argusqa-os 9.8.1 → 10.0.0

package/glama.json

@@ -1,12 +1,12 @@
 {
   "$schema": "https://glama.ai/mcp/schemas/server.json",
   "name": "argus",
-  "description": "AI-powered QA harness that audits web apps via Chrome DevTools Protocol. Catches JS errors, network failures, a11y violations, SEO issues, security headers, CSS regressions, and more — directly from Claude conversations. 9 MCP tools: argus_audit (fast 8-analyzer pass), argus_audit_full (Lighthouse + memory + responsive), argus_compare (dev vs staging diff), argus_last_report (retrieve last JSON report), argus_watch_snapshot (live tab snapshot without navigating), argus_get_context (LLM-optimized context + fix loop with snapshot_id diff), argus_design_audit (Figma design fidelity — 13 finding types), argus_visual_diff (screenshot baseline comparison, updateBaseline flag), argus_pr_validate (PR diff → affected routes → baseline-aware targeted audit + PR comment/Check Run → blocked flag). Every finding is post-processed with intelligent baseline filtering (cross-run noise classifier) and root cause linking (recent git commits mapped to new findings). 166 test blocks, 961 hard assertions, 67 detection categories.",
+  "description": "AI-powered QA harness that audits web apps via Chrome DevTools Protocol. Catches JS errors, network failures, a11y violations, SEO issues, security headers, CSS regressions, and more — directly from Claude conversations. 9 MCP tools: argus_audit (fast 8-analyzer pass), argus_audit_full (Lighthouse + memory + responsive), argus_compare (dev vs staging diff), argus_last_report (retrieve last JSON report), argus_watch_snapshot (live tab snapshot without navigating), argus_get_context (LLM-optimized context + fix loop with snapshot_id diff), argus_design_audit (Figma design fidelity — 13 finding types), argus_visual_diff (screenshot baseline comparison, updateBaseline flag), argus_pr_validate (PR diff → affected routes → baseline-aware targeted audit + PR comment/Check Run → blocked flag). Every finding is post-processed with intelligent baseline filtering (cross-run noise classifier) and root cause linking (recent git commits mapped to new findings). Every tool response passes through the Aegis confidentiality egress boundary (default-on, fail-closed): secrets, PII, and exploit detail are redacted before a finding can cross into the calling agent's context window — the local on-disk report keeps 100% fidelity, opt out with ARGUS_REDACT_SENSITIVE=0. 171 test blocks, 998 hard assertions, 67 detection categories.",
   "maintainers": ["ironclawdevs27"],
   "tools": [
     {
       "name": "argus_audit",
-      "description": "Fast QA audit — JS errors, network failures (4xx/5xx), CORS, API frequency loops, slow/blocking third-party requests, API contract violations, SEO violations, security headers, content quality, DevTools Issues panel, and HTTPS enforcement. Returns { findings, summary }. Supports cache: true to skip re-crawl on repeat calls."
+      "description": "Fast QA audit — JS errors, network failures (4xx/5xx), CORS, API frequency loops, slow/blocking third-party requests, API contract violations, SEO violations, security headers, content quality, DevTools Issues panel, and HTTPS enforcement. Returns { findings, summary } plus an optional redaction rider when the Aegis egress boundary withholds sensitive detail. Supports cache: true to skip re-crawl on repeat calls."
     },
     {
       "name": "argus_audit_full",

