@securecode-ai/mcp 0.1.0

package/dist/approval/broker.js

@@ -0,0 +1,252 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApprovalBroker = void 0;
+const http = __importStar(require("http"));
+const child_process_1 = require("child_process");
+const types_1 = require("./types");
+const auditLog_1 = require("./auditLog");
+const APPROVAL_PAGE_HTML = `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>SecureCode MCP — Approval Required</title>
+<style>
+body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; max-width: 600px; margin: 60px auto; padding: 20px; color: #1a1a1a; }
+h1 { font-size: 20px; margin-bottom: 8px; }
+.summary { background: #f4f4f4; padding: 16px; border-radius: 8px; margin: 16px 0; font-family: monospace; font-size: 13px; white-space: pre-wrap; word-break: break-all; }
+.meta { color: #666; font-size: 13px; margin-bottom: 16px; }
+.buttons { display: flex; gap: 12px; margin-top: 24px; }
+button { padding: 10px 24px; border: none; border-radius: 6px; font-size: 14px; cursor: pointer; font-weight: 600; }
+.approve { background: #16a34a; color: white; }
+.deny { background: #dc2626; color: white; }
+.result { margin-top: 24px; font-size: 16px; font-weight: 600; }
+.timeout { color: #d97706; }
+.expired { display: none; color: #dc2626; }
+</style>
+</head>
+<body>
+<h1>SecureCode MCP — Approval Required</h1>
+<div class="meta">Tool: <span id="tool"></span> | Hash: <span id="hash"></span></div>
+<div class="summary" id="summary"></div>
+<div class="buttons" id="buttons">
+<button class="approve" onclick="respond(true)">Approve</button>
+<button class="deny" onclick="respond(false)">Deny</button>
+</div>
+<div class="result" id="result"></div>
+<div class="expired" id="expired">This request has expired. You can close this page.</div>
+<script>
+const params = new URLSearchParams(window.location.search);
+const reqId = params.get('id');
+document.getElementById('tool').textContent = params.get('tool') || '';
+document.getElementById('hash').textContent = params.get('hash') || '';
+document.getElementById('summary').textContent = decodeURIComponent(params.get('summary') || '');
+
+async function respond(approved) {
+document.getElementById('buttons').style.display = 'none';
+const res = document.getElementById('result');
+try {
+const r = await fetch('/decide', {
+method: 'POST',
+headers: {'Content-Type': 'application/json'},
+body: JSON.stringify({ id: reqId, approved })
+});
+const data = await r.json();
+if (data.ok) {
+res.textContent = approved ? 'Approved. You can close this page.' : 'Denied. You can close this page.';
+res.style.color = approved ? '#16a34a' : '#dc2626';
+} else {
+res.textContent = 'Error: ' + (data.error || 'unknown');
+res.style.color = '#dc2626';
+}
+} catch (e) {
+res.textContent = 'Error: ' + e.message;
+res.style.color = '#dc2626';
+}
+}
+
+const expiresAt = parseInt(params.get('exp') || '0');
+if (expiresAt && Date.now() > expiresAt) {
+document.getElementById('buttons').style.display = 'none';
+document.getElementById('expired').style.display = 'block';
+}
+</script>
+</body>
+</html>`;
+function openBrowser(url) {
+    const platform = process.platform;
+    try {
+        if (platform === 'darwin') {
+            (0, child_process_1.exec)(`open "${url}"`);
+        }
+        else if (platform === 'win32') {
+            (0, child_process_1.exec)(`start "" "${url}"`);
+        }
+        else {
+            (0, child_process_1.exec)(`xdg-open "${url}"`);
+        }
+    }
+    catch {
+        // If browser open fails, the user can copy the URL from stdout
+    }
+}
+class ApprovalBroker {
+    server = null;
+    port = 0;
+    pending = new Map();
+    async start() {
+        return new Promise((resolve) => {
+            this.server = http.createServer((req, res) => this.handle(req, res));
+            this.server.listen(0, '127.0.0.1', () => {
+                const addr = this.server.address();
+                this.port = addr.port;
+                resolve(this.port);
+            });
+        });
+    }
+    async stop() {
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    getPort() {
+        return this.port;
+    }
+    requestApproval(tool, summary, operationParts, timeoutMs = 60_000) {
