fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/mcpToolReview.js

@@ -0,0 +1,127 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolReviewLease = void 0;
+exports.verifiedToolTrust = verifiedToolTrust;
+exports.readCompleteToolCatalog = readCompleteToolCatalog;
+const machineActionVerify_1 = require("./machineActionVerify");
+const mcpToolTrust_1 = require("./mcpToolTrust");
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/** Retain the signed requirement even when the general bundle ages out offline. */
+class ToolReviewLease {
+    machineId;
+    shieldId;
+    file;
+    remembered;
+    loaded = false;
+    constructor(machineId, shieldId, apiUrl, directory = path.join(os.homedir(), '.fullcourtdefense', 'tool-review')) {
+        this.machineId = machineId;
+        this.shieldId = shieldId;
+        this.file = path.join(directory, (0, crypto_1.createHash)('sha256').update(JSON.stringify([machineId, shieldId, apiUrl])).digest('hex') + '.json');
+    }
+    settings(candidate) {
+        if (candidate)
+            verifiedToolTrust(candidate, this.machineId, this.shieldId);
+        if (!this.loaded) {
+            try {
+                const raw = fs.readFileSync(this.file, 'utf8');
+                if (raw.length > 64000)
+                    throw new Error('Tool review cache is invalid.');
+                this.remembered = JSON.parse(raw);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT' && !candidate)
+                    throw new Error('Tool review cache is unreadable. Reconnect before calling tools.');
+            }
+            this.loaded = true;
+        }
+        if (candidate) {
+            const serialized = JSON.stringify(candidate);
+            if (serialized !== JSON.stringify(this.remembered)) {
+                fs.mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 });
+                const temp = `${this.file}.${(0, crypto_1.randomUUID)()}.tmp`;
+                try {
+                    fs.writeFileSync(temp, serialized, { flag: 'wx', mode: 0o600 });
+                    fs.renameSync(temp, this.file);
+                }
+                finally {
+                    try {
+                        fs.unlinkSync(temp);
+                    }
+                    catch { /* renamed or unavailable */ }
+                }
+                this.remembered = candidate;
+            }
+        }
+        return this.remembered ? verifiedToolTrust(this.remembered, this.machineId, this.shieldId) : undefined;
+    }
+}
+exports.ToolReviewLease = ToolReviewLease;
+function verifiedToolTrust(envelope, machineId, shieldId) {
+    const created = Date.parse(envelope.createdAt), expires = Date.parse(envelope.expiresAt);
+    if (envelope.type !== 'mcp_tool_trust' || !envelope.organizationId || !envelope.signature || envelope.machineId !== machineId || !Number.isFinite(created) || !Number.isFinite(expires) || created > Date.now() + 60000 || expires <= Date.now() || expires - created > 86400000)
+        throw new Error('Tool review settings are missing, expired or invalid. Reconnect before calling tools.');
+    const verdict = (0, machineActionVerify_1.verifyMachineAction)(envelope, { localMachineId: machineId });
+    if (!verdict.ok || verdict.reason)
+        throw new Error('Tool review settings failed signature verification.');
+    const settings = JSON.parse(envelope.reason);
+    if (!shieldId || settings.shieldId !== shieldId)
+        throw new Error('Tool review settings belong to another enrollment.');
+    return (0, mcpToolTrust_1.parseToolTrustSettings)(settings);
+}
+/** Preserve every declared field and exhaust pagination before fingerprinting. */
+async function readCompleteToolCatalog(request) {
+    const tools = [];
+    const cursors = new Set();
+    let cursor;
+    for (let page = 0; page < 20; page++) {
+        const response = await request(cursor ? { cursor } : {});
+        if (!response || !Array.isArray(response.tools))
+            throw new Error('MCP server returned an invalid tool list.');
+        tools.push(...response.tools);
+        if (tools.length > 1000)
+            throw new Error('MCP catalog exceeds the supported review size.');
+        if (response.nextCursor === undefined)
+            return tools;
+        if (typeof response.nextCursor !== 'string' || !response.nextCursor || cursors.has(response.nextCursor))
+            throw new Error('Invalid MCP catalog pagination.');
+        cursor = response.nextCursor;
+        cursors.add(cursor);
+    }
+    throw new Error('MCP catalog pagination exceeded the supported limit.');
+}