package/package.json

@@ -1,18 +1,24 @@
 {
   "name": "argusqa-os",
-  "version": "9.8.1",
+  "version": "10.0.0",
   "mcpName": "io.github.ironclawdevs27/argus",
-  "description": "Argus — AI-powered automated dev-testing platform using Chrome DevTools MCP and Claude Code",
+  "description": "Argus — the QA layer for AI-assisted development. Claude-native (MCP) Chrome audits across 67 categories — errors, visual regressions, a11y, security, performance — no test files, secrets redacted by default (Aegis).",
   "keywords": [
     "mcp",
     "mcp-server",
     "claude",
+    "claude-code",
+    "ai-agents",
+    "agentic-coding",
     "qa",
     "testing",
     "accessibility",
     "automation",
     "chrome-devtools",
-    "web-testing"
+    "web-testing",
+    "visual-regression",
+    "web-vitals",
+    "security"
   ],
   "author": "ironclawdevs",
   "license": "MIT",
@@ -23,6 +29,7 @@
   },
   "files": [
     "src/",
+    "scripts/rehydrate-report.mjs",
     ".mcp.json",
     "glama.json"
   ],
@@ -43,6 +50,7 @@
     "init": "node src/cli/init.js",
     "chrome": "node src/cli/chrome-launcher.js",
     "doctor": "node src/cli/doctor.js",
+    "metrics": "node scripts/metrics-snapshot.mjs",
     "crawl": "node src/orchestration/crawl-and-report.js",
     "compare": "node src/orchestration/env-comparison.js",
     "watch": "node src/orchestration/watch-mode.js",
@@ -59,6 +67,7 @@
     "test:coverage": "npm run coverage:harness && npm run coverage:unit && npm run coverage:gate",
     "report:html": "node src/utils/html-reporter.js",
     "report:pdf": "node src/utils/pdf-exporter.js",
+    "report:rehydrate": "node scripts/rehydrate-report.mjs",
     "mcp-server": "node src/mcp-server.js"
   },
   "dependencies": {

package/scripts/rehydrate-report.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/**
+ * Aegis rehydrate CLI (Step 8 of REDACTION_BOUNDARY_MAX_PLAN.md).
+ *
+ * Re-inflates a token-redacted report LOCALLY by swapping every `AEGIS_` vault token
+ * back to its original from the on-disk vault. This is a LOCAL-ONLY operator tool —
+ * it requires the per-machine vault key + the mapping files under
+ * reports/.aegis-vault/ (both 0600, gitignored). The token that crossed the trust
+ * boundary is information-free; only this machine can re-hydrate.
+ *
+ *   npm run report:rehydrate -- <report.json> [--stdout]
+ *
+ * Without --stdout, writes <report>.rehydrated.json next to the input and prints the
+ * path. The original (redacted) file is never modified.
+ */
+import fs from 'fs';
+import { rehydrate, loadVault } from '../src/utils/aegis-vault.js';
+
+const args = process.argv.slice(2);
+const toStdout = args.includes('--stdout');
+const file = args.find((a) => !a.startsWith('--'));
+
+if (!file) {
+  console.error('Usage: npm run report:rehydrate -- <report.json> [--stdout]');
+  process.exit(1);
+}
+
+let raw;
+try {
+  raw = fs.readFileSync(file, 'utf8');
+} catch (err) {
+  console.error(`[Aegis] cannot read ${file}: ${err.message}`);
+  process.exit(1);
+}
+
+let obj;
+try {
+  obj = JSON.parse(raw);
+} catch (err) {
+  console.error(`[Aegis] ${file} is not valid JSON: ${err.message}`);
+  process.exit(1);
+}
+
+const vault = loadVault();
+if (vault.size === 0) {
+  console.error('[Aegis] vault is empty — nothing to rehydrate. Was ARGUS_REDACT_VAULT=1 (and ARGUS_REDACT_MODE=token) set during the run?');
+}
+
+const out = rehydrate(obj, vault);
+
+if (toStdout) {
+  process.stdout.write(JSON.stringify(out, null, 2) + '\n');
+} else {
+  const outPath = file.replace(/\.json$/i, '') + '.rehydrated.json';
+  try {
+    fs.writeFileSync(outPath, JSON.stringify(out, null, 2), 'utf8');
+    console.error(`[Aegis] rehydrated using ${vault.size} mapping(s) → ${outPath}`);
+  } catch (err) {
+    console.error(`[Aegis] could not write ${outPath}: ${err.message}`);
+    process.exit(1);
+  }
+}

package/src/cli/pr-validate.js

@@ -31,6 +31,8 @@ import { auditRoutesConcurrently, auditRouteWithRetry, routeResilienceFromEnv }
 import { fetchPrFiles, mapFilesToRoutesDeep, resolveAnnotationTarget } from '../utils/pr-diff-analyzer.js';
 import { resolveTargetUrl }                           from '../utils/deploy-preview.js';
 import { reportPrValidation }                         from '../utils/github-reporter.js';
+import { redactForEgress }                             from '../utils/sensitivity-classifier.js';
+import { scrubText }                                   from '../utils/secret-patterns.js';
 import { getCurrentBranch }                            from '../utils/baseline-manager.js';
 import {
   decidePrBlock, resolvePrBaselineFile, loadPrBaseline, savePrBaseline, tagFindingNovelty, severityTally,
@@ -38,6 +40,24 @@ import {
 
