klyro 1.0.6 → 1.0.7

package/dist/mcp/remote.js

@@ -1,6 +1,17 @@
 import { McpError } from './client.js';
+import { AuthError, mcpTokenCacheKey, resolveAuth } from './auth.js';
 const PROTOCOL_VERSION = '2024-11-05';
 const DEFAULT_TIMEOUT_MS = 30_000;
+/** Loopback check shared with the SSE transport guard. */
+export function isLoopback(url) {
+    try {
+        const h = new URL(url).hostname.toLowerCase().replace(/^\[|\]$/g, '');
+        return h === 'localhost' || h === '127.0.0.1' || h === '::1' || h === '0.0.0.0' || h === '::' || h.startsWith('127.');
+    }
+    catch {
+        return false;
+    }
+}
 /** Parse a Streamable-HTTP SSE body (`data: {...}` lines) into JSON payloads. */
 export function parseSseBody(text) {
     const out = [];
@@ -24,15 +35,58 @@ export class RemoteMcpClient {
     nextId = 1;
     headers;
     timeoutMs;
+    authHeader = null;
     constructor(name, spec) {
         this.name = name;
         this.spec = spec;
         if (!spec.url)
             throw new McpError(`mcp server "${name}" has no url`, 'INVALID_SPEC');
+        // Fail-closed: refuse plaintext remote endpoints even if a spec bypassed
+        // schema validation (defense-in-depth; schema already rejects insecure http).
+        if (spec.url.startsWith('http:') && !isLoopback(spec.url) && process.env.KLYRO_ALLOW_INSECURE_MCP !== '1') {
+            throw new McpError(`insecure MCP server url (plain HTTP) for host ${new URL(spec.url).hostname} — use https:// or a loopback URL, or set KLYRO_ALLOW_INSECURE_MCP=1`, 'INVALID_SPEC');
+        }
         this.headers = { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream', ...(spec.headers ?? {}) };
         this.timeoutMs = spec.policy?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     }
+    /** B2: resolve OAuth bearer token; returns true when usable headers exist. */
+    async ensureAuth() {
+        if (!this.spec.auth || !this.spec.url)
+            return false;
+        if (this.authHeader)
+            return true;
+        const url = this.spec.url;
+        const cacheKey = mcpTokenCacheKey(url, this.spec.auth.clientId);
+        try {
+            const result = await resolveAuth(this.spec.auth, cacheKey);
+            if (result.headers['Authorization']) {
+                this.authHeader = result.headers['Authorization'];
+                return true;
+            }
+        }
+        catch (err) {
+            if (err instanceof AuthError)
+                throw err;
+            throw new AuthError(`auth flow failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return false;
+    }
+    /** Base headers merged with the OAuth bearer token (never mutates base). */
+    headersFor() {
+        return this.authHeader ? { ...this.headers, Authorization: this.authHeader } : this.headers;
+    }
     async connect() {
+        // B2: resolve OAuth/pkce bearer token (reuses cache, else interactive
+        // flow) and merge `Authorization` before the handshake. Non-fatal if no
+        // auth is configured.
+        if (this.spec.auth) {
+            try {
+                await this.ensureAuth();
+            }
+            catch (err) {
+                throw new McpError(`mcp server "${this.name}" auth failed: ${err instanceof Error ? err.message : String(err)}`, 'AUTH_ERROR');
+            }
+        }
         // Handshake doubles as reachability probe; failures surface typed errors.
         await this.request('initialize', {
             protocolVersion: PROTOCOL_VERSION,
@@ -43,7 +97,7 @@ export class RemoteMcpClient {
         try {
             await fetch(this.spec.url, {
                 method: 'POST',
-                headers: this.headers,
+                headers: this.headersFor(),
                 body: JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }),
                 signal: AbortSignal.timeout(5000),
             });
@@ -103,7 +157,7 @@ export class RemoteMcpClient {
         try {
             const res = await fetch(this.spec.url, {
                 method: 'POST',
-                headers: this.headers,
+                headers: this.headersFor(),
                 body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
                 signal: ctrl.signal,
             });

