ftown 0.19.52 → 0.19.54

package/dist/mcp/fleet.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type McpRequestContext } from './secure-client.js';
 export declare const configSchema: z.ZodEffects<z.ZodObject<{
     concurrency: z.ZodDefault<z.ZodNumber>;
     timeoutMs: z.ZodDefault<z.ZodNumber>;
@@ -70,8 +71,8 @@ export declare const configSchema: z.ZodEffects<z.ZodObject<{
         label?: string | undefined;
     }>]>, "many">;
 }, "strict", z.ZodTypeAny, {
-    concurrency: number;
     timeoutMs: number;
+    concurrency: number;
     machines: ({
         id: string;
         userId: string;
@@ -119,11 +120,11 @@ export declare const configSchema: z.ZodEffects<z.ZodObject<{
         tokenEnv: string;
         label?: string | undefined;
     })[];
-    concurrency?: number | undefined;
     timeoutMs?: number | undefined;
+    concurrency?: number | undefined;
 }>, {
-    concurrency: number;
     timeoutMs: number;
+    concurrency: number;
     machines: ({
         id: string;
         userId: string;
@@ -171,8 +172,8 @@ export declare const configSchema: z.ZodEffects<z.ZodObject<{
         tokenEnv: string;
         label?: string | undefined;
     })[];
-    concurrency?: number | undefined;
     timeoutMs?: number | undefined;
+    concurrency?: number | undefined;
 }>;
 export type FleetConfig = z.infer<typeof configSchema>;
 export declare const requestSchema: z.ZodObject<{
@@ -181,12 +182,12 @@ export declare const requestSchema: z.ZodObject<{
     body: z.ZodOptional<z.ZodUnknown>;
     timeoutMs: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
-    method: "POST" | "GET" | "DELETE" | "PATCH";
+    method: "POST" | "GET" | "PATCH" | "DELETE";
     path: string;
     timeoutMs: number;
     body?: unknown;
 }, {
-    method: "POST" | "GET" | "DELETE" | "PATCH";
+    method: "POST" | "GET" | "PATCH" | "DELETE";
     path: string;
     timeoutMs: number;
     body?: unknown;
@@ -205,7 +206,7 @@ export declare function errorResult(error: unknown): {
     outcomeUnknown: boolean;
 };
 export declare function httpRequest(origin: string, token: string, request: BridgeRequest, signal?: AbortSignal): Promise<any>;
-export declare function localRequest(request: BridgeRequest, bridgeFile?: string, signal?: AbortSignal): Promise<any>;
+export declare function localRequest(request: BridgeRequest, bridgeFile?: string, signal?: AbortSignal, context?: McpRequestContext, machineId?: string): Promise<unknown>;
 export declare function loadConfig(path?: string): Promise<FleetConfig>;
 export declare function mapLimit<T, R>(items: T[], concurrency: number, fn: (item: T, index: number) => Promise<R>): Promise<R[]>;
 export declare class Fleet {
@@ -213,6 +214,7 @@ export declare class Fleet {
     private relay?;
     private active;
     private waiters;
-    constructor(config: FleetConfig, relay?: ((userId: string, machineId: string, request: BridgeRequest, signal?: AbortSignal) => Promise<unknown>) | undefined);
-    request(machineId: string, method: BridgeRequest["method"], path: string, body?: unknown, signal?: AbortSignal, timeoutMs?: number): Promise<any>;
+    constructor(config: FleetConfig, relay?: ((userId: string, machineId: string, request: BridgeRequest, signal?: AbortSignal, context?: McpRequestContext) => Promise<unknown>) | undefined);
+    scoped(context: McpRequestContext): Pick<Fleet, 'config' | 'request'>;
+    request(machineId: string, method: BridgeRequest["method"], path: string, body?: unknown, signal?: AbortSignal, timeoutMs?: number, context?: McpRequestContext): Promise<any>;
 }

package/dist/mcp/fleet.js

@@ -1,8 +1,9 @@
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { execFile } from "node:child_process";
 import { z } from "zod";
+import { parseSecureEnvelope, MAX_ENVELOPE_BYTES, SecurityError } from '../security/crypto.js';
+import { SecureMcpClient } from './secure-client.js';
 const machineBase = {
     id: z.string().regex(/^[a-zA-Z0-9_-]+$/),
     label: z.string().optional(),
@@ -91,6 +92,8 @@ export class FleetError extends Error {
     }
 }
 export function errorResult(error) {
+    if (error instanceof SecurityError)
+        return { code: error.code, message: error.message, outcomeUnknown: error.code === 'outcome_unknown' };
     if (error instanceof FleetError)
         return {
             code: error.code,
@@ -157,20 +160,63 @@ export async function httpRequest(origin, token, request, signal) {
                 : "connection_error", "Bridge request failed; check machine connectivity and credentials", request.method !== "GET");
     }
 }
-export async function localRequest(request, bridgeFile = join(homedir(), ".ftown", "bridge.json"), signal) {
+export async function localRequest(request, bridgeFile = join(homedir(), ".ftown", "bridge.json"), signal, context, machineId) {
+    if (!context || !machineId)
+        throw new FleetError('upgrade_required', 'Legacy MCP proxy requests require an approved encrypted endpoint');
     let credentials;
     try {
         credentials = z
             .object({
             port: z.number().int().min(1).max(65535),
-            token: z.string().min(1),
         })
             .parse(JSON.parse(await readFile(bridgeFile, "utf8")));
     }
     catch {
