@trentapps/manager-protocol 1.1.2 → 1.2.0

package/dist/rules/stripe.js

@@ -2,26 +2,24 @@
  * Stripe Payment Security Rules
  * Governance rules for Stripe payment processing
  */
+import { createAuditLoggingRule, createValidationRule } from './shared-patterns.js';
 export const stripeRules = [
-    {
+    // Webhook Signature Validation - uses shared validation pattern
+    createValidationRule({
         id: 'stripe-001',
         name: 'Require Webhook Signature Validation',
         description: 'Stripe webhooks must validate signatures to prevent replay attacks',
-        type: 'security',
-        enabled: true,
+        validationType: 'signature',
+        scope: {
+            actionName: 'webhook',
+            provider: 'stripe'
+        },
+        actionType: 'deny',
+        message: 'Stripe webhook signature validation is required (use stripe.webhooks.constructEvent)',
         priority: 980,
-        conditions: [
-            { field: 'actionName', operator: 'contains', value: 'webhook' },
-            { field: 'provider', operator: 'equals', value: 'stripe' },
-            { field: 'signatureValidated', operator: 'not_equals', value: true }
-        ],
-        conditionLogic: 'all',
-        actions: [
-            { type: 'deny', message: 'Stripe webhook signature validation is required (use stripe.webhooks.constructEvent)' }
-        ],
         riskWeight: 65,
-        tags: ['stripe', 'security', 'webhook', 'validation']
-    },
+        tags: ['stripe', 'webhook']
+    }),
     {
         id: 'stripe-002',
         name: 'Enforce Idempotency Keys',
@@ -100,24 +98,19 @@ export const stripeRules = [
         riskWeight: 55,
         tags: ['stripe', 'sca', 'psd2', 'compliance', 'eu']
     },
-    {
+    // Payment Event Logging - uses shared audit pattern
+    createAuditLoggingRule({
         id: 'stripe-006',
         name: 'Log All Payment Events',
         description: 'All payment events must be logged for audit',
-        type: 'compliance',
-        enabled: true,
-        priority: 940,
-        conditions: [
-            { field: 'actionCategory', operator: 'equals', value: 'financial' },
+        categories: ['financial'],
+        additionalConditions: [
             { field: 'provider', operator: 'equals', value: 'stripe' }
         ],
-        conditionLogic: 'all',
-        actions: [
-            { type: 'log' }
-        ],
+        priority: 940,
         riskWeight: 10,
-        tags: ['stripe', 'audit', 'logging', 'compliance']
-    },
+        tags: ['stripe', 'compliance']
+    }),
     {
         id: 'stripe-007',
         name: 'Use Latest API Version',

package/dist/rules/stripe.js.map

@@ -1 +1 @@
-{"version":3,"file":"stripe.js","sourceRoot":"","sources":["../../src/rules/stripe.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EAAE,oEAAoE;QACjF,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/D,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SACrE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,sFAAsF,EAAE;SAClH;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC;KACtD;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;YACnE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE;YAChF,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SACjE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oFAAoF,EAAE;SAC5H;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC;KAC3D;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,0DAA0D;QACvE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE;YAC3E,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE;YAClE,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;SAC5D;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8FAA8F,EAAE;SAC1H;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,YAAY,CAAC;KAC/D;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EAAE,6DAA6D;QAC1E,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/D,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SAC/E;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yEAAyE,EAAE;SACrG;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;KACxD;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE,qDAAqD;QAClE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;YACnE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE;YACvE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SAC7D;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kFAAkF,EAAE;SAC9G;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC;KACpD;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;YACnE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;SAC3D;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,KAAK,EAAE;SAChB;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC;KACnD;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,yDAAyD;QACtE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE;SACpE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,6EAA6E,EAAE;SACzG;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC;KAC3D;CACF,CAAC"}
+{"version":3,"file":"stripe.js","sourceRoot":"","sources":["../../src/rules/stripe.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,gEAAgE;IAChE,oBAAoB,CAAC;QACnB,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EAAE,oEAAoE;QACjF,cAAc,EAAE,WAAW;QAC3B,KAAK,EAAE;YACL,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,QAAQ;SACnB;QACD,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,sFAAsF;QAC/F,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC5B,CAAC;IACF;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;YACnE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE;YAChF,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SACjE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oFAAoF,EAAE;SAC5H;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC;KAC3D;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,0DAA0D;QACvE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE;YAC3E,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE;YAClE,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;SAC5D;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8FAA8F,EAAE;SAC1H;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,YAAY,CAAC;KAC/D;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EAAE,6DAA6D;QAC1E,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/D,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SAC/E;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yEAAyE,EAAE;SACrG;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC;KACxD;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE,qDAAqD;QAClE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;YACnE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE;YACvE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SAC7D;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kFAAkF,EAAE;SAC9G;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC;KACpD;IACD,oDAAoD;IACpD,sBAAsB,CAAC;QACrB,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,6CAA6C;QAC1D,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,oBAAoB,EAAE;YACpB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;SAC3D;QACD,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;KAC/B,CAAC;IACF;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,yDAAyD;QACtE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC1D,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE;SACpE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,6EAA6E,EAAE;SACzG;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC;KAC3D;CACF,CAAC"}

