agent-exec-guard 0.1.0

package/dist/parser/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/parser/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/pipeline.js

@@ -0,0 +1,22 @@
+import { normalizeCommand } from "./parser/normalize.js";
+import { parseShellCommand } from "./parser/shellParse.js";
+import { classify } from "./classify/classify.js";
+/**
+ * The single shared normalize -> parse -> classify pipeline. Both
+ * exec_guard_check and exec_guard_run call exactly this function --
+ * exec_guard_run NEVER trusts a classification/checksum handed to it by a
+ * caller, it always re-derives its own by calling this again (see
+ * docs/security-model.md, "Re-verification, not trust-on-first-check").
+ */
+export function runPipeline(rawCommand) {
+    const normalized = normalizeCommand(rawCommand);
+    if (!normalized.ok) {
+        const parseResult = { ok: false, reason: `normalization_rejected: ${normalized.reason}`, raw: rawCommand };
+        const result = classify(parseResult);
+        return { classification: result.classification, reason: result.reason, commandChecksum: result.commandChecksum, parsedCommand: parseResult };
+    }
+    const parsed = parseShellCommand(normalized.normalized);
+    const result = classify(parsed);
+    return { classification: result.classification, reason: result.reason, commandChecksum: result.commandChecksum, parsedCommand: parsed };
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../src/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAuB,MAAM,wBAAwB,CAAC;AAUvE;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,WAAW,GAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,UAAU,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACxH,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;IAC/I,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC1I,CAAC"}

package/dist/security/audit.js

@@ -0,0 +1,50 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { config } from "../config.js";
+const GENESIS_HASH = "0".repeat(64);
+const auditPath = path.join(config.stateDir, "audit.log");
+function computeEntryHash(prevHash, partial) {
+    return createHash("sha256").update(JSON.stringify({ ...partial, prevHash })).digest("hex");
+}
+function readRawLines() {
+    if (!fs.existsSync(auditPath))
+        return [];
+    return fs
+        .readFileSync(auditPath, "utf8")
+        .split("\n")
+        .filter(Boolean)
+        .map((l) => JSON.parse(l));
+}
+export function appendAudit(event) {
+    fs.mkdirSync(config.stateDir, { recursive: true });
+    const existing = readRawLines();
+    const prev = existing[existing.length - 1];
+    const prevHash = prev ? prev.entryHash : GENESIS_HASH;
+    const seq = prev ? prev.seq + 1 : 1;
+    const base = { seq, ts: new Date().toISOString(), prevHash, ...event };
+    const entryHash = computeEntryHash(prevHash, base);
+    const full = { ...base, entryHash };
+    fs.appendFileSync(auditPath, JSON.stringify(full) + "\n", "utf8");
+    return full;
+}
+export function readAudit(limit = 50) {
+    const all = readRawLines();
+    return all.slice(Math.max(0, all.length - limit));
+}
+/** Recomputes the hash chain over the whole log; used by tests and
+ * available for operators who want to verify the log hasn't been altered. */
+export function verifyAuditChain() {
+    const all = readRawLines();
+    let prevHash = GENESIS_HASH;
+    for (const entry of all) {
+        const { entryHash, ...rest } = entry;
+        const expected = computeEntryHash(prevHash, rest);
+        if (expected !== entryHash || entry.prevHash !== prevHash) {
+            return { ok: false, brokenAtSeq: entry.seq };
+        }
+        prevHash = entryHash;
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=audit.js.map

package/dist/security/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/security/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAyBtC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAE1D,SAAS,gBAAgB,CAAC,QAAgB,EAAE,OAAsC;IAChF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,EAAE;SACN,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC;SAC/B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAsB;IAChD,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAkC,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACtG,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAe,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC;IAChD,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAK,GAAG,EAAE;IAClC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC;AAOD;6EAC6E;AAC7E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,YAAY,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC/C,CAAC;QACD,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/security/redact.js

