@provos/ironcurtain 0.9.1 → 0.11.0

package/dist/trusted-process/mcp-client-manager.js

@@ -16,25 +16,28 @@ export class MCPClientManager {
         // Permissive validator bypasses client-side outputSchema validation that
         // breaks on MCP servers returning non-conforming structuredContent on errors.
         // See permissive-output-validator.ts for full context and SDK issue link.
+        // Always advertise `roots.listChanged` so backend servers know to
+        // subscribe to updates. Escalation-time root expansion relies on
+        // this capability being present even when we connected with an
+        // empty initial roots list.
         const client = new Client({ name: 'ironcurtain', version: VERSION }, {
-            ...(roots ? { capabilities: { roots: { listChanged: true } } } : {}),
+            capabilities: { roots: { listChanged: true } },
             jsonSchemaValidator: permissiveJsonSchemaValidator,
         });
-        // Mutable copy -- addRoot() pushes to this array.
-        const mutableRoots = roots ? [...roots] : undefined;
+        // Always initialize a mutable roots array so `addRootToClient` can
+        // extend it at escalation time even when we started with none.
+        const mutableRoots = roots ? [...roots] : [];
         const managed = { client, transport, roots: mutableRoots };
-        // When the server asks for roots, return the current set.
-        // If a rootsRefreshed callback is registered (from addRoot),
-        // resolve it so the caller knows the server has the latest roots.
-        if (mutableRoots) {
-            client.setRequestHandler(ListRootsRequestSchema, () => {
-                if (managed.rootsRefreshed) {
-                    managed.rootsRefreshed();
-                    managed.rootsRefreshed = undefined;
-                }
-                return { roots: mutableRoots };
-            });
-        }
+        // When the server asks for roots, return the current set. The
+        // handler is always registered so escalation-time root additions
+        // are observable even if we connected with an empty initial list.
+        client.setRequestHandler(ListRootsRequestSchema, () => {
+            if (managed.rootsRefreshed) {
+                managed.rootsRefreshed();
+                managed.rootsRefreshed = undefined;
+            }
+            return { roots: managed.roots };
+        });
         try {
             await client.connect(transport);
         }
@@ -51,38 +54,30 @@ export class MCPClientManager {
         this.servers.set(name, managed);
     }
     /**
-     * Adds a root directory to a connected server and waits for the
-     * server to fetch the updated root list. This ensures the server's
-     * allowed directories include the new root before any tool call
-     * that depends on it is forwarded.
+     * Returns the live MCP `Client` for a connected server, or undefined
+     * when the server is not connected. Exposed so the coordinator can
+     * wire an existing client through `ClientState` for
+     * `handleCallTool`'s escalation/roots-expansion paths.
      *
-     * No-op if the root URI is already present.
+     * Callers must not mutate client internals; use the manager's public
+     * methods (`callTool`) for state-changing operations.
      */
-    async addRoot(serverName, root) {
-        const server = this.servers.get(serverName);
-        if (!server?.roots)
-            return;
-        // Deduplicate
-        if (server.roots.some((r) => r.uri === root.uri))
-            return;
-        server.roots.push(root);
-        // Wait for the server to call roots/list after we notify it.
-        let timer;
-        const refreshed = new Promise((resolve) => {
-            server.rootsRefreshed = () => {
-                clearTimeout(timer);
-                resolve();
-            };
-        });
-        const timeout = new Promise((resolve) => {
-            timer = setTimeout(() => {
-                server.rootsRefreshed = undefined;
-                resolve();
-            }, ROOTS_REFRESH_TIMEOUT_MS);
-            timer.unref();
-        });
-        await server.client.sendRootsListChanged();
-        await Promise.race([refreshed, timeout]);
+    getClient(serverName) {
+        return this.servers.get(serverName)?.client;
+    }
+    /** Returns the root list tracked for a connected server, if any. */
+    getRoots(serverName) {
+        return this.servers.get(serverName)?.roots;
+    }
+    /**
+     * Returns the live `ClientState` for a connected server. Callers use
+     * this to share the manager's mutable `roots` array and one-shot
+     * `rootsRefreshed` slot with the tool-call pipeline's
+     * `addRootToClient`, so a single mutation is both visible to the
+     * `roots/list` handler and observable as a refresh event.
