@rigour-labs/core 5.5.4 → 6.1.0-beta.1

package/dist/firewall/attestation.js

@@ -0,0 +1,197 @@
+/**
+ * Signed attestation bundles for completed transactions.
+ * Keys prefer env / home directory — not agent-writable workspace keys for CI admit.
+ */
+import { createHash, createHmac, randomBytes } from 'crypto';
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { execa } from 'execa';
+const KEY_FILE = 'attestation.key';
+export async function resolveAttestationKey(cwd) {
+    const envKey = process.env.RIGOUR_ATTESTATION_KEY;
+    if (envKey && envKey.length >= 32) {
+        return { key: Buffer.from(envKey, 'utf8'), source: 'env' };
+    }
+    const homeKeyPath = path.join(os.homedir(), '.rigour', KEY_FILE);
+    if (await fs.pathExists(homeKeyPath)) {
+        return { key: await fs.readFile(homeKeyPath), source: 'home' };
+    }
+    const workspaceKeyPath = path.join(cwd, '.rigour', KEY_FILE);
+    if (await fs.pathExists(workspaceKeyPath)) {
+        return { key: await fs.readFile(workspaceKeyPath), source: 'workspace' };
+    }
+    // Create home key by default (outside agent workspace)
+    await fs.ensureDir(path.join(os.homedir(), '.rigour'));
+    const key = randomBytes(32);
+    await fs.writeFile(homeKeyPath, key, { mode: 0o600 });
+    return { key, source: 'home' };
+}
+/** @deprecated use resolveAttestationKey */
+export async function ensureAttestationKey(cwd) {
+    const { key } = await resolveAttestationKey(cwd);
+    return key;
+}
+function payloadForSign(bundle) {
+    return JSON.stringify({
+        version: bundle.version,
+        transactionId: bundle.transactionId,
+        agentId: bundle.agentId,
+        userId: bundle.userId,
+        scope: bundle.scope,
+        policyHash: bundle.policyHash,
+        capabilities: bundle.capabilities,
+        filesUsed: bundle.filesUsed,
+        toolsUsed: bundle.toolsUsed,
+        gateResults: bundle.gateResults,
+        overrides: bundle.overrides,
+        artifactDigest: bundle.artifactDigest,
+        commitSha: bundle.commitSha,
+        treeDigest: bundle.treeDigest,
+    });
+}
+export function computeArtifactDigest(files, contents) {
+    const h = createHash('sha256');
+    for (const f of [...files].sort()) {
+        h.update(f);
+        h.update('\0');
+        h.update(contents.get(f) ?? '');
+        h.update('\0');
+    }
+    return h.digest('hex');
+}
+export async function getGitCommitSha(dir) {
+    try {
+        const { stdout } = await execa('git', ['rev-parse', 'HEAD'], { cwd: dir, shell: false });
+        return stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function getGitTreeDigest(dir) {
+    try {
+        const { stdout } = await execa('git', ['rev-parse', 'HEAD^{tree}'], { cwd: dir, shell: false });
+        return stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function createAttestation(cwd, input) {
+    const { key } = await resolveAttestationKey(cwd);
+    const verifyRoot = input.verifyRoot || input.transaction.worktreePath || cwd;
+    const commitSha = input.commitSha ?? (await getGitCommitSha(verifyRoot)) ?? undefined;
+    const treeDigest = input.treeDigest ?? (await getGitTreeDigest(verifyRoot)) ?? undefined;
+    const files = input.transaction.filesChanged;
+    const contents = input.fileContents ?? new Map();
+    if (files.length > 0 && contents.size === 0) {
+        for (const f of files) {
+            const abs = path.join(verifyRoot, f);
+            if (await fs.pathExists(abs)) {
+                contents.set(f, await fs.readFile(abs, 'utf-8'));
+            }
+        }
+    }
+    let artifactDigest = computeArtifactDigest(files, contents);
+    if (files.length === 0 && treeDigest) {
+        artifactDigest = createHash('sha256').update(`tree:${treeDigest}`).digest('hex');
+    }
+    if (!treeDigest && files.length === 0) {
+        throw new Error('Attestation requires treeDigest or non-empty filesChanged with contents');
+    }
