defense-mcp-server 0.9.1 → 0.9.3

package/build/core/auto-installer.js

@@ -275,7 +275,7 @@ function verifyInstalledBinary(binary) {
             stdio: ["pipe", "pipe", "pipe"],
         });
         if (!pattern.test(stdout ?? "")) {
-            console.error(`[auto-installer] ⚠️  Installed '${binary}' but --version output doesn't match ` +
+            console.error(`[auto-installer] WARNING: Installed '${binary}' but --version output doesn't match ` +
                 `expected pattern /${pattern.source}/. The package may be a name collision, not the security tool.`);
             return false;
         }
@@ -283,7 +283,7 @@ function verifyInstalledBinary(binary) {
     }
     catch {
         // Can't verify — warn but don't block
-        console.error(`[auto-installer] ⚠️  Could not verify '${binary}' identity via --version (non-fatal)`);
+        console.error(`[auto-installer] WARNING: Could not verify '${binary}' identity via --version (non-fatal)`);
         return false;
     }
 }
@@ -319,7 +319,7 @@ export class AutoInstaller {
             AutoInstaller._instance = new AutoInstaller();
             // Fix E: Warn when auto-install is enabled
             if (AutoInstaller._instance.isEnabled()) {
-                console.error("[auto-install] ⚠ Auto-installation is ENABLED. Packages will be installed with sudo when missing dependencies are detected.");
+                console.error("[auto-install] WARNING: Auto-installation is ENABLED. Packages will be installed with sudo when missing dependencies are detected.");
             }
         }
         return AutoInstaller._instance;
@@ -457,7 +457,7 @@ export class AutoInstaller {
         const toolReq = lookup.get(binary);
         if (!toolReq) {
             // Binary not in approved package list — refuse to install
-            console.error(`[auto-install] ⚠ Binary "${binary}" not in approved package list — skipping auto-install`);
+            console.error(`[auto-install] WARNING: Binary "${binary}" not in approved package list — skipping auto-install`);
             return {
                 dependency: binary,
                 type: "binary",
@@ -496,7 +496,7 @@ export class AutoInstaller {
             }
             // Third-party install not enabled — return verified instructions (NOT curl|sh hints)
             const instructions = getVerifiedInstallInstructions(binary);
-            console.error(`[auto-install] ⚠ Binary "${binary}" requires third-party installation (not in standard repos).\n` +
+            console.error(`[auto-install] WARNING: Binary "${binary}" requires third-party installation (not in standard repos).\n` +
                 `  Set DEFENSE_MCP_THIRD_PARTY_INSTALL=true to enable verified auto-install.`);
             return {
                 dependency: binary,
@@ -511,7 +511,7 @@ export class AutoInstaller {
         }
         // Check if this is a package-only dependency (e.g. PAM module, not a binary)
         if (toolReq.isPackageOnly) {
-            console.error(`[auto-install] ℹ "${binary}" is a package-only dependency (e.g. PAM module), not a standalone binary. ` +
+            console.error(`[auto-install] INFO: "${binary}" is a package-only dependency (e.g. PAM module), not a standalone binary. ` +
                 `Will attempt to install the package "${toolReq.packages.debian ?? toolReq.packages.fallback}".`);
         }
         // Check for package conflicts (e.g. ufw vs iptables-persistent)
@@ -519,7 +519,7 @@ export class AutoInstaller {
             for (const conflictPkg of toolReq.conflictsWith) {
                 const checkResult = execSimple("dpkg", ["-l", conflictPkg], { timeoutMs: 10_000 });
                 if (checkResult.success && checkResult.stdout.includes("ii")) {
-                    console.error(`[auto-install] ⚠ CONFLICT: Cannot install "${binary}" — conflicting package "${conflictPkg}" is already installed. ` +
+                    console.error(`[auto-install] WARNING: CONFLICT: Cannot install "${binary}" — conflicting package "${conflictPkg}" is already installed. ` +
                         `${toolReq.availabilityNote ?? ""}`);
                     return {
                         dependency: binary,
@@ -538,7 +538,7 @@ export class AutoInstaller {
             toolReq.packages.fallback ??
             "";
         if (!packageName) {
-            console.error(`[auto-install] ⚠ No package mapping for binary "${binary}" on ${distro.family} — skipping`);
+            console.error(`[auto-install] WARNING: No package mapping for binary "${binary}" on ${distro.family} — skipping`);
             return {
                 dependency: binary,
                 type: "binary",
@@ -550,7 +550,7 @@ export class AutoInstaller {
         }
         // Validate package name for safe characters
         if (!validatePackageName(packageName)) {
-            console.error(`[auto-install] ⚠ Invalid package name "${packageName}" for binary "${binary}" — skipping`);
+            console.error(`[auto-install] WARNING: Invalid package name "${packageName}" for binary "${binary}" — skipping`);
             return {
                 dependency: binary,
                 type: "binary",
@@ -562,7 +562,7 @@ export class AutoInstaller {
         }
         // Verify package is in the approved allowlist