 // ── Exported helpers (testable without Chrome) ────────────────────────────────
 
+/**
+ * Aegis egress guard (Step 7): the $GITHUB_STEP_SUMMARY is a CI artifact readable by anyone
+ * with repo access (A4), so a finding's free-text must never cross raw. Project the finding
+ * through redactForEgress and return its egress-safe `message` + `url`: a sensitive finding's
+ * message collapses to the 🔒 marker, a benign one keeps its scrubbed message; the url is
+ * stripped of query/userinfo. ARGUS_REDACT_SENSITIVE=0 ⇒ raw (byte-identical to pre-Aegis).
+ *
+ * @param {object} f
+ * @returns {{ message: string, url: string }}
+ */
+export function safeFindingLine(f) {
+  if (process.env.ARGUS_REDACT_SENSITIVE === '0') {
+    return { message: String(f?.message ?? ''), url: String(f?.url ?? '') };
+  }
+  const [p] = redactForEgress([f]);
+  return { message: String(p?.message ?? ''), url: String(p?.url ?? '') };
+}
+
 /**
  * Build a GitHub-flavoured markdown step summary.
  *
@@ -105,8 +125,9 @@ export function buildStepSummary({ blocked, summary, affectedRoutes, perRoute, f
       const sev = f.severity === 'critical' ? '🔴 critical'
                : f.severity === 'warning'  ? '⚠️ warning'
                : 'ℹ️ info';
-      const msg = String(f.message ?? '').replace(/\|/g, '\\|').slice(0, 100);
-      const url = String(f.url     ?? '').replace(/\|/g, '\\|').slice(0, 80);
+      const safe = safeFindingLine(f);   // Aegis: scrub message + strip url query before egress
+      const msg = safe.message.replace(/\|/g, '\\|').slice(0, 100);
+      const url = safe.url.replace(/\|/g, '\\|').slice(0, 80);
       md += `| ${sev} | \`${f.type ?? ''}\` | ${msg} | ${url} |\n`;
     }
     if (findings.length > 50) {
@@ -455,11 +476,18 @@ async function main() {
       // genuine diff line (see pr-diff-analyzer.js).
       const annTarget = resolveAnnotationTarget(route.path, prFiles);
       const loc = annTarget ? ` file=${annTarget.path},line=${annTarget.line}` : '';
+      // Aegis (Step 7): a GitHub Actions ::error/::warning annotation is rendered on the PR and
+      // captured in the CI log (A4). scrubText the message so a secret/PII captured from the page
+      // never lands in an annotation; the type + audit-target url stay (structural, non-secret).
+      const annMsg = (m) => {
+        const s = String(m ?? '');
+        return (process.env.ARGUS_REDACT_SENSITIVE === '0' ? s : scrubText(s)).replace(/\n/g, ' ');
+      };
       for (const f of findings.filter(g => g.severity === 'critical')) {
-        console.log(`::error${loc}::${String(f.message ?? '').replace(/\n/g, ' ')} [${f.type}] on ${url}`);
+        console.log(`::error${loc}::${annMsg(f.message)} [${f.type}] on ${url}`);
       }
       for (const f of findings.filter(g => g.severity === 'warning')) {
-        console.log(`::warning${loc}::${String(f.message ?? '').replace(/\n/g, ' ')} [${f.type}] on ${url}`);
+        console.log(`::warning${loc}::${annMsg(f.message)} [${f.type}] on ${url}`);
       }
     }
 
@@ -546,7 +574,14 @@ async function main() {
       blockOn,
       baseline: baselineInfo,
     };
-    console.log(JSON.stringify(result, null, 2));
+    // Aegis (Step 7): the CLI prints this result to stdout, which lands in the GitHub Actions log
+    // (world-readable for public repos, A4). Project the findings through redactForEgress for the
+    // printed view (type/severity/route/scrubbed-message survive — the downstream contract holds);
+    // reportPrValidation below receives the RAW `result` and redacts independently. Opt-out ⇒ raw.
+    const printResult = process.env.ARGUS_REDACT_SENSITIVE === '0'
+      ? result
+      : { ...result, findings: redactForEgress(allFindings) };
+    console.log(JSON.stringify(printResult, null, 2));
 