         throw new FleetError("configuration_error", "Cannot read bridge credentials; start ftown-bridge on this machine");
     }
-    return httpRequest(`http://127.0.0.1:${credentials.port}`, credentials.token, requestSchema.parse(request), signal);
+    return secureHttpRequest(`http://127.0.0.1:${credentials.port}`, context, machineId, requestSchema.parse(request), signal);
+}
+async function secureHttpRequest(origin, context, machineId, request, signal) {
+    const client = new SecureMcpClient(context, machineId, `local-http:${machineId}`, async (packet, deadline, mutating, abort) => {
+        let sent = false;
+        try {
+            if (abort?.aborted || Date.now() >= deadline)
+                throw new FleetError('cancelled', 'Encrypted request cancelled before dispatch');
+            sent = true;
+            const timeout = AbortSignal.timeout(Math.max(1, deadline - Date.now()));
+            const response = await fetch(new URL('/api/security/envelope', origin), { method: 'POST', redirect: 'error', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(packet), signal: abort ? AbortSignal.any([abort, timeout]) : timeout });
+            if (!response.ok)
+                throw new FleetError([404, 426].includes(response.status) ? 'upgrade_required' : 'bridge_error', 'Bridge encrypted endpoint is unavailable', mutating && response.status >= 500, response.status);
+            const reader = response.body?.getReader();
+            if (!reader)
+                throw new FleetError('bridge_error', 'Bridge encrypted response is missing', mutating);
+            let size = 0;
+            const chunks = [];
+            try {
+                while (true) {
+                    const chunk = await reader.read();
+                    if (chunk.done)
+                        break;
+                    size += chunk.value.byteLength;
+                    if (size > MAX_ENVELOPE_BYTES) {
+                        await reader.cancel();
+                        throw new FleetError('response_too_large', 'Encrypted bridge response is too large', mutating);
+                    }
+                    chunks.push(chunk.value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            return parseSecureEnvelope(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+        }
+        catch (error) {
+            if (error instanceof FleetError)
+                throw error;
+            throw new FleetError(abort?.aborted ? 'cancelled' : 'connection_error', 'Encrypted bridge request failed', sent && mutating);
+        }
+    });
+    return client.request(request, signal);
 }
 export async function loadConfig(path) {
     return configSchema.parse(path
@@ -197,11 +243,16 @@ export class Fleet {
         this.config = config;
         this.relay = relay;
     }
-    async request(machineId, method, path, body, signal, timeoutMs = this.config.timeoutMs) {
+    scoped(context) {
+        return { config: this.config, request: (machineId, method, path, body, signal, timeout) => this.request(machineId, method, path, body, signal, timeout, context) };
+    }
+    async request(machineId, method, path, body, signal, timeoutMs = this.config.timeoutMs, context) {
         const machine = this.config.machines.find((m) => m.id === machineId);
         if (!machine)
             throw new FleetError("unknown_machine", `Unknown machine: ${machineId}`);
         const request = requestSchema.parse({ method, path, body, timeoutMs });
+        if (!context)
+            throw new FleetError('approval_required', 'An encrypted MCP grant is required');
         if (this.active >= this.config.concurrency)
             await new Promise((resolve, reject) => {
                 const acquire = () => { signal?.removeEventListener("abort", cancel); resolve(); };
@@ -220,54 +271,20 @@ export class Fleet {
         else
             this.active++;
         try {
+            await context.revalidate?.();
             if (signal?.aborted)
                 throw new FleetError("cancelled", "Request cancelled before dispatch");
             if (machine.transport === "relay") {
                 if (!this.relay)
                     throw new FleetError("configuration_error", "Relay transport is not configured");
-                return await this.relay(machine.userId, machine.id, request, signal);
+                return await this.relay(machine.userId, machine.id, request, signal, context);
             }
             if (machine.transport === "local")
-                return await localRequest(request, machine.bridgeFile, signal);
+                return await localRequest(request, machine.bridgeFile, signal, context, machine.id);
             if (machine.transport === "http") {
-                const token = process.env[machine.tokenEnv];
-                if (!token)
-                    throw new FleetError("configuration_error", "Configured token environment variable is missing");
-                return await httpRequest(machine.url, token, request, signal);
+                return await secureHttpRequest(machine.url, context, machine.id, request, signal);
             }
-            // Only a trusted configured executable enters the remote shell. All tool arguments travel over stdin.