         if (!getApprovedPackages().has(packageName)) {
-            console.error(`[auto-install] ⚠ Package "${packageName}" not in approved allowlist — skipping`);
+            console.error(`[auto-install] WARNING: Package "${packageName}" not in approved allowlist — skipping`);
             return {
                 dependency: binary,
                 type: "binary",
@@ -589,7 +589,7 @@ export class AutoInstaller {
         const useSudo = distro.packageManager !== "brew";
         const result = execWithSudo(installArgs, { useSudo, timeoutMs: 300_000 });
         if (!result.success) {
-            console.error(`[auto-installer] ✗ Failed to install '${binary}' (package: ${packageName}): ${result.stderr.slice(0, 200)}`);
+            console.error(`[auto-installer] FAIL Failed to install '${binary}' (package: ${packageName}): ${result.stderr.slice(0, 200)}`);
             return {
                 dependency: binary,
                 type: "binary",
@@ -606,13 +606,13 @@ export class AutoInstaller {
         if (installed) {
             const verified = verifyInstalledBinary(binary);
             if (!verified) {
-                console.error(`[auto-installer] ⚠️  Binary '${binary}' installed but identity verification failed. ` +
+                console.error(`[auto-installer] WARNING: Binary '${binary}' installed but identity verification failed. ` +
                     `The package may be a name collision (not the expected security tool). ` +
                     `Trivy, Grype, Syft, and Cosign require third-party repositories.`);
             }
         }
         if (installed) {
-            console.error(`[auto-installer] ✓ Installed '${binary}' via ${distro.packageManager} (${elapsed}s)`);
+            console.error(`[auto-installer] OK Installed '${binary}' via ${distro.packageManager} (${elapsed}s)`);
             // Log successful installation to the audit changelog
             logChange(createChangeEntry({
                 tool: "auto-installer",
@@ -625,7 +625,7 @@ export class AutoInstaller {
             }));
         }
         else {
-            console.error(`[auto-installer] ⚠ Package '${packageName}' installed but binary '${binary}' not found in PATH`);
+            console.error(`[auto-installer] WARNING: Package '${packageName}' installed but binary '${binary}' not found in PATH`);
         }
         return {
             dependency: binary,
@@ -651,7 +651,7 @@ export class AutoInstaller {
         // Determine pip command
         const pip = binaryAvailable("pip3") ? "pip3" : binaryAvailable("pip") ? "pip" : null;
         if (!pip) {
-            console.error(`[auto-installer] ✗ Cannot install Python module '${module}': pip not found`);
+            console.error(`[auto-installer] FAIL Cannot install Python module '${module}': pip not found`);
             return {
                 dependency: module,
                 type: "python-module",
@@ -663,7 +663,7 @@ export class AutoInstaller {
         }
         // Validate module name for safe characters
         if (!validateModuleName(module)) {
-            console.error(`[auto-install] ⚠ Invalid Python module name "${module}" — skipping`);
+            console.error(`[auto-install] WARNING: Invalid Python module name "${module}" — skipping`);
             return {
                 dependency: module,
                 type: "python-module",
@@ -675,7 +675,7 @@ export class AutoInstaller {
         }
         // SECURITY (CORE-008): Verify pip package is in the allowed packages list
         if (!ALLOWED_PIP_PACKAGES.has(module)) {
-            console.error(`[auto-install] ⚠ REJECTED: pip package "${module}" is not in the allowed packages list`);
+            console.error(`[auto-install] WARNING: REJECTED: pip package "${module}" is not in the allowed packages list`);
             return {
                 dependency: module,
                 type: "python-module",
@@ -694,7 +694,7 @@ export class AutoInstaller {
             result = execWithSudo([pip, "install", module], { timeoutMs: 120_000 });
         }
         if (!result.success) {
-            console.error(`[auto-installer] ✗ Failed to install Python module '${module}': ${result.stderr.slice(0, 200)}`);
+            console.error(`[auto-installer] FAIL Failed to install Python module '${module}': ${result.stderr.slice(0, 200)}`);
             return {
                 dependency: module,
                 type: "python-module",
@@ -710,7 +710,7 @@ export class AutoInstaller {
         const verifyResult = execSimple(python, ["-c", `import ${importName}`], { timeoutMs: 10_000 });
         const elapsed = ((Date.now() - start) / 1000).toFixed(1);
         if (verifyResult.success) {
-            console.error(`[auto-installer] ✓ Installed Python module '${module}' (${elapsed}s)`);
+            console.error(`[auto-installer] OK Installed Python module '${module}' (${elapsed}s)`);
             // Log successful installation to the audit changelog
             logChange(createChangeEntry({
                 tool: "auto-installer",
@@ -723,7 +723,7 @@ export class AutoInstaller {
             }));
         }
         else {
-            console.error(`[auto-installer] ⚠ pip install succeeded for '${module}' but import verification failed`);
