haechi 1.2.0 → 1.3.1

package/packages/cli/bin/haechi.mjs

@@ -549,6 +549,8 @@ async function mcpStdioCommand(argv) {
   await runMcpStdioFilter({ runtime });
 }
 
+const STDERR_MODES = new Set(["filter", "drop", "inherit"]);
+
 async function mcpWrapCommand(argv) {
   const separator = argv.indexOf("--");
   if (separator === -1 || !argv[separator + 1]) {
@@ -558,21 +560,108 @@ async function mcpWrapCommand(argv) {
   const command = argv[separator + 1];
   const commandArgs = argv.slice(separator + 2);
 
+  // --stderr controls how the child's stderr crosses the local-process boundary.
+  // filter (default) runs each line through the same Haechi protection as MCP
+  // traffic before re-emitting; drop discards it; inherit is the raw passthrough
+  // (an explicit, opt-in local-process boundary). Unknown values fail closed.
+  const stderrMode = options.stderr === undefined ? "filter" : options.stderr;
+  if (!STDERR_MODES.has(stderrMode)) {
+    throw new Error(`mcp-wrap --stderr must be one of: filter | drop | inherit (got ${JSON.stringify(stderrMode)})`);
+  }
+
   const config = await loadConfig(options.config ?? DEFAULT_CONFIG_PATH);
   const runtime = createRuntime(config);
 
+  // "inherit" hands the child's stderr straight to the terminal (raw, unfiltered);
+  // filter/drop pipe it so the wrapper can inspect or discard each line.
   const child = spawn(command, commandArgs, {
-    stdio: ["pipe", "pipe", "inherit"]
+    stdio: ["pipe", "pipe", stderrMode === "inherit" ? "inherit" : "pipe"]
   });
 
   for (const signal of ["SIGINT", "SIGTERM"]) {
     process.on(signal, () => child.kill(signal));
   }
 
+  if (stderrMode === "filter") {
+    pipeFilteredStderr({ runtime, child });
+  } else if (stderrMode === "drop") {
+    // Consume so the child's stderr pipe never fills and stalls the child, but
+    // re-emit nothing.
+    child.stderr?.resume();
+  }
+
   const { code } = await wrapMcpChild({ runtime, child });
   process.exitCode = code;
 }
 
