@true-and-useful/janee 0.8.3 → 0.8.5

package/dist/core/exec.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * Secure CLI Execution for Janee (RFC 0001)
+ *
+ * Executes CLI commands with credentials injected via environment variables.
+ * The agent specifies the command to run but never sees the actual credential.
+ * Janee's core security property is preserved: agent never sees the key.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateCommand = validateCommand;
+exports.buildExecEnv = buildExecEnv;
+exports.scrubCredentials = scrubCredentials;
+exports.executeCommand = executeCommand;
+const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
+/**
+ * Validate that a command is allowed by the capability's whitelist
+ */
+function validateCommand(command, allowCommands) {
+    if (!command || command.length === 0) {
+        return { allowed: false, reason: 'Empty command' };
+    }
+    const executable = path_1.default.basename(command[0]);
+    if (!allowCommands.includes(executable)) {
+        return {
+            allowed: false,
+            reason: `Command '${executable}' not allowed by capability. Allowed: ${allowCommands.join(', ')}`
+        };
+    }
+    // Check for shell injection patterns in arguments
+    const shellMetachars = /[;&|`$(){}\\<>]/;
+    for (let i = 1; i < command.length; i++) {
+        if (shellMetachars.test(command[i])) {
+            return {
+                allowed: false,
+                reason: `Argument ${i} contains shell metacharacters. Use structured arguments instead of shell syntax.`
+            };
+        }
+    }
+    return { allowed: true };
+}
+/**
+ * Build environment variables for command execution.
+ * Replaces {{credential}} placeholders with the actual secret.
+ * Replaces {{apiKey}} and {{apiSecret}} for HMAC-style auth.
+ */
+function buildExecEnv(envTemplate, credential, extraCredentials) {
+    const env = {};
+    for (const [key, value] of Object.entries(envTemplate)) {
+        let resolved = value;
+        resolved = resolved.replace(/{{credential}}/g, credential);
+        if (extraCredentials?.apiKey) {
+            resolved = resolved.replace(/{{apiKey}}/g, extraCredentials.apiKey);
+        }
+        if (extraCredentials?.apiSecret) {
+            resolved = resolved.replace(/{{apiSecret}}/g, extraCredentials.apiSecret);
+        }
+        if (extraCredentials?.passphrase) {
+            resolved = resolved.replace(/{{passphrase}}/g, extraCredentials.passphrase);
+        }
+        env[key] = resolved;
+    }
+    return env;
+}
+/**
+ * Scrub credential values from output strings.
+ * Prevents accidental credential leakage in stdout/stderr.
+ */
+function scrubCredentials(output, credential, extraCredentials) {
+    let scrubbed = output;
+    // Only scrub if credential is long enough to be meaningful
+    if (credential && credential.length >= 8) {
+        scrubbed = scrubbed.replaceAll(credential, '[REDACTED]');
+    }
+    if (extraCredentials?.apiKey && extraCredentials.apiKey.length >= 8) {
+        scrubbed = scrubbed.replaceAll(extraCredentials.apiKey, '[REDACTED]');
+    }
+    if (extraCredentials?.apiSecret && extraCredentials.apiSecret.length >= 8) {
+        scrubbed = scrubbed.replaceAll(extraCredentials.apiSecret, '[REDACTED]');
+    }
+    if (extraCredentials?.passphrase && extraCredentials.passphrase.length >= 8) {
+        scrubbed = scrubbed.replaceAll(extraCredentials.passphrase, '[REDACTED]');
+    }
+    return scrubbed;
+}
+/**
+ * Execute a CLI command with injected credentials.
+ * Returns stdout/stderr/exitCode without exposing the credential.
+ */
+async function executeCommand(command, injectedEnv, options) {
+    const timeout = options.timeout || 30000;
+    const startTime = Date.now();
+    return new Promise((resolve, reject) => {
+        const proc = (0, child_process_1.spawn)(command[0], command.slice(1), {
+            env: {
+                ...process.env, // Inherit base env
+                ...injectedEnv, // Override with injected credentials
+                // Safety: prevent credential exfil via common env vars
+                HISTFILE: '/dev/null',
+                LESSHISTFILE: '/dev/null',
+            },
+            cwd: options.workDir || '/tmp/janee-exec',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout,
+            // Don't use shell — prevents injection
+            shell: false,
+        });
+        let stdout = '';
+        let stderr = '';
+        proc.stdout.on('data', (data) => {
+            stdout += data.toString();
+        });
+        proc.stderr.on('data', (data) => {
+            stderr += data.toString();
+        });
+        if (options.stdin) {
+            proc.stdin.write(options.stdin);
+            proc.stdin.end();
+        }
+        else {
+            proc.stdin.end();
+        }
+        proc.on('close', (code) => {
+            const executionTimeMs = Date.now() - startTime;
+            // Scrub credentials from output
+            const scrubbedStdout = scrubCredentials(stdout, options.credential, options.extraCredentials);
+            const scrubbedStderr = scrubCredentials(stderr, options.credential, options.extraCredentials);
+            resolve({
+                stdout: scrubbedStdout,
+                stderr: scrubbedStderr,
+                exitCode: code ?? 1,
+                executionTimeMs,
+            });
+        });
+        proc.on('error', (error) => {
+            const executionTimeMs = Date.now() - startTime;
+            resolve({
+                stdout: '',
+                stderr: `Failed to execute command: ${error.message}`,
+                exitCode: 127,
+                executionTimeMs,
+            });
+        });
+    });
+}
+//# sourceMappingURL=exec.js.map