+     */
+    getClientState(serverName) {
+        return this.servers.get(serverName);
     }
     async listTools(serverName) {
         const server = this.servers.get(serverName);

package/dist/trusted-process/mcp-client-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-client-manager.js","sourceRoot":"","sources":["../../src/trusted-process/mcp-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE/G,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAEjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAc9C,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAuB,EAAE,KAAiB;QACpE,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;SACnE,CAAC,CAAC;QAEH,yEAAyE;QACzE,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC;YACE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,mBAAmB,EAAE,6BAA6B;SACnD,CACF,CAAC;QAEF,kDAAkD;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,MAAM,OAAO,GAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAE1E,0DAA0D;QAC1D,6DAA6D;QAC7D,kEAAkE;QAClE,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,EAAE;gBACpD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;oBACzB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;gBACrC,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,IAAa;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,OAAO;QAE3B,cAAc;QACd,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO;QACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExB,6DAA6D;QAC7D,IAAI,KAAoC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC9C,MAAM,CAAC,cAAc,GAAG,GAAG,EAAE;gBAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAgB,EAAE,IAA6B;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,qFAAqF;QACrF,0FAA0F;QAC1F,mGAAmG;QACnG,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"mcp-client-manager.js","sourceRoot":"","sources":["../../src/trusted-process/mcp-client-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE/G,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAEjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AA6B9C,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAuB,EAAE,KAAiB;QACpE,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,EAAE,GAAI,OAAO,CAAC,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE;SACnE,CAAC,CAAC;QAEH,yEAAyE;QACzE,8EAA8E;QAC9E,0EAA0E;QAC1E,kEAAkE;QAClE,iEAAiE;QACjE,+DAA+D;QAC/D,4BAA4B;QAC5B,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,EACzC;YACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;YAC9C,mBAAmB,EAAE,6BAA6B;SACnD,CACF,CAAC;QAEF,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,YAAY,GAAc,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAE1E,8DAA8D;QAC9D,iEAAiE;QACjE,kEAAkE;QAClE,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,EAAE;YACpD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;gBACzB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YACrC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC9C,CAAC;IAED,oEAAoE;IACpE,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,UAAkB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAgB,EAAE,IAA6B;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QAED,qFAAqF;QACrF,0FAA0F;QAC1F,mGAAmG;QACnG,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/trusted-process/mcp-proxy-server.d.ts

@@ -1,86 +1,38 @@
 /**
- * MCP Proxy Server -- The trusted process running as a standalone MCP server.
+ * MCP Proxy Server -- Standalone MCP subprocess for Code Mode.
  *
- * Code Mode spawns this as a child process via stdio transport. It acts
- * as the security boundary between the sandbox and real MCP servers:
+ * Runs as a child process spawned by MCPClientManager. Acts as a pure
+ * MCP pass-through relay: connects to real MCP backend servers and
+ * forwards tool calls without any policy evaluation. The coordinator
+ * in the parent process owns the full security pipeline.
  *
- * 1. Connects to real MCP servers as a client
- * 2. Exposes their tools with passthrough schemas
- * 3. Evaluates every tool call against the policy engine
- * 4. Forwards allowed calls to real servers, denies or escalates others
- * 5. Logs every request and decision to the append-only audit log
+ * Responsibilities:
+ *   - MCP transport setup (stdio/UDS/TCP)
+ *   - Backend MCP server connection (StdioClientTransport)
+ *   - OAuth credential injection and TokenFileRefresher
+ *   - Sandbox-runtime wrapping (srt)
+ *   - ListTools handler (raw pass-through)
+ *   - CallTool handler (pure forward to backend)
+ *   - Virtual proxy tools (MITM_CONTROL_ADDR)
+ *   - Tool description hints injection
+ *   - Roots bridging: on `notifications/roots/list_changed` from the
+ *     coordinator, fetch fresh roots via `server.listRoots()`, update
+ *     the shared `relayRoots` array, and notify each backend client so
+ *     they re-query their `roots/list` handlers with the new set.