package/dist/rules/websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../src/rules/websocket.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,eAAO,MAAM,cAAc,EAAE,YAAY,EAkIxC,CAAC"}
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../src/rules/websocket.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOtD,eAAO,MAAM,cAAc,EAAE,YAAY,EAyHxC,CAAC"}

package/dist/rules/websocket.js

@@ -2,6 +2,7 @@
  * WebSocket & Real-Time Communication Rules
  * Governance rules for WebSocket, Socket.IO, and real-time connections
  */
+import { createEncryptionRule, createValidationRule, createRateLimitRule } from './shared-patterns.js';
 export const websocketRules = [
     {
         id: 'ws-001',
@@ -22,24 +23,21 @@ export const websocketRules = [
         riskWeight: 60,
         tags: ['websocket', 'socket.io', 'security', 'authentication']
     },
-    {
+    // Message Rate Limiting - uses shared rate limit pattern
+    createRateLimitRule({
         id: 'ws-002',
         name: 'Enforce Message Rate Limiting',
         description: 'WebSocket messages must be rate limited per connection',
-        type: 'security',
-        enabled: true,
+        limitType: 'message',
+        scope: {
+            protocol: ['websocket', 'socket.io']
+        },
+        actionType: 'warn',
+        message: 'Implement message rate limiting to prevent flood attacks (e.g., 100 msg/min)',
         priority: 920,
-        conditions: [
-            { field: 'protocol', operator: 'in', value: ['websocket', 'socket.io'] },
-            { field: 'messageRateLimitEnabled', operator: 'not_equals', value: true }
-        ],
-        conditionLogic: 'all',
-        actions: [
-            { type: 'warn', message: 'Implement message rate limiting to prevent flood attacks (e.g., 100 msg/min)' }
-        ],
         riskWeight: 40,
-        tags: ['websocket', 'rate-limiting', 'dos', 'security']
-    },
+        tags: ['websocket', 'dos']
+    }),
     {
         id: 'ws-003',
         name: 'Validate Binary Message Size',
@@ -95,42 +93,36 @@ export const websocketRules = [
         riskWeight: 30,
         tags: ['websocket', 'limits', 'abuse-prevention']
     },
-    {
+    // Message Schema Validation - uses shared validation pattern
+    createValidationRule({
         id: 'ws-006',
         name: 'Validate Message Schema',
         description: 'WebSocket messages should be validated against schema',
-        type: 'security',
-        enabled: true,
+        validationType: 'message',
+        scope: {
+            protocol: ['websocket', 'socket.io']
+        },
+        actionType: 'warn',
+        message: 'Validate WebSocket message structure/schema to prevent injection attacks',
         priority: 860,
-        conditions: [
-            { field: 'protocol', operator: 'in', value: ['websocket', 'socket.io'] },
-            { field: 'messageValidation', operator: 'not_equals', value: true }
-        ],
-        conditionLogic: 'all',
-        actions: [
-            { type: 'warn', message: 'Validate WebSocket message structure/schema to prevent injection attacks' }
-        ],
         riskWeight: 35,
-        tags: ['websocket', 'validation', 'security']
-    },
-    {
+        tags: ['websocket']
+    }),
+    // WebSocket TLS Requirement - uses shared encryption pattern
+    createEncryptionRule({
         id: 'ws-007',
         name: 'WebSocket TLS Requirement',
         description: 'Production WebSocket connections must use TLS (wss://)',
-        type: 'security',
-        enabled: true,
+        encryptionType: 'tls',
+        scope: {
+            protocol: ['websocket', 'socket.io'],
+            environment: 'production'
+        },
+        actionType: 'deny',
+        message: 'Production WebSocket connections must use wss:// (TLS encrypted)',
         priority: 950,
-        conditions: [
-            { field: 'protocol', operator: 'in', value: ['websocket', 'socket.io'] },
-            { field: 'environment', operator: 'equals', value: 'production' },
-            { field: 'tlsEnabled', operator: 'not_equals', value: true }
-        ],
-        conditionLogic: 'all',
-        actions: [
-            { type: 'deny', message: 'Production WebSocket connections must use wss:// (TLS encrypted)' }
-        ],
         riskWeight: 55,
-        tags: ['websocket', 'tls', 'encryption', 'security']
-    }
+        tags: ['websocket', 'tls']
+    })
 ];
 //# sourceMappingURL=websocket.js.map