-            const command = `'${machine.executable.replaceAll("'", "'\\''")}' --proxy`;
-            return await new Promise((resolve, reject) => {
-                const child = execFile("ssh", [
-                    "-T",
-                    "-o",
-                    "BatchMode=yes",
-                    "-o",
-                    "StrictHostKeyChecking=yes",
-                    "-o",
-                    "ConnectTimeout=10",
-                    "--",
-                    machine.host,
-                    command,
-                ], { timeout: timeoutMs + 1000, maxBuffer: maxBytes, signal }, (error, stdout) => {
-                    if (error) {
-                        reject(new FleetError("ssh_error", "SSH proxy failed; verify SSH access and remote ftown-mcp installation", method !== "GET"));
-                        return;
-                    }
-                    try {
-                        const result = JSON.parse(stdout);
-                        if (result.error)
-                            reject(new FleetError(result.error.code, result.error.message, result.error.outcomeUnknown, result.error.status));
-                        else
-                            resolve(result.data);
-                    }
-                    catch {
-                        reject(new FleetError("protocol_error", "Invalid SSH proxy response", method !== "GET"));
-                    }
-                });
-                child.stdin?.on("error", () => { });
-                child.stdin?.end(JSON.stringify(request));
-            });
+            throw new FleetError('upgrade_required', 'Legacy SSH MCP adapters do not negotiate encrypted endpoint framing');
         }
         finally {
             const next = this.waiters.shift();

package/dist/mcp/fleet.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet.js","sourceRoot":"","sources":["../../src/mcp/fleet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC;AACF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;QAChC,CAAC;aACE,MAAM,CAAC;YACN,GAAG,WAAW;YACd,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;SAC3B,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC;YACN,GAAG,WAAW;YACd,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC;YACN,GAAG,WAAW;YACd,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iCAAiC,CAAC;YACzD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;SACnD,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC;YACN,GAAG,WAAW;YACd,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;YACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAC5B,CAAC;aACD,MAAM,EAAE;KACZ,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;CACb,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IACE,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAEzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAC7B,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzB,IACE,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,QAAQ,KAAK,GAAG;gBAClB,CAAC,CACC,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;wBACrB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC5D,EACD,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EACL,4FAA4F;iBAC/F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CACJ,gLAAgL,CACjL;IACH,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,OAAO,UAAW,SAAQ,KAAK;IAExB;IAEA;IACA;IAJX,YACW,IAAY,EACrB,OAAe,EACN,iBAAiB,KAAK,EACtB,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,SAAI,GAAJ,IAAI,CAAQ;QAEZ,mBAAc,GAAd,cAAc,CAAQ;QACtB,WAAM,GAAN,MAAM,CAAS;IAG1B,CAAC;CACF;AACD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,UAAU;QAC7B,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,kBAAkB;QAC3B,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,KAAa,EACb,OAAsB,EACtB,MAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;YACrD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EACF,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;YACvE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;SAC9D,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,MAAM;YACR,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;oBACzB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;wBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;wBACtB,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,mDAAmD,EACnD,OAAO,CAAC,MAAM,KAAK,KAAK,CACzB,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GACV,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;gBAC7B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;gBAC3D,CAAC,CAAC,yBAAyB,CAAC;YAChC,MAAM,IAAI,UAAU,CAClB,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAC5M,GAAG,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,EAChC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAC7C,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,UAAU,CAClB,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,OAAO,CAAC,OAAO;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,EACxB,mEAAmE,EACnE,OAAO,CAAC,MAAM,KAAK,KAAK,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,EACrD,MAAoB;IAEpB,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,CAAC;aACZ,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SACzB,CAAC;aACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAChB,oBAAoB,WAAW,CAAC,IAAI,EAAE,EACtC,WAAW,CAAC,KAAK,EACjB,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAC5B,MAAM,CACP,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAa;IAC5C,OAAO,YAAY,CAAC,KAAK,CACvB,IAAI;QACF,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CACxD,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAU,EACV,WAAmB,EACnB,EAA0C;IAE1C,MAAM,OAAO,GAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACrE,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,MAAM,OAAO,KAAK;IAIL;IACD;IAJF,MAAM,GAAG,CAAC,CAAC;IACX,OAAO,GAAsB,EAAE,CAAC;IACxC,YACW,MAAmB,EACpB,KAKa;QANZ,WAAM,GAAN,MAAM,CAAa;QACpB,UAAK,GAAL,KAAK,CAKQ;IACpB,CAAC;IACJ,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,MAA+B,EAC/B,IAAY,EACZ,IAAc,EACd,MAAoB,EACpB,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;QAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW;YACxC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnF,MAAM,MAAM,GAAG,GAAG,EAAE;oBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC5C,IAAI,KAAK,KAAK,CAAC,CAAC;wBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBAChD,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAC7C,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC,CAAC;gBAC3E,CAAC,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,IAAI,MAAM,EAAE,OAAO;oBAAE,MAAM,EAAE,CAAC;YAChC,CAAC,CAAC,CAAC;;YACA,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,MAAM,EAAE,OAAO;gBACjB,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;YACzE,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,KAAK;oBACb,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,mCAAmC,CACpC,CAAC;gBACJ,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO;gBAC/B,OAAO,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,CAAC,KAAK;oBACR,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,kDAAkD,CACnD,CAAC;gBACJ,OAAO,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAChE,CAAC;YACD,sGAAsG;YACtG,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC;YAC3E,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,KAAK,GAAG,QAAQ,CACpB,KAAK,EACL;oBACE,IAAI;oBACJ,IAAI;oBACJ,eAAe;oBACf,IAAI;oBACJ,2BAA2B;oBAC3B,IAAI;oBACJ,mBAAmB;oBACnB,IAAI;oBACJ,OAAO,CAAC,IAAI;oBACZ,OAAO;iBACR,EACD,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAC1D,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;oBAChB,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,CACJ,IAAI,UAAU,CACZ,WAAW,EACX,uEAAuE,EACvE,MAAM,KAAK,KAAK,CACjB,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAClC,IAAI,MAAM,CAAC,KAAK;4BACd,MAAM,CACJ,IAAI,UAAU,CACZ,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,CAAC,KAAK,CAAC,OAAO,EACpB,MAAM,CAAC,KAAK,CAAC,cAAc,EAC3B,MAAM,CAAC,KAAK,CAAC,MAAM,CACpB,CACF,CAAC;;4BACC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC5B,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CACJ,IAAI,UAAU,CACZ,gBAAgB,EAChB,4BAA4B,EAC5B,MAAM,KAAK,KAAK,CACjB,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC,CACF,CAAC;gBACF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,IAAI;gBAAE,IAAI,EAAE,CAAC;;gBACZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"fleet.js","sourceRoot":"","sources":["../../src/mcp/fleet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,eAAe,EAA0B,MAAM,oBAAoB,CAAC;AAE7E,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC;AACF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;QAChC,CAAC;aACE,MAAM,CAAC;YACN,GAAG,WAAW;YACd,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;SAC3B,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC;YACN,GAAG,WAAW;YACd,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC;YACN,GAAG,WAAW;YACd,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iCAAiC,CAAC;YACzD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;SACnD,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC;YACN,GAAG,WAAW;YACd,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;YACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAC5B,CAAC;aACD,MAAM,EAAE;KACZ,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;CACb,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IACE,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAEzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAC7B,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzB,IACE,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,QAAQ,KAAK,GAAG;gBAClB,CAAC,CACC,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBACvB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;wBACrB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAC5D,EACD,CAAC;gBACD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EACL,4FAA4F;iBAC/F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CACJ,gLAAgL,CACjL;IACH,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,OAAO,UAAW,SAAQ,KAAK;IAExB;IAEA;IACA;IAJX,YACW,IAAY,EACrB,OAAe,EACN,iBAAiB,KAAK,EACtB,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,SAAI,GAAJ,IAAI,CAAQ;QAEZ,mBAAc,GAAd,cAAc,CAAQ;QACtB,WAAM,GAAN,MAAM,CAAS;IAG1B,CAAC;CACF;AACD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;IAC1I,IAAI,KAAK,YAAY,UAAU;QAC7B,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,kBAAkB;QAC3B,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,KAAa,EACb,OAAsB,EACtB,MAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;YACrD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EACF,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;YACvE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;SAC9D,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,MAAM;YACR,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;oBACzB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;wBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;wBACtB,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,mDAAmD,EACnD,OAAO,CAAC,MAAM,KAAK,KAAK,CACzB,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GACV,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;gBAC7B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;gBAC3D,CAAC,CAAC,yBAAyB,CAAC;YAChC,MAAM,IAAI,UAAU,CAClB,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAC5M,GAAG,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,EAChC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAC7C,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,UAAU,CAClB,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,OAAO,CAAC,OAAO;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,EACxB,mEAAmE,EACnE,OAAO,CAAC,MAAM,KAAK,KAAK,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,EACrD,MAAoB,EACpB,OAA2B,EAC3B,SAAkB;IAElB,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,kEAAkE,CAAC,CAAC;IACzI,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACH,WAAW,GAAG,CAAC;aACZ,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;SACzC,CAAC;aACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CACtB,oBAAoB,WAAW,CAAC,IAAI,EAAE,EACtC,OAAO,EACP,SAAS,EACT,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAC5B,MAAM,CACP,CAAC;AACJ,CAAC;AACD,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAA0B,EAAE,SAAiB,EAAE,OAAsB,EAAE,MAAoB;IAC1I,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC5H,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;YAC/H,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3P,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,EAAE,0CAA0C,EAAE,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpN,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,sCAAsC,EAAE,QAAQ,CAAC,CAAC;YACpG,IAAI,IAAI,GAAG,CAAC,CAAC;YAAC,MAAM,MAAM,GAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBAAC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAAC,IAAI,KAAK,CAAC,IAAI;wBAAE,MAAM;oBAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;oBAAC,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;wBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;wBAAC,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,wCAAwC,EAAE,QAAQ,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,CAAC;YAChS,CAAC;oBAAS,CAAC;gBAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YACnC,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU;gBAAE,MAAM,KAAK,CAAC;YAC7C,MAAM,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,EAAE,iCAAiC,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAa;IAC5C,OAAO,YAAY,CAAC,KAAK,CACvB,IAAI;QACF,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CACxD,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAU,EACV,WAAmB,EACnB,EAA0C;IAE1C,MAAM,OAAO,GAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACrE,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,MAAM,OAAO,KAAK;IAIL;IACD;IAJF,MAAM,GAAG,CAAC,CAAC;IACX,OAAO,GAAsB,EAAE,CAAC;IACxC,YACW,MAAmB,EACpB,KAMa;QAPZ,WAAM,GAAN,MAAM,CAAa;QACpB,UAAK,GAAL,KAAK,CAMQ;IACpB,CAAC;IACJ,MAAM,CAAC,OAA0B;QAC/B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IACrK,CAAC;IACD,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,MAA+B,EAC/B,IAAY,EACZ,IAAc,EACd,MAAoB,EACpB,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EACjC,OAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW;YACxC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnF,MAAM,MAAM,GAAG,GAAG,EAAE;oBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC5C,IAAI,KAAK,KAAK,CAAC,CAAC;wBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBAChD,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAC7C,MAAM,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC,CAAC;gBAC3E,CAAC,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,IAAI,MAAM,EAAE,OAAO;oBAAE,MAAM,EAAE,CAAC;YAChC,CAAC,CAAC,CAAC;;YACA,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YAC7B,IAAI,MAAM,EAAE,OAAO;gBACjB,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;YACzE,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,KAAK;oBACb,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,mCAAmC,CACpC,CAAC;gBACJ,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO;gBAC/B,OAAO,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtF,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBACjC,OAAO,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,qEAAqE,CAAC,CAAC;QAClH,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,IAAI;gBAAE,IAAI,EAAE,CAAC;;gBACZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;CACF"}

package/dist/mcp/http.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import type { FleetRelay } from "./relay.js";
 import { FtownOAuthProvider } from "./oauth.js";
+import { SecurityEventStore } from './security-events.js';