  *
  * Configuration via environment variables:
- *   AUDIT_LOG_PATH     -- path to the audit log file
  *   MCP_SERVERS_CONFIG -- JSON string of MCP server configs to proxy
  *   GENERATED_DIR      -- path to the generated artifacts directory
  *   PROTECTED_PATHS    -- JSON array of protected paths
- *   ALLOWED_DIRECTORY  -- (optional) sandbox directory for structural containment check
- *   ESCALATION_DIR     -- (optional) directory for file-based escalation IPC
+ *   ALLOWED_DIRECTORY  -- (optional) sandbox directory
  *   SESSION_LOG_PATH   -- (optional) path for capturing child process stderr
  *   SANDBOX_POLICY     -- (optional) "enforce" | "warn" (default: "warn")
- *   AUDIT_REDACTION    -- (optional) "true" to redact PII/credentials in audit log entries
- *   SERVER_FILTER      -- (optional) when set, only connect to this single server name
- *   AUTO_APPROVE_ENABLED   -- (optional) "true" to enable auto-approval of escalations
- *   AUTO_APPROVE_MODEL_ID  -- (optional) qualified model ID for auto-approve LLM
- *   AUTO_APPROVE_API_KEY   -- (optional) API key for the auto-approve model's provider
- *   AUTO_APPROVE_LLM_LOG_PATH -- (optional) path to JSONL file for auto-approve LLM logging
+ *   SERVER_FILTER      -- (optional) only connect to this single server name
  */
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { PolicyEngine } from './policy-engine.js';
-import { AuditLog } from './audit-log.js';
 import { type ResolvedSandboxConfig } from './sandbox-integration.js';
-import type { ToolCallRequest, PolicyDecision } from '../types/mcp.js';
-import type { AuditEntry } from '../types/audit.js';
-import { type McpRoot } from './mcp-client-manager.js';
-import { CallCircuitBreaker } from './call-circuit-breaker.js';
-import { type UserContext } from './auto-approver.js';
-import { type ServerContextMap } from './server-context.js';
-import type { LanguageModelV3 } from '@ai-sdk/provider';
 import type { MCPServerConfig, SandboxAvailabilityPolicy } from '../config/types.js';
-import { type ApprovalWhitelist } from './approval-whitelist.js';
-import { type ControlApiClient } from '../docker/proxy-tools.js';
-export interface ProxiedTool {
-    serverName: string;
-    name: string;
-    description?: string;
-    inputSchema: Record<string, unknown>;
-}
-export interface ClientState {
-    client: Client;
-    roots: McpRoot[];
-    rootsRefreshed?: () => void;
-}
-/**
- * Delay before retrying a tool call that returned "access denied" immediately
- * after roots expansion. The filesystem server needs time to async-validate
- * (fs.realpath, fs.stat) the new roots after receiving the rootsListChanged
- * notification. Exported for test access.
- */
-export declare const ROOTS_RACE_RETRY_DELAY_MS = 200;
-/** Extracts concatenated text from MCP content blocks. */
-export declare function extractTextFromContent(content: unknown): string | undefined;
-/**
- * Returns true when a user context is safe to act on for auto-approval.