package/dist/rules/websocket.js.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.js","sourceRoot":"","sources":["../../src/rules/websocket.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,kCAAkC;QACxC,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;YACjE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SAChE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,6DAA6D,EAAE;SACzF;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAC;KAC/D;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SAC1E;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8EAA8E,EAAE;SAC1G;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC;KACxD;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,iDAAiD;QAC9D,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC7D,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SACjE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8DAA8D,EAAE;SAC1F;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC;KACnD;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,4DAA4D;QACzE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SACnE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4DAA4D,EAAE;SACxF;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,mBAAmB,CAAC;KACtD;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,iDAAiD;QAC9D,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE;SACxE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,sFAAsF,EAAE;SAClH;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC;KAClD;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,uDAAuD;QACpE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SACpE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,0EAA0E,EAAE;SACtG;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;KAC9C;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE;YACjE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SAC7D;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kEAAkE,EAAE;SAC9F;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC;KACrD;CACF,CAAC"}
+{"version":3,"file":"websocket.js","sourceRoot":"","sources":["../../src/rules/websocket.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,kCAAkC;QACxC,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;YACjE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SAChE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,6DAA6D,EAAE;SACzF;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAC;KAC/D;IACD,yDAAyD;IACzD,mBAAmB,CAAC;QAClB,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,wDAAwD;QACrE,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE;YACL,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;SACrC;QACD,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,8EAA8E;QACvF,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC;KAC3B,CAAC;IACF;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,iDAAiD;QAC9D,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC7D,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SACjE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8DAA8D,EAAE;SAC1F;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC;KACnD;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,4DAA4D;QACzE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;SACnE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4DAA4D,EAAE;SACxF;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,mBAAmB,CAAC;KACtD;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,iDAAiD;QAC9D,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE;YACV,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YACxE,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE;SACxE;QACD,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,sFAAsF,EAAE;SAClH;QACD,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,kBAAkB,CAAC;KAClD;IACD,6DAA6D;IAC7D,oBAAoB,CAAC;QACnB,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,uDAAuD;QACpE,cAAc,EAAE,SAAS;QACzB,KAAK,EAAE;YACL,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;SACrC;QACD,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,0EAA0E;QACnF,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,CAAC;KACpB,CAAC;IACF,6DAA6D;IAC7D,oBAAoB,CAAC;QACnB,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,wDAAwD;QACrE,cAAc,EAAE,KAAK;QACrB,KAAK,EAAE;YACL,QAAQ,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;YACpC,WAAW,EAAE,YAAY;SAC1B;QACD,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,kEAAkE;QAC3E,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE,EAAE;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC;KAC3B,CAAC;CACH,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAs8CnE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWX,CAAC;AAwgCF,OAAO,EAAE,MAAM,EAAE,CAAC;AAElB,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAIjD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAw+CnE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWX,CAAC;AA+jCF,OAAO,EAAE,MAAM,EAAE,CAAC;AAElB,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAIjD"}

