@shield-agent/kya 0.11.0 → 0.12.0

package/dist/gate/otlp-receiver.js

@@ -0,0 +1,186 @@
+/**
+ * Local OTLP/HTTP traces receiver. The gateway exports spans to
+ * `http://127.0.0.1:<otlpPort>/v1/traces`; each `tools/call` span becomes one
+ * TrailEvent on the global trail (mode "observe") so the report's MCP server
+ * facet lights up for gate traffic.
+ *
+ * Privacy: only whitelisted span attributes are read (method, target, tool
+ * name, session id). Tool arguments are never extracted, and the persisted
+ * fields pass through the secret scanner before hitting the trail.
+ *
+ * Known limitation: the receiver is unauthenticated — any local process can
+ * POST spans and inject trail events. That is the same trust boundary as the
+ * user-writable trail file itself (any local process can append to
+ * ~/.kya/trail.jsonl), so no new privilege is granted; remote injection is
+ * impossible because the receiver binds 127.0.0.1 only.
+ */
+import { createServer } from "node:http";
+import { appendTrail } from "../trail.js";
+import { assertNoSecrets } from "../dash/render.js";
+import { decodeTraceJson, decodeTraceProtobuf, } from "./otlp-decode.js";
+const STATUS_ERROR = 2;
+/** Twin-collapse window: how long a sessioned call suppresses its client-span twin. */
+const TWIN_TTL_MS = 30_000;
+// Verified against the real gateway (v1.5.0): a CEL-filtered tool call is
+// refused as `-32602 Unknown tool` over HTTP 400; the span carries ERROR
+// status and an "Unknown tool" error message. Downstream API denials (a
+// tool's own 403/"forbidden" result) are NOT policy denials and must not
+// match this signal — they classify as TOOL_ERROR.
+const DENIAL_SIGNAL = /\bunknown tool\b/i;
+function attr(span, key) {
+    const v = span.attributes[key];
+    return typeof v === "string" && v ? v : undefined;
+}
+/**
+ * Map one decoded span to a TrailEvent, or undefined when the span is not an
+ * MCP tools/call. toolId is `<target>__<tool>` so the registry's MCP facet
+ * recognizes calls to known servers.
+ */
+export function spanToTrailEvent(span, ctx) {
+    if (attr(span, "mcp.method.name") !== "tools/call")
+        return undefined;
+    const tool = attr(span, "gen_ai.tool.name");
+    if (!tool)
+        return undefined;
+    const target = attr(span, "mcp.target") ?? "unknown";
+    const sessionId = attr(span, "mcp.session.id") || ctx.fallbackSessionId;
+    let verdict = "ALLOW";
+    let reasonCode = "ALLOW";
+    if (span.statusCode === STATUS_ERROR) {
+        if (DENIAL_SIGNAL.test(span.statusMessage ?? "")) {
+            verdict = "DENY";
+            reasonCode = "POLICY_DENY";
+        }
+        else {
+            // The gate allowed the call; the tool itself failed.
+            reasonCode = "TOOL_ERROR";
+        }
+    }
+    const toolId = `${target}__${tool}`;
+    // Defense-in-depth: nothing we persist may smuggle a secret out of a span.
+    assertNoSecrets(`${toolId}\n${sessionId}`);
+    return {
+        ts: new Date().toISOString(),
+        sessionId,
+        toolId,
+        verdict,
+        reasonCode,
+        mode: "observe",
+        summary: `gate: ${target}.${tool}`,
+    };
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on("data", (c) => {
+            size += c.length;
+            if (size > 8 * 1024 * 1024) {
+                req.destroy();
+                reject(new Error("payload too large"));
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+/**
+ * Accept OTLP trace exports on 127.0.0.1 and append tools/call spans to the
+ * trail. Malformed payloads get a 400 and are dropped — the receiver never
+ * dies on bad input (the gateway keeps exporting).
+ */
+export async function startOtlpReceiver(opts) {
+    const env = opts.env ?? process.env;
+    const append = opts.append ?? appendTrail;
+    const ctx = { fallbackSessionId: opts.fallbackSessionId, cwd: opts.cwd };
+    const seenSpanIds = new Set();
+    /** traceId|target__tool → expiry: sessioned calls, for cross-batch twin collapse. */
+    const sessionedCalls = new Map();
+    const server = createServer((req, res) => {
+        void (async () => {
+            if (req.method !== "POST" || req.url !== "/v1/traces") {
+                res.writeHead(404, { "content-type": "text/plain" }).end("not found\n");
+                return;
+            }
+            let spans;
+            try {
+                const body = await readBody(req);
+                const contentType = (req.headers["content-type"] ?? "").toLowerCase();
+                spans = contentType.includes("json")
+                    ? decodeTraceJson(JSON.parse(body.toString("utf8")))
+                    : decodeTraceProtobuf(body);
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain" }).end("bad otlp payload\n");
+                return;
+            }
+            // The gateway emits a client span per target call next to the server
+            // span for the same tools/call; only the server span carries
+            // mcp.session.id. Twins share a trace_id: collapse the sessionless one
+            // via a short-TTL cache so a pair split across export batches (or
+            // re-exported) still trails exactly once.
+            const now = Date.now();
+            for (const [k, exp] of sessionedCalls) {
+                if (exp <= now)
+                    sessionedCalls.delete(k);
+            }
+            const twinKey = (s) => `${s.traceId ?? ""}|${String(s.attributes["mcp.target"] ?? "unknown")}__${String(s.attributes["gen_ai.tool.name"] ?? "")}`;
+            const batchTwins = new Set(spans
+                .filter((s) => s.attributes["mcp.method.name"] === "tools/call" &&
+                typeof s.attributes["mcp.session.id"] === "string")
+                .map(twinKey));
+            for (const span of spans) {
+                const isCall = span.attributes["mcp.method.name"] === "tools/call";
+                const hasSession = typeof span.attributes["mcp.session.id"] === "string";
+                if (isCall && hasSession) {
+                    sessionedCalls.set(twinKey(span), now + TWIN_TTL_MS);
+                }
+                if (isCall &&
+                    !hasSession &&
+                    (batchTwins.has(twinKey(span)) ||
+                        (sessionedCalls.get(twinKey(span)) ?? 0) > now)) {
+                    continue;
+                }
+                if (span.spanId) {
+                    if (seenSpanIds.has(span.spanId))
+                        continue;
+                    seenSpanIds.add(span.spanId);
+                    if (seenSpanIds.size > 100_000)
+                        seenSpanIds.clear();
+                }
+                try {
+                    const event = spanToTrailEvent(span, ctx);
+                    if (event)
+                        append(opts.cwd, event, env);
+                }
+                catch {
+                    // Secret-scanner trip or append failure: drop the event, keep serving.
+                }
+            }
+            // OTLP/HTTP success: partialSuccess-free empty response.
+            res.writeHead(200, { "content-type": "application/x-protobuf" }).end(Buffer.alloc(0));
+        })().catch(() => {
+            try {
+                res.writeHead(500).end();
+            }
+            catch {
+                /* already closed */
+            }
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(opts.port, "127.0.0.1", () => resolve());
+    });
+    const port = server.address().port;
+    return {
+        port,
+        url: `http://127.0.0.1:${port}`,
+        close: () => new Promise((resolve) => {
+            server.close(() => resolve());
+        }),
+    };
+}
+//# sourceMappingURL=otlp-receiver.js.map