@@ -0,0 +1,22 @@
+/** Deep-redacts any object by key name before it's returned to the LLM,
+ * as defense-in-depth against a tool accidentally including something
+ * credential-shaped in its response. */
+const SENSITIVE_KEY_RE = /^(.*_?(secret|password|api_key|apikey|access_key|private_key|credential)s?.*)$/i;
+// "approvalToken" is the one legitimate token this server is *supposed* to
+// hand back to the caller (it's the human-approval proof itself, minted by
+// exec_guard_check_approval_status) -- excluded from the generic
+// token-shaped-key redaction below so it isn't scrubbed away by accident.
+// The server secret used to *sign* tokens never flows through a tool
+// response at all (see security/secret.ts), so there is no ambiguity here.
+const ALLOWED_TOKEN_KEYS = new Set(["approvaltoken"]);
+const TOKEN_KEY_RE = /token/i;
+export function redactByKeyName(value) {
+    return JSON.parse(JSON.stringify(value, (key, val) => {
+        if (TOKEN_KEY_RE.test(key) && !ALLOWED_TOKEN_KEYS.has(key.toLowerCase()))
+            return "[REDACTED]";
+        if (SENSITIVE_KEY_RE.test(key))
+            return "[REDACTED]";
+        return val;
+    }));
+}
+//# sourceMappingURL=redact.js.map

package/dist/security/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/security/redact.ts"],"names":[],"mappings":"AAAA;;wCAEwC;AACxC,MAAM,gBAAgB,GAAG,iFAAiF,CAAC;AAE3G,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AACjE,0EAA0E;AAC1E,qEAAqE;AACrE,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AACtD,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,MAAM,UAAU,eAAe,CAAI,KAAQ;IACzC,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,YAAY,CAAC;QAC9F,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,YAAY,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/security/secret.js

@@ -0,0 +1,13 @@
+import { config } from "../config.js";
+import { registerRedactedValue } from "../utils/logger.js";
+// Single choke point for the server secret. Nothing outside
+// approval/token.ts should call getServerSecret(). It is registered with
+// the logger so any accidental log line containing it gets scrubbed, but
+// the real invariant is enforced by never handing it to execFile env or a
+// tool response -- see exec/run.ts (env is always explicitly allow-listed)
+// and security/redact.ts.
+registerRedactedValue(config.serverSecret);
+export function getServerSecret() {
+    return config.serverSecret;
+}
+//# sourceMappingURL=secret.js.map

package/dist/security/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/security/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,4DAA4D;AAC5D,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,0BAA0B;AAC1B,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAE3C,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC"}

package/dist/server.js

@@ -0,0 +1,35 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { tools } from "./tools/index.js";
+import { redactByKeyName } from "./security/redact.js";
+import { logger } from "./utils/logger.js";
+export async function buildServer() {
+    const server = new McpServer({ name: "agent-exec-guard", version: "0.1.0" });
+    for (const tool of tools) {
+        const shape = tool.schema instanceof z.ZodObject ? tool.schema.shape : { input: tool.schema };
+        server.tool(tool.name, tool.description, shape, async (args) => {
+            try {
+                const parsed = tool.schema.parse(args);
+                const result = await tool.handler(parsed);
+                const redacted = redactByKeyName(result);
+                return { content: [{ type: "text", text: JSON.stringify(redacted, null, 2) }] };
+            }
+            catch (err) {
+                logger.error(`tool ${tool.name} failed`, { error: err instanceof Error ? err.message : String(err) });
+                return {
+                    isError: true,
+                    content: [{ type: "text", text: JSON.stringify({ error: "tool_failed", message: err instanceof Error ? err.message : String(err) }) }],
+                };
+            }
+        });
+    }
+    return server;
+}
+export async function main() {
+    const server = await buildServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    logger.info("agent-exec-guard MCP server started");
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;gBACzC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtG,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;iBAChJ,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;AACrD,CAAC"}