package/dist/mcpToolTrust.d.ts

@@ -0,0 +1,22 @@
+/** Pure, byte-identical CLI contract. Definitions are evidence, never instructions. */
+export interface ToolTrustSettings {
+    version: 1;
+    enabled: boolean;
+    approved: Array<{
+        serverId: string;
+        catalogHash: string;
+    }>;
+}
+export interface ToolCatalog {
+    serverId: string;
+    serverName: string;
+    catalogHash: string;
+    tools: Array<Record<string, unknown> & {
+        name: string;
+    }>;
+}
+export declare function canonicalToolJson(value: unknown): string;
+export declare function toolDigest(value: unknown): string;
+export declare function parseToolCatalog(value: unknown): ToolCatalog;
+export declare function parseToolTrustSettings(value: unknown): ToolTrustSettings;
+export declare function toolCatalogAllowed(settings: ToolTrustSettings, catalog: ToolCatalog, name: string): boolean;

package/dist/mcpToolTrust.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalToolJson = canonicalToolJson;
+exports.toolDigest = toolDigest;
+exports.parseToolCatalog = parseToolCatalog;
+exports.parseToolTrustSettings = parseToolTrustSettings;
+exports.toolCatalogAllowed = toolCatalogAllowed;
+const crypto_1 = require("crypto");
+function canonicalToolJson(value) {
+    let nodes = 0;
+    const visit = (item, depth) => {
+        if (++nodes > 30000 || depth > 32)
+            throw new Error('Tool definition is too complex.');
+        if (item === null || typeof item === 'string' || typeof item === 'boolean')
+            return item;
+        if (typeof item === 'number' && Number.isFinite(item))
+            return item;
+        if (Array.isArray(item))
+            return item.map(v => visit(v, depth + 1));
+        if (!item || typeof item !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(item)))
+            throw new Error('Invalid tool definition.');
+        const output = Object.create(null);
+        for (const key of Object.keys(item).sort()) {
+            const descriptor = Object.getOwnPropertyDescriptor(item, key);
+            if (!('value' in descriptor))
+                throw new Error('Invalid tool definition.');
+            output[key] = visit(descriptor.value, depth + 1);
+        }
+        return output;
+    };
+    const result = JSON.stringify(visit(value, 0));
+    if (Buffer.byteLength(result) > 512000)
+        throw new Error('Tool catalog is too large.');
+    return result;
+}
+function toolDigest(value) { return (0, crypto_1.createHash)('sha256').update(canonicalToolJson(value)).digest('hex'); }
+const hash = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+function parseToolCatalog(value) {
+    const p = value;
+    if (!p || !hash(p.serverId) || typeof p.serverName !== 'string' || !p.serverName.trim() || p.serverName.length > 160 || /[\x00-\x1f]/.test(p.serverName) || !Array.isArray(p.tools) || p.tools.length > 1000)
+        throw new Error('Invalid tool catalog.');
+    const tools = JSON.parse(canonicalToolJson(p.tools));
+    const names = new Set();
+    for (const tool of tools) {
+        if (!tool || typeof tool !== 'object' || typeof tool.name !== 'string' || !tool.name || tool.name.length > 200 || names.has(tool.name))
+            throw new Error('Invalid or duplicate tool name.');
+        names.add(tool.name);
+    }
+    tools.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    return { serverId: p.serverId, serverName: p.serverName, tools, catalogHash: toolDigest(tools) };
+}
+function parseToolTrustSettings(value) {
+    const p = value;
+    if (!p || p.version !== 1 || typeof p.enabled !== 'boolean' || !Array.isArray(p.approved) || p.approved.length > 100)
+        throw new Error('Invalid tool review settings.');
+    const seen = new Set();
+    for (const entry of p.approved) {
+        if (!entry || !hash(entry.serverId) || !hash(entry.catalogHash) || seen.has(entry.serverId))
+            throw new Error('Invalid tool approval.');
+        seen.add(entry.serverId);
+    }
+    return { version: 1, enabled: p.enabled, approved: p.approved.map(({ serverId, catalogHash }) => ({ serverId, catalogHash })) };
+}
+function toolCatalogAllowed(settings, catalog, name) {
+    return !settings.enabled || (catalog.tools.some(tool => tool.name === name) && settings.approved.some(entry => entry.serverId === catalog.serverId && entry.catalogHash === catalog.catalogHash));
+}

