@webdecoy/ai-protection 0.1.0-alpha.15 → 0.1.0-alpha.16

package/MCP.md

@@ -372,3 +372,25 @@ the revision; enforcement still works but revision feedback remains unknown.
 Report delivery is best effort and requires the normal reporting queue/flush.
 This evidence is not acknowledgment from every replica, provider revocation, or
 independent proof of execution. Outage behavior remains fail open.
+
+### Per-tool pauses (alpha.16)
+
+Enable `sharedRuntime.toolPause: true` after updating the hosted runtime. Tool
+pauses cover the exact property, configured server ID and action/tool name,
+across callers and schema versions. MCP supplies tool metadata automatically;
+plain action integrations must provide `toolSchema` on every action. Renaming a
+server/tool changes this identity; an old pause does not cover the new name.
+Tool-only checks do not require `reportCaller` or send a caller pseudonym.
+
+Owners/admins manage a tool pause in AI Protection, with an explicit scope
+review, reason, expiry and audit history. Saved controls remain listed even if
+the tool disappears from recent inventory. Other server/tool names stay active.
+The tool remains discoverable; work already admitted is not cancelled.
+
+When both `callerPause` and `toolPause` are enabled, they share one online request
+and both checks are reported. Caller denial takes precedence if both deny.
+`callerPauseTimeoutMs` controls the shared deadline (default 1000 ms). There is
+no retry/cache; unavailable, timed-out or malformed checks fail open with explicit
+evidence. Application permissions still apply before this check. Saving is not
+an acknowledgment from every instance. Exact revision evidence permits the
+dashboard to show an SDK-reported tool denial separately from saved state.

package/action-runtime.mjs

@@ -15,6 +15,8 @@ export function prepareActionRuntime(options, definitions) {
     typeof config.subjectSecret!=='string'||!config.subjectSecret.isWellFormed()||Buffer.byteLength(config.subjectSecret)<32)throw Error('Invalid action runtime');
   if(config.reportCaller !== undefined && typeof config.reportCaller !== "boolean")throw Error("Invalid caller reporting option");
   if(config.callerPause !== undefined && typeof config.callerPause !== 'boolean')throw Error('Invalid caller pause option');
+  if(config.toolPause !== undefined && typeof config.toolPause !== 'boolean')throw Error('Invalid tool pause option');
+  if(config.toolPause && [...definitions.values()].some(d=>!d.toolSchema))throw Error('Tool pause requires toolSchema on every action');
   if(config.callerPause && !config.reportCaller)throw Error('Caller pause requires caller reporting');
   const pauseTimeout=config.callerPauseTimeoutMs??1000;
   if(!Number.isInteger(pauseTimeout)||pauseTimeout<1||pauseTimeout>10000)throw Error('Invalid caller pause timeout');
@@ -70,7 +72,35 @@ export function prepareActionRuntime(options, definitions) {
     } catch { signal.throwIfAborted(); }
     check.durationMs=Math.max(0,performance.now()-started);return {check,denial};
   }:null;
-  return {limits,checkCallerPause,callerEvidence:caller=>actionCallerEvidence(c,caller),report:event=>reporter.send(event),flush:()=>reporter.flush()};
+  const checkToolPause = c.toolPause ? async (caller,name,toolSchema,signal) => {
+    signal.throwIfAborted();const started=performance.now();
+    const kinds=c.callerPause?['caller','tool']:['tool'];
+    let checks=kinds.map(kind=>({id:kind+'_pause',source:'shared',mode:'enforce',decision:'unavailable',reason:kind+'_pause_unavailable',durationMs:0})),denial;
+    try {
+      const id=c.callerPause?actionCallerEvidence(c,caller).id:'';
+      const response=await fetch(new URL('/api/v1/sdk/ai-abuse/caller-pause',c.webdecoyUrl),{
+        method:'POST',redirect:'error',signal:AbortSignal.any([signal,AbortSignal.timeout(pauseTimeout)]),
+        headers:{Authorization:`Bearer ${c.webdecoyKey}`,'Content-Type':'application/json','X-WebDecoy-Property-ID':c.propertyId},
+        body:JSON.stringify({schema:2,caller:id,server_id:toolSchema.serverId,tool:name})
+      });
+      if(!response.ok){await response.body?.cancel();throw Error('Tool control unavailable');}
+      const value=await readJSON(response,4096);
+      if(value.schema!==2||value.property_id!==c.propertyId.toLowerCase()||value.caller!==id||value.server_id!==toolSchema.serverId||value.tool!==name||(!c.callerPause&&value.caller_control!==null))throw Error('Invalid tool control response');
+      // Validate the entire combined response before accepting either decision.
+      const checked=kinds.map(kind=>{
+        const control=value[kind+'_control'];
+        if(!control||typeof control.allowed!=='boolean'||control.reason!==kind+(control.allowed?'_allowed':'_paused')||
+          (control.control_revision!=null&&!validPropertyID(control.control_revision)))throw Error('Invalid control evidence');
+        return {id:kind+'_pause',source:'shared',mode:'enforce',decision:control.allowed?'allow':'deny',reason:control.reason,durationMs:0,
+          ...(control.control_revision?{controlRevision:control.control_revision.toLowerCase()}:{})};
+      });
+      checks=checked;const denied=checks.find(check=>check.decision==='deny');
+      if(denied)denial={reason:denied.reason,status:403};
+    } catch {signal.throwIfAborted();}
+    const durationMs=Math.max(0,performance.now()-started);
+    return {checks:checks.map(check=>({...check,durationMs})),denial};
+  }:null;
+  return {limits,checkCallerPause,checkToolPause,callerEvidence:caller=>actionCallerEvidence(c,caller),report:event=>reporter.send(event),flush:()=>reporter.flush()};
 }
 