package/dist/core/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/core/exec.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;AAkDH,0CA6BC;AAOD,oCAuBC;AAMD,4CAuBC;AAMD,wCAiFC;AA/ND,iDAAsC;AACtC,gDAAwB;AA4CxB;;GAEG;AACH,SAAgB,eAAe,CAC7B,OAAiB,EACjB,aAAuB;IAEvB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,UAAU,GAAG,cAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,YAAY,UAAU,yCAAyC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClG,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,MAAM,cAAc,GAAG,iBAAiB,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,CAAC,mFAAmF;aACzG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAC1B,WAAmC,EACnC,UAAkB,EAClB,gBAA+E;IAE/E,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,gBAAgB,EAAE,MAAM,EAAE,CAAC;YAC7B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,gBAAgB,EAAE,SAAS,EAAE,CAAC;YAChC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,gBAAgB,EAAE,UAAU,EAAE,CAAC;YACjC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACtB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,MAAc,EACd,UAAkB,EAClB,gBAA+E;IAE/E,IAAI,QAAQ,GAAG,MAAM,CAAC;IAEtB,2DAA2D;IAC3D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzC,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,gBAAgB,EAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACpE,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,gBAAgB,EAAE,SAAS,IAAI,gBAAgB,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1E,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,gBAAgB,EAAE,UAAU,IAAI,gBAAgB,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5E,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,OAAiB,EACjB,WAAmC,EACnC,OAMC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC/C,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG,EAAG,mBAAmB;gBACpC,GAAG,WAAW,EAAG,qCAAqC;gBACtD,uDAAuD;gBACvD,QAAQ,EAAE,WAAW;gBACrB,YAAY,EAAE,WAAW;aAC1B;YACD,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,iBAAiB;YACzC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO;YACP,uCAAuC;YACvC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE/C,gCAAgC;YAChC,MAAM,cAAc,GAAG,gBAAgB,CACrC,MAAM,EACN,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,gBAAgB,CACzB,CAAC;YACF,MAAM,cAAc,GAAG,gBAAgB,CACrC,MAAM,EACN,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,gBAAgB,CACzB,CAAC;YAEF,OAAO,CAAC;gBACN,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,IAAI,IAAI,CAAC;gBACnB,eAAe;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACzB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,OAAO,CAAC;gBACN,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,8BAA8B,KAAK,CAAC,OAAO,EAAE;gBACrD,QAAQ,EAAE,GAAG;gBACb,eAAe;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/health.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Health check module for Janee services
+ * Provides connectivity and latency checks for configured API backends
+ */
+export interface HealthCheckResult {
+    service: string;
+    healthy: boolean;
+    statusCode?: number;
+    latencyMs: number;
+    error?: string;
+    checkedAt: string;
+}
+export interface HealthCheckOptions {
+    timeout?: number;
+    fetchFn?: typeof fetch;
+}
+/**
+ * Check if a service endpoint is reachable and responding
+ */
+export declare function checkServiceHealth(serviceName: string, baseUrl: string, options?: HealthCheckOptions): Promise<HealthCheckResult>;
+/**
+ * Check health of multiple services in parallel
+ */
+export declare function checkAllServicesHealth(services: Map<string, {
+    baseUrl: string;
+}>, options?: HealthCheckOptions): Promise<HealthCheckResult[]>;
+//# sourceMappingURL=health.d.ts.map

package/dist/core/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/core/health.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CA6D5B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC1C,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAK9B"}