package/dist/tools/auditLog.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+import { readAudit, verifyAuditChain } from "../security/audit.js";
+export const auditLogSchema = z.object({
+    limit: z.number().int().positive().max(1000).optional(),
+});
+/** Read-only: returns recent classification+execution decisions from the
+ * local hash-chained audit log, and whether the chain still verifies
+ * (false would mean the log file was tampered with or corrupted). */
+export async function exec_guard_audit_log(input) {
+    const events = readAudit(input.limit ?? 50);
+    const chain = verifyAuditChain();
+    return { events, chainVerified: chain.ok, brokenAtSeq: chain.ok ? undefined : chain.brokenAtSeq };
+}
+//# sourceMappingURL=auditLog.js.map

package/dist/tools/auditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../src/tools/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH;;qEAEqE;AACrE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAqC;IAC9E,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;AACpG,CAAC"}

package/dist/tools/check.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { runPipeline } from "../pipeline.js";
+import { appendAudit } from "../security/audit.js";
+export const checkSchema = z.object({
+    command: z.string().min(1),
+    cwd: z.string().optional(),
+});
+/** Read-only: parses and classifies a candidate command without executing
+ * anything. This is what an agent (or its host harness) calls first to
+ * decide what to do next. */
+export async function exec_guard_check(input) {
+    const result = runPipeline(input.command);
+    appendAudit({
+        type: "check",
+        command: input.command,
+        classification: result.classification,
+        commandChecksum: result.commandChecksum ?? undefined,
+    });
+    return {
+        classification: result.classification,
+        reason: result.reason,
+        parsedCommand: result.parsedCommand,
+        commandChecksum: result.commandChecksum,
+    };
+}
+//# sourceMappingURL=check.js.map

package/dist/tools/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/tools/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH;;6BAE6B;AAC7B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAkC;IACvE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC;QACV,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,SAAS;KACrD,CAAC,CAAC;IACH,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC;AACJ,CAAC"}

package/dist/tools/checkApprovalStatus.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { getApproval } from "../approval/store.js";
+export const checkApprovalStatusSchema = z.object({
+    approvalId: z.string().uuid(),
+});
+/** Polled by the agent after exec_guard_request_approval. Returns the
+ * signed single-use approvalToken only once a human has approved -- the
+ * agent can never obtain a token any other way. */
+export async function exec_guard_check_approval_status(input) {
+    const approval = await getApproval(input.approvalId);
+    if (!approval)
+        return { error: "not_found" };
+    const base = { approvalId: approval.id, status: approval.status, expiresAt: approval.expiresAt };
+    if (approval.status === "approved") {
+        return { ...base, approvalToken: approval.approvalToken };
+    }
+    if (approval.status === "denied") {
+        return { ...base, denyReason: approval.denyReason };
+    }
+    return base;
+}
+//# sourceMappingURL=checkApprovalStatus.js.map

package/dist/tools/checkApprovalStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkApprovalStatus.js","sourceRoot":"","sources":["../../src/tools/checkApprovalStatus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC9B,CAAC,CAAC;AAEH;;mDAEmD;AACnD,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAAgD;IACrG,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAE7C,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/index.js