     // Step 9: Post/update the Argus PR comment + Check Run (Phase A). Idempotent — updates
     // the single marker-tagged comment in place; the Check Run conclusion maps to the block

package/src/mcp-server.js

@@ -45,6 +45,10 @@ import { getCurrentBranch }                    from './utils/baseline-manager.js
 import {
   decidePrBlock, resolvePrBaselineFile, loadPrBaseline, savePrBaseline, tagFindingNovelty, severityTally,
 } from './utils/pr-baseline.js';
+import {
+  redactForEgress, buildRedactionRider, redactReport, deepScrub,
+} from './utils/sensitivity-classifier.js';
+import { flushTeamVault } from './utils/team-vault.js';
 
 const logger = childLogger('mcp-server');
 
@@ -78,6 +82,85 @@ function cacheAudit(url, result) {
   }
 }
 
+// ── Aegis egress projection (REDACTION_BOUNDARY_MAX_PLAN.md Step 4) ─────────────
+// The MCP boundary is the PRIMARY agent trust boundary: every tool response transits to
+// the calling agent's provider (OWASP LLM02). These helpers project findings to the
+// deny-by-default allowlist + attach a `redaction` rider BEFORE the response crosses, so
+// no secret / PII / exploit-detail substring ever leaves in raw form. The LOCAL on-disk
+// report keeps full fidelity (the JSON write in report-processor is untouched). FAIL
+// CLOSED: any projection error yields an empty-findings, redacted response — never the raw
+// payload. ARGUS_REDACT_SENSITIVE=0 = byte-identical passthrough (the documented opt-out).
+const redactOff = () => process.env.ARGUS_REDACT_SENSITIVE === '0';
+
+/**
+ * Project a findings-bearing result object ({ findings, ...rest }) for egress: `findings`
+ * is run through redactForEgress, every other field (summary computed PRE-redaction, urls,
+ * etc.) is preserved, and a `redaction` rider is appended. Used by the findings-array tools
+ * (argus_audit / argus_visual_diff / argus_design_audit / argus_pr_validate).
+ */
+function egressResult(obj, opts = {}) {
+  if (redactOff() || !obj || typeof obj !== 'object') return obj;
+  try {
+    const findings = Array.isArray(obj.findings) ? obj.findings : [];
+    return { ...obj, findings: redactForEgress(findings), redaction: buildRedactionRider(findings, opts) };
+  } catch (err) {
+    logger.error('[ARGUS] Aegis MCP egress failed — failing closed:', err.message);
+    const { findings: _drop, ...rest } = obj;
+    return { ...rest, findings: [],
+      redaction: { redacted: 0, total: 0, localReportPath: opts.localReportPath ?? null,
+        failClosed: true, note: 'Redaction error — findings withheld (fail closed).' } };
+  }
+}
+
+/** Project an argus_watch_snapshot result ({ findings, newConsole, newNetwork }). */
+function egressWatch(r) {
+  if (redactOff() || !r || typeof r !== 'object') return r;
+  try {
+    const findings = Array.isArray(r.findings) ? r.findings : [];
+    return {
+      findings:   redactForEgress(findings),
+      newConsole: (Array.isArray(r.newConsole) ? r.newConsole : []).map((m) => deepScrub(m)),
+      newNetwork: (Array.isArray(r.newNetwork) ? r.newNetwork : []).map((n) => deepScrub(n)),
+      redaction:  buildRedactionRider(findings),
+    };
+  } catch (err) {
+    logger.error('[ARGUS] Aegis watch egress failed — failing closed:', err.message);
+    return { findings: [], newConsole: [], newNetwork: [], redaction: { redacted: 0, total: 0, failClosed: true } };
+  }
+}
+
+/**
+ * Project an argus_get_context result: each finding array is redacted, the raw
+ * console/network arrays are deepScrub'd, open_tabs urls are sanitised, and a rider is
+ * appended. `allFindings` (the full pre-split findings list) feeds the rider count.
+ */
+function egressContext(ctx, allFindings) {
+  if (redactOff() || !ctx || typeof ctx !== 'object') return ctx;
+  try {
+    const out = { ...ctx };
+    for (const k of ['critical_issues', 'warnings', 'js_errors', 'network_failures', 'resolved', 'new_issues', 'persisting']) {
+      if (Array.isArray(ctx[k])) out[k] = redactForEgress(ctx[k]);
+    }
+    if (Array.isArray(ctx.console_errors))  out.console_errors  = ctx.console_errors.map((m) => deepScrub(m));
+    if (Array.isArray(ctx.recent_requests)) out.recent_requests = ctx.recent_requests.map((n) => deepScrub(n));
+    if (Array.isArray(ctx.open_tabs)) {
+      // open_tabs is the user's own diagnostic tab list (not a finding). deepScrub the url —
+      // masks a DETECTED secret (JWT / basic-auth / high-entropy token) while preserving benign
+      // query structure (a sanitizeUrl query-strip would destroy diagnostic context + tab identity).
+      out.open_tabs = ctx.open_tabs.map((t) =>
+        (t && typeof t === 'object' && typeof t.url === 'string') ? { ...t, url: deepScrub(t.url) } : t);
+    }
+    out.redaction = buildRedactionRider(Array.isArray(allFindings) ? allFindings : []);
+    return out;
+  } catch (err) {
+    logger.error('[ARGUS] Aegis get_context egress failed — failing closed:', err.message);
+    return { snapshot_id: ctx.snapshot_id, summary: 'redacted', url: ctx.url, timestamp: ctx.timestamp,
+      critical_issues: [], warnings: [], js_errors: [], network_failures: [],
+      console_errors: [], recent_requests: [], open_tabs: ctx.open_tabs ?? [],
+      redaction: { redacted: 0, total: 0, failClosed: true } };
+  }
+}
+
 // ── Tool definitions ─────────────────────────────────────────────────────────
 