package/dist/core/health.js

@@ -0,0 +1,73 @@
+"use strict";
+/**
+ * Health check module for Janee services
+ * Provides connectivity and latency checks for configured API backends
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkServiceHealth = checkServiceHealth;
+exports.checkAllServicesHealth = checkAllServicesHealth;
+/**
+ * Check if a service endpoint is reachable and responding
+ */
+async function checkServiceHealth(serviceName, baseUrl, options = {}) {
+    const { timeout = 5000, fetchFn = fetch } = options;
+    const checkedAt = new Date().toISOString();
+    if (!baseUrl) {
+        return {
+            service: serviceName,
+            healthy: false,
+            latencyMs: 0,
+            error: 'No base URL configured',
+            checkedAt
+        };
+    }
+    const start = Date.now();
+    try {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        const response = await fetchFn(baseUrl, {
+            method: 'HEAD',
+            signal: controller.signal
+        });
+        clearTimeout(timeoutId);
+        const latencyMs = Date.now() - start;
+        // 2xx = healthy, 401/403 = reachable (auth expected), 4xx = unhealthy, 5xx = unhealthy
+        const isReachable = response.ok || response.status === 401 || response.status === 403;
+        if (isReachable) {
+            return {
+                service: serviceName,
+                healthy: true,
+                statusCode: response.status,
+                latencyMs,
+                checkedAt
+            };
+        }
+        return {
+            service: serviceName,
+            healthy: false,
+            statusCode: response.status,
+            latencyMs,
+            error: `HTTP ${response.status} ${response.statusText}`,
+            checkedAt
+        };
+    }
+    catch (err) {
+        const latencyMs = Date.now() - start;
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            service: serviceName,
+            healthy: false,
+            latencyMs,
+            error: message,
+            checkedAt
+        };
+    }
+}
+/**
+ * Check health of multiple services in parallel
+ */
+async function checkAllServicesHealth(services, options = {}) {
+    const checks = Array.from(services.entries()).map(([name, config]) => checkServiceHealth(name, config.baseUrl, options));
+    return Promise.all(checks);
+}
+//# sourceMappingURL=health.js.map

package/dist/core/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/core/health.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAmBH,gDAiEC;AAKD,wDAQC;AAjFD;;GAEG;AACI,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,OAAe,EACf,UAA8B,EAAE;IAEhC,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,CAAC;YACZ,KAAK,EAAE,wBAAwB;YAC/B,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAErC,uFAAuF;QACvF,MAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;QAEtF,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,SAAS;gBACT,SAAS;aACV,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,SAAS;YACT,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE;YACvD,SAAS;SACV,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,KAAK;YACd,SAAS;YACT,KAAK,EAAE,OAAO;YACd,SAAS;SACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,sBAAsB,CAC1C,QAA0C,EAC1C,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CACnE,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAClD,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC"}

package/dist/core/mcp-server.d.ts

@@ -7,6 +7,8 @@ import { SessionManager } from './sessions.js';
 import { Rules } from './rules.js';
 import { AuditLogger } from './audit.js';
 import { URL } from 'url';
+import { ExecResult } from './exec.js';
+import { CredentialOwnership } from './agent-scope.js';
 export interface Capability {
     name: string;
     service: string;
@@ -14,6 +16,11 @@ export interface Capability {
     autoApprove?: boolean;
     requiresReason?: boolean;
     rules?: Rules;
+    mode?: 'proxy' | 'exec';
+    allowCommands?: string[];
+    env?: Record<string, string>;
+    workDir?: string;
+    timeout?: number;
 }
 export interface ServiceConfig {
     baseUrl: string;
@@ -27,6 +34,8 @@ export interface ServiceConfig {
         credentials?: string;
         scopes?: string[];
     };
+    /** Ownership metadata for agent-scoped credential access control */
+    ownership?: CredentialOwnership;
 }
 export interface APIRequest {
     service: string;
@@ -47,10 +56,14 @@ export interface ReloadResult {
 export interface MCPServerOptions {
     capabilities: Capability[];
     services: Map<string, ServiceConfig>;
+    /** Map of service name -> ownership metadata for agent-scoped access control */
     sessionManager: SessionManager;
     auditLogger: AuditLogger;
     onExecute: (session: any, request: APIRequest) => Promise<APIResponse>;
+    onExecCommand?: (session: any, capability: Capability, command: string[], stdin?: string) => Promise<ExecResult>;
     onReloadConfig?: () => ReloadResult;
+    /** Persist ownership changes to config storage (called after grant/revoke) */
+    onPersistOwnership?: (serviceName: string, ownership: CredentialOwnership) => void;
 }
 /**
  * Create and start MCP server

package/dist/core/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../src/core/mcp-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAQnE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAc,KAAK,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAG1B,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,iBAAiB,CAAC;QACzF,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,cAAc,EAAE,cAAc,CAAC;IAC/B,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,cAAc,CAAC,EAAE,MAAM,YAAY,CAAC;CACrC;AAsBD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAgOjE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,GAAG,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,WAAW,CAAC,CAsCtB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlE;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,IAAI,CAAC,CA0Bf"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../../src/core/mcp-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAQnE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAc,KAAK,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1B,OAAO,EAAmE,UAAU,EAAE,MAAM,WAAW,CAAC;AAExG,OAAO,EAAwC,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAQ7F,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,CAAC;IAEd,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,iBAAiB,CAAC;QACzF,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,oEAAoE;IACpE,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,gFAAgF;IAChF,cAAc,EAAE,cAAc,CAAC;IAC/B,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjH,cAAc,CAAC,EAAE,MAAM,YAAY,CAAC;IACpC,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,KAAK,IAAI,CAAC;CACpF;AAsBD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAihBjE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,GAAG,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,WAAW,CAAC,CAyCtB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlE;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,IAAI,CAAC,CA0Bf"}