package/dist/gate/otlp-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otlp-receiver.js","sourceRoot":"","sources":["../../src/gate/otlp-receiver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,uFAAuF;AACvF,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,mDAAmD;AACnD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAS1C,SAAS,IAAI,CAAC,IAAiB,EAAE,GAAW;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,GAAmB;IACrE,IAAI,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC;IAExE,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,IAAI,IAAI,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACrC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,GAAG,MAAM,CAAC;YACjB,UAAU,GAAG,aAAa,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,UAAU,GAAG,YAAY,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;IACpC,2EAA2E;IAC3E,eAAe,CAAC,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,SAAS;QACT,MAAM;QACN,OAAO;QACP,UAAU;QACV,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,SAAS,MAAM,IAAI,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAkBD,SAAS,QAAQ,CAAC,GAAwC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC3B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAyB;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC1C,MAAM,GAAG,GAAmB,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACzF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,qFAAqF;IACrF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;gBACtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,IAAI,KAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACtE,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAClC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBACpD,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,6DAA6D;YAC7D,uEAAuE;YACvE,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;gBACtC,IAAI,GAAG,IAAI,GAAG;oBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,CAAc,EAAU,EAAE,CACzC,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7H,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK;iBACF,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,YAAY;gBAChD,OAAO,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CACrD;iBACA,GAAG,CAAC,OAAO,CAAC,CAChB,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,YAAY,CAAC;gBACnE,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC;gBACzE,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;oBACzB,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,WAAW,CAAC,CAAC;gBACvD,CAAC;gBACD,IACE,MAAM;oBACN,CAAC,UAAU;oBACX,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBAC5B,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,EACjD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;wBAAE,SAAS;oBAC3C,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC7B,IAAI,WAAW,CAAC,IAAI,GAAG,OAAO;wBAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC1C,IAAI,KAAK;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,uEAAuE;gBACzE,CAAC;YACH,CAAC;YACD,yDAAyD;YACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,IAAI,CAAC;gBACH,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;IACpD,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,oBAAoB,IAAI,EAAE;QAC/B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/mcp-servers.d.ts