package/dist/mcp/sse.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Legacy HTTP+SSE MCP transport (MCP 2024-11-05 shape).
+ *
+ * Distinct from Streamable HTTP (`remote.ts`): the client opens a persistent
+ * GET event stream, waits for the `endpoint` event carrying the message POST
+ * URI, then POSTs each JSON-RPC request and matches responses by id off the
+ * shared stream. Used when `transport: 'sse'` is set on a `url` spec.
+ */
+import type { McpServerSpec } from './config.js';
+import { type McpClientLike, type McpToolDef, type McpCallResult, type McpResource, type McpPromptDef } from './client.js';
+/** Loopback check for the SSE constructor guard. */
+export declare function isLoopback(url: string): boolean;
+export declare class SseMcpClient implements McpClientLike {
+    readonly name: string;
+    private readonly spec;
+    private nextId;
+    private readonly pending;
+    private readonly headers;
+    private readonly timeoutMs;
+    private endpoint;
+    private streamAbort;
+    private pumpDone;
+    private dead;
+    private closed;
+    private authHeader;
+    constructor(name: string, spec: McpServerSpec);
+    /** Base + OAuth authorization header (merged per-request, never mutates base). */
+    private authHeadersFor;
+    /** B2: resolve OAuth bearer token; true when request headers carry it. */
+    private ensureAuth;
+    connect(): Promise<void>;
+    private pump;
+    private dispatch;
+    private failAll;
+    private request;
+    listTools(signal?: AbortSignal): Promise<McpToolDef[]>;
+    callTool(name: string, args: unknown, signal?: AbortSignal): Promise<McpCallResult>;
+    listResources(signal?: AbortSignal): Promise<McpResource[]>;
+    promptsList(signal?: AbortSignal): Promise<McpPromptDef[]>;
+    promptsGet(name: string, args?: Record<string, string>, signal?: AbortSignal): Promise<string>;
+    close(): Promise<void>;
+}