 export declare const gatewayConfigSchema: z.ZodEffects<z.ZodObject<{
     publicUrl: z.ZodEffects<z.ZodString, string, string>;
     loginUrl: z.ZodEffects<z.ZodString, string, string>;
@@ -76,8 +77,8 @@ export declare const gatewayConfigSchema: z.ZodEffects<z.ZodObject<{
             label?: string | undefined;
         }>]>, "many">;
     }, "strict", z.ZodTypeAny, {
-        concurrency: number;
         timeoutMs: number;
+        concurrency: number;
         machines: ({
             id: string;
             userId: string;
@@ -125,11 +126,11 @@ export declare const gatewayConfigSchema: z.ZodEffects<z.ZodObject<{
             tokenEnv: string;
             label?: string | undefined;
         })[];
-        concurrency?: number | undefined;
         timeoutMs?: number | undefined;
+        concurrency?: number | undefined;
     }>, {
-        concurrency: number;
         timeoutMs: number;
+        concurrency: number;
         machines: ({
             id: string;
             userId: string;
@@ -177,8 +178,8 @@ export declare const gatewayConfigSchema: z.ZodEffects<z.ZodObject<{
             tokenEnv: string;
             label?: string | undefined;
         })[];
-        concurrency?: number | undefined;
         timeoutMs?: number | undefined;
+        concurrency?: number | undefined;
     }>;
     access: z.ZodArray<z.ZodObject<{
         subject: z.ZodString;
@@ -199,8 +200,8 @@ export declare const gatewayConfigSchema: z.ZodEffects<z.ZodObject<{
     loginUrl: string;
     allowedOrigins: string[];
     fleet: {
-        concurrency: number;
         timeoutMs: number;
+        concurrency: number;
         machines: ({
             id: string;
             userId: string;
@@ -256,8 +257,8 @@ export declare const gatewayConfigSchema: z.ZodEffects<z.ZodObject<{
             tokenEnv: string;
             label?: string | undefined;
         })[];
-        concurrency?: number | undefined;
         timeoutMs?: number | undefined;
+        concurrency?: number | undefined;
     };
     allowedOrigins?: string[] | undefined;
 }>, {
@@ -269,8 +270,8 @@ export declare const gatewayConfigSchema: z.ZodEffects<z.ZodObject<{
     loginUrl: string;
     allowedOrigins: string[];
     fleet: {
-        concurrency: number;
         timeoutMs: number;
+        concurrency: number;
         machines: ({
             id: string;
             userId: string;
@@ -326,10 +327,10 @@ export declare const gatewayConfigSchema: z.ZodEffects<z.ZodObject<{
             tokenEnv: string;
             label?: string | undefined;
         })[];
-        concurrency?: number | undefined;
         timeoutMs?: number | undefined;
+        concurrency?: number | undefined;
     };
     allowedOrigins?: string[] | undefined;
 }>;
 export type GatewayConfig = z.infer<typeof gatewayConfigSchema>;
-export declare function createGateway(config: GatewayConfig, provider: FtownOAuthProvider, relay?: FleetRelay): import("express-serve-static-core").Express;
+export declare function createGateway(config: GatewayConfig, provider: FtownOAuthProvider, relay?: FleetRelay, audit?: Pick<SecurityEventStore, 'admit' | 'finish'>): import("express-serve-static-core").Express;

package/dist/mcp/http.js

@@ -7,6 +7,10 @@ import { z } from "zod";
 import { configSchema, Fleet, FleetError } from "./fleet.js";
 import { createMcpServer } from "./server.js";
 import { MCP_SCOPES } from "./oauth.js";
+import { randomUUID } from 'node:crypto';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { errorResult } from './fleet.js';
+import { READ_MCP_TOOLS, safeTool, safeFailureCode, securityOutcome, finishSecurityEvent } from './security-events.js';
 const httpsOrigin = z
     .string()
     .url()
@@ -40,11 +44,43 @@ export const gatewayConfigSchema = z
                 message: "Access references an unknown machine",
             });
 });
-export function createGateway(config, provider, relay) {
+export function createGateway(config, provider, relay, audit) {
     const app = express();
     const rootFleet = new Fleet(config.fleet, relay
-        ? (user, id, request, signal) => relay.request(user, id, request, signal)
+        ? (user, id, request, signal, context) => relay.request(user, id, request, signal, context)
         : undefined);
+    const actions = new AsyncLocalStorage();
+    const states = new WeakMap();
+    const finish = (state, outcome) => finishSecurityEvent(audit, state, outcome);
+    const admission = async (req, res) => {
+        if (!audit || !provider.keys)
+            throw new FleetError('security_setup_required', 'Encrypted MCP storage and security audit must be configured');
+        const subject = String(req.auth.extra.subject);
+        const tool = req.body?.method === 'tools/call' ? safeTool(req.body?.params?.name)
+            : req.body?.method === 'initialize' ? 'initialize' : req.body?.method === 'tools/list' ? 'tools_list'
+                : req.body?.method === 'resources/list' ? 'resources_list' : req.body?.method === 'resources/read' ? 'resources_read'
+                    : req.body?.id === undefined ? 'protocol_notification' : 'protocol_request';
+        const target = req.body?.params?.arguments;