+            console.error(`[auto-installer] WARNING: pip install succeeded for '${module}' but import verification failed`);
         }
         return {
             dependency: module,
@@ -746,7 +746,7 @@ export class AutoInstaller {
     async installNpmPackage(pkg) {
         const start = Date.now();
         if (!binaryAvailable("npm")) {
-            console.error(`[auto-installer] ✗ Cannot install npm package '${pkg}': npm not found`);
+            console.error(`[auto-installer] FAIL Cannot install npm package '${pkg}': npm not found`);
             return {
                 dependency: pkg,
                 type: "npm-package",
@@ -758,7 +758,7 @@ export class AutoInstaller {
         }
         // Validate npm package name for safe characters
         if (!validateModuleName(pkg)) {
-            console.error(`[auto-install] ⚠ Invalid npm package name "${pkg}" — skipping`);
+            console.error(`[auto-install] WARNING: Invalid npm package name "${pkg}" — skipping`);
             return {
                 dependency: pkg,
                 type: "npm-package",
@@ -770,7 +770,7 @@ export class AutoInstaller {
         }
         // SECURITY (CORE-008): Verify npm package is in the allowed packages list
         if (!ALLOWED_NPM_PACKAGES.has(pkg)) {
-            console.error(`[auto-install] ⚠ REJECTED: npm package "${pkg}" is not in the allowed packages list`);
+            console.error(`[auto-install] WARNING: REJECTED: npm package "${pkg}" is not in the allowed packages list`);
             return {
                 dependency: pkg,
                 type: "npm-package",
@@ -790,7 +790,7 @@ export class AutoInstaller {
         }
         const elapsed = ((Date.now() - start) / 1000).toFixed(1);
         if (!result.success) {
-            console.error(`[auto-installer] ✗ Failed to install npm package '${pkg}': ${result.stderr.slice(0, 200)}`);
+            console.error(`[auto-installer] FAIL Failed to install npm package '${pkg}': ${result.stderr.slice(0, 200)}`);
             return {
                 dependency: pkg,
                 type: "npm-package",
@@ -803,11 +803,11 @@ export class AutoInstaller {
         // Verify — many npm packages provide a binary with the same name
         const installed = binaryAvailable(pkg);
         if (installed) {
-            console.error(`[auto-installer] ✓ Installed npm package '${pkg}' (${elapsed}s)`);
+            console.error(`[auto-installer] OK Installed npm package '${pkg}' (${elapsed}s)`);
         }
         else {
             // Package installed but binary might have a different name
-            console.error(`[auto-installer] ✓ npm package '${pkg}' installed (binary may differ from package name)`);
+            console.error(`[auto-installer] OK npm package '${pkg}' installed (binary may differ from package name)`);
         }
         // Log successful npm installation to the audit changelog
         logChange(createChangeEntry({
@@ -860,7 +860,7 @@ export class AutoInstaller {
         for (const candidate of candidates) {
             // Validate candidate package name for safe characters
             if (!validatePackageName(candidate)) {
-                console.error(`[auto-install] ⚠ Invalid library package name "${candidate}" — skipping candidate`);
+                console.error(`[auto-install] WARNING: Invalid library package name "${candidate}" — skipping candidate`);
                 continue;
             }
             const installArgs = getInstallArgs(distro.packageManager, candidate);
@@ -870,7 +870,7 @@ export class AutoInstaller {
             const result = execWithSudo(installArgs, { useSudo, timeoutMs: 120_000 });
             if (result.success) {
                 installed = true;
-                console.error(`[auto-installer] ✓ Installed library '${lib}' (package: ${candidate})`);
+                console.error(`[auto-installer] OK Installed library '${lib}' (package: ${candidate})`);
                 // Log successful library installation to the audit changelog
                 logChange(createChangeEntry({
                     tool: "auto-installer",
@@ -886,7 +886,7 @@ export class AutoInstaller {
             lastError = result.stderr.slice(0, 200);
         }
         if (!installed) {
-            console.error(`[auto-installer] ✗ Failed to install library '${lib}': ${lastError}`);
+            console.error(`[auto-installer] FAIL Failed to install library '${lib}': ${lastError}`);
             return {
                 dependency: lib,
                 type: "library",
@@ -900,10 +900,10 @@ export class AutoInstaller {
         const verified = this.verifyLibrary(lib);
         const elapsed = ((Date.now() - start) / 1000).toFixed(1);
         if (verified) {
-            console.error(`[auto-installer] ✓ Library '${lib}' verified (${elapsed}s)`);
+            console.error(`[auto-installer] OK Library '${lib}' verified (${elapsed}s)`);
         }
         else {
-            console.error(`[auto-installer] ⚠ Library package installed but '${lib}' not found via ldconfig/pkg-config`);
+            console.error(`[auto-installer] WARNING: Library package installed but '${lib}' not found via ldconfig/pkg-config`);
         }
         return {
             dependency: lib,