+        return new Promise((resolve) => {
+            const req = (0, types_1.createApprovalRequest)(tool, summary, operationParts, timeoutMs);
+            const startTime = Date.now();
+            this.pending.set(req.id, { req, resolve });
+            const url = `http://127.0.0.1:${this.port}/?id=${req.id}&tool=${encodeURIComponent(tool)}&hash=${req.operationHash}&summary=${encodeURIComponent(summary)}&exp=${req.expiresAt}`;
+            console.error(`[securecode] Approval required for ${tool}. Open: ${url}`);
+            openBrowser(url);
+            const timer = setTimeout(() => {
+                const entry = this.pending.get(req.id);
+                if (entry) {
+                    this.pending.delete(req.id);
+                    const result = {
+                        approved: false,
+                        reason: 'Request timed out',
+                        requestId: req.id,
+                        duration: Date.now() - startTime,
+                    };
+                    (0, auditLog_1.appendAudit)({
+                        timestamp: new Date().toISOString(),
+                        requestId: req.id,
+                        tool: req.tool,
+                        operationHash: req.operationHash,
+                        approved: false,
+                        reason: 'timeout',
+                        durationMs: result.duration,
+                    });
+                    resolve(result);
+                }
+            }, timeoutMs + 5000);
+            const origResolve = resolve;
+            this.pending.set(req.id, {
+                req,
+                resolve: (r) => {
+                    clearTimeout(timer);
+                    origResolve(r);
+                },
+            });
+        });
+    }
+    handle(req, res) {
+        const url = req.url || '/';
+        if (req.method === 'GET' && (url === '/' || url.startsWith('/?'))) {
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(APPROVAL_PAGE_HTML);
+            return;
+        }
+        if (req.method === 'POST' && req.url === '/decide') {
+            let body = '';
+            req.on('data', (c) => { body += c; });
+            req.on('end', () => {
+                try {
+                    const data = JSON.parse(body);
+                    const requestId = data.id;
+                    const entry = requestId ? this.pending.get(requestId) : undefined;
+                    if (!entry || !requestId) {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, error: 'Request not found or already answered' }));
+                        return;
+                    }
+                    if ((0, types_1.isExpired)(entry.req)) {
+                        this.pending.delete(requestId);
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, error: 'Request expired' }));
+                        return;
+                    }
+                    this.pending.delete(requestId);
+                    const approved = data.approved === true;
+                    const startTime = entry.req.createdAt;
+                    const result = {
+                        approved,
+                        reason: approved ? 'User approved' : 'User denied',
+                        requestId: entry.req.id,
+                        duration: Date.now() - startTime,
+                    };
+                    (0, auditLog_1.appendAudit)({
+                        timestamp: new Date().toISOString(),
+                        requestId: entry.req.id,
+                        tool: entry.req.tool,
+                        operationHash: entry.req.operationHash,
+                        approved,
+                        reason: approved ? 'approved' : 'denied',
+                        durationMs: result.duration,
+                    });
+                    entry.resolve(result);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true }));
+                }
+                catch {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: false, error: 'Invalid request body' }));
+                }
+            });
+            return;
+        }
+        res.writeHead(404);
+        res.end('Not found');
+    }
+}
+exports.ApprovalBroker = ApprovalBroker;
+//# sourceMappingURL=broker.js.map

