@webdecoy/ai-protection 0.1.0-alpha.14 → 0.1.0-alpha.15

package/MCP.md

@@ -361,3 +361,14 @@ pseudonym and existing pauses no longer match. Only opt-in Node action integrati
 are covered, including this MCP adapter; Python/Go and unwrapped tools are not.
 Listings and initialization remain available; this pauses new tool execution.
 No automatic pause is applied after a decoy call.
+
+#### Pause feedback (alpha.15)
+
+The SDK includes the runtime's control revision in action check reports when
+available. The dashboard can then distinguish a saved pause from an SDK-reported
+denial for that exact revision, with server receipt time and request ID. Delayed
+reports from an earlier pause do not confirm a later save. Older runtimes omit
+the revision; enforcement still works but revision feedback remains unknown.
+Report delivery is best effort and requires the normal reporting queue/flush.
+This evidence is not acknowledgment from every replica, provider revocation, or
+independent proof of execution. Outage behavior remains fail open.

package/action-runtime.mjs

@@ -40,7 +40,7 @@ export function prepareActionRuntime(options, definitions) {
   const reporter=createReporter({reportingTimeoutMs:c.reportingTimeoutMs??1000,maxPendingReports:c.maxPendingReports??100,
     onObservation:async(event,{signal})=>{
       const checks=[{id:'action_boundary',source:'local',mode:'enforce',decision:event.decision,reason:event.reason,duration_ms:0},
-        ...event.checks.map(check=>({id:check.id,source:check.source,mode:check.mode,decision:check.decision,reason:check.reason,duration_ms:check.durationMs}))];
+        ...event.checks.map(check=>({id:check.id,source:check.source,mode:check.mode,decision:check.decision,reason:check.reason,duration_ms:check.durationMs,...(check.controlRevision?{control_revision:check.controlRevision}:{})}))];
       const payload={schema:2,request_id:event.eventId,timestamp:event.timestamp,decision:event.decision,reason:event.reason,
         degraded:event.checks.some(c=>c.decision==='unavailable'),checks,handler_attempted:event.attempted,
         action:event.decision==='deny'?'denied':event.outcome==='unknown'?'handler_error':'forwarded',
@@ -62,7 +62,10 @@ export function prepareActionRuntime(options, definitions) {
       if(!response.ok){await response.body?.cancel();throw Error('Caller control unavailable');}
       const value=await readJSON(response,2048);
       if(value.schema!==1||value.property_id!==c.propertyId.toLowerCase()||value.caller!==id||typeof value.allowed!=='boolean'||value.reason!==(value.allowed?'caller_allowed':'caller_paused'))throw Error('Invalid caller control response');
+      // Older runtimes omit revision evidence. Never invent it from receipt time.
+      if(value.control_revision != null && (!validPropertyID(value.control_revision)||value.control_revision==='00000000-0000-0000-0000-000000000000'))throw Error('Invalid caller control revision');
       check.decision=value.allowed?'allow':'deny';check.reason=value.reason;
+      if(value.control_revision != null)check.controlRevision=value.control_revision.toLowerCase();
       if(!value.allowed)denial={reason:'caller_paused',status:403};
     } catch { signal.throwIfAborted(); }
     check.durationMs=Math.max(0,performance.now()-started);return {check,denial};

package/actions.d.mts

@@ -48,7 +48,7 @@ export interface ActionEvent {
   readonly schema: 1;
   readonly eventId: string;
   readonly timestamp: string;
-  readonly checks: readonly {id:string;source:string;mode:string;decision:string;reason:string;durationMs:number}[];
+  readonly checks: readonly {id:string;source:string;mode:string;decision:string;reason:string;durationMs:number;controlRevision?:string}[];
   readonly actionId: string;
   readonly action: string;
   readonly policyVersion: string;

package/package.json

@@ -11,7 +11,7 @@
     "test:types": "tsc --strict --noEmit --module nodenext --target es2022 test/types.mts test/mcp-types.mts",
     "test:workers": "node --test test/workers/*.test.mjs"
   },
-  "version": "0.1.0-alpha.14",
+  "version": "0.1.0-alpha.15",
   "exports": {
     "./fetch": {
       "types": "./fetch.d.mts",