@@ -23,4 +23,12 @@ export declare function mcpServerLabel(serverId: string): string;
  * server, ADMIN first, then the server's default. Unknown server → undefined.
  */
 export declare function mcpToolTier(serverId: string, toolName: string): McpToolTier | undefined;
+/**
+ * ADMIN-tier rule patterns (regex sources) for a known server, in registry
+ * order. Undefined for unknown servers — the gate's CEL generation treats
+ * those as "no server-specific deny rules" (destructive-name deny only).
+ */
+export declare function mcpServerAdminPatterns(serverId: string): readonly string[] | undefined;
+/** Fallback tier for tools no rule matches; undefined for unknown servers. */
+export declare function mcpServerDefaultTier(serverId: string): McpToolTier | undefined;
 //# sourceMappingURL=mcp-servers.d.ts.map

package/dist/mcp-servers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-servers.d.ts","sourceRoot":"","sources":["../src/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAyOD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAQrE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAQvF"}
+{"version":3,"file":"mcp-servers.d.ts","sourceRoot":"","sources":["../src/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAyOD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAQrE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAQvF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAItF;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAE9E"}

package/dist/mcp-servers.js

@@ -254,4 +254,19 @@ export function mcpToolTier(serverId, toolName) {
     }
     return entry.defaultTier;
 }
+/**
+ * ADMIN-tier rule patterns (regex sources) for a known server, in registry
+ * order. Undefined for unknown servers — the gate's CEL generation treats
+ * those as "no server-specific deny rules" (destructive-name deny only).
+ */
+export function mcpServerAdminPatterns(serverId) {
+    const entry = LOOKUP.get(normalizeId(serverId));
+    if (!entry)
+        return undefined;
+    return entry.rules.filter((rule) => rule.tier === "ADMIN").map((rule) => rule.pattern.source);
+}
+/** Fallback tier for tools no rule matches; undefined for unknown servers. */
+export function mcpServerDefaultTier(serverId) {
+    return LOOKUP.get(normalizeId(serverId))?.defaultTier;
+}
 //# sourceMappingURL=mcp-servers.js.map