 const TOOLS = [
@@ -200,13 +283,21 @@ async function withMcp(fn) {
 // PR-validate path (handlePrValidate) passes the depth-policy-selected expensive analyzer
 // names (D2) so the same handler runs them on the affected route. The public tool is always
 // called with no `analyzers` → [] → crawlRouteWithDepth returns the cheap pass unchanged.
-async function handleAudit({ url, critical = false, cache = false, analyzers = [] }) {
+// `ctx.internal` is set ONLY by handlePrValidate (an in-process call, NOT through the MCP
+// dispatcher) so the PR-validate block/baseline/novelty/reporting logic operates on RAW
+// findings. It is a SECOND positional argument — the dispatcher calls handleAudit(args) with
+// no ctx, so a client cannot inject internal:true via req.params.arguments to bypass redaction.
+async function handleAudit({ url, critical = false, cache = false, analyzers = [] }, ctx = {}) {
+  const internal = ctx.internal === true;
+  const finalize = (payload) =>
+    ({ content: [{ type: 'text', text: JSON.stringify(internal ? payload : egressResult(payload), null, 2) }] });
+
   if (cache && auditCache.has(url)) {
     const { result, ts } = auditCache.get(url);
     // Refresh recency on read so eviction is true LRU, not insertion-order FIFO.
     auditCache.delete(url);
     auditCache.set(url, { result, ts });
-    return { content: [{ type: 'text', text: JSON.stringify({ ...result, _cached: true, _cachedAt: new Date(ts).toISOString() }, null, 2) }] };
+    return finalize({ ...result, _cached: true, _cachedAt: new Date(ts).toISOString() });
   }
   return withMcp(async (mcp) => {
     const parsed = new URL(url);
@@ -224,8 +315,8 @@ async function handleAudit({ url, critical = false, cache = false, analyzers = [
       pageTitle:  raw.pageTitle,
       screenshot: raw.screenshot,
     };
-    if (cache) cacheAudit(url, result);
-    return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    if (cache) cacheAudit(url, result);   // cache stores RAW; redaction happens in finalize
+    return finalize(result);
   });
 }
 