+// Filter the child's stderr through the SAME protection the wrapper applies to
+// MCP traffic, then re-emit each safe line to the parent process.stderr. Each
+// complete line is protected as text via the runtime's haechi instance (redact/
+// mask rewrite detected secrets/PII in place); a block-action detection drops the
+// line entirely. Partial lines are buffered across chunk boundaries (split on \n;
+// hold the trailing partial, flushed on stream end).
+function pipeFilteredStderr({ runtime, child, stderr = process.stderr }) {
+  const source = child.stderr;
+  if (!source) {
+    return;
+  }
+  source.setEncoding("utf8");
+  let buffer = "";
+  // Serialize async protection so lines re-emit in source order even though
+  // protectStderrLine is async.
+  let queue = Promise.resolve();
+
+  function enqueue(line) {
+    queue = queue.then(async () => {
+      const safe = await protectStderrLine(runtime, line);
+      if (safe !== null) {
+        stderr.write(`${safe}\n`);
+      }
+    });
+  }
+
+  source.on("data", (chunk) => {
+    buffer += chunk;
+    let index;
+    while ((index = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, index);
+      buffer = buffer.slice(index + 1);
+      enqueue(line);
+    }
+  });
+  source.on("end", () => {
+    // Flush any trailing partial line (no terminating newline).
+    if (buffer.length > 0) {
+      enqueue(buffer);
+      buffer = "";
+    }
+  });
+}
+
+// Protect one stderr line as text. Returns the protected line (detected secrets/
+// PII redacted/masked in place), or null when a block-action detection means the
+// line must be dropped (not emitted). Uses the runtime's haechi stream/text
+// protector — the clean single-shot text entrypoint (protectText) that detects,
+// decides, and transforms a complete, self-contained text segment by offset, the
+// same logic the streaming delta channel commits with. A fresh protector per line
+// keeps no cross-line state (we already split on \n and buffer partials above).
+async function protectStderrLine(runtime, line) {
+  if (line.length === 0) {
+    return line;
+  }
+  const protector = runtime.haechi.createStreamProtector({
+    protocol: "mcp-stdio",
+    operation: "stderr",
+    direction: "response",
+    mode: runtime.config.policy.mode ?? runtime.config.mode
+  });
+  const result = await protector.protectText(line);
+  if (result.blocked) {
+    return null;
+  }
+  return result.text;
+}
+
 function parseOptions(argv) {
   const options = {};
   for (let index = 0; index < argv.length; index += 1) {
@@ -675,9 +764,9 @@ const COMMAND_HELP = {
     summary: "Filter MCP JSON-RPC traffic on stdin/stdout (one direction)."
   },
   "mcp-wrap": {
-    usage: "haechi mcp-wrap [--config haechi.config.json] -- <command> [args...]",
+    usage: "haechi mcp-wrap [--config haechi.config.json] [--stderr filter|drop|inherit] -- <command> [args...]",
     summary: "Wrap an MCP server with bidirectional stdio protection.",
-    detail: "Spawns <command>, applies the method allowlist + params protection client→server, and result protection + injection heuristics server→client. Drop-in for MCP client configs."
+    detail: "Spawns <command>, applies the method allowlist + params protection client→server, and result protection + injection heuristics server→client. Drop-in for MCP client configs. --stderr controls the child's stderr: filter (default) protects each line with the same policy before re-emitting, drop discards it, inherit passes it through raw (an explicit, opt-in local-process boundary). filter follows the configured policy mode — in dry-run/report-only it detects but does not transform (like the rest of the pipeline), so set policy.mode=enforce for stderr redaction to take effect."
   },
   auth: {
     usage: "haechi auth add --type user|service|agent [--scope k:v ...] [--label k=v ...]\n  haechi auth list [--config haechi.config.json]\n  haechi auth revoke <id> [--config haechi.config.json]",
@@ -737,7 +826,8 @@ Enforcement
 
 Upstream + proxy
   target.type               llm-http | openai-compatible | vllm-openai |
-                            ollama | llama-cpp                 (unknown = fail)
+                            ollama | llama-cpp | anthropic |
+                            gemini                             (unknown = fail)
   target.upstream           the only upstream the proxy forwards to
   proxy.host / proxy.port   127.0.0.1 / ${DEFAULT_PROXY_PORT}
                             non-loopback host needs --allow-remote-bind (CLI flag)
@@ -777,7 +867,7 @@ Audit integrity
   audit.anchor.everyRecords anchor cadence                      (default 1)
 
 Privacy + MCP
-  privacy.profile           kr-pipa | eu-gdpr | us-general | null
+  privacy.profile           kr-pipa | eu-gdpr | asia-pdpa | us-general | jp-appi | null
   mcp.allowedMethods        client-callable method allowlist
 
 Binding beyond loopback (0.0.0.0):