package/dist/mcp-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-servers.js","sourceRoot":"","sources":["../src/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,IAAiB,EAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhF,MAAM,WAAW,GAA8B;IAC7C;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE;YACL,CAAC,CAAC,6OAA6O,EAAE,OAAO,CAAC;YACzP,CAAC,CAAC,gIAAgI,EAAE,MAAM,CAAC;SAC5I;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,wEAAwE,EAAE,OAAO,CAAC;YACpF,CAAC,CAAC,iLAAiL,EAAE,OAAO,CAAC;YAC7L,CAAC,CAAC,iGAAiG,EAAE,MAAM,CAAC;SAC7G;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvB,WAAW,EAAE,MAAM;KACpB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,KAAK,EAAE;YACL,CAAC,CAAC,gEAAgE,EAAE,OAAO,CAAC;YAC5E,CAAC,CAAC,oDAAoD,EAAE,MAAM,CAAC;SAChE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC;YAClC,CAAC,CAAC,4EAA4E,EAAE,OAAO,CAAC;YACxF,CAAC,CAAC,0CAA0C,EAAE,MAAM,CAAC;SACtD;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtC,KAAK,EAAE,CAAC,CAAC,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC;QAC3D,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,CAAC;QAC1D,KAAK,EAAE;YACL,CAAC,CAAC,sJAAsJ,EAAE,MAAM,CAAC;SAClK;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;QAC/B,KAAK,EAAE;YACL,CAAC,CAAC,+CAA+C,EAAE,OAAO,CAAC;YAC3D,CAAC,CAAC,8PAA8P,EAAE,OAAO,CAAC;YAC1Q,CAAC,CAAC,iFAAiF,EAAE,MAAM,CAAC;SAC7F;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,sCAAsC,EAAE,OAAO,CAAC;YAClD,CAAC,CAAC,qFAAqF,EAAE,OAAO,CAAC;YACjG,CAAC,CAAC,qDAAqD,EAAE,MAAM,CAAC;SACjE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,4CAA4C,EAAE,OAAO,CAAC;YACxD,CAAC,CAAC,6FAA6F,EAAE,OAAO,CAAC;YACzG,CAAC,CAAC,qDAAqD,EAAE,MAAM,CAAC;SACjE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,+DAA+D,EAAE,OAAO,CAAC;YAC3E,CAAC,CAAC,4IAA4I,EAAE,OAAO,CAAC;YACxJ,CAAC,CAAC,+DAA+D,EAAE,MAAM,CAAC;SAC3E;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,UAAU,CAAC;QACrB,KAAK,EAAE;YACL,CAAC,CAAC,yBAAyB,EAAE,OAAO,CAAC;YACrC,CAAC,CAAC,2EAA2E,EAAE,OAAO,CAAC;YACvF,CAAC,CAAC,2DAA2D,EAAE,MAAM,CAAC;SACvE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,CAAC,CAAC,CAAC,iGAAiG,EAAE,MAAM,CAAC,CAAC;QACrH,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvB,WAAW,EAAE,MAAM;KACpB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,6BAA6B,EAAE,OAAO,CAAC;YACzC,CAAC,CAAC,+FAA+F,EAAE,OAAO,CAAC;YAC3G,CAAC,CAAC,mDAAmD,EAAE,MAAM,CAAC;SAC/D;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,+BAA+B,EAAE,OAAO,CAAC;YAC3C,CAAC,CAAC,+DAA+D,EAAE,OAAO,CAAC;YAC3E,CAAC,CAAC,4CAA4C,EAAE,MAAM,CAAC;SACxD;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,oBAAoB,EAAE,OAAO,CAAC;YAChC,CAAC,CAAC,iIAAiI,EAAE,OAAO,CAAC;YAC7I,CAAC,CAAC,4EAA4E,EAAE,MAAM,CAAC;SACxF;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,6BAA6B,EAAE,OAAO,CAAC;YACzC,CAAC,CAAC,uGAAuG,EAAE,OAAO,CAAC;YACnH,CAAC,CAAC,sDAAsD,EAAE,MAAM,CAAC;SAClE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,wCAAwC,EAAE,OAAO,CAAC;YACpD,CAAC,CAAC,qFAAqF,EAAE,OAAO,CAAC;YACjG,CAAC,CAAC,+CAA+C,EAAE,MAAM,CAAC;SAC3D;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC;QAC3C,KAAK,EAAE;YACL,CAAC,CAAC,8FAA8F,EAAE,MAAM,CAAC;SAC1G;QACD,WAAW,EAAE,OAAO;KACrB;CACF,CAAC;AAEF,MAAM,MAAM,GAAwC,CAAC,GAAG,EAAE;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,CAAC,GAAG,qEAAqE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"mcp-servers.js","sourceRoot":"","sources":["../src/