@@ -237,14 +328,18 @@ async function handleAuditFull({ url, critical = false }) {
       [{ path: parsed.pathname + parsed.search + parsed.hash, name: 'audit', critical }],
       parsed.origin,
     );
-    return { content: [{ type: 'text', text: JSON.stringify(report, null, 2) }] };
+    // Report-shaped egress: redact every finding array (routes[].errors / flows[].findings /
+    // codebase[]) + attach the rider; report metadata stays so the golden schema holds.
+    return { content: [{ type: 'text', text: JSON.stringify(redactReport(report), null, 2) }] };
   });
 }
 
 async function handleCompare() {
   return withMcp(async (mcp) => {
     const report = await runComparison(mcp);
-    return { content: [{ type: 'text', text: JSON.stringify(report, null, 2) }] };
+    // Handles BOTH compare modes: css-analysis routes[].findings via redactForEgress and
+    // env-comparison routes[].diffs via deepScrub (descriptions/urls scrubbed, paths stripped).
+    return { content: [{ type: 'text', text: JSON.stringify(redactReport(report), null, 2) }] };
   });
 }
 
@@ -255,7 +350,9 @@ async function handleWatchSnapshot({ url, tabId } = {}) {
     const baseUrl = url ?? process.env.TARGET_DEV_URL ?? 'http://localhost:3000';
     const session = new WatchSession(browser, baseUrl);
     const result  = await session.poll();
-    return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+    // Redact findings + scrub the RAW newConsole/newNetwork arrays (a Bearer token in a
+    // console.error or a ?token= query in a request URL would otherwise cross raw).
+    return { content: [{ type: 'text', text: JSON.stringify(egressWatch(result), null, 2) }] };
   });
 }
 
@@ -333,7 +430,10 @@ async function handleGetContext({ url, snapshot_id: prevId, tabId } = {}) {
       ...(isDiff ? { resolved, new_issues, persisting } : {}),
     };
 
-    return { content: [{ type: 'text', text: JSON.stringify(context, null, 2) }] };
+    // Egress projection at the boundary — AFTER all internal logic (diff keys, summary) ran on
+    // raw findings: redact every finding array + scrub console_errors/recent_requests + sanitise
+    // open_tabs urls + append the rider (counted over the full `findings` set).
+    return { content: [{ type: 'text', text: JSON.stringify(egressContext(context, findings), null, 2) }] };
   });
 }
 
@@ -360,7 +460,10 @@ async function handleVisualDiff({ url, updateBaseline = false, baselineDir }) {
     const baseline   = findings.find(f => f.type === 'visual_baseline_created');
     const summary    = findings.find(f => f.type === 'visual_diff_summary');
 
-    return { content: [{ type: 'text', text: JSON.stringify({
+    // The structured summary is computed from the RAW findings ABOVE, then egressResult
+    // redacts the findings array (cosmetic visual_* findings keep a scrubbed message; any
+    // accidental embedded secret is caught) and appends the rider.
+    return { content: [{ type: 'text', text: JSON.stringify(egressResult({
       findings,
       summary: {
         status:      regression ? 'regression' : baseline ? 'baseline_created' : 'no_change',
@@ -369,7 +472,7 @@ async function handleVisualDiff({ url, updateBaseline = false, baselineDir }) {
         totalPixels: summary?.totalPixels ?? 0,
         severity:    regression?.severity ?? 'info',
       },
-    }, null, 2) }] };
+    }), null, 2) }] };
   });
 }
 
@@ -379,11 +482,11 @@ async function handleDesignAudit({ url, figmaFrameUrl }) {
 
   const figmaData = await getFigmaFrame(figmaFrameUrl);
   if (!figmaData) {
-    return { content: [{ type: 'text', text: JSON.stringify({
+    return { content: [{ type: 'text', text: JSON.stringify(egressResult({
       error: 'Could not fetch Figma data. Ensure FIGMA_API_TOKEN is set and the figmaFrameUrl is valid.',
       findings: [],
       summary: { tokenMismatches: 0, missingComponents: 0, colorMismatches: 0, typographyMismatches: 0, spacingMismatches: 0, radiusMismatches: 0, boundsOverflows: 0, positionDrifts: 0, strokeMismatches: 0, shadowMismatches: 0, opacityMismatches: 0, gapMismatches: 0, textMismatches: 0 },
-    }) }] };
+    })) }] };
   }
 
   return withMcp(async (mcp) => {
@@ -405,7 +508,9 @@ async function handleDesignAudit({ url, figmaFrameUrl }) {
       gapMismatches:        count('design_gap_mismatch'),
       textMismatches:       count('design_text_mismatch'),
     };
-    return { content: [{ type: 'text', text: JSON.stringify({ findings, summary }, null, 2) }] };
+    // Summary counts are computed from the RAW findings above; egressResult then redacts the
+    // findings array (cosmetic design_* findings keep a scrubbed message) + appends the rider.
+    return { content: [{ type: 'text', text: JSON.stringify(egressResult({ findings, summary }), null, 2) }] };
   });
 }
 