+        const allowed = req.auth.extra.machines;
+        const actionId = randomUUID();
+        const action = { actionId, parentActionId: null, clientId: req.auth.clientId, grantId: String(req.auth.extra.grantId), tool, operation: null };
+        const event = {
+            version: 1, id: actionId, actionId, parentActionId: null, ownerId: subject, source: 'gateway',
+            bridgeId: typeof target?.machine === 'string' && allowed.includes(target.machine) ? target.machine : null,
+            clientId: action.clientId, grantId: action.grantId, endpointId: String(req.auth.extra.endpointId), tool, operation: null,
+            sessionId: typeof target?.sessionId === 'string' && /^[A-Za-z0-9_-]{1,200}$/.test(target.sessionId) ? target.sessionId : null,
+            startedAt: new Date().toISOString(), finishedAt: null, status: 'started', errorCode: null,
+            mutating: req.body?.method === 'tools/call' && !READ_MCP_TOOLS.has(tool),
+        };
+        await audit.admit(event);
+        const state = { event, action, finished: false, dispatched: false };
+        states.set(req, state);
+        res.once('close', () => {
+            if (!state.finished)
+                void finish(state, { status: state.dispatched ? 'unknown' : 'rejected', errorCode: state.dispatched ? 'outcome_unknown' : res.statusCode >= 400 ? 'invalid_request' : 'cancelled' }).catch(() => { });
+        });
+        return state;
+    };
     app.disable("x-powered-by");
     // Fly's edge is the sole HTTP ingress; forwarded headers are not used for authorization.
     app.set("trust proxy", 1);
@@ -107,7 +143,7 @@ export function createGateway(config, provider, relay) {
         limit: 60,
         standardHeaders: true,
         legacyHeaders: false,
-    }), express.json({ limit: "16kb" }));
+    }), express.json({ limit: "512kb" }));
     app.post("/consent/:action", async (req, res) => {
         try {
             if (typeof req.body?.assertion !== "string") {
@@ -152,14 +188,39 @@ export function createGateway(config, provider, relay) {
         requiredScopes: ["mcp:read"],
         resourceMetadataUrl: new URL("/.well-known/oauth-protected-resource/mcp", config.publicUrl).href,
     }));
+    app.use('/mcp', express.json({ limit: '1mb' }));
+    app.use('/mcp', async (req, res, next) => {
+        try {
+            await admission(req, res);
+            next();
+        }
+        catch {
+            res.status(503).json({ error: 'Security audit or encrypted endpoint is unavailable' });
+        }
+    });
     app.use("/mcp", rateLimit({
         windowMs: 60000,
         limit: 600,
         keyGenerator: (req) => String(req.auth?.extra?.subject),
         standardHeaders: true,
         legacyHeaders: false,
+        handler: (req, res) => {
+            const state = states.get(req);
+            void (state ? finish(state, { status: 'rejected', errorCode: 'capacity_exceeded' }) : Promise.resolve()).catch(() => { }).finally(() => res.status(429).json({ error: 'MCP request limit exceeded' }));
+        },
     }));
-    app.post("/mcp", express.json({ limit: "1mb" }), async (req, res) => {
+    app.post("/mcp", async (req, res) => {
+        const state = states.get(req);
+        let identity;
+        try {
+            identity = await provider.keys.loadGrantIdentity(state.event.ownerId, state.action.grantId);
+            await provider.keys.markActive(identity.ownerId, identity.requestId);
+        }
+        catch {
+            await finish(state, { status: 'rejected', errorCode: 'approval_required' });
+            res.status(403).json({ error: 'Renew encrypted bridge consent' });
+            return;
+        }
         const allowed = req.auth.extra.machines;
         const fleet = {
             config: {
@@ -169,7 +230,12 @@ export function createGateway(config, provider, relay) {
             request: (id, ...args) => {
                 if (!allowed.includes(id))
                     return Promise.reject(new FleetError("forbidden", "Machine is not authorized for this grant"));
-                return rootFleet.request(id, ...args);
+                state.dispatched = true;
+                return rootFleet.scoped({ grant: identity, action: actions.getStore() ?? state.action, revalidate: async () => {
+                        const current = await provider.verifyAccessToken(req.auth.token);
+                        if (!(current.extra?.machines).includes(id) || (state.event.mutating && !current.scopes.includes('mcp:control')))
+                            throw new FleetError('forbidden', 'MCP access changed before dispatch');
+                    } }).request(id, ...args);
             },
         };
         const server = createMcpServer(fleet, {
@@ -187,6 +253,29 @@ export function createGateway(config, provider, relay) {
                 if (machines.some((machine) => !authorized.includes(machine)))
                     throw new FleetError("forbidden", "Machine access was revoked during this request");
             },
+            runChild: async (name, args, run) => {
+                const actionId = randomUUID();
+                const child = {