@@ -0,0 +1,38 @@
+import { exec_guard_check, checkSchema } from "./check.js";
+import { exec_guard_run, runSchema } from "./run.js";
+import { exec_guard_request_approval, requestApprovalSchema } from "./requestApproval.js";
+import { exec_guard_check_approval_status, checkApprovalStatusSchema } from "./checkApprovalStatus.js";
+import { exec_guard_audit_log, auditLogSchema } from "./auditLog.js";
+export const tools = [
+    {
+        name: "exec_guard_check",
+        description: "Fully parses (real shell grammar, not string-prefix matching) and classifies a candidate shell command as SAFE, BLOCKED, or UNCERTAIN. Read-only -- never executes anything. Call this first to decide what to do with a command.",
+        schema: checkSchema,
+        handler: exec_guard_check,
+    },
+    {
+        name: "exec_guard_run",
+        description: "The only tool that actually executes a command. Always re-parses and re-classifies internally (never trusts a classification passed in). Executes immediately if SAFE; refuses if BLOCKED; requires a verified approvalId+approvalToken (from exec_guard_request_approval / exec_guard_check_approval_status) if UNCERTAIN.",
+        schema: runSchema,
+        handler: exec_guard_run,
+    },
+    {
+        name: "exec_guard_request_approval",
+        description: "For an UNCERTAIN command, creates a pending approval request and prompts a human at the server's terminal for a y/n decision. Returns an approvalId to poll with exec_guard_check_approval_status.",
+        schema: requestApprovalSchema,
+        handler: exec_guard_request_approval,
+    },
+    {
+        name: "exec_guard_check_approval_status",
+        description: "Polls the status of a pending approval request. Returns a signed single-use approvalToken once a human approves.",
+        schema: checkApprovalStatusSchema,
+        handler: exec_guard_check_approval_status,
+    },
+    {
+        name: "exec_guard_audit_log",
+        description: "Read-only: returns recent classification/execution decisions from the local tamper-evident (hash-chained) audit log.",
+        schema: auditLogSchema,
+        handler: exec_guard_audit_log,
+    },
+];
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AASrE,MAAM,CAAC,MAAM,KAAK,GAAqB;IACrC;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,mOAAmO;QACrO,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,gBAAgB;KAC1B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,6TAA6T;QAC/T,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,cAAc;KACxB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,oMAAoM;QACtM,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,2BAA2B;KACrC;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,WAAW,EAAE,kHAAkH;QAC/H,MAAM,EAAE,yBAAyB;QACjC,OAAO,EAAE,gCAAgC;KAC1C;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,sHAAsH;QACnI,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,oBAAoB;KAC9B;CACF,CAAC"}

package/dist/tools/requestApproval.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { runPipeline } from "../pipeline.js";
+import { createApproval } from "../approval/store.js";
+import { promptForApproval } from "../approval/cliApproval.js";
+export const requestApprovalSchema = z.object({
+    command: z.string().min(1),
+    cwd: z.string().optional(),
+});
+/** For an UNCERTAIN command, creates a pending approval request and
+ * (v0.1) prompts the human running the server via the CLI. Returns an
+ * approvalId the agent should poll with exec_guard_check_approval_status.
+ * Refuses outright for BLOCKED commands (no point asking a human to
+ * approve something that will never be allowed to run) and for already-SAFE
+ * commands (no approval needed -- call exec_guard_run directly). */
+export async function exec_guard_request_approval(input) {
+    const result = runPipeline(input.command);
+    if (result.classification === "BLOCKED") {
+        return { error: "blocked", message: `This command is BLOCKED and cannot be approved: ${result.reason}` };
+    }
+    if (result.classification === "SAFE") {
+        return { error: "already_safe", message: "This command already classifies SAFE -- call exec_guard_run directly, no approval needed." };
+    }
+    if (!result.commandChecksum) {
+        return { error: "internal_error", message: "no checksum computed" };
+    }
+    const approval = await createApproval(input.command, result.commandChecksum, input.cwd);
+    promptForApproval(approval);
+    return {
+        approvalId: approval.id,
+        status: approval.status,
+        expiresAt: approval.expiresAt,
+        message: "Approval requested. A human must respond at the server's terminal. Poll exec_guard_check_approval_status with this approvalId.",
+    };
+}
+//# sourceMappingURL=requestApproval.js.map

package/dist/tools/requestApproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestApproval.js","sourceRoot":"","sources":["../../src/tools/requestApproval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH;;;;;oEAKoE;AACpE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAA4C;IAC5F,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,mDAAmD,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACxF,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAE5B,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,gIAAgI;KAC1I,CAAC;AACJ,CAAC"}