package/dist/server.js

@@ -24,6 +24,29 @@ const supervisor = new AgentSupervisor({
     }
 });
 // ============================================================================
+// RESPONSE SIZE LIMITS - Prevent OOM errors from large payloads
+// ============================================================================
+/** Maximum number of items in any list response to prevent memory exhaustion */
+const MAX_RESPONSE_ITEMS = 1000;
+/** Default limit for list responses when not specified */
+const DEFAULT_RESPONSE_LIMIT = 100;
+/** Helper to truncate arrays and add warning if truncated */
+function limitResults(items, limit = DEFAULT_RESPONSE_LIMIT, maxLimit = MAX_RESPONSE_ITEMS) {
+    const effectiveLimit = Math.min(limit, maxLimit);
+    const total = items.length;
+    const truncated = total > effectiveLimit;
+    const limitedItems = items.slice(0, effectiveLimit);
+    return {
+        items: limitedItems,
+        total,
+        truncated,
+        ...(truncated && {
+            warning: `Response truncated: showing ${effectiveLimit} of ${total} items. Use limit/offset parameters for pagination.`,
+            pagination: { offset: 0, limit: effectiveLimit, hasMore: true }
+        })
+    };
+}
+// ============================================================================
 // COMPACT RESPONSE HELPERS - Keep MCP responses concise
 // ============================================================================
 /** Compact JSON (no pretty printing) */
@@ -1589,8 +1612,14 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case 'list_pending_approvals': {
                 const repo = typeof args?.repo === 'string' ? args.repo : undefined;
-                const approvals = await supervisor.getPendingApprovals(repo);
-                return resp({ count: approvals.length, approvals: approvals.map((a) => ({ id: a.requestId, reason: a.reason, priority: a.priority })) });
+                const allApprovals = await supervisor.getPendingApprovals(repo);
+                const result = limitResults(allApprovals, DEFAULT_RESPONSE_LIMIT);
+                return resp({
+                    count: result.items.length,
+                    total: result.total,
+                    approvals: result.items.map((a) => ({ id: a.requestId, reason: a.reason, priority: a.priority })),
+                    ...(result.truncated && { warning: result.warning, pagination: result.pagination })
+                });
             }
             case 'approve_request': {
                 const validated = ApproveRequestArgsSchema.parse(args);
@@ -1766,8 +1795,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             // Audit & reporting
             case 'get_audit_events': {
                 const validated = GetAuditEventsArgsSchema.parse(args);
-                const events = supervisor.getAuditEvents(validated);
-                return { content: [{ type: 'text', text: JSON.stringify(events, null, 2) }] };
+                const requestedLimit = validated.limit || DEFAULT_RESPONSE_LIMIT;
+                const events = supervisor.getAuditEvents({ ...validated, limit: Math.min(requestedLimit, MAX_RESPONSE_ITEMS) });
+                const result = limitResults(events, requestedLimit);
+                return resp({
+                    count: result.items.length,
+                    total: result.total,
+                    events: result.items,
+                    ...(result.truncated && { warning: result.warning, pagination: result.pagination })
+                });
             }
             case 'get_audit_stats': {
                 const validated = GetAuditStatsArgsSchema.parse(args || {});
@@ -1781,7 +1817,23 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             case 'export_audit_log': {
                 const validated = ExportAuditLogArgsSchema.parse(args || {});
                 const exported = supervisor.exportAuditLog(validated);
-                return { content: [{ type: 'text', text: exported }] };
+                // Parse exported JSON to apply limits
+                try {
+                    const parsed = JSON.parse(exported);
+                    if (Array.isArray(parsed)) {
+                        const result = limitResults(parsed, MAX_RESPONSE_ITEMS, MAX_RESPONSE_ITEMS);
+                        return resp({
+                            count: result.items.length,
+                            total: result.total,
+                            events: result.items,
+                            ...(result.truncated && { warning: result.warning, pagination: result.pagination })
+                        });
+                    }
+                    return { content: [{ type: 'text', text: exported }] };
+                }
+                catch {
+                    return { content: [{ type: 'text', text: exported }] };
+                }
             }
             // Configuration
             case 'get_config': {
@@ -2017,7 +2069,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     apps = supervisor.findAppsByTag(args.tag);
                 }