+                    ...state.event, id: actionId, actionId, parentActionId: state.event.actionId, tool: safeTool(name), operation: safeTool(name),
+                    bridgeId: typeof args.machine === 'string' && allowed.includes(args.machine) ? args.machine : null,
+                    sessionId: typeof args.sessionId === 'string' && /^[A-Za-z0-9_-]{1,200}$/.test(args.sessionId) ? args.sessionId : null,
+                    startedAt: new Date().toISOString(), mutating: !READ_MCP_TOOLS.has(name),
+                };
+                await audit.admit(child);
+                const action = { ...state.action, actionId, parentActionId: state.event.actionId, tool: child.tool, operation: child.operation };
+                let outcome;
+                try {
+                    const result = await actions.run(action, run);
+                    outcome = securityOutcome(result);
+                    await audit.finish(child, outcome);
+                    return result;
+                }
+                catch (error) {
+                    const failure = errorResult(error);
+                    await audit.finish(child, { status: failure.outcomeUnknown ? 'unknown' : ['forbidden', 'permission_denied'].includes(failure.code) ? 'rejected' : 'failed', errorCode: safeFailureCode(failure.code) });
+                    throw error;
+                }
+            },
         });
         // Stateless transport: every request is authenticated and reconstructs its own scoped tool surface.
         const transport = new StreamableHTTPServerTransport({
@@ -195,29 +284,65 @@ export function createGateway(config, provider, relay) {
             // No GET stream/session map or unsolicited server notifications are advertised.
             enableJsonResponse: !(req.body?.method === "tools/call" && req.body?.params?.name === "attention_wait"),
         });
+        const send = transport.send.bind(transport);
+        transport.send = async (message, options) => {
+            if ('id' in message && message.id === req.body?.id && ('result' in message || 'error' in message)) {
+                let outcome = 'error' in message ? { status: 'rejected', errorCode: message.error.code === -32602 ? 'invalid_arguments' : message.error.code === -32601 ? 'unknown_tool' : 'invalid_request' } : securityOutcome(message.result);
+                if (state.event.mutating && !req.auth.scopes.includes('mcp:control'))
+                    outcome = { status: 'rejected', errorCode: 'permission_denied' };
+                try {
+                    await finish(state, outcome);
+                }
+                catch {
+                    await finish(state, { status: 'unknown', errorCode: 'outcome_unknown' }).catch(() => { });
+                    await send({ jsonrpc: '2.0', id: message.id, error: { code: -32603, message: 'Operation outcome is unknown because final audit storage failed', data: { code: 'outcome_unknown', outcomeUnknown: true } } }, options);
+                    return;
+                }
+            }
+            await send(message, options);
+        };
         res.on("close", () => {
             void server.close();
         });
         try {
             await server.connect(transport);
-            await transport.handleRequest(req, res, req.body);
+            await actions.run(state.action, () => transport.handleRequest(req, res, req.body));
+            if (!state.finished && res.statusCode >= 400)
+                await finish(state, { status: 'rejected', errorCode: 'invalid_request' });
+            else if (!state.finished && req.body?.id === undefined)
+                await finish(state, { status: 'succeeded', errorCode: null });
         }
         catch {
+            if (!state.finished)
+                await finish(state, { status: state.dispatched && state.event.mutating ? 'unknown' : 'failed', errorCode: state.dispatched && state.event.mutating ? 'outcome_unknown' : 'internal_error' }).catch(() => { });
             if (!res.headersSent)
                 res.status(500).json({ error: "MCP request failed" });
         }
     });
-    app.all("/mcp", (_req, res) => {
+    app.all("/mcp", async (_req, res) => {
+        const state = states.get(_req);
+        if (state)
+            await finish(state, { status: 'rejected', errorCode: 'invalid_request' }).catch(() => { });
         res.setHeader("Allow", "POST, OPTIONS");
         res.status(405).end();
     });
-    app.use((error, _req, res, _next) => {
+    app.use(async (error, _req, res, _next) => {
         const status = typeof error === "object" &&
             error !== null &&
             "status" in error &&
             error.status === 413
             ? 413
             : 400;
+        if (_req.auth) {
+            try {
+                const state = states.get(_req) ?? await admission(_req, res);
+                await finish(state, { status: 'rejected', errorCode: 'invalid_request' });
+            }
+            catch {
+                res.status(503).json({ error: 'Security audit storage is unavailable' });
+                return;
+            }
+        }
         res.status(status).json({ error: "Invalid request" });
     });
     return app;