package/dist/approval/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/approval/broker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,iDAAqC;AACrC,mCAAsG;AACtG,yCAAyC;AAEzC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkEnB,CAAC;AAET,SAAS,WAAW,CAAC,GAAW;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAA,oBAAI,EAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAA,oBAAI,EAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACJ,IAAA,oBAAI,EAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,+DAA+D;IACnE,CAAC;AACL,CAAC;AAED,MAAa,cAAc;IACf,MAAM,GAAuB,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,CAAC;IACT,OAAO,GAAgF,IAAI,GAAG,EAAE,CAAC;IAEzG,KAAK,CAAC,KAAK;QACP,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAO,CAAC,OAAO,EAAS,CAAC;gBAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,IAAI;QACN,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACJ,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,eAAe,CACX,IAAY,EACZ,OAAe,EACf,cAAyB,EACzB,YAAoB,MAAM;QAE1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,IAAA,6BAAqB,EAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAE3C,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,SAAS,kBAAkB,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,aAAa,YAAY,kBAAkB,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC;YACjL,OAAO,CAAC,KAAK,CAAC,sCAAsC,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC;YAC1E,WAAW,CAAC,GAAG,CAAC,CAAC;YAEjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,IAAI,KAAK,EAAE,CAAC;oBACR,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5B,MAAM,MAAM,GAAmB;wBAC3B,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,mBAAmB;wBAC3B,SAAS,EAAE,GAAG,CAAC,EAAE;wBACjB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC;oBACF,IAAA,sBAAW,EAAC;wBACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,GAAG,CAAC,EAAE;wBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,aAAa,EAAE,GAAG,CAAC,aAAa;wBAChC,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,SAAS;wBACjB,UAAU,EAAE,MAAM,CAAC,QAAQ;qBAC9B,CAAC,CAAC;oBACH,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpB,CAAC;YACL,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;YAErB,MAAM,WAAW,GAAG,OAAO,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;gBACrB,GAAG;gBACH,OAAO,EAAE,CAAC,CAAiB,EAAE,EAAE;oBAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,WAAW,CAAC,CAAC,CAAC,CAAC;gBACnB,CAAC;aACJ,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,MAAM,CAAC,GAAyB,EAAE,GAAwB;QAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAE3B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC5B,OAAO;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,IAAI,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwC,CAAC;oBACrE,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAClE,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;wBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;wBACvF,OAAO;oBACX,CAAC;oBAED,IAAI,IAAA,iBAAS,EAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;wBACjE,OAAO;oBACX,CAAC;oBAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;oBACxC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;oBACtC,MAAM,MAAM,GAAmB;wBAC3B,QAAQ;wBACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa;wBAClD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;wBACvB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC;oBAEF,IAAA,sBAAW,EAAC;wBACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;wBACvB,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;wBACpB,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa;wBACtC,QAAQ;wBACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;wBACxC,UAAU,EAAE,MAAM,CAAC,QAAQ;qBAC9B,CAAC,CAAC;oBAEH,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAEtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACL,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;gBAC1E,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;CACJ;AAjJD,wCAiJC"}