package/build/core/command-allowlist.js

@@ -880,7 +880,7 @@ export async function verifyAllBinaries() {
         }
         else {
             warnings++;
-            console.error(`[binary-integrity] ⚠ ${result.message}`);
+            console.error(`[binary-integrity] WARNING: ${result.message}`);
         }
     }
     console.error(`[binary-integrity] Checked ${results.length} critical binaries: ` +

package/build/core/config.d.ts

@@ -59,6 +59,22 @@ export interface DefenseConfig {
     commandTimeout: number;
     /** Network operation timeout in ms (default: 30s; env: DEFENSE_MCP_NETWORK_TIMEOUT) */
     networkTimeout: number;
+    /**
+     * SECURITY: Redact sensitive data (passwords, tokens, keys) from command
+     * output before returning to the LLM. Defaults to `true`.
+     * Env: DEFENSE_MCP_REDACT_OUTPUT (set to "false" to disable)
+     */
+    redactOutput: boolean;
+    /**
+     * When true, only register tools with readOnlyHint: true annotations.
+     * Env: DEFENSE_MCP_READ_ONLY (default: false)
+     */
+    readOnly: boolean;
+    /**
+     * Comma-separated list of tool names to register. Empty means all tools.
+     * Env: DEFENSE_MCP_ALLOWED_TOOLS (default: "")
+     */
+    allowedTools: string[];
 }
 /**
  * Returns the current configuration by reading environment variables.

package/build/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,eAAO,MAAM,WAAW,iKAed,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB;IACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C;;;;;OAKG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,WAAW,EAAE,OAAO,CAAC;IACrB,wCAAwC;IACxC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;CACxB;AAmGD;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAQzC;AAwFD;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAIR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAkBR"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,eAAO,MAAM,WAAW,iKAed,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB;IACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C;;;;;OAKG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,WAAW,EAAE,OAAO,CAAC;IACrB,wCAAwC;IACxC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAmGD;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAQzC;AA8FD;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAIR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAkBR"}

package/build/core/config.js

@@ -168,6 +168,12 @@ function buildConfigFromEnv() {
             const sec = parseInt(process.env.DEFENSE_MCP_NETWORK_TIMEOUT ?? "30", 10);
             return isNaN(sec) || sec <= 0 ? 30_000 : sec * 1000;
         })(),
+        redactOutput: process.env.DEFENSE_MCP_REDACT_OUTPUT !== "false",
+        readOnly: process.env.DEFENSE_MCP_READ_ONLY === "true",
+        allowedTools: (() => {
+            const raw = process.env.DEFENSE_MCP_ALLOWED_TOOLS ?? "";
+            return raw.split(",").map(s => s.trim()).filter(s => s.length > 0);
+        })(),
     };
     // Warn when dry-run is active so operators know no changes will be applied
     if (config.dryRun) {