+    const unsigned = {
+        version: 1,
+        transactionId: input.transaction.id,
+        agentId: input.transaction.agentId,
+        userId: input.userId,
+        scope: input.transaction.scope,
+        policyHash: input.transaction.policyHash,
+        capabilities: input.transaction.capabilitiesIssued,
+        filesUsed: files,
+        toolsUsed: input.toolsUsed ?? [],
+        gateResults: input.gateResults,
+        overrides: input.overrides ?? [],
+        artifactDigest,
+        commitSha,
+        treeDigest,
+    };
+    const signedAt = new Date().toISOString();
+    const signature = createHmac('sha256', key)
+        .update(payloadForSign(unsigned) + signedAt)
+        .digest('hex');
+    const bundle = { ...unsigned, signedAt, signature };
+    const outDir = path.join(cwd, '.rigour', 'attestations');
+    await fs.ensureDir(outDir);
+    await fs.writeJson(path.join(outDir, `${bundle.transactionId}.json`), bundle, { spaces: 2 });
+    await fs.writeJson(path.join(cwd, '.rigour', 'attestation-latest.json'), bundle, { spaces: 2 });
+    return bundle;
+}
+export async function verifyAttestation(cwd, bundle) {
+    const { key } = await resolveAttestationKey(cwd);
+    const { signature, signedAt, ...rest } = bundle;
+    const expected = createHmac('sha256', key)
+        .update(payloadForSign(rest) + signedAt)
+        .digest('hex');
+    return expected === signature;
+}
+export async function loadLatestAttestation(cwd) {
+    const p = path.join(cwd, '.rigour', 'attestation-latest.json');
+    if (!(await fs.pathExists(p)))
+        return null;
+    try {
+        return await fs.readJson(p);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * CI admission: valid signature, PASS gates, bound commit/tree, fresh, non-workspace-key unless allowed.
+ */
+export async function admitForCi(cwd) {
+    const { source } = await resolveAttestationKey(cwd);
+    if (source === 'workspace' && process.env.RIGOUR_ALLOW_WORKSPACE_ATTESTATION_KEY !== '1') {
+        return {
+            admit: false,
+            reason: 'Attestation key is workspace-local; set RIGOUR_ATTESTATION_KEY or ~/.rigour/attestation.key',
+        };
+    }
+    const bundle = await loadLatestAttestation(cwd);
+    if (!bundle) {
+        return { admit: false, reason: 'No attestation bundle found' };
+    }
+    const valid = await verifyAttestation(cwd, bundle);
+    if (!valid) {
+        return { admit: false, reason: 'Attestation signature invalid' };
+    }
+    if (bundle.gateResults.status !== 'PASS') {
+        return { admit: false, reason: `Gates not PASS (${bundle.gateResults.status})` };
+    }
+    if (!bundle.treeDigest && (!bundle.filesUsed || bundle.filesUsed.length === 0)) {
+        return { admit: false, reason: 'Attestation missing treeDigest and filesUsed' };
+    }
+    if (!bundle.artifactDigest || bundle.artifactDigest.length < 16) {
+        return { admit: false, reason: 'Attestation artifactDigest missing or trivial' };
+    }
+    const maxAgeMs = Number(process.env.RIGOUR_ATTESTATION_MAX_AGE_MS || 24 * 60 * 60 * 1000);
+    const age = Date.now() - Date.parse(bundle.signedAt);
+    if (!Number.isFinite(age) || age < 0 || age > maxAgeMs) {
+        return { admit: false, reason: 'Attestation expired or has invalid signedAt' };
+    }
+    const headSha = await getGitCommitSha(cwd);
+    if (bundle.commitSha && headSha && bundle.commitSha !== headSha) {
+        return {
+            admit: false,
+            reason: `Attestation commitSha ${bundle.commitSha.slice(0, 8)}≠ HEAD ${headSha.slice(0, 8)}`,
+        };
+    }
+    const headTree = await getGitTreeDigest(cwd);
+    if (bundle.treeDigest && headTree && bundle.treeDigest !== headTree) {
+        return {
+            admit: false,
+            reason: `Attestation treeDigest mismatch vs HEAD tree`,
+        };
+    }
+    return { admit: true, reason: 'Valid attestation with PASS gates and bound tree/commit' };
+}