                 const includeHealth = args?.includeHealth !== false;
-                const result = apps.map(app => {
+                const limited = limitResults(apps, DEFAULT_RESPONSE_LIMIT);
+                const mappedApps = limited.items.map((app) => {
                     const base = { ...app };
                     if (includeHealth) {
                         return {
@@ -2027,7 +2080,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     }
                     return base;
                 });
-                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+                return resp({
+                    count: mappedApps.length,
+                    total: limited.total,
+                    apps: mappedApps,
+                    ...(limited.truncated && { warning: limited.warning, pagination: limited.pagination })
+                });
             }
             case 'get_app_status': {
                 const validated = GetAppStatusArgsSchema.parse(args);
@@ -2200,26 +2258,44 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case 'get_tasks': {
                 const validated = GetTasksArgsSchema.parse(args || {});
-                const tasks = await taskManager.getTasksByProject(validated.projectName, {
+                const allTasks = await taskManager.getTasksByProject(validated.projectName, {
                     status: validated.status,
                     priority: validated.priority,
                     assignee: validated.assignee,
                     labels: validated.labels
                 });
-                return resp({ count: tasks.length, tasks: tasks.map(slimTask) });
+                const result = limitResults(allTasks, DEFAULT_RESPONSE_LIMIT);
+                return resp({
+                    count: result.items.length,
+                    total: result.total,
+                    tasks: result.items.map(slimTask),
+                    ...(result.truncated && { warning: result.warning, pagination: result.pagination })
+                });
             }
             case 'get_pending_tasks': {
                 const projectName = typeof args?.projectName === 'string' ? args.projectName : undefined;
                 const tasks = await taskManager.getPendingTasks(projectName);
                 const approvedTasks = tasks.filter(task => !task.labels?.includes('needs-approval'));
-                return resp({ count: approvedTasks.length, tasks: approvedTasks.map(slimTask) });
+                const result = limitResults(approvedTasks, DEFAULT_RESPONSE_LIMIT);
+                return resp({
+                    count: result.items.length,
+                    total: result.total,
+                    tasks: result.items.map(slimTask),
+                    ...(result.truncated && { warning: result.warning, pagination: result.pagination })
+                });
             }
             case 'get_approved_tasks': {
                 const projectName = typeof args?.projectName === 'string' ? args.projectName : undefined;
                 const allTasks = await taskManager.getTasksByProject(projectName);
                 const approvedTasks = allTasks.filter(task => (task.status === 'pending' || task.status === 'in_progress') &&
                     task.labels?.includes('approved'));
-                return resp({ count: approvedTasks.length, tasks: approvedTasks.map(slimTask) });
+                const result = limitResults(approvedTasks, DEFAULT_RESPONSE_LIMIT);
+                return resp({
+                    count: result.items.length,
+                    total: result.total,
+                    tasks: result.items.map(slimTask),
+                    ...(result.truncated && { warning: result.warning, pagination: result.pagination })
+                });
             }
             case 'get_task': {
                 const validated = GetTaskArgsSchema.parse(args);
@@ -2298,12 +2374,15 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             }
             case 'search_tasks': {
                 const validated = SearchTasksArgsSchema.parse(args);
-                const tasks = await taskManager.searchTasks(validated.query, validated.projectName);
-                return { content: [{ type: 'text', text: JSON.stringify({
-                                query: validated.query,
-                                count: tasks.length,
-                                tasks
-                            }, null, 2) }] };
+                const allTasks = await taskManager.searchTasks(validated.query, validated.projectName);
+                const result = limitResults(allTasks, DEFAULT_RESPONSE_LIMIT);
+                return resp({
+                    query: validated.query,
+                    count: result.items.length,
+                    total: result.total,
+                    tasks: result.items.map(slimTask),
+                    ...(result.truncated && { warning: result.warning, pagination: result.pagination })
+                });
             }
             default:
                 throw new Error(`Unknown tool: ${name}`);