package/dist/approval/types.d.ts

@@ -0,0 +1,26 @@
+export interface ApprovalRequest {
+    id: string;
+    tool: string;
+    summary: string;
+    operationHash: string;
+    createdAt: number;
+    expiresAt: number;
+}
+export interface ApprovalResult {
+    approved: boolean;
+    reason: string;
+    requestId: string;
+    duration: number;
+}
+export interface AuditEntry {
+    timestamp: string;
+    requestId: string;
+    tool: string;
+    operationHash: string;
+    approved: boolean;
+    reason: string;
+    durationMs: number;
+}
+export declare function hashOperation(tool: string, ...parts: unknown[]): string;
+export declare function createApprovalRequest(tool: string, summary: string, operationParts: unknown[], timeoutMs?: number): ApprovalRequest;
+export declare function isExpired(req: ApprovalRequest, now?: number): boolean;

package/dist/approval/types.js

@@ -0,0 +1,58 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashOperation = hashOperation;
+exports.createApprovalRequest = createApprovalRequest;
+exports.isExpired = isExpired;
+const crypto = __importStar(require("crypto"));
+function hashOperation(tool, ...parts) {
+    const data = JSON.stringify({ tool, parts });
+    return crypto.createHash('sha256').update(data).digest('hex').substring(0, 16);
+}
+function createApprovalRequest(tool, summary, operationParts, timeoutMs = 60_000) {
+    const now = Date.now();
+    return {
+        id: crypto.randomUUID(),
+        tool,
+        summary,
+        operationHash: hashOperation(tool, ...operationParts),
+        createdAt: now,
+        expiresAt: now + timeoutMs,
+    };
+}
+function isExpired(req, now = Date.now()) {
+    return now > req.expiresAt;
+}
+//# sourceMappingURL=types.js.map

package/dist/approval/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/approval/types.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,sCAGC;AAED,sDAeC;AAED,8BAEC;AApDD,+CAAiC;AA4BjC,SAAgB,aAAa,CAAC,IAAY,EAAE,GAAG,KAAgB;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAgB,qBAAqB,CACjC,IAAY,EACZ,OAAe,EACf,cAAyB,EACzB,YAAoB,MAAM;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO;QACH,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,IAAI;QACJ,OAAO;QACP,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,cAAc,CAAC;QACrD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,SAAS;KAC7B,CAAC;AACN,CAAC;AAED,SAAgB,SAAS,CAAC,GAAoB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACpE,OAAO,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC;AAC/B,CAAC"}

package/dist/attack/agentLoop.d.ts

@@ -0,0 +1,21 @@
+import type { ServerContext } from '../mcp/types';
+import { type AttackBudget } from './policy';
+import { type AttackReport } from './report';
+import type { AgentRunStatus } from './protocol';
+export interface AttackOptions {
+    targetPort: number;
+    targetHost?: string;
+    budget?: Partial<AttackBudget>;
+    signal?: AbortSignal;
+}
+export interface AttackResult {
+    status: AgentRunStatus;
+    report?: AttackReport;
+    error?: string;
+}
+export declare function runAttack(ctx: ServerContext, endpoint: {
+    method: string;
+    path: string;
+    sourceFile: string;
+    handlerName: string;
+}, code: string, language: string, options: AttackOptions): Promise<AttackResult>;