package/dist/nativeHook.d.ts

@@ -22,6 +22,10 @@ export declare function nativeErrorVerdict(client: NativeClient, reason: string)
  * cannot approve by writing `yes` to hook stdin. Re-exported for existing callers.
  */
 export { confirmNativeAction };
+/**
+ * `confirm` is a test seam only (yes/no). Production leaves it undefined and gets the
+ * shared three-button FullCourtDefense dialog through askDialog.ts.
+ */
 export declare function evaluateNativeHook(client: NativeClient, raw: Payload, args: HookArgs, config: BotGuardConfig, confirm?: (reason: string) => Promise<boolean>): Promise<{
     stdout: string;
     stderr: string;

package/dist/nativeHook.js

@@ -13,8 +13,11 @@ const runtimeConfig_1 = require("./runtimeConfig");
 const hookIo_1 = require("./hookIo");
 const devConfirm_1 = require("./devConfirm");
 Object.defineProperty(exports, "confirmNativeAction", { enumerable: true, get: function () { return devConfirm_1.confirmNativeAction; } });
+const askDialog_1 = require("./askDialog");
 const telemetry_1 = require("./telemetry");
 const codexMcpIdentity_1 = require("./codexMcpIdentity");
+/** Inside the 110 s process deadline below, with room for the verdict itself. */
+const NATIVE_DIALOG_TIMEOUT_MS = 90_000;
 exports.NATIVE_CLIENTS = ['codex', 'gemini_cli', 'windsurf', 'kiro'];
 function patchToolCalls(raw) {
     const patch = typeof raw.tool_input === 'string' ? raw.tool_input : String(raw.tool_input?.command || raw.tool_input?.patch || '');
@@ -112,7 +115,11 @@ function nativeErrorVerdict(client, reason) {
         return { stdout: JSON.stringify({ decision: 'block', reason }), stderr: '', exitCode: 0 };
     return nativeVerdict(client, true, reason);
 }
-async function evaluateNativeHook(client, raw, args, config, confirm = devConfirm_1.confirmNativeAction) {
+/**
+ * `confirm` is a test seam only (yes/no). Production leaves it undefined and gets the
+ * shared three-button FullCourtDefense dialog through askDialog.ts.
+ */
+async function evaluateNativeHook(client, raw, args, config, confirm) {
     if (client === 'codex' && raw.tool_name === 'apply_patch') {
         try {
             // Evaluate every file operation before Codex executes the atomic patch.
@@ -141,7 +148,18 @@ async function evaluateNativeHook(client, raw, args, config, confirm = devConfir
         return nativeErrorVerdict(client, `FullCourtDefense could not parse the hook: ${String(error)}`);
     }
     return (0, telemetry_1.markVerdictTiming)({ startedAt: Date.now(), path: 'local', agentClient: client }, async () => {
-        const result = await (0, hook_1.evaluateHookRequest)({ ...args, agentClient: client }, JSON.stringify(payload), config);
+        const evaluated = await (0, hook_1.evaluateHookRequest)({ ...args, agentClient: client }, JSON.stringify(payload), config);
+        // The three-button FullCourtDefense dialog (askDialog.ts) — the same one Cursor
+        // and Claude Code get. A test-injected `confirm` keeps the legacy yes/no shape.
+        const result = await (0, askDialog_1.resolveAskWithDialog)(evaluated, {
+            clientLabel: client,
+            dialog: confirm ? async (reason, timeoutMs) => {
+                const started = Date.now();
+                const ok = await confirm(reason);
+                return { outcome: ok ? 'allow' : 'deny', latencyMs: Date.now() - started };
+            } : undefined,
+            ...(confirm ? {} : { timeoutMs: NATIVE_DIALOG_TIMEOUT_MS }),
+        });
         let decision;
         try {