package/dist/tools/run.js

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import { runPipeline } from "../pipeline.js";
+import { executeParsedCommand } from "../exec/run.js";
+import { consumeToken } from "../approval/store.js";
+import { appendAudit } from "../security/audit.js";
+export const runSchema = z.object({
+    command: z.string().min(1),
+    cwd: z.string().optional(),
+    approvalId: z.string().optional(),
+    approvalToken: z.string().optional(),
+});
+/**
+ * The only tool that actually executes a command. Deliberately re-runs the
+ * exact same normalize -> parse -> classify pipeline as exec_guard_check
+ * internally -- it never trusts a classification, checksum, or "this was
+ * already checked" claim passed in from outside (see docs/security-model.md,
+ * "Re-verification, not trust-on-first-check").
+ *
+ * - SAFE: executes immediately.
+ * - BLOCKED: refuses with a structured reason, never executes.
+ * - UNCERTAIN: requires approvalId + approvalToken; verifies signature,
+ *   expiry, single-use, and that the token's checksum matches the freshly
+ *   re-parsed command -- only executes on success.
+ */
+export async function exec_guard_run(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const result = runPipeline(input.command);
+    if (result.classification === "BLOCKED") {
+        appendAudit({ type: "run_blocked", command: input.command, classification: "BLOCKED", commandChecksum: result.commandChecksum ?? undefined, detail: { reason: result.reason } });
+        return { executed: false, classification: "BLOCKED", reason: result.reason };
+    }
+    if (result.classification === "UNCERTAIN") {
+        if (!input.approvalId || !input.approvalToken) {
+            appendAudit({ type: "run_uncertain_no_token", command: input.command, classification: "UNCERTAIN", commandChecksum: result.commandChecksum ?? undefined });
+            return {
+                executed: false,
+                classification: "UNCERTAIN",
+                reason: `${result.reason}. Call exec_guard_request_approval, then retry exec_guard_run with the resulting approvalId and approvalToken.`,
+            };
+        }
+        if (!result.commandChecksum) {
+            return { executed: false, classification: "UNCERTAIN", reason: "internal error: no checksum computed for an UNCERTAIN command" };
+        }
+        const consumed = await consumeToken(input.approvalId, input.approvalToken, result.commandChecksum);
+        if (!consumed.ok) {
+            appendAudit({ type: "run_rejected", command: input.command, classification: "UNCERTAIN", commandChecksum: result.commandChecksum, approvalId: input.approvalId, detail: { reason: consumed.reason } });
+            return { executed: false, classification: "UNCERTAIN", reason: describeRejection(consumed.reason) };
+        }
+        // Falls through to execution below -- token verified, single-use
+        // consumed atomically.
+    }
+    if (!result.parsedCommand.ok) {
+        // Cannot happen for SAFE/consumed-UNCERTAIN (classify() only returns
+        // those for a successful parse), but keeps the type checker honest.
+        return { executed: false, classification: result.classification, reason: "internal error: no parsed command available to execute" };
+    }
+    const outcome = await executeParsedCommand(result.parsedCommand, cwd);
+    appendAudit({
+        type: "run_executed",
+        command: input.command,
+        classification: result.classification,
+        commandChecksum: result.commandChecksum ?? undefined,
+        approvalId: input.approvalId,
+        detail: { exitCode: outcome.exitCode, timedOut: outcome.timedOut },
+    });
+    return {
+        executed: true,
+        classification: result.classification,
+        exitCode: outcome.exitCode,
+        timedOut: outcome.timedOut,
+        stdout: outcome.stdout,
+        stderr: outcome.stderr,
+    };
+}
+function describeRejection(reason) {
+    switch (reason) {
+        case "not_found":
+            return "No such approval request.";
+        case "not_approved":
+            return "This request has not been approved yet (or was denied/expired). Poll exec_guard_check_approval_status.";
+        case "already_consumed":
+            return "This approval token has already been used. Tokens are single-use; call exec_guard_request_approval again to retry.";
+        case "expired":
+            return "This approval token has expired.";
+        case "checksum_mismatch":
+            return "The command differs from what was approved (checksum mismatch) -- approving one command never approves a different one. Request a fresh approval for the exact command you want to run.";
+        case "bad_signature":
+            return "Token signature is invalid.";
+        default:
+            return "Approval could not be verified.";
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/tools/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/tools/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAgC;IACnE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjL,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9C,WAAW,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,SAAS,EAAE,CAAC,CAAC;YAC3J,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,cAAc,EAAE,WAAW;gBAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,gHAAgH;aACzI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;QACnI,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvM,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtG,CAAC;QACD,iEAAiE;QACjE,uBAAuB;IACzB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QAC7B,qEAAqE;QACrE,oEAAoE;QACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;IACtI,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACtE,WAAW,CAAC;QACV,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,SAAS;QACpD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;KACnE,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA0B;IACnD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO,2BAA2B,CAAC;QACrC,KAAK,cAAc;YACjB,OAAO,wGAAwG,CAAC;QAClH,KAAK,kBAAkB;YACrB,OAAO,oHAAoH,CAAC;QAC9H,KAAK,SAAS;YACZ,OAAO,kCAAkC,CAAC;QAC5C,KAAK,mBAAmB;YACtB,OAAO,yLAAyL,CAAC;QACnM,KAAK,eAAe;YAClB,OAAO,6BAA6B,CAAC;QACvC;YACE,OAAO,iCAAiC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/utils/logger.js