package/packages/cli/runtime.mjs

@@ -103,7 +103,13 @@ export function defaultConfig() {
       // allowlist [] = no operator FP exceptions. Both additive; neither can
       // suppress a hard-block type (secret/api_key/kr_rrn/card) — see core.
       minConfidence: 0,
-      allowlist: []
+      allowlist: [],
+      // WS2d residual — opt-in base64/percent decode-and-rescan. Default false =
+      // byte-identical to prior behavior (no decode). When true, a string leaf
+      // that looks base64/percent-encoded is decoded and rescanned; a decoded
+      // hit fails closed to a WHOLE-LEAF detection and only fires for a validator-
+      // backed / hard-block match (precision guard against random-base64 FPs).
+      decodeAndRescan: false
     },
     keys: {
       provider: "local",
@@ -592,6 +598,7 @@ export function normalizeConfig(config) {
   if (merged.auth.provider === "plugin") {
     validatePluginAuthConfig(merged);
   }
+  validateForwardHeaders(merged.target);
   createProtocolAdapter(merged.target);
   return merged;
 }
@@ -716,6 +723,11 @@ function validateFilters(filters) {
       }
     }
   }
+  // WS2d residual — opt-in base64/percent decode-and-rescan. Strict boolean,
+  // fail-closed: a non-boolean throws rather than silently coercing.
+  if (filters.decodeAndRescan !== undefined && typeof filters.decodeAndRescan !== "boolean") {
+    throw new Error("filters.decodeAndRescan must be a boolean");
+  }
 }
 
 function validatePolicyExtras(policy) {
@@ -925,6 +937,54 @@ function validatePluginAuthConfig(merged) {
   }
 }
 
+// P0-CR-001 — additive escape hatch for an unusual upstream that needs a header
+// the built-in allowlist does not cover. `target.forwardHeaders` is an OPTIONAL
+// array of extra lowercase header NAMES to forward to the upstream. Fail-closed:
+// it must be an array of non-empty strings, and it may NOT name a header that the
+// proxy always drops (ambient client credentials + hop-by-hop control headers) —
+// an operator cannot re-enable a gateway-credential leak through it. Absent =
+// the built-in default-drop allowlist alone (byte-identical to prior behavior).
+const FORWARD_HEADERS_FORBIDDEN = new Set([
+  "host",
+  "content-length",
+  "content-type",
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "proxy-authorization",
+  "connection",
+  "keep-alive",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+
+function validateForwardHeaders(target) {
+  if (target.forwardHeaders === undefined || target.forwardHeaders === null) {
+    return;
+  }
+  if (!Array.isArray(target.forwardHeaders)) {
+    throw new Error("target.forwardHeaders must be an array of lowercase header names");
+  }
+  const normalized = [];
+  for (const name of target.forwardHeaders) {
+    if (typeof name !== "string" || !name.trim()) {
+      throw new Error("target.forwardHeaders entries must be non-empty strings");
+    }
+    const lower = name.trim().toLowerCase();
+    if (lower !== name) {
+      throw new Error(`target.forwardHeaders entries must be lowercase header names (got: ${JSON.stringify(name)})`);
+    }
+    if (FORWARD_HEADERS_FORBIDDEN.has(lower)) {
+      throw new Error(`target.forwardHeaders may not include the always-dropped header ${JSON.stringify(lower)} (ambient credentials and hop-by-hop headers are never forwarded)`);
+    }
+    normalized.push(lower);
+  }
+  // Persist the validated, de-duplicated list back onto the normalized target.
+  target.forwardHeaders = [...new Set(normalized)];
+}
+
 function resolveAuthProvider(config, providers, cryptoProvider, auditSink) {
   if (config.auth.provider === "external") {
     if (typeof providers.authProvider?.authenticate !== "function") {

package/packages/core/index.mjs

@@ -148,6 +148,21 @@ export function createHaechi({ filterEngine, policyEngine, cryptoProvider, audit
     }
 
     return {
+      // Single-shot text protection for a complete, self-contained text payload
+      // (P1-CR-005): a parse-failed CONTENT frame whose data: text is NOT JSON
+      // (plain text, malformed/partial JSON, provider-specific text). It detects,
+      // decides, tallies, and either returns { text } or { blocked: true } — the
+      // SAME transformSegment logic the delta channel commits with. CRITICALLY it
+      // does NOT touch the cross-frame `pending` buffer, so inspecting a non-JSON
+      // frame's text cannot corrupt the JSON delta channel's sliding-buffer state.
+      // Per-frame inspection only: cross-frame buffering of arbitrary non-JSON
+      // frames is out of scope (the delta channel keeps its own buffer).
+      async protectText(text) {
+        if (typeof text !== "string" || text.length === 0) {
+          return { text: text ?? "", blocked: false };
+        }
+        return transformSegment(text);
+      },
       // Protect string leaves of a parsed frame OTHER than the incremental
       // delta text (e.g. tool-call arguments). Returns the mutated object.
       async protectFrameExtras(value) {

package/packages/crypto/index.mjs

@@ -4,6 +4,37 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 
 const ALG = "AES-256-GCM";
 