@@ -481,7 +586,9 @@ async function handlePrValidate({ prUrl, targetUrl, githubToken, blockOn } = {})
     const routePath = String(route.path ?? '/').startsWith('/') ? route.path : `/${route.path}`;
     const url  = `${baseUrl}${routePath}`;
     const res  = await auditRouteWithRetry(
-      () => handleAudit({ url, critical: route.critical ?? false, analyzers: depthAnalyzers }),
+      // internal:true ⇒ handleAudit returns RAW findings so the block/baseline/novelty/
+      // reporting logic below sees full detail; the MCP RESPONSE is redacted at the return.
+      () => handleAudit({ url, critical: route.critical ?? false, analyzers: depthAnalyzers }, { internal: true }),
       { timeoutMs: routeTimeoutMs, retries: routeRetries, label: `Route audit ${routePath}` },
     );
     const data = JSON.parse(res.content[0].text);
@@ -560,7 +667,10 @@ async function handlePrValidate({ prUrl, targetUrl, githubToken, blockOn } = {})
     reporting = { posted: false, checked: false, skipped: true, reason: `reporting failed: ${err.message}` };
   }
 
-  return { content: [{ type: 'text', text: JSON.stringify({ ...result, reporting }, null, 2) }] };
+  // Egress projection of the MCP response — redacts `result.findings` + appends the rider.
+  // reportPrValidation above already ran on the RAW `result` (the GitHub sink is guarded
+  // separately in Step 6); the block decision / baseline used raw findings too.
+  return { content: [{ type: 'text', text: JSON.stringify(egressResult({ ...result, reporting }), null, 2) }] };
 }
 
 async function handleLastReport() {
@@ -575,7 +685,12 @@ async function handleLastReport() {
     .map(f => ({ f, mt: fs.statSync(path.join(REPORTS_DIR, f)).mtimeMs }))
     .sort((a, b) => b.mt - a.mt)[0].f;
   const json = fs.readFileSync(path.join(REPORTS_DIR, latest), 'utf8');
-  return { content: [{ type: 'text', text: json }] };
+  // The on-disk report keeps full fidelity (raw secrets); when it crosses the MCP boundary
+  // it MUST be redacted (this tool is a direct local-report → agent-context egress path).
+  if (redactOff()) return { content: [{ type: 'text', text: json }] };
+  let parsed;
+  try { parsed = JSON.parse(json); } catch { return { content: [{ type: 'text', text: json }] }; }
+  return { content: [{ type: 'text', text: JSON.stringify(redactReport(parsed), null, 2) }] };
 }
 
 // ── Server bootstrap ──────────────────────────────────────────────────────────
@@ -587,20 +702,32 @@ const server = new Server(
 
