722,6 +1010,26 @@ async function main() {
             });
         }
     }
+    // In virtual-only mode (SERVER_FILTER=proxy), register proxy tool definitions
+    // and create the control API client for communicating with the MITM proxy.
+    const isVirtualOnlyMode = process.env.SERVER_FILTER === 'proxy' && Object.keys(serversConfig).length === 0;
+    let controlApiClient = null;
+    if (isVirtualOnlyMode) {
+        for (const toolDef of proxyToolDefinitions) {
+            allTools.push({
+                serverName: 'proxy',
+                name: toolDef.name,
+                description: toolDef.description,
+                inputSchema: toolDef.inputSchema,
+            });
+        }
+        const mitmControlAddr = process.env.MITM_CONTROL_ADDR;
+        if (!mitmControlAddr) {
+            throw new Error('MITM_CONTROL_ADDR must be set when running in virtual-only proxy mode ' +
+                '(SERVER_FILTER=proxy with no other MCP servers).');
+        }
+        controlApiClient = createControlApiClient(mitmControlAddr);
+    }
     const toolMap = buildToolMap(allTools);
     const toolDescriptionHints = loadToolDescriptionHints();
     const hintedTools = applyToolDescriptionHints(allTools, toolDescriptionHints);
@@ -748,6 +1056,8 @@ async function main() {
         escalationDir,
         autoApproveModel,
         serverContextMap,
+        whitelist: createApprovalWhitelist(),
+        controlApiClient,
     };
     server.setRequestHandler(CallToolRequestSchema, async (req) => {
         return handleCallTool(req.params.name, req.params.arguments ?? {}, callToolDeps);
@@ -775,6 +1085,11 @@ async function main() {
     await server.connect(transport);
     // ── Shutdown handler ──────────────────────────────────────────────
     async function shutdown() {
+        // Stop token refreshers before closing clients
+        for (const refresher of tokenRefreshers.values()) {
+            refresher.stop();
+        }
+        tokenRefreshers.clear();
         for (const state of clientStates.values()) {
             try {
                 await state.client.close();