- *
- * For PTY sessions (isPtySession=true):
- *   - source must be 'mux-trusted-input' (set by the trusted mux layer)
- *   - timestamp must be present, valid, not in the future, and within
- *     TRUSTED_INPUT_STALENESS_MS of `now`
- *
- * For non-PTY sessions:
- *   - source is not checked (no mux layer in the path)
- *   - a missing or invalid timestamp does not prevent trust; a valid stale
- *     timestamp still prevents trust (belt-and-suspenders for future callers)
- *
- * @param context - The user context parsed from user-context.json
- * @param isPtySession - Whether this is a PTY interactive session
- * @param now - Current time in ms; defaults to Date.now() (injectable for tests)
- */
-export declare function isUserContextTrusted(context: UserContext, isPtySession: boolean, now?: number): boolean;
 /** Parsed environment configuration for the proxy server. */
 export interface ProxyEnvConfig {
-    auditLogPath: string;
     serversConfig: Record<string, MCPServerConfig>;
     generatedDir: string;
     /** Directory for tool-annotations.json. Defaults to generatedDir if unset. */
@@ -88,38 +40,24 @@ export interface ProxyEnvConfig {
     protectedPaths: string[];
     sessionLogPath: string | undefined;
     allowedDirectory: string | undefined;
-    escalationDir: string | undefined;
     serverCredentials: Record<string, string>;
     sandboxPolicy: SandboxAvailabilityPolicy;
-    auditRedaction: boolean;
+    /** Raw `SERVER_FILTER` env value (e.g., backend name, "proxy", or undefined). */
+    serverFilter: string | undefined;
 }
 /** Result of sandbox availability validation. */
 export interface SandboxValidationResult {
     sandboxAvailable: boolean;
 }
-/** MCP tool call response shape returned by handleCallTool. */
-export interface ToolCallResponse {
-    content: unknown;
-    isError?: boolean;
-    [key: string]: unknown;
-}
-/** Dependencies injected into handleCallTool for testability. */
-export interface CallToolDeps {
-    toolMap: Map<string, ProxiedTool>;
-    policyEngine: PolicyEngine;
-    auditLog: AuditLog;
-    circuitBreaker: CallCircuitBreaker;
-    clientStates: Map<string, ClientState>;
-    resolvedSandboxConfigs: Map<string, ResolvedSandboxConfig>;
-    allowedDirectory: string | undefined;
-    escalationDir: string | undefined;
-    autoApproveModel: LanguageModelV3 | null;
-    serverContextMap: ServerContextMap;
-    /** Ephemeral approval whitelist for this session. */
-    whitelist: ApprovalWhitelist;
-    /** Control API client for virtual proxy tools. Only set in virtual-only mode. */
-    controlApiClient?: ControlApiClient | null;
-}
+/**
+ * True when this proxy subprocess is in a viable serving state -- either
+ * virtual-only mode (no backends configured) or at least one configured
+ * backend connected. Returning false means the parent should treat this
+ * subprocess as failed; otherwise it would register zero tools for the
+ * server and trigger a misleading "stale annotations" warning in the
+ * coordinator's drift check.
+ */
+export declare function proxyCanServe(serversConfig: Record<string, MCPServerConfig>, connectedBackendCount: number): boolean;
 /**
  * Reads and validates proxy environment variables.
  * Returns a typed config object or calls process.exit(1) on missing required vars.
@@ -141,33 +79,6 @@ export declare function resolveServerSandboxConfigs(serversConfig: Record<string
     settingsDir: string;
     serverCwdPaths: Map<string, string>;
 };
-/**
- * Validates that all argument keys exist in the tool's inputSchema.
- * Returns null if valid, or an error message listing unknown and valid keys.
- * Skips validation when the schema has no properties or allows additional properties.
- */
-export declare function validateToolArguments(args: Record<string, unknown>, inputSchema: Record<string, unknown>): string | null;
-/** Builds a lookup map from tool name to ProxiedTool for routing. */
-export declare function buildToolMap(allTools: ProxiedTool[]): Map<string, ProxiedTool>;
-/**
- * Creates an audit entry and logs it. Extracted so the audit shape
- * construction is testable independently.
- */
-export declare function buildAuditEntry(request: ToolCallRequest, argsForTransport: Record<string, unknown>, policyDecision: PolicyDecision, result: AuditEntry['result'], durationMs: number, options: {
-    escalationResult?: 'approved' | 'denied';
-    sandboxed?: boolean;
-    autoApproved?: boolean;
-    whitelistApproved?: boolean;
-    whitelistPatternId?: string;
-}): AuditEntry;
-/**
- * Handles a single tool call request: policy evaluation, escalation,
- * circuit breaker check, and forwarding to the real MCP server.
- *
- * This is the core security logic extracted from the CallTool handler
- * for independent unit testing.
- */
-export declare function handleCallTool(toolName: string, rawArgs: Record<string, unknown>, deps: CallToolDeps): Promise<ToolCallResponse>;
 /**
  * Selects and validates the proxy transport based on environment variables.
  * Returns 'tcp', 'uds', or 'stdio' along with the transport options.