 export function actionCallerEvidence(config,caller) {

package/actions.d.mts

@@ -71,14 +71,16 @@ export interface ActionRuntime {
   reportCaller?:boolean;
   /** Opt-in online caller pause check before work. Requires reportCaller. Fails open on timeout (default 1000ms); no cache, retry or in-flight cancellation. */
   callerPause?:boolean;
-  /** Caller-pause RPC deadline, 1–10000ms; default 1000ms. Short deadlines can fail open during cold authentication. */
+  /** Opt-in tool pause by property/server/name across callers and schema versions. Requires toolSchema on each action; no caller reporting required. Combines with callerPause in one RPC and fails open on unavailable controls. */
+  toolPause?:boolean;
+  /** Caller/tool-pause RPC deadline, 1–10000ms; default 1000ms. Short deadlines can fail open during cold authentication. */
   callerPauseTimeoutMs?:number;
   webdecoyUrl:string;webdecoyKey:string;propertyId:string;subjectSecret:string;
   reportingTimeoutMs?:number;maxPendingReports?:number;
 }
 export interface ActionDefinition {
   /** Optional non-secret server label and canonical SHA-256 schema hash. MCP discovery fills this automatically.
-   * Requires a runtime supporting tool_schema evidence; does not change admission.
+   * Requires a runtime supporting tool_schema evidence. With toolPause enabled, serverId and the action name identify the control scope.
    */
   toolSchema?: ToolSchemaEvidence;
   limits?: ActionLimits;

package/actions.mjs

@@ -133,7 +133,10 @@ export function createActionProtection(options) {
       // Shared limits run only after application permission checks. Their own
       // RPC deadlines are separate from local admission and detector availability.
       clearTimeout(timer);
-      if(runtime?.checkCallerPause){
+      if(runtime?.checkToolPause){
+        const r=await runtime.checkToolPause(caller,name,action.toolSchema,admissionSignal);checks.push(...r.checks);
+        if(r.denial)deny(r.denial.reason,r.denial.status);
+      }else if(runtime?.checkCallerPause){
         const r=await runtime.checkCallerPause(caller,admissionSignal);checks.push(r.check);
         if(r.denial)deny(r.denial.reason,r.denial.status);
       }

package/package.json

@@ -11,7 +11,7 @@
     "test:types": "tsc --strict --noEmit --module nodenext --target es2022 test/types.mts test/mcp-types.mts",
     "test:workers": "node --test test/workers/*.test.mjs"
   },
-  "version": "0.1.0-alpha.15",
+  "version": "0.1.0-alpha.16",
   "exports": {
     "./fetch": {
       "types": "./fetch.d.mts",