             decision = result.stdout ? JSON.parse(result.stdout) : {};
@@ -153,26 +171,22 @@ async function evaluateNativeHook(client, raw, args, config, confirm = devConfir
             return nativeErrorVerdict(client, 'Invalid FullCourtDefense verdict shape; action denied.');
         const permission = decision.hookSpecificOutput?.permissionDecision || decision.permissionDecision || decision.permission;
         let denied = result.exitCode !== 0 || permission === 'deny' || decision.decision === 'block' || decision.continue === false;
-        const reason = decision.hookSpecificOutput?.permissionDecisionReason || decision.permissionDecisionReason || decision.reason || decision.user_message || result.stderr || 'FullCourtDefense policy decision.';
+        let reason = decision.hookSpecificOutput?.permissionDecisionReason || decision.permissionDecisionReason || decision.reason || decision.user_message || result.stderr || 'FullCourtDefense policy decision.';
         if (permission === 'ask' && !denied) {
+            // No dialog could be shown (headless, binary missing) or the org routes asks to
+            // the IDE — these clients have no ask card of their own, so this is a deny.
             const mapped = (0, hook_1.normalizeClaudePayload)(payload);
             const call = mapped && mapped.event !== 'ignore' ? (0, hook_1.buildToolCall)(mapped.event, mapped.payload) : null;
-            // No remembered/pending handoff remains when an external dialog is used.
+            // No pending handoff remains: nothing will settle it.
             if (call && mapped)
                 (0, devConfirm_1.rejectDeveloperConfirmation)(mapped.event, call.toolName, (0, devConfirm_1.actionDigest)(call.toolArgs));
-            let allowed = false;
-            try {
-                allowed = (0, devConfirm_1.isHumanPresent)() && await confirm(`${client}: ${payload.tool_name}\n${reason}`);
-            }
-            catch { /* deny */ }
-            denied = !allowed;
-            // Hand the click to the MCP gateway that will see this exact call next, so the
-            // developer is not asked twice for one action (single-use, 2-minute, exact digest).
-            if (allowed && call && mapped?.event === 'mcp')
-                (0, devConfirm_1.recordConfirmedAction)(call.toolName, (0, devConfirm_1.actionDigest)(call.toolArgs));
-            (0, telemetry_1.spoolEvent)({ decision: allowed ? 'allow' : 'block', toolName: call?.toolName || payload.tool_name,
-                reason: allowed ? 'Developer approved once in the FullCourtDefense dialog.' : 'Developer declined, confirmation unavailable, or timed out.',
-                approvalScope: 'developer', ...(allowed ? { approvedBy: 'developer' } : {}) });
+            denied = true;
+            const why = (0, devConfirm_1.isHumanPresent)()
+                ? 'Developer confirmation could not be shown (no dialog available on this machine).'
+                : 'Developer confirmation requires a person at the keyboard; none is present.';
+            (0, telemetry_1.spoolEvent)({ decision: 'block', toolName: call?.toolName || payload.tool_name, reason: why, approvalScope: 'developer' });
+            // The ask text ends in a question the client cannot put to anyone; say why it was not run.
+            reason = `${reason}\nFullCourtDefense: ${why} The action was not run.`;
         }
         // Prompt blocks use the documented exit-code contract, not a PreToolUse object.
         if (payload.hook_event_name === 'UserPromptSubmit' && denied)