package/dist/firewall/capability-broker.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Capability broker — issues one-use, short-lived capabilities.
+ */
+import type { CapabilityAction, CapabilityGrant, PolicyEvaluation } from './types.js';
+import { type AgentScopeRecord } from './scope-enforcement.js';
+export interface BrokerConfig {
+    defaultTtlMs: number;
+    toolAllowlist: string[];
+    agentScopes: AgentScopeRecord[];
+    agentId?: string;
+    taskId?: string;
+}
+export declare class CapabilityBroker {
+    private readonly config;
+    private grants;
+    private decisions;
+    private readonly policyHash;
+    constructor(config: BrokerConfig);
+    getPolicyHash(): string;
+    getDecisions(): PolicyEvaluation[];
+    listGrants(): CapabilityGrant[];
+    issue(action: CapabilityAction, resource: string, constraints?: Record<string, unknown>): CapabilityGrant;
+    evaluateProposal(input: {
+        action: CapabilityAction;
+        resource: string;
+        args?: Record<string, unknown>;
+        command?: string;
+        capabilityId?: string;
+    }): PolicyEvaluation;
+    private prechecks;
+    private denyUndeclaredMcp;
+    private denyOutOfScopeWrite;
+    private evaluateWithCapability;
+    private consumeCapability;
+    private denyCap;
+    private record;
+    persistDecisions(cwd: string): Promise<void>;
+}
+/** Pure evaluate for adversarial replay (fresh broker per call). */
+export declare function evaluateActionDeterministic(input: {
+    action: CapabilityAction;
+    resource: string;
+    command?: string;
+    toolAllowlist: string[];
+    agentScopes: AgentScopeRecord[];
+    agentId?: string;
+}): PolicyEvaluation;