package/build/core/dependency-validator.js

@@ -162,7 +162,7 @@ export async function validateAllDependencies() {
                 if (recheck.available) {
                     installed.push(binary);
                     available.push(binary);
-                    console.error(`[dep-validator] ✅ Installed: ${binary}`);
+                    console.error(`[dep-validator] Installed: ${binary}`);
                 }
                 else {
                     missing.push(binary);
@@ -170,7 +170,7 @@ export async function validateAllDependencies() {
                         binary,
                         error: "Package installed but binary not found in PATH",
                     });
-                    console.error(`[dep-validator] ⚠️ Package installed but binary '${binary}' not found`);
+                    console.error(`[dep-validator] WARNING: Package installed but binary '${binary}' not found`);
                 }
             }
             else {
@@ -179,7 +179,7 @@ export async function validateAllDependencies() {
                     binary,
                     error: result?.message ?? "No package mapping found",
                 });
-                console.error(`[dep-validator] ❌ Failed to install: ${binary}`);
+                console.error(`[dep-validator] Failed to install: ${binary}`);
             }
         }
     }
@@ -212,7 +212,7 @@ export async function validateAllDependencies() {
         (installed.length > 0 ? `, ${installed.length} auto-installed` : "") +
         (installFailed.length > 0 ? `, ${installFailed.length} install failures` : ""));
     if (criticalMissing.length > 0) {
-        console.error(`[dep-validator] ⚠️ CRITICAL: ${criticalMissing.length} critical tools have missing dependencies:`);
+        console.error(`[dep-validator] WARNING: CRITICAL: ${criticalMissing.length} critical tools have missing dependencies:`);
         for (const cm of criticalMissing) {
             console.error(`[dep-validator]   - ${cm.toolName}: needs ${cm.missingBinaries.join(", ")}`);
         }
@@ -340,13 +340,13 @@ export function formatValidationReport(report) {
     if (report.installed.length > 0) {
         lines.push(`  Auto-installed:      ${report.installed.length}`);
         for (const bin of report.installed) {
-            lines.push(`    ✅ ${bin}`);
+            lines.push(`    PASS: ${bin}`);
         }
     }
     if (report.installFailed.length > 0) {
         lines.push(`  Install failures:    ${report.installFailed.length}`);
         for (const fail of report.installFailed) {
-            lines.push(`    ❌ ${fail.binary}: ${fail.error}`);
+            lines.push(`    ${fail.binary}: ${fail.error}`);
         }
     }
     if (report.missing.length > 0) {
@@ -360,15 +360,15 @@ export function formatValidationReport(report) {
     }
     if (report.criticalMissing.length > 0) {
         lines.push("");
-        lines.push("  ⚠️  CRITICAL tools with missing dependencies:");
+        lines.push("  WARNING: CRITICAL tools with missing dependencies:");
         for (const cm of report.criticalMissing) {
-            lines.push(`    ⛔ ${cm.toolName}: needs ${cm.missingBinaries.join(", ")}`);
+            lines.push(`    CRITICAL: ${cm.toolName}: needs ${cm.missingBinaries.join(", ")}`);
         }
     }
     lines.push("");
     lines.push(`  Auto-install: ${report.autoInstallEnabled ? "ENABLED" : "DISABLED"}`);
     if (!report.autoInstallEnabled && report.missing.length > 0) {
-        lines.push("  💡 Set DEFENSE_MCP_AUTO_INSTALL=true to auto-install missing tools");
+        lines.push("  Set DEFENSE_MCP_AUTO_INSTALL=true to auto-install missing tools");
     }
     lines.push(`  Duration: ${report.durationMs}ms`);
     return lines.join("\n");

package/build/core/distro-adapter.d.ts

@@ -169,9 +169,4 @@ export declare class DistroAdapter {
  * Subsequent calls return the cached instance.
  */
 export declare function getDistroAdapter(): Promise<DistroAdapter>;
-/**
- * Returns the cached adapter if already initialized, or null.
- * Use when you can't await (synchronous contexts).
- */
-export declare function getDistroAdapterSync(): DistroAdapter | null;
 //# sourceMappingURL=distro-adapter.d.ts.map

package/build/core/distro-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distro-adapter.d.ts","sourceRoot":"","sources":["../../src/core/distro-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC7B,MAAM,aAAa,CAAC;AAIrB,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+BAA+B;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,yBAAyB,EAAE,MAAM,CAAC;IAClC,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8CAA8C;IAC9C,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC3C,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,SAAS,EAAE,OAAO,CAAC;IACnB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,sDAAsD;IACtD,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC3C,8BAA8B;IAC9B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iCAAiC;IACjC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACxC,+BAA+B;IAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,+CAA+C;IAC/C,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC1C,qCAAqC;IACrC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wCAAwC;IACxC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,qCAAqC;AACrC,MAAM,WAAW,yBAAyB;IACxC,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,8CAA8C;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,yBAAyB;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8BAA8B;IAC9B,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC;IACrC,QAAQ,CAAC,EAAE,EAAE,uBAAuB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAGhD,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,sBAAsB,EAC3B,GAAG,EAAE,sBAAsB,EAC3B,EAAE,EAAE,uBAAuB;IAa7B,0DAA0D;IAC1D,IAAI,OAAO,IAAI,MAAM,CAMpB;IAED,iDAAiD;IACjD,IAAI,QAAQ,IAAI,OAAO,CAA4C;IAEnE,+CAA+C;IAC/C,IAAI,MAAM,IAAI,OAAO,CAA0C;IAE/D,+CAA+C;IAC/C,IAAI,MAAM,IAAI,OAAO,CAA0C;IAE/D,+CAA+C;IAC/C,IAAI,MAAM,IAAI,OAAO,CAA0C;IAE/D,2CAA2C;IAC3C,IAAI,QAAQ,IAAI,OAAO,CAA4C;IAEnE,oFAAoF;IACpF,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE;IAK5D,mFAAmF;IACnF,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE;CAI5D;AA0ZD;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAa/D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,GAAG,IAAI,CAE3D"}
+{"version":3,"file":"distro-adapter.d.ts","sourceRoot":"","sources":["../../src/core/distro-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC7B,MAAM,aAAa,CAAC;AAIrB,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+BAA+B;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,yBAAyB,EAAE,MAAM,CAAC;IAClC,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8CAA8C;IAC9C,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC3C,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,SAAS,EAAE,OAAO,CAAC;IACnB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,sDAAsD;IACtD,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC3C,8BAA8B;IAC9B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gCAAgC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iCAAiC;IACjC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACxC,+BAA+B;IAC/B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,+CAA+C;IAC/C,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IAC1C,qCAAqC;IACrC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wCAAwC;IACxC,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,qCAAqC;AACrC,MAAM,WAAW,yBAAyB;IACxC,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,8CAA8C;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,yBAAyB;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8BAA8B;IAC9B,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC;IACrC,QAAQ,CAAC,EAAE,EAAE,uBAAuB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC;gBAGhD,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,sBAAsB,EAC3B,GAAG,EAAE,sBAAsB,EAC3B,EAAE,EAAE,uBAAuB;IAa7B,0DAA0D;IAC1D,IAAI,OAAO,IAAI,MAAM,CAMpB;IAED,iDAAiD;IACjD,IAAI,QAAQ,IAAI,OAAO,CAA4C;IAEnE,+CAA+C;IAC/C,IAAI,MAAM,IAAI,OAAO,CAA0C;IAE/D,+CAA+C;IAC/C,IAAI,MAAM,IAAI,OAAO,CAA0C;IAE/D,+CAA+C;IAC/C,IAAI,MAAM,IAAI,OAAO,CAA0C;IAE/D,2CAA2C;IAC3C,IAAI,QAAQ,IAAI,OAAO,CAA4C;IAEnE,oFAAoF;IACpF,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE;IAK5D,mFAAmF;IACnF,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE;CAI5D;AA0ZD;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAa/D"}