package/dist/policyRefresh.d.ts

@@ -0,0 +1,3 @@
+import { type FetchBundleInput, type EffectiveBundle } from './runtimeConfig';
+/** A remote refresh succeeds only after both policy caches have a verified replacement. */
+export declare function refreshMachinePolicies(input: FetchBundleInput): Promise<EffectiveBundle>;

package/dist/policyRefresh.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshMachinePolicies = refreshMachinePolicies;
+const runtimeConfig_1 = require("./runtimeConfig");
+const localSafetySnapshot_1 = require("./localSafetySnapshot");
+const distress_1 = require("./distress");
+/** A remote refresh succeeds only after both policy caches have a verified replacement. */
+async function refreshMachinePolicies(input) {
+    const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ ...input, force: true, requireServerValidation: true });
+    if (!bundle.policyHash)
+        throw new Error('The policy bundle did not include a hash for shell policy verification');
+    const identity = (0, localSafetySnapshot_1.hookSnapshotIdentity)();
+    const snapshot = await (0, localSafetySnapshot_1.loadLocalSafetySnapshot)({
+        apiUrl: input.apiUrl, shieldId: input.shieldId, shieldKey: input.shieldKey,
+        ...identity, expectedPolicyHash: bundle.policyHash, timeoutMs: input.timeoutMs,
+        requireServerValidation: true,
+    });
+    // Keep the new cache readable throughout invalidation. Older gateway keys
+    // then resolve the fresh snapshot instead of a removed or stale replacement.
+    if (!snapshot)
+        throw new Error('Shell policy refresh did not return a verified snapshot');
+    if (!(0, localSafetySnapshot_1.clearAllLocalSafetySnapshotCaches)(snapshot.policyHash)) {
+        throw new Error('Policy refresh could not remove stale shell policy caches; check file permissions and retry');
+    }
+    (0, distress_1.clearDistress)(distress_1.DISTRESS.POLICY_CACHE_WRITE_FAILED, 'shell_policy');
+    return bundle;
+}

package/dist/protectionMaintenance.d.ts

@@ -0,0 +1,10 @@
+export type ConfigurationSnapshot = Map<string, string>;
+/** Content, absence and unreadability are distinct. Never retain config values. */
+export declare function captureProtectionConfiguration(files: Iterable<string>): ConfigurationSnapshot;
+export declare function changedProtectionConfiguration(before: ConfigurationSnapshot, after: ConfigurationSnapshot): string[];
+export type ProtectionNotice = 'attention' | 'restored';
+/** Routine success is silent. One warning per unresolved incident, then recovery. */
+export declare function protectionNoticeTransition(attentionShown: boolean, healthy: boolean, quiet: boolean): {
+    attentionShown: boolean;
+    notice?: ProtectionNotice;
+};

package/dist/protectionMaintenance.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureProtectionConfiguration = captureProtectionConfiguration;
+exports.changedProtectionConfiguration = changedProtectionConfiguration;
+exports.protectionNoticeTransition = protectionNoticeTransition;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+/** Content, absence and unreadability are distinct. Never retain config values. */
+function captureProtectionConfiguration(files) {
+    const result = new Map();
+    for (const file of files) {
+        try {
+            result.set(file, crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'));
+        }
+        catch (error) {
+            result.set(file, `unreadable:${error.code || 'unknown'}`);
+        }
+    }
+    return result;
+}
+function changedProtectionConfiguration(before, after) {
+    return [...after].filter(([file, fingerprint]) => before.get(file) !== fingerprint).map(([file]) => file);
+}
+/** Routine success is silent. One warning per unresolved incident, then recovery. */
+function protectionNoticeTransition(attentionShown, healthy, quiet) {
+    if (healthy)
+        return { attentionShown: false, notice: attentionShown && !quiet ? 'restored' : undefined };
+    if (quiet || attentionShown)
+        return { attentionShown };
+    return { attentionShown: true, notice: 'attention' };
+}

package/dist/protectionProfile.d.ts

@@ -0,0 +1,26 @@
+/** Pure contract. Vendored into the CLI; the sync test prevents drift. */
+export interface ProtectionProfile {
+    version: 1;
+    name: string;
+    platform: 'win32' | 'linux' | 'darwin';
+    workspace: string;
+    writableFolders: string[];
+    blockedFolders: string[];
+    allowedSites: string[];
+    blockedSites: string[];
+}
+export declare function parseProtectionProfile(value: unknown): ProtectionProfile;
+export declare function protectionRuntimeSettings(profile: ProtectionProfile): {
+    filesystem: {
+        allowRead: string[];
+        denyRead: string[];
+        allowWrite: string[];
+        denyWrite: string[];
+    };
+    network: {
+        allowedDomains: string[];
+        deniedDomains: string[];
+    };
+    enableWeakerNestedSandbox: boolean;
+    enableWeakerNetworkIsolation: boolean;
+};