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,IAAiB,EAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhF,MAAM,WAAW,GAA8B;IAC7C;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,KAAK,EAAE;YACL,CAAC,CAAC,6OAA6O,EAAE,OAAO,CAAC;YACzP,CAAC,CAAC,gIAAgI,EAAE,MAAM,CAAC;SAC5I;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,wEAAwE,EAAE,OAAO,CAAC;YACpF,CAAC,CAAC,iLAAiL,EAAE,OAAO,CAAC;YAC7L,CAAC,CAAC,iGAAiG,EAAE,MAAM,CAAC;SAC7G;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvB,WAAW,EAAE,MAAM;KACpB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,KAAK,EAAE;YACL,CAAC,CAAC,gEAAgE,EAAE,OAAO,CAAC;YAC5E,CAAC,CAAC,oDAAoD,EAAE,MAAM,CAAC;SAChE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC;YAClC,CAAC,CAAC,4EAA4E,EAAE,OAAO,CAAC;YACxF,CAAC,CAAC,0CAA0C,EAAE,MAAM,CAAC;SACtD;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtC,KAAK,EAAE,CAAC,CAAC,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC;QAC3D,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,CAAC;QAC1D,KAAK,EAAE;YACL,CAAC,CAAC,sJAAsJ,EAAE,MAAM,CAAC;SAClK;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;QAC/B,KAAK,EAAE;YACL,CAAC,CAAC,+CAA+C,EAAE,OAAO,CAAC;YAC3D,CAAC,CAAC,8PAA8P,EAAE,OAAO,CAAC;YAC1Q,CAAC,CAAC,iFAAiF,EAAE,MAAM,CAAC;SAC7F;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,sCAAsC,EAAE,OAAO,CAAC;YAClD,CAAC,CAAC,qFAAqF,EAAE,OAAO,CAAC;YACjG,CAAC,CAAC,qDAAqD,EAAE,MAAM,CAAC;SACjE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,4CAA4C,EAAE,OAAO,CAAC;YACxD,CAAC,CAAC,6FAA6F,EAAE,OAAO,CAAC;YACzG,CAAC,CAAC,qDAAqD,EAAE,MAAM,CAAC;SACjE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,+DAA+D,EAAE,OAAO,CAAC;YAC3E,CAAC,CAAC,4IAA4I,EAAE,OAAO,CAAC;YACxJ,CAAC,CAAC,+DAA+D,EAAE,MAAM,CAAC;SAC3E;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,UAAU,CAAC;QACrB,KAAK,EAAE;YACL,CAAC,CAAC,yBAAyB,EAAE,OAAO,CAAC;YACrC,CAAC,CAAC,2EAA2E,EAAE,OAAO,CAAC;YACvF,CAAC,CAAC,2DAA2D,EAAE,MAAM,CAAC;SACvE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,CAAC,CAAC,CAAC,iGAAiG,EAAE,MAAM,CAAC,CAAC;QACrH,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;QACtD,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvB,WAAW,EAAE,MAAM;KACpB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,6BAA6B,EAAE,OAAO,CAAC;YACzC,CAAC,CAAC,+FAA+F,EAAE,OAAO,CAAC;YAC3G,CAAC,CAAC,mDAAmD,EAAE,MAAM,CAAC;SAC/D;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,+BAA+B,EAAE,OAAO,CAAC;YAC3C,CAAC,CAAC,+DAA+D,EAAE,OAAO,CAAC;YAC3E,CAAC,CAAC,4CAA4C,EAAE,MAAM,CAAC;SACxD;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,oBAAoB,EAAE,OAAO,CAAC;YAChC,CAAC,CAAC,iIAAiI,EAAE,OAAO,CAAC;YAC7I,CAAC,CAAC,4EAA4E,EAAE,MAAM,CAAC;SACxF;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,6BAA6B,EAAE,OAAO,CAAC;YACzC,CAAC,CAAC,uGAAuG,EAAE,OAAO,CAAC;YACnH,CAAC,CAAC,sDAAsD,EAAE,MAAM,CAAC;SAClE;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,CAAC,CAAC,wCAAwC,EAAE,OAAO,CAAC;YACpD,CAAC,CAAC,qFAAqF,EAAE,OAAO,CAAC;YACjG,CAAC,CAAC,+CAA+C,EAAE,MAAM,CAAC;SAC3D;QACD,WAAW,EAAE,OAAO;KACrB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC;QAC3C,KAAK,EAAE;YACL,CAAC,CAAC,8FAA8F,EAAE,MAAM,CAAC;SAC1G;QACD,WAAW,EAAE,OAAO;KACrB;CACF,CAAC;AAEF,MAAM,MAAM,GAAwC,CAAC,GAAG,EAAE;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,CAAC,GAAG,qEAAqE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAChG,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC;AACxD,CAAC"}