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
 
+async function callTool(req) {
+  switch (req.params.name) {
+    case 'argus_audit':       return await handleAudit(req.params.arguments ?? {});
+    case 'argus_audit_full':  return await handleAuditFull(req.params.arguments ?? {});
+    case 'argus_compare':     return await handleCompare();
+    case 'argus_last_report':     return await handleLastReport();
+    case 'argus_watch_snapshot':  return await handleWatchSnapshot(req.params.arguments ?? {});
+    case 'argus_get_context':     return await handleGetContext(req.params.arguments ?? {});
+    case 'argus_visual_diff':     return await handleVisualDiff(req.params.arguments ?? {});
+    case 'argus_design_audit':    return await handleDesignAudit(req.params.arguments ?? {});
+    case 'argus_pr_validate':     return await handlePrValidate(req.params.arguments ?? {});
+    default: throw new Error(`Unknown tool: ${req.params.name}`);
+  }
+}
+
 server.setRequestHandler(CallToolRequestSchema, async (req) => {
   try {
-    switch (req.params.name) {
-      case 'argus_audit':       return await handleAudit(req.params.arguments ?? {});
-      case 'argus_audit_full':  return await handleAuditFull(req.params.arguments ?? {});
-      case 'argus_compare':     return await handleCompare();
-      case 'argus_last_report':     return await handleLastReport();
-      case 'argus_watch_snapshot':  return await handleWatchSnapshot(req.params.arguments ?? {});
-      case 'argus_get_context':     return await handleGetContext(req.params.arguments ?? {});
-      case 'argus_visual_diff':     return await handleVisualDiff(req.params.arguments ?? {});
-      case 'argus_design_audit':    return await handleDesignAudit(req.params.arguments ?? {});
-      case 'argus_pr_validate':     return await handlePrValidate(req.params.arguments ?? {});
-      default: throw new Error(`Unknown tool: ${req.params.name}`);
-    }
+    const result = await callTool(req);
+    // Aegis team-vault flush (AEGIS_FOR_TEAMS §9): if this response was projected in
+    // `token` mode under an active team vault, ship the buffered token→secret mappings
+    // to the org's central vault so a token that just crossed to the agent can later be
+    // re-hydrated through the authorized RBAC flow. Best-effort + inert without a gov
+    // token + team-vault URL (byte-identical default); never throws, never leaks (the
+    // emitted tokens are information-free).
+    await flushTeamVault();
+    return result;
   } catch (err) {
     return {
       content: [{ type: 'text', text: JSON.stringify({ error: err.message }) }],

package/src/orchestration/dispatcher.js

@@ -13,6 +13,7 @@ import { postBugReport }                          from './slack-notifier.js';
 import { isSlackConfigured }                      from '../utils/slack-guard.js';
 import { isGitHubConfigured, reportToGitHub }     from '../utils/github-reporter.js';
 import { generateHtmlReport }                     from '../utils/html-reporter.js';
+import { redactForEgress, summarizeRedaction }    from '../utils/sensitivity-classifier.js';
 
 const logger = childLogger('dispatcher');
 
@@ -57,6 +58,30 @@ function errorText(e) {
  * Info       → single digest message summarising all routes
  */
 async function dispatchToSlack(report, diff) {
+  // ── Aegis egress guard (Step 5) ───────────────────────────────────────────
+  // Slack is a third-party sink outside the trust boundary (a shared channel, A2).
+  // Project EVERY finding through redactForEgress before any description / details
+  // line is built, so no secret / PII / exploit detail crosses: a sensitive finding's
+  // line collapses to the 🔒 marker (its message becomes REDACT_MARKER), a benign
+  // finding keeps its mandatory-scrubbed message. The LOCAL on-disk report is untouched
+  // (this rebinds the local `report` param to a redacted CLONE). ARGUS_REDACT_SENSITIVE=0
+  // ⇒ byte-identical passthrough (redactForEgress returns the same objects).
+  let redactedCount = 0;
+  if (process.env.ARGUS_REDACT_SENSITIVE !== '0') {
+    const rawFindings = [
+      ...report.routes.flatMap(r => r.errors ?? []),
+      ...(report.flows ?? []).flatMap(f => f.findings ?? []),
+      ...(report.codebase ?? []),
+    ];
+    redactedCount = summarizeRedaction(rawFindings).redacted;
+    report = {
+      ...report,
+      routes:   report.routes.map(r => ({ ...r, errors: redactForEgress(r.errors ?? []) })),
+      flows:    (report.flows ?? []).map(f => ({ ...f, findings: redactForEgress(f.findings ?? []) })),
+      codebase: redactForEgress(report.codebase ?? []),
+    };
+  }
+
   const { summary } = report;
 
   // ── Criticals: one message per affected route ─────────────────────────────
@@ -218,6 +243,9 @@ async function dispatchToSlack(report, diff) {
       description:
         `Summary: ${summary.total} findings across ${report.routes.length} routes\n` +
         `:red_circle: ${summary.critical} critical  :large_yellow_circle: ${summary.warning} warnings  :large_blue_circle: ${summary.info} info\n` +
+        (redactedCount > 0
+          ? `:lock: ${redactedCount} sensitive finding(s) redacted at the boundary — full detail in the local report\n`
+          : '') +
         (trendLine ? trendLine + '\n' : '') + '\n' +
         (digestLines.length > 0 ? digestLines.join('\n') : '_No info-level findings._'),
       url: report.baseUrl,