package/dist/attack/agentLoop.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAttack = runAttack;
+const client_1 = require("../api/client");
+const executor_1 = require("./executor");
+const policy_1 = require("./policy");
+const report_1 = require("./report");
+async function runAttack(ctx, endpoint, code, language, options) {
+    const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
+    const budget = { ...policy_1.DEFAULT_BUDGET, ...options.budget };
+    const target = {
+        host: options.targetHost || '127.0.0.1',
+        port: options.targetPort,
+        path: endpoint.path,
+    };
+    (0, policy_1.validateTarget)(target);
+    const startTime = Date.now();
+    let stepsTaken = 0;
+    let requestsMade = 0;
+    const state = { stepsTaken, requestsMade, startTime };
+    try {
+        const scanResp = await client.postJson('/scan', {
+            code,
+            language,
+            filePath: endpoint.sourceFile,
+            scanDepth: 'auto',
+        });
+        const findings = (scanResp.scanType === 'advanced' && scanResp.finalFindings)
+            ? scanResp.finalFindings
+            : (scanResp.findings || []);
+        const attackable = findings.filter((f) => {
+            const type = f.type || f.check_id;
+            return type && f.source !== 'dependency';
+        });
+        if (attackable.length === 0) {
+            return { status: 'completed', error: 'No attackable vulnerability found in scan results.' };
+        }
+        const finding = attackable[0];
+        const loc = finding.location || {
+            line_start: finding.start?.line,
+            line_end: finding.end?.line ?? finding.start?.line,
+        };
+        const fixResp = await client.postJson('/fix', {
+            code,
+            language,
+            vulnerability: {
+                type: finding.type || finding.check_id,
+                line_start: loc.line_start ?? 1,
+                line_end: loc.line_end ?? loc.line_start ?? 1,
+                evidence_snippet: finding.evidence_snippet || '',
+            },
+        });
+        if (!fixResp.fixed_code || fixResp.fixed_code.length === 0) {
+            return { status: 'completed', error: 'Fixer returned no patch — nothing to attack.' };
+        }
+        const startResp = await client.postJson('/attack/agent/start', {});
+        const runId = startResp.runId;
+        const endpointContext = {
+            method: endpoint.method,
+            path: endpoint.path,
+            handlerName: endpoint.handlerName,
+            sourceFile: endpoint.sourceFile,
+            line: 0,
+            middleware: [],
+            params: [],
+            authScheme: 'unknown',
+            dataLayer: 'unknown',
+            validatorLibrary: 'unknown',
+            callGraph: [],
+            responseShape: 'unknown',
+            confidence: 0,
+            runtimeConfirmed: false,
+        };
+        const transcript = [];
+        while (true) {
+            const budgetCheck = (0, policy_1.checkBudget)(budget, state);
+            if (budgetCheck.exhausted) {
+                return {
+                    status: 'capped',
+                    report: (0, report_1.buildReport)('capped', [], transcript, stepsTaken, 0, budgetCheck.reason),
+                };
+            }
+            if (options.signal?.aborted) {
+                return {
+                    status: 'cancelled',
+                    report: (0, report_1.buildReport)('cancelled', [], transcript, stepsTaken, 0, 'Cancelled by user'),
+                };
+            }
+            const stepResp = await client.postJson('/attack/agent/step', {
+                runId,
+                endpointContext,
+                language,
+                handlerSource: code,
+                transcript,
+                budget: {
+                    stepsRemaining: budget.maxSteps - stepsTaken,
+                    costSpentUsd: 0,
+                    costCapUsd: 0,
+                },
+            });
+            if (!stepResp.next) {
+                return {
+                    status: stepResp.costCapped ? 'capped' : (stepResp.degraded ? 'degraded' : 'completed'),
+                    report: (0, report_1.buildReport)(stepResp.costCapped ? 'capped' : 'completed', [], transcript, stepsTaken, stepResp.costUsd || 0),
+                };
+            }
+            const action = stepResp.next;
+            stepsTaken++;
+            state.stepsTaken = stepsTaken;
+            if (action.type === 'finish') {
+                return {
+                    status: 'completed',
+                    report: (0, report_1.buildReport)('completed', action.findings || [], transcript, stepsTaken, stepResp.costUsd || 0, action.summary),
+                };
+            }
+            if (action.type === 'http_request') {
+                requestsMade++;
+                state.requestsMade = requestsMade;
+                const execResp = await (0, executor_1.executeHttpRequest)({
+                    method: action.method,
+                    path: action.path,
+                    host: target.host,
+                    port: target.port,
+                    headers: action.headers,
+                    body: action.body,
+                }, budget, options.signal);
+                transcript.push({
+                    action,
+                    observation: {
+                        statusCode: execResp.statusCode,
+                        headers: execResp.headers,
+                        body: (0, report_1.redactText)(execResp.body).slice(0, 10_000),
+                        latencyMs: execResp.latencyMs,
+                        error: execResp.error,
+                    },
+                });
+            }
+        }
+    }
+    catch (err) {
+        return {
+            status: 'spawn_failed',
+            error: err.message || String(err),
+            report: (0, report_1.buildReport)('spawn_failed', [], [], stepsTaken, 0, err.message),
+        };
+    }
+}
+//# sourceMappingURL=agentLoop.js.map