package/build/core/distro-adapter.js

@@ -472,10 +472,3 @@ export async function getDistroAdapter() {
     console.error(`[distro-adapter] Initialized: ${cachedAdapter.summary}`);
     return cachedAdapter;
 }
-/**
- * Returns the cached adapter if already initialized, or null.
- * Use when you can't await (synchronous contexts).
- */
-export function getDistroAdapterSync() {
-    return cachedAdapter;
-}

package/build/core/distro.d.ts

@@ -8,8 +8,6 @@ export type DistroFamily = "debian" | "rhel" | "arch" | "alpine" | "suse" | "unk
 export type SpecificDistro = "debian" | "ubuntu" | "kali" | "fedora" | "rhel" | "centos" | "arch" | "alpine" | "opensuse" | "macos" | "unknown";
 /** Package manager identifiers (extended with brew). */
 export type PackageManagerName = "apt" | "dnf" | "yum" | "pacman" | "brew" | "apk" | "zypper" | "unknown";
-/** @deprecated Use PackageManagerName. Kept for backwards compatibility. */
-export type PackageManager = PackageManagerName;
 export type InitSystem = "systemd" | "openrc" | "launchd" | "sysvinit" | "unknown";
 export interface PackageManagerCommands {
     installCmd(pkg: string): string[];
@@ -52,15 +50,6 @@ export declare function detectDistro(): Promise<DistroInfo>;
 export declare function getPackageManager(nameOrDistro?: string): PackageManagerCommands;
 export declare function getServiceManager(initSystem?: InitSystem): ServiceManagerCommands;
 export declare function getFirewallBackend(): Promise<FirewallBackendCommands>;
-export declare function canUseAppArmor(): Promise<boolean>;
-export declare function canUseSELinux(): Promise<boolean>;
-export declare function canUseAuditd(): Promise<boolean>;
-export declare function canUseSystemd(): Promise<boolean>;
-export declare function canUseIPTables(): Promise<boolean>;
-export declare function canUseNFTables(): Promise<boolean>;
-export declare function canUseBPF(): Promise<boolean>;
-export declare function hasTPM(): Promise<boolean>;
-export declare function hasSecureBoot(): Promise<boolean>;
 /** @deprecated Prefer getPackageManager(pkgManager).installCmd(pkg) */
 export declare function getInstallCommand(pkgManager: PackageManagerName, pkg: string): string[];
 /** @deprecated Prefer getPackageManager(pkgManager).updateCmd() */