package/dist/firewall/capability-broker.js

@@ -0,0 +1,209 @@
+/**
+ * Capability broker — issues one-use, short-lived capabilities.
+ */
+import { randomUUID } from 'crypto';
+import fs from 'fs-extra';
+import path from 'path';
+import { hashPolicy } from './policy-hash.js';
+import { evaluateTypedCommand } from './typed-command.js';
+import { isPathInScope } from './scope-enforcement.js';
+const DEFAULT_TTL_MS = 30_000;
+export class CapabilityBroker {
+    config;
+    grants = new Map();
+    decisions = [];
+    policyHash;
+    constructor(config) {
+        this.config = config;
+        this.policyHash = hashPolicy({
+            toolAllowlist: [...config.toolAllowlist].sort(),
+            scopes: config.agentScopes,
+            ttl: config.defaultTtlMs ?? DEFAULT_TTL_MS,
+        });
+    }
+    getPolicyHash() {
+        return this.policyHash;
+    }
+    getDecisions() {
+        return [...this.decisions];
+    }
+    listGrants() {
+        return [...this.grants.values()];
+    }
+    issue(action, resource, constraints) {
+        const grant = {
+            id: randomUUID(),
+            action,
+            resource,
+            constraints,
+            expiresAt: Date.now() + (this.config.defaultTtlMs ?? DEFAULT_TTL_MS),
+            agentId: this.config.agentId,
+            taskId: this.config.taskId,
+            policyHash: this.policyHash,
+            used: false,
+        };
+        this.grants.set(grant.id, grant);
+        return grant;
+    }
+    evaluateProposal(input) {
+        const timestamp = new Date().toISOString();
+        const early = this.prechecks(input, timestamp);
+        if (early)
+            return early;
+        if (input.capabilityId) {
+            return this.evaluateWithCapability(input.capabilityId, input.action, input.resource, timestamp);
+        }
+        const grant = this.issue(input.action, input.resource, input.args);
+        return this.record({
+            decision: 'allow',
+            reason: `Capability issued for ${input.action}:${input.resource}`,
+            ruleId: 'capability.issue',
+            capabilityId: grant.id,
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    prechecks(input, timestamp) {
+        if (input.action === 'mcp.call') {
+            const deny = this.denyUndeclaredMcp(input.resource, timestamp);
+            if (deny)
+                return deny;
+        }
+        if (input.action === 'filesystem.write') {
+            const deny = this.denyOutOfScopeWrite(input.resource, timestamp);
+            if (deny)
+                return deny;
+        }
+        if (input.action === 'shell.exec' && input.command) {
+            const cmdEv = evaluateTypedCommand(input.command);
+            if (cmdEv.decision !== 'allow') {
+                return this.record({ ...cmdEv, policyHash: this.policyHash, timestamp });
+            }
+        }
+        if (input.action === 'secret.lease') {
+            const grant = this.issue('secret.lease', input.resource, { purpose: input.args?.purpose });
+            return this.record({
+                decision: 'allow',
+                reason: `Secret lease capability issued for ${input.resource} (secret not exposed to agent)`,
+                ruleId: 'secret.lease',
+                capabilityId: grant.id,
+                policyHash: this.policyHash,
+                timestamp,
+            });
+        }
+        return null;
+    }
+    denyUndeclaredMcp(tool, timestamp) {
+        const allow = this.config.toolAllowlist;
+        if (allow.includes('*') || allow.includes(tool))
+            return null;
+        return this.record({
+            decision: 'deny',
+            reason: `MCP tool "${tool}" is not on the agent allowlist`,
+            ruleId: 'mcp.undeclared',
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    denyOutOfScopeWrite(resource, timestamp) {
+        if (this.config.agentScopes.length === 0)
+            return null;
+        if (!this.config.agentId) {
+            return this.record({
+                decision: 'scope-violation',
+                reason: 'Writer agentId is required when agent scopes are registered (fail-closed; no union-allow)',
+                ruleId: 'scope.unbound',
+                policyHash: this.policyHash,
+                timestamp,
+            });
+        }
+        const agents = this.config.agentScopes.filter(a => a.agentId === this.config.agentId);
+        const rel = resource.replace(/\\/g, '/');
+        const ok = agents.some(a => isPathInScope(rel, a.taskScope));
+        if (ok)
+            return null;
+        return this.record({
+            decision: 'scope-violation',
+            reason: `Write to "${resource}" outside assigned scope`,
+            ruleId: 'scope.out-of-bounds',
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    evaluateWithCapability(capabilityId, action, resource, timestamp) {
+        const consumed = this.consumeCapability(capabilityId, action, resource, timestamp);
+        if (consumed.kind === 'deny')
+            return consumed.evaluation;
+        return this.record({
+            decision: 'allow',
+            reason: `Capability ${capabilityId} consumed for ${action}:${resource}`,
+            ruleId: 'capability.consume',
+            capabilityId,
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    consumeCapability(capabilityId, action, resource, timestamp) {
+        const grant = this.grants.get(capabilityId);
+        if (!grant) {
+            return { kind: 'deny', evaluation: this.denyCap('Unknown capability id', 'capability.unknown', timestamp) };
+        }
+        if (grant.used) {
+            return {
+                kind: 'deny',
+                evaluation: this.denyCap('Capability already consumed (one-use)', 'capability.reuse', timestamp, grant.id),
+            };
+        }
+        if (Date.now() > grant.expiresAt) {
+            return {
+                kind: 'deny',
+                evaluation: this.denyCap('Capability expired', 'capability.expired', timestamp, grant.id),
+            };
+        }
+        if (grant.action !== action || grant.resource !== resource) {
+            return {
+                kind: 'deny',
+                evaluation: this.denyCap('Capability does not match proposed action/resource', 'capability.mismatch', timestamp, grant.id),
+            };
+        }
+        grant.used = true;
+        return { kind: 'ok' };
+    }
+    denyCap(reason, ruleId, timestamp, capabilityId) {
+        return this.record({
+            decision: 'deny',
+            reason,
+            ruleId,
+            capabilityId,
+            policyHash: this.policyHash,
+            timestamp,
+        });
+    }
+    record(ev) {
+        this.decisions.push(ev);
+        return ev;
+    }
+    async persistDecisions(cwd) {
+        const dir = path.join(cwd, '.rigour');
+        await fs.ensureDir(dir);
+        const file = path.join(dir, 'firewall-decisions.jsonl');
+        const lines = this.decisions.map(d => JSON.stringify(d)).join('\n');
+        if (lines) {
+            await fs.appendFile(file, lines + '\n');
+        }
+    }
+}
+/** Pure evaluate for adversarial replay (fresh broker per call). */
+export function evaluateActionDeterministic(input) {
+    const broker = new CapabilityBroker({
+        defaultTtlMs: DEFAULT_TTL_MS,
+        toolAllowlist: input.toolAllowlist,
+        agentScopes: input.agentScopes,
+        agentId: input.agentId,
+    });
+    return broker.evaluateProposal({
+        action: input.action,
+        resource: input.resource,
+        command: input.command,
+    });
+}

package/dist/firewall/firewall.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/firewall/firewall.test.js