+// Single source of truth for parsing + validating an on-disk local key file.
+// Both the provider's loadKeys() and initLocalKeyFile() (existing-file path)
+// go through here so the 32-byte key invariant is enforced once. Throws a
+// specific error per defect so a corrupted-but-present file is caught at init
+// time instead of failing later during encrypt/decrypt/token/bundle.
+//
+// requireActive: init demands an explicit status:"active" key; the provider
+// keeps its historical fallback to keys[0] when none is marked active.
+async function loadKeyFile(keyFile, { requireActive = false } = {}) {
+  const raw = JSON.parse(await readFile(keyFile, "utf8"));
+  if (!raw.keys?.length) {
+    throw new Error(`No keys found in ${keyFile}`);
+  }
+  const byKid = new Map();
+  for (const entry of raw.keys) {
+    const key = Buffer.from(entry.k, "base64url");
+    if (key.length !== 32) {
+      throw new Error("AES-256-GCM local key must be 32 bytes");
+    }
+    byKid.set(entry.kid, { kid: entry.kid, key });
+  }
+  const activeEntry = raw.keys.find((key) => key.status === "active") ?? (requireActive ? null : raw.keys[0]);
+  if (!activeEntry) {
+    throw new Error("No active key found in local key file");
+  }
+  return {
+    active: byKid.get(activeEntry.kid),
+    byKid
+  };
+}
+
 export function createLocalCryptoProvider({ keyFile }) {
   if (!keyFile) {
     throw new Error("Local crypto provider requires keyFile");
@@ -15,23 +46,7 @@ export function createLocalCryptoProvider({ keyFile }) {
     if (cachedKeys) {
       return cachedKeys;
     }
-    const raw = JSON.parse(await readFile(keyFile, "utf8"));
-    if (!raw.keys?.length) {
-      throw new Error(`No keys found in ${keyFile}`);
-    }
-    const byKid = new Map();
-    for (const entry of raw.keys) {
-      const key = Buffer.from(entry.k, "base64url");
-      if (key.length !== 32) {
-        throw new Error("AES-256-GCM local key must be 32 bytes");
-      }
-      byKid.set(entry.kid, { kid: entry.kid, key });
-    }
-    const activeEntry = raw.keys.find((key) => key.status === "active") ?? raw.keys[0];
-    cachedKeys = {
-      active: byKid.get(activeEntry.kid),
-      byKid
-    };
+    cachedKeys = await loadKeyFile(keyFile);
     return cachedKeys;
   }
 
@@ -102,15 +117,22 @@ export async function initLocalKeyFile(keyFile, { force = false } = {}) {
   await mkdir(dirname(keyFile), { recursive: true });
 
   let existing = null;
+  let fileExists = true;
   try {
     existing = JSON.parse(await readFile(keyFile, "utf8"));
-    if (!force) {
-      return { created: false, keyFile };
-    }
   } catch (error) {
     if (error.code !== "ENOENT") {
       throw error;
     }
+    fileExists = false;
+  }
+
+  if (fileExists && !force) {
+    // A present key file must be usable, not merely present: validate the
+    // active key (base64url, 32 bytes) and every retired key before reporting
+    // success, so a corrupted file is rejected here rather than at first use.
+    await loadKeyFile(keyFile, { requireActive: true });
+    return { created: false, keyFile };
   }
 
   // Rotating with --force must not orphan existing envelopes/token vault