package/build/core/distro.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distro.d.ts","sourceRoot":"","sources":["../../src/core/distro.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAIlD,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,SAAS,CAAC;AAId,MAAM,MAAM,cAAc,GACtB,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAC3D,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAIzD,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAC1B,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7E,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAIhD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAInF,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,SAAS,IAAI,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,gBAAgB,IAAI,MAAM,EAAE,CAAC;CAC9B;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,eAAe,IAAI,MAAM,EAAE,CAAC;CAC7B;AAID,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;AAErE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChD,OAAO,IAAI,MAAM,EAAE,CAAC;IACpB,QAAQ,IAAI,MAAM,EAAE,CAAC;CACtB;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,kBAAkB,CAAC;IACnC,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAgFD,wBAAsB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,CAmHxD;AAID,wBAAgB,iBAAiB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,sBAAsB,CA4D/E;AA4BD,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,sBAAsB,CAoCjF;AAmDD,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAc3E;AAYD,wBAAsB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAEvD;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAEtD;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAErD;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAEtD;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAEvD;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAEvD;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAElD;AAED,wBAAsB,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAE/C;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAKtD;AAID,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvF;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAEzE"}
+{"version":3,"file":"distro.d.ts","sourceRoot":"","sources":["../../src/core/distro.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAIlD,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,SAAS,CAAC;AAId,MAAM,MAAM,cAAc,GACtB,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAC3D,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAIzD,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAC1B,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAK7E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAInF,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,SAAS,IAAI,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,gBAAgB,IAAI,MAAM,EAAE,CAAC;CAC9B;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,eAAe,IAAI,MAAM,EAAE,CAAC;CAC7B;AAID,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;AAErE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChD,OAAO,IAAI,MAAM,EAAE,CAAC;IACpB,QAAQ,IAAI,MAAM,EAAE,CAAC;CACtB;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,kBAAkB,CAAC;IACnC,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAgFD,wBAAsB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,CAmHxD;AAID,wBAAgB,iBAAiB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,sBAAsB,CA4D/E;AA4BD,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,sBAAsB,CAoCjF;AAmDD,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAc3E;AAID,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvF;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAEzE"}

package/build/core/distro.js

@@ -398,54 +398,6 @@ export async function getFirewallBackend() {
         return buildFirewallBackend("pf");
     return buildFirewallBackend("unknown");
 }
-// ── Capability detection ─────────────────────────────────────────────────────
-async function safeCap(fn) {
-    try {
-        return await fn();
-    }
-    catch {
-        return false;
-    }
-}
-async function fileReadable(path) {
-    try {
-        await readFile(path, "utf-8");
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function canUseAppArmor() {
-    return safeCap(async () => (await binaryExists("apparmor_status")) || (await fileReadable("/sys/kernel/security/apparmor")));
-}
-export async function canUseSELinux() {
-    return safeCap(async () => (await binaryExists("getenforce")) || (await fileReadable("/sys/fs/selinux")));
-}
-export async function canUseAuditd() {
-    return safeCap(() => binaryExists("auditctl"));
-}
-export async function canUseSystemd() {
-    return safeCap(async () => existsSync("/run/systemd/system"));
-}
-export async function canUseIPTables() {
-    return safeCap(() => binaryExists("iptables"));
-}
-export async function canUseNFTables() {
-    return safeCap(() => binaryExists("nft"));
-}
-export async function canUseBPF() {
-    return safeCap(async () => (await binaryExists("bpftool")) || existsSync("/sys/fs/bpf"));
-}
-export async function hasTPM() {
-    return safeCap(async () => existsSync("/dev/tpm0") || existsSync("/dev/tpmrm0"));
-}
-export async function hasSecureBoot() {
-    return safeCap(async () => {
-        const r = await executeCommand({ toolName: "_internal", command: "mokutil", args: ["--sb-state"], timeout: 5000 });
-        return r.exitCode === 0 && r.stdout.toLowerCase().includes("secureboot enabled");
-    });
-}
 // ── Legacy helpers (backwards compatibility) ─────────────────────────────────
 /** @deprecated Prefer getPackageManager(pkgManager).installCmd(pkg) */
 export function getInstallCommand(pkgManager, pkg) {

package/build/core/encrypted-state.d.ts

@@ -66,11 +66,4 @@ export declare class SecureStateStore {
      */
     private decrypt;
 }
-/**
- * Default singleton SecureStateStore instance.
- *
- * Uses the default state directory and reads the encryption key from
- * the `DEFENSE_MCP_STATE_KEY` environment variable.
- */
-export declare const secureState: SecureStateStore;
 //# sourceMappingURL=encrypted-state.d.ts.map