@@ -0,0 +1,102 @@
+import { describe, it, expect } from 'vitest';
+import { evaluateTypedCommand, parseCommandLine, evaluateWriteScope, evaluateActionDeterministic, runAdversarialCorpus, CapabilityBroker, validateAgentClaimedScope, } from './index.js';
+describe('typed command firewall', () => {
+    it('denies shell metacharacters', () => {
+        const ev = evaluateTypedCommand('ls; rm -rf /');
+        expect(ev.decision).toBe('deny');
+        expect(ev.ruleId).toBe('shell.no-meta');
+    });
+    it('denies unknown binaries including node/npx', () => {
+        expect(evaluateTypedCommand('curl https://evil.example').decision).toBe('deny');
+        expect(evaluateTypedCommand('node -e "1"').decision).toBe('deny');
+        expect(evaluateTypedCommand('npx cowsay hi').decision).toBe('deny');
+    });
+    it('denies git push', () => {
+        const ev = evaluateTypedCommand('git push origin main');
+        expect(ev.decision).toBe('deny');
+        expect(ev.ruleId).toBe('git.destructive');
+    });
+    it('allows vitest', () => {
+        const ev = evaluateTypedCommand('vitest run packages/rigour-core');
+        expect(ev.decision).toBe('allow');
+        expect(parseCommandLine('vitest run x')?.bin).toBe('vitest');
+    });
+});
+describe('scope enforcement', () => {
+    it('denies unbound writer when scopes exist', () => {
+        const ev = evaluateWriteScope('/repo', 'packages/rigour-core/src/x.ts', [
+            { agentId: 'a1', taskScope: ['packages/rigour-core/**'] },
+        ]);
+        expect(ev.decision).toBe('scope-violation');
+        expect(ev.ruleId).toBe('scope.unbound');
+    });
+    it('flags out-of-scope writes for bound agent', () => {
+        const ev = evaluateWriteScope('/repo', '.github/workflows/x.yml', [
+            { agentId: 'a1', taskScope: ['packages/rigour-core/**'] },
+        ], 'a1');
+        expect(ev.decision).toBe('scope-violation');
+    });
+    it('allows in-scope writes for bound agent', () => {
+        const ev = evaluateWriteScope('/repo', 'packages/rigour-core/src/firewall/types.ts', [
+            { agentId: 'a1', taskScope: ['packages/rigour-core/**'] },
+        ], 'a1');
+        expect(ev.decision).toBe('allow');
+    });
+    it('rejects broad self-registration scopes', () => {
+        expect(validateAgentClaimedScope(['**/*']).ok).toBe(false);
+        expect(validateAgentClaimedScope(['.github/**']).ok).toBe(false);
+        expect(validateAgentClaimedScope(['packages/rigour-core/**']).ok).toBe(true);
+    });
+});
+describe('capability broker', () => {
+    it('denies undeclared MCP tools', () => {
+        const broker = new CapabilityBroker({
+            defaultTtlMs: 1000,
+            toolAllowlist: ['rigour_check'],
+            agentScopes: [],
+        });
+        const ev = broker.evaluateProposal({
+            action: 'mcp.call',
+            resource: 'slack.post_message',
+        });
+        expect(ev.decision).toBe('deny');
+        expect(ev.ruleId).toBe('mcp.undeclared');
+    });
+    it('issues one-use capabilities', () => {
+        const broker = new CapabilityBroker({
+            defaultTtlMs: 60_000,
+            toolAllowlist: ['*'],
+            agentScopes: [],
+        });
+        const grant = broker.issue('mcp.call', 'rigour_check');
+        const ok = broker.evaluateProposal({
+            action: 'mcp.call',
+            resource: 'rigour_check',
+            capabilityId: grant.id,
+        });
+        expect(ok.decision).toBe('allow');
+        const again = broker.evaluateProposal({
+            action: 'mcp.call',
+            resource: 'rigour_check',
+            capabilityId: grant.id,
+        });
+        expect(again.decision).toBe('deny');
+        expect(again.ruleId).toBe('capability.reuse');
+    });
+});
+describe('adversarial corpus', () => {
+    it('passes default regression corpus', () => {
+        const report = runAdversarialCorpus();
+        expect(report.failed).toBe(0);
+        expect(report.passed).toBeGreaterThan(0);
+    });
+    it('evaluateActionDeterministic matches expected deny', () => {
+        const ev = evaluateActionDeterministic({
+            action: 'mcp.call',
+            resource: 'github.merge',
+            toolAllowlist: [],
+            agentScopes: [],
+        });
+        expect(ev.decision).toBe('deny');
+    });
+});