package/dist/attack/agentLoop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentLoop.js","sourceRoot":"","sources":["../../src/attack/agentLoop.ts"],"names":[],"mappings":";;AAsBA,8BAgLC;AAtMD,0CAA0C;AAI1C,yCAAgD;AAChD,qCAA0F;AAC1F,qCAAsE;AAgB/D,KAAK,UAAU,SAAS,CAC3B,GAAkB,EAClB,QAAmF,EACnF,IAAY,EACZ,QAAgB,EAChB,OAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,EAAE,GAAG,uBAAc,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACxD,MAAM,MAAM,GAAG;QACX,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,WAAW;QACvC,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,IAAI,EAAE,QAAQ,CAAC,IAAI;KACtB,CAAC;IAEF,IAAA,uBAAc,EAAC,MAAM,CAAC,CAAC;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAEtD,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAe,OAAO,EAAE;YAC1D,IAAI;YACJ,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM;SACpB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,aAAa,CAAC;YACzE,CAAC,CAAC,QAAQ,CAAC,aAAa;YACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAI,QAAkB,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC;YAClC,OAAO,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;QAChG,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAQ,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI;YAC5B,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI;YAC/B,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI;SACrD,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAc,MAAM,EAAE;YACvD,IAAI;YACJ,QAAQ;YACR,aAAa,EAAE;gBACX,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ;gBACtC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC/B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC7C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE;aACnD;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAqB,qBAAqB,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QAE9B,MAAM,eAAe,GAAoB;YACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,IAAI,EAAE,CAAC;YACP,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,SAAS;YACpB,gBAAgB,EAAE,SAAS;YAC3B,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,SAAS;YACxB,UAAU,EAAE,CAAC;YACb,gBAAgB,EAAE,KAAK;SAC1B,CAAC;QAEF,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,OAAO,IAAI,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,IAAA,oBAAW,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC/C,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBACxB,OAAO;oBACH,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,IAAA,oBAAW,EAAC,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;iBACnF,CAAC;YACN,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC1B,OAAO;oBACH,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,IAAA,oBAAW,EAAC,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,mBAAmB,CAAC;iBACvF,CAAC;YACN,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAoB,oBAAoB,EAAE;gBAC5E,KAAK;gBACL,eAAe;gBACf,QAAQ;gBACR,aAAa,EAAE,IAAI;gBACnB,UAAU;gBACV,MAAM,EAAE;oBACJ,cAAc,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU;oBAC5C,YAAY,EAAE,CAAC;oBACf,UAAU,EAAE,CAAC;iBAChB;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO;oBACH,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;oBACvF,MAAM,EAAE,IAAA,oBAAW,EACf,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAC5C,EAAE,EACF,UAAU,EACV,UAAU,EACV,QAAQ,CAAC,OAAO,IAAI,CAAC,CACxB;iBACJ,CAAC;YACN,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC7B,UAAU,EAAE,CAAC;YACb,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAE9B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,OAAO;oBACH,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,IAAA,oBAAW,EAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;iBACzH,CAAC;YACN,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACjC,YAAY,EAAE,CAAC;gBACf,KAAK,CAAC,YAAY,GAAG,YAAY,CAAC;gBAElC,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAkB,EACrC;oBACI,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;iBACpB,EACD,MAAM,EACN,OAAO,CAAC,MAAM,CACjB,CAAC;gBAEF,UAAU,CAAC,IAAI,CAAC;oBACZ,MAAM;oBACN,WAAW,EAAE;wBACT,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,IAAI,EAAE,IAAA,mBAAU,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;wBAChD,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;qBACxB;iBACJ,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,OAAO;YACH,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;YACjC,MAAM,EAAE,IAAA,oBAAW,EAAC,cAAc,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC;SAC1E,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/attack/executor.d.ts

@@ -0,0 +1,17 @@
+import type { AttackBudget } from './policy';
+export interface ExecRequest {
+    method: string;
+    path: string;
+    host: string;
+    port: number;
+    headers?: Record<string, string>;
+    body?: unknown;
+}
+export interface ExecResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+    latencyMs: number;
+    error?: string;
+}
+export declare function executeHttpRequest(req: ExecRequest, budget: AttackBudget, signal?: AbortSignal): Promise<ExecResponse>;