package/build/core/encrypted-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encrypted-state.d.ts","sourceRoot":"","sources":["../../src/core/encrypted-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA4DH;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IAEvC;;;;OAIG;gBACS,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAwB9C;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;OAKG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAmBpC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiB/B;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAcxB,+CAA+C;IAC/C,OAAO,CAAC,QAAQ;IAMhB,iEAAiE;IACjE,OAAO,CAAC,cAAc;IAOtB,wDAAwD;IACxD,OAAO,CAAC,SAAS;IAajB;;;OAGG;IACH,OAAO,CAAC,OAAO;IAgBf;;;OAGG;IACH,OAAO,CAAC,OAAO;CAoChB;AAID;;;;;GAKG;AACH,eAAO,MAAM,WAAW,kBAAyB,CAAC"}
+{"version":3,"file":"encrypted-state.d.ts","sourceRoot":"","sources":["../../src/core/encrypted-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA4DH;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IAEvC;;;;OAIG;gBACS,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAwB9C;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;OAKG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAmBpC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiB/B;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAcxB,+CAA+C;IAC/C,OAAO,CAAC,QAAQ;IAMhB,iEAAiE;IACjE,OAAO,CAAC,cAAc;IAOtB,wDAAwD;IACxD,OAAO,CAAC,SAAS;IAajB;;;OAGG;IACH,OAAO,CAAC,OAAO;IAgBf;;;OAGG;IACH,OAAO,CAAC,OAAO;CAoChB"}

package/build/core/encrypted-state.js

@@ -200,10 +200,3 @@ export class SecureStateStore {
     }
 }
 // ── Singleton Export ─────────────────────────────────────────────────────────
-/**
- * Default singleton SecureStateStore instance.
- *
- * Uses the default state directory and reads the encryption key from
- * the `DEFENSE_MCP_STATE_KEY` environment variable.
- */
-export const secureState = new SecureStateStore();

package/build/core/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/core/executor.ts"],"names":[],"mappings":"AAkFA;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AA0FD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqOxB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/core/executor.ts"],"names":[],"mappings":"AAmFA;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AA0FD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAoPxB"}

package/build/core/executor.js

@@ -6,6 +6,7 @@ import { getConfig, getToolTimeout } from "./config.js";
 import { SudoSession } from "./sudo-session.js";
 import { SudoGuard } from "./sudo-guard.js";
 import { resolveCommand, resolveSudoCommand } from "./command-allowlist.js";
+import { redactOutput } from "./output-redactor.js";
 // ── Askpass helper detection ─────────────────────────────────────────────────
 /**
  * Ordered list of known graphical sudo/SSH askpass helpers.
@@ -328,6 +329,18 @@ export async function executeCommand(options) {
             const exitCode = timedOut ? 124 : (code ?? 1);
             let stdout = Buffer.concat(stdoutChunks).toString("utf-8");
             let stderr = Buffer.concat(stderrChunks).toString("utf-8");
+            // ── Output sanitization: redact credentials before returning to LLM ──
+            if (getConfig().redactOutput) {
+                const stdoutR = redactOutput(stdout);
+                const stderrR = redactOutput(stderr);
+                stdout = stdoutR.text;
+                stderr = stderrR.text;
+                const total = stdoutR.redactionCount + stderrR.redactionCount;
+                if (total > 0) {
+                    const patterns = [...new Set([...stdoutR.matchedPatterns, ...stderrR.matchedPatterns])];
+                    console.error(`[output-redactor] Redacted ${total} sensitive pattern(s) from '${options.toolName}': ${patterns.join(", ")}`);
+                }
+            }
             if (stdoutCapped) {
                 stdout += "\n[OUTPUT TRUNCATED - exceeded max buffer]";
             }

package/build/core/logger.js

@@ -99,7 +99,7 @@ export class Logger {
             }
             catch {
                 // Fall back to stderr-only if directory creation fails
-                process.stderr.write(`[logger] WARNING: Cannot create log directory for ${this.logFile}, falling back to stderr-only\n`);
+                process.stderr.write(`[logger] Cannot create log directory for ${this.logFile}, falling back to stderr-only\n`);
                 this.logFile = null;
             }
         }

package/build/core/output-redactor.d.ts

@@ -0,0 +1,26 @@
+/**
+ * output-redactor.ts — Post-execution output sanitization.
+ *
+ * Scans command stdout/stderr for sensitive data patterns and replaces
+ * them with [REDACTED] before returning results to the LLM.
+ *
+ * SECURITY: Over-redacting is preferred to under-redacting.
+ *
+ * @module output-redactor
+ */
+export interface RedactionResult {
+    /** The sanitized text */
+    text: string;
+    /** Number of redactions applied */
+    redactionCount: number;
+    /** Labels of patterns that matched */
+    matchedPatterns: string[];
+}
+/**
+ * Redact sensitive data from command output.
+ *
+ * @param text - Raw stdout or stderr text
+ * @returns Sanitized text with redaction metadata
+ */
+export declare function redactOutput(text: string): RedactionResult;
+//# sourceMappingURL=output-redactor.d.ts.map

package/build/core/output-redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-redactor.d.ts","sourceRoot":"","sources":["../../src/core/output-redactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmFH,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAmB1D"}