@@ -0,0 +1,34 @@
+const SECRET_PATTERNS = [];
+// Registered lazily by security/secret.ts so the logger module doesn't need
+// to import the secret directly (keeps the secret's blast radius to one
+// file).
+export function registerRedactedValue(value) {
+    if (!value)
+        return;
+    SECRET_PATTERNS.push(new RegExp(value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"));
+}
+function redact(msg) {
+    let out = msg;
+    for (const re of SECRET_PATTERNS)
+        out = out.replace(re, "[REDACTED]");
+    return out;
+}
+function line(level, msg, meta) {
+    const entry = {
+        ts: new Date().toISOString(),
+        level,
+        msg: redact(msg),
+        ...(meta ? { meta: JSON.parse(redact(JSON.stringify(meta))) } : {}),
+    };
+    process.stderr.write(JSON.stringify(entry) + "\n");
+}
+export const logger = {
+    info: (msg, meta) => line("info", msg, meta),
+    warn: (msg, meta) => line("warn", msg, meta),
+    error: (msg, meta) => line("error", msg, meta),
+    debug: (msg, meta) => {
+        if (process.env.AGENT_EXEC_GUARD_DEBUG)
+            line("debug", msg, meta);
+    },
+};
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAa,EAAE,CAAC;AAErC,4EAA4E;AAC5E,wEAAwE;AACxE,SAAS;AACT,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,GAAW,EAAE,IAA8B;IACtE,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,KAAK;QACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,IAAI,EAAE,CAAC,GAAW,EAAE,IAA8B,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;IAC9E,IAAI,EAAE,CAAC,GAAW,EAAE,IAA8B,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;IAC9E,KAAK,EAAE,CAAC,GAAW,EAAE,IAA8B,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC;IAChF,KAAK,EAAE,CAAC,GAAW,EAAE,IAA8B,EAAE,EAAE;QACrD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB;YAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;CACF,CAAC"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "agent-exec-guard",
+  "version": "0.1.0",
+  "description": "MCP server that fully parses and classifies shell commands (SAFE/BLOCKED/UNCERTAIN) before AI coding agents execute them, requiring a human-signed single-use token for anything uncertain.",
+  "type": "module",
+  "bin": {
+    "agent-exec-guard": "bin/agent-exec-guard.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist",
+    "bin"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint src",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "security",
+    "ai-agent",
+    "shell",
+    "command-validation",
+    "sandbox",
+    "approval",
+    "claude",
+    "cursor"
+  ],
+  "license": "MIT",
+  "author": "Sourabh Yogi",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SORABH13/agent-exec-guard.git"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.11.0",
+    "mvdan-sh": "^0.10.1",
+    "sql.js": "^1.14.2",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "@types/sql.js": "^1.4.11",
+    "@typescript-eslint/eslint-plugin": "^8.68.0",
+    "@typescript-eslint/parser": "^8.68.0",
+    "eslint": "^9.9.0",
+    "tsx": "^4.16.2",
+    "typescript": "^5.5.4",
+    "vitest": "^2.0.5"
+  }
+}