package/droid/README.md

@@ -1,6 +1,6 @@
 # Droid (Factory) + Shield KYA
 
-Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.11.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
+Preferred path is Droid's own CLI: `droid mcp add shield-kya "npx --no-install @shield-agent/kya@0.12.0 serve-mcp --stdio" --env KYA_BASE_URL=https://shield-agent.com --env KYA_API_KEY=$KYA_API_KEY --env KYA_HOST=ide`.
 
 `mcp.example.json` shows the expected on-disk shape (`~/.factory/mcp.json`) — **schema not yet verified against a live Droid install**; treat as a starting point and prefer `droid mcp add`.
 

package/droid/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/gemini/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/grok/README.md

@@ -40,7 +40,7 @@ chat = client.chat.create(
 There is no grok.com stdio path. For a local agent host use the same stdio launch as Claude:
 
 ```bash
-npx --no-install @shield-agent/kya@0.11.0 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.12.0 serve-mcp --stdio
 ```
 
 Env: `KYA_BASE_URL`, `KYA_API_KEY`, `KYA_HOST`. Codex and Gemini example configs in this package show the full snippets.

package/kilo/kilo.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/kimi/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/kiro/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "shield-kya",
   "display_name": "Shield KYA",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Know Your Agent MCP gate: ALLOW / DENY / REQUIRE_APPROVE. Sole PEP is Shield.",
   "long_description": "Local Claude Desktop extension that runs the packaged `dist/cli.js serve-mcp --stdio` against your Shield control plane (local or https://shield-agent.com). Tools evaluate policy, ingest session risk, and open Hold tickets. They never execute irreversible side effects.",
   "author": {

package/mastracode/mcp.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/mcp.json

@@ -3,7 +3,7 @@
     "shield-kya": {
       "description": "Know Your Agent local MCP gate: wrap-before-write, named-agent registry, Hold/Clear.",
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "${KYA_BASE_URL}",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/openai/codex.config.example.toml

@@ -11,7 +11,7 @@
 # --- Local stdio (OSS) ---
 [mcp_servers.shield-kya]
 command = "npx"
-args = ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"]
+args = ["--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"]
 startup_timeout_sec = 20
 env_vars = ["KYA_BASE_URL", "KYA_API_KEY", "KYA_HOST", "KYA_AGENT_ID"]
 

package/opencode/opencode.example.json

@@ -2,7 +2,7 @@
   "mcp": {
     "shield-kya": {
       "type": "local",
-      "command": ["npx", "--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "command": ["npx", "--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "enabled": true,
       "environment": {
         "KYA_BASE_URL": "https://shield-agent.com",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shield-agent/kya",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Audit trail & traceability for AI agents — local MCP gate (Allow/Review/Deny), live receipt dashboard, trust-baseline certification.",
   "license": "MIT",
   "type": "module",

package/qwen/settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.11.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.12.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/The-Pixel-Boys/shield-kya",
     "source": "github"
   },
-  "version": "0.11.0",
+  "version": "0.12.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@shield-agent/kya",
-      "version": "0.11.0",
+      "version": "0.12.0",
       "transport": {
         "type": "stdio"
       },