package/dist/firewall/index.d.ts

@@ -0,0 +1,10 @@
+export * from './types.js';
+export * from './policy-hash.js';
+export * from './typed-command.js';
+export * from './scope-enforcement.js';
+export * from './capability-broker.js';
+export * from './transaction.js';
+export * from './attestation.js';
+export * from './adversarial.js';
+export * from './mcp-gateway.js';
+export * from './arbitration-token.js';

package/dist/firewall/index.js

@@ -0,0 +1,10 @@
+export * from './types.js';
+export * from './policy-hash.js';
+export * from './typed-command.js';
+export * from './scope-enforcement.js';
+export * from './capability-broker.js';
+export * from './transaction.js';
+export * from './attestation.js';
+export * from './adversarial.js';
+export * from './mcp-gateway.js';
+export * from './arbitration-token.js';

package/dist/firewall/mcp-gateway.d.ts

@@ -0,0 +1,40 @@
+/**
+ * MCP Gateway interface sketch (ADR 001).
+ * Full proxy packaging may move to packages/rigour-gateway later.
+ */
+import type { PolicyEvaluation } from './types.js';
+import { CapabilityBroker, type BrokerConfig } from './capability-broker.js';
+export interface ToolDescriptor {
+    name: string;
+    description?: string;
+}
+export interface McpGatewayInvokeRequest {
+    agentId: string;
+    taskId: string;
+    tool: string;
+    args: Record<string, unknown>;
+    capabilityId?: string;
+}
+export interface McpGatewayInvokeResult {
+    decision: PolicyEvaluation['decision'];
+    reason: string;
+    ruleId?: string;
+    capabilityId?: string;
+    /** Present only when decision is allow and a downstream handler is wired. */
+    result?: unknown;
+}
+/**
+ * In-process gateway that filters discovery and authorizes calls via CapabilityBroker.
+ * Does not forward to external MCP servers yet — that is the next packaging step.
+ */
+export declare class McpGateway {
+    private readonly config;
+    private broker;
+    constructor(config: BrokerConfig & {
+        downstream?: (tool: string, args: Record<string, unknown>) => Promise<unknown>;
+    });
+    listTools(): ToolDescriptor[];
+    invoke(req: McpGatewayInvokeRequest): Promise<McpGatewayInvokeResult>;
+    leaseSecret(name: string, purpose: string): McpGatewayInvokeResult;
+    getBroker(): CapabilityBroker;
+}

package/dist/firewall/mcp-gateway.js

@@ -0,0 +1,64 @@
+/**
+ * MCP Gateway interface sketch (ADR 001).
+ * Full proxy packaging may move to packages/rigour-gateway later.
+ */
+import { CapabilityBroker } from './capability-broker.js';
+/**
+ * In-process gateway that filters discovery and authorizes calls via CapabilityBroker.
+ * Does not forward to external MCP servers yet — that is the next packaging step.
+ */
+export class McpGateway {
+    config;
+    broker;
+    constructor(config) {
+        this.config = config;
+        this.broker = new CapabilityBroker(config);
+    }
+    listTools() {
+        return this.config.toolAllowlist
+            .filter(t => t !== '*')
+            .map(name => ({ name, description: 'Allowlisted tool' }));
+    }
+    async invoke(req) {
+        const evaluation = this.broker.evaluateProposal({
+            action: 'mcp.call',
+            resource: req.tool,
+            args: req.args,
+            capabilityId: req.capabilityId,
+        });
+        if (evaluation.decision !== 'allow') {
+            return {
+                decision: evaluation.decision,
+                reason: evaluation.reason,
+                ruleId: evaluation.ruleId,
+            };
+        }
+        let result;
+        if (this.config.downstream) {
+            result = await this.config.downstream(req.tool, req.args);
+        }
+        return {
+            decision: 'allow',
+            reason: evaluation.reason,
+            ruleId: evaluation.ruleId,
+            capabilityId: evaluation.capabilityId,
+            result,
+        };
+    }
+    leaseSecret(name, purpose) {
+        const evaluation = this.broker.evaluateProposal({
+            action: 'secret.lease',
+            resource: name,
+            args: { purpose },
+        });
+        return {
+            decision: evaluation.decision,
+            reason: evaluation.reason,
+            ruleId: evaluation.ruleId,
+            capabilityId: evaluation.capabilityId,
+        };
+    }
+    getBroker() {
+        return this.broker;
+    }
+}

package/dist/firewall/policy-hash.d.ts

@@ -0,0 +1 @@
+export declare function hashPolicy(input: unknown): string;