package/dist/protectionProfile.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseProtectionProfile = parseProtectionProfile;
+exports.protectionRuntimeSettings = protectionRuntimeSettings;
+function parseProtectionProfile(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('A protection profile is required.');
+    const p = value;
+    const keys = ['version', 'name', 'platform', 'workspace', 'writableFolders', 'blockedFolders', 'allowedSites', 'blockedSites'];
+    if (Object.keys(p).some(key => !keys.includes(key)))
+        throw new Error('Unknown profile setting.');
+    if (p.version !== 1 || !['win32', 'linux', 'darwin'].includes(String(p.platform)))
+        throw new Error('Choose the computer operating system.');
+    if (typeof p.name !== 'string' || !p.name.trim() || p.name.length > 80 || /[\x00-\x1f]/.test(p.name))
+        throw new Error('Enter a profile name (1–80 characters).');
+    const folder = (v) => {
+        if (typeof v !== 'string' || v.length > 500 || /[\x00-\x1f*?<>"|$`%]/.test(v))
+            throw new Error('Use a full local folder path without wildcards or variables.');
+        const windows = p.platform === 'win32';
+        if (windows ? !/^[A-Za-z]:[\\/]/.test(v) || v.slice(2).includes(':') : !v.startsWith('/') || v.startsWith('//'))
+            throw new Error('Use a full local folder path for this computer.');
+        const normalized = windows ? v.replace(/\\/g, '/') : v;
+        if (normalized.split('/').some(part => part === '.' || part === '..'))
+            throw new Error('Folder paths cannot contain . or .. segments.');
+        if (windows && normalized.split('/').slice(1).some(part => /[. ]$/.test(part)))
+            throw new Error('Windows folder names cannot end with a dot or space.');
+        if (/^[A-Za-z]:\/$/.test(normalized))
+            return normalized;
+        return normalized.replace(/\/+$/, '') || '/';
+    };
+    const site = (v) => {
+        if (typeof v !== 'string' || v.length > 253 || !/^(?:\*\.)?[a-zA-Z0-9](?:[a-zA-Z0-9.-]*[a-zA-Z0-9])?$/.test(v))
+            throw new Error('Enter a hostname such as example.com or *.example.com, without a URL or port.');
+        const host = v.replace(/^\*\./, '');
+        if (host.split('.').some(part => !part || part.length > 63 || part.startsWith('-') || part.endsWith('-')))
+            throw new Error('Enter a valid hostname.');
+        return v.toLowerCase();
+    };
+    const list = (key, parse) => {
+        const values = p[key];
+        if (!Array.isArray(values) || values.length > 50)
+            throw new Error(`Choose at most 50 entries for ${key}.`);
+        return [...new Set(values.map(parse))].sort();
+    };
+    const result = { version: 1, name: p.name.trim(), platform: p.platform, workspace: folder(p.workspace),
+        writableFolders: list('writableFolders', folder), blockedFolders: list('blockedFolders', folder), allowedSites: list('allowedSites', site), blockedSites: list('blockedSites', site) };
+    const compare = (v) => result.platform === 'win32' ? v.toLowerCase() : v;
+    const within = (child, parent) => compare(child) === compare(parent) || compare(child).startsWith(compare(parent).replace(/\/$/, '') + '/');
+    if (result.blockedFolders.some(blocked => within(result.workspace, blocked)))
+        throw new Error('The working folder cannot be inside a blocked folder.');
+    if (result.writableFolders.some(allowed => result.blockedFolders.some(blocked => within(allowed, blocked))))
+        throw new Error('A writable folder cannot be inside a blocked folder.');
+    return result;
+}
+function protectionRuntimeSettings(profile) {
+    const p = parseProtectionProfile(profile);
+    const native = (paths) => p.platform === 'win32' ? paths.map(value => value.replace(/\//g, '\\')) : paths;
+    return {
+        filesystem: { allowRead: [], denyRead: native(p.blockedFolders), allowWrite: native(p.writableFolders), denyWrite: native(p.blockedFolders) },
+        network: { allowedDomains: p.allowedSites, deniedDomains: p.blockedSites },
+        enableWeakerNestedSandbox: false, enableWeakerNetworkIsolation: false,
+    };
+}

package/dist/runtimeConfig.d.ts

@@ -16,6 +16,8 @@ import type { EngineActionPolicy } from './actionPolicyEngine';
  */
 export type ShieldMode = 'block' | 'monitor' | 'shadow';
 export interface RuntimeBundle {
+    mcpToolTrust?: import('./machineActionVerify').VerifiableMachineAction | null;
+    protectionProfile?: import('./machineActionVerify').VerifiableMachineAction | null;
     mode: ShieldMode;
     version: string;
     policyHash?: string;