package/dist/mcp/sse.js

@@ -0,0 +1,310 @@
+import { McpError } from './client.js';
+import { AuthError, mcpTokenCacheKey, resolveAuth } from './auth.js';
+const DEFAULT_TIMEOUT_MS = 30_000;
+const CONNECT_TIMEOUT_MS = 15_000;
+/** Loopback check for the SSE constructor guard. */
+export function isLoopback(url) {
+    try {
+        const h = new URL(url).hostname.toLowerCase().replace(/^\[|\]$/g, '');
+        return h === 'localhost' || h === '127.0.0.1' || h === '::1' || h === '0.0.0.0' || h === '::' || h.startsWith('127.');
+    }
+    catch {
+        return false;
+    }
+}
+export class SseMcpClient {
+    name;
+    spec;
+    nextId = 1;
+    pending = new Map();
+    headers;
+    timeoutMs;
+    endpoint = null;
+    streamAbort = null;
+    pumpDone = null;
+    dead = null;
+    closed = false;
+    authHeader = null;
+    constructor(name, spec) {
+        this.name = name;
+        this.spec = spec;
+        if (!spec.url)
+            throw new McpError(`mcp server "${name}" has no url`, 'INVALID_SPEC');
+        // Fail-closed: refuse plaintext remote endpoints (defense-in-depth; the
+        // spec schema already rejects insecure remote http URLs at load time).
+        if (spec.url.startsWith('http:') && !isLoopback(spec.url) && process.env.KLYRO_ALLOW_INSECURE_MCP !== '1') {
+            throw new McpError(`insecure MCP server url (plain HTTP) for host ${new URL(spec.url).hostname} — use https:// or a loopback URL, or set KLYRO_ALLOW_INSECURE_MCP=1`, 'INVALID_SPEC');
+        }
+        this.headers = { ...(spec.headers ?? {}) };
+        this.timeoutMs = spec.policy?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    /** Base + OAuth authorization header (merged per-request, never mutates base). */
+    authHeadersFor() {
+        return this.authHeader ? { ...this.headers, Authorization: this.authHeader } : this.headers;
+    }
+    /** B2: resolve OAuth bearer token; true when request headers carry it. */
+    async ensureAuth() {
+        if (!this.spec.auth || !this.spec.url)
+            return false;
+        if (this.authHeader)
+            return true;
+        try {
+            const result = await resolveAuth(this.spec.auth, mcpTokenCacheKey(this.spec.url, this.spec.auth.clientId));
+            if (result.headers['Authorization']) {
+                this.authHeader = result.headers['Authorization'];
+                return true;
+            }
+        }
+        catch (err) {
+            if (err instanceof AuthError)
+                throw err;
+            throw new AuthError(`auth flow failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return false;
+    }
+    async connect() {
+        if (this.endpoint)
+            return;
+        if (this.closed)
+            throw new McpError(`mcp server "${this.name}" is closed`, 'CLOSED');
+        // B2: resolve OAuth bearer token before the GET stream handshake.
+        if (this.spec.auth && (await this.ensureAuth()) === false) {
+            throw new McpError(`mcp server "${this.name}" auth produced no token`, 'AUTH_ERROR');
+        }
+        this.streamAbort = new AbortController();
+        const endpointP = new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(new McpError(`mcp server "${this.name}" SSE endpoint timeout`, 'TIMEOUT')), CONNECT_TIMEOUT_MS);
+            this.pumpDone = this.pump(timer, resolve, reject).catch(() => undefined);
+        });
+        this.endpoint = await endpointP;
+        // Standard initialize handshake over the discovered message endpoint.
+        await this.request('initialize', {
+            protocolVersion: '2024-11-05',
+            capabilities: {},
+            clientInfo: { name: 'klyro', version: 'sse' },
+        });
+    }
+    async pump(timer, onEndpoint, onFatal) {
+        let buf = '';
+        let eventType = '';
+        let gotEndpoint = false;
+        try {
+            const res = await fetch(this.spec.url, {
+                headers: { ...this.authHeadersFor(), Accept: 'text/event-stream' },
+                signal: this.streamAbort.signal,
+            });
+            if (!res.ok || !res.body) {
+                throw new McpError(`mcp server "${this.name}" SSE GET failed: HTTP ${res.status}`, 'HTTP_ERROR', { status: res.status });
+            }
+            const reader = res.body.getReader();
+            const decoder = new TextDecoder();
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                buf += decoder.decode(value, { stream: true });
+                let idx;
+                while ((idx = buf.indexOf('\n')) !== -1) {
+                    const line = buf.slice(0, idx).replace(/\r$/, '');
+                    buf = buf.slice(idx + 1);
+                    if (line === '') {
+                        eventType = '';
+                        continue;
+                    }
+                    if (line.startsWith('event:')) {
+                        eventType = line.slice(6).trim();
+                        continue;
+                    }
+                    if (!line.startsWith('data:'))
+                        continue;
+                    const data = line.slice(5).trim();
+                    if (eventType === 'endpoint' && !gotEndpoint) {
+                        gotEndpoint = true;
+                        clearTimeout(timer);
+                        try {
+                            onEndpoint(new URL(data, this.spec.url).toString());
+                        }
+                        catch {
+                            onFatal(new McpError(`mcp server "${this.name}" sent a bad endpoint URI`, 'PROTOCOL_ERROR'));
+                            return;
+                        }
+                        eventType = '';
+                        continue;
+                    }
+                    let msg = null;
+                    try {
+                        msg = JSON.parse(data);
+                    }
+                    catch {
+                        continue;
+                    }
+                    this.dispatch(msg);
+                    eventType = '';
+                }
+            }
+        }
+        catch (err) {
+            if (!gotEndpoint) {
+                clearTimeout(timer);
+                onFatal(err instanceof McpError ? err : new McpError(`mcp server "${this.name}" SSE stream failed: ${err instanceof Error ? err.message : String(err)}`, 'IO_ERROR'));
+                return;
+            }
+            this.failAll(new McpError(`mcp server "${this.name}" SSE stream closed`, 'SERVER_EXITED'));
+        }
+    }
+    dispatch(msg) {
+        if (!msg || typeof msg !== 'object')
+            return;
+        const m = msg;
+        if (typeof m.id !== 'number')
+            return; // notifications are ignored
+        const p = this.pending.get(m.id);
+        if (!p)
+            return;
+        this.pending.delete(m.id);
+        clearTimeout(p.timer);
+        clearTimeout(p.timer);
+        if (m.error)
+            p.reject(new McpError(`mcp server "${this.name}" error: ${m.error.message ?? 'unknown'}`, 'SERVER_ERROR', m.error));
+        else
+            p.resolve(m.result ?? {});
+    }
+    failAll(err) {
+        if (!this.dead)
+            this.dead = err;
+        for (const [id, p] of [...this.pending]) {
+            this.pending.delete(id);
+            clearTimeout(p.timer);
+            p.reject(err);
+        }
+    }
+    async request(method, params, signal) {
+        if (this.closed)
+            throw new McpError(`mcp server "${this.name}" is closed`, 'CLOSED');
+        if (this.dead)
+            throw this.dead;
+        if (!this.endpoint)
+            throw new McpError(`mcp server "${this.name}" not connected`, 'NOT_CONNECTED');
+        if (signal?.aborted)
+            throw new McpError(`mcp call "${method}" aborted`, 'ABORTED');
+        const id = this.nextId++;
+        const drop = () => {
+            const p = this.pending.get(id);
+            if (p) {
+                this.pending.delete(id);
+                clearTimeout(p.timer);
+            }
+        };
+        const out = new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new McpError(`mcp call "${method}" timed out after ${this.timeoutMs}ms`, 'TIMEOUT'));
+            }, this.timeoutMs);
+            this.pending.set(id, { resolve, reject, timer });
+            signal?.addEventListener('abort', () => {
+                if (!this.pending.has(id))
+                    return;
+                this.pending.delete(id);
+                clearTimeout(timer);
+                reject(new McpError(`mcp call "${method}" aborted`, 'ABORTED'));
+            }, { once: true });
+        });
+        try {
+            const res = await fetch(this.endpoint, {
+                method: 'POST',
+                headers: { ...this.authHeadersFor(), 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' },
+                body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
+                signal: signal ?? undefined,
+            });
+            if (!res.ok && res.status !== 202) {
+                const text = await res.text().catch(() => '');
+                drop();
+                throw new McpError(`mcp server "${this.name}" HTTP ${res.status}: ${text.slice(0, 300)}`, 'HTTP_ERROR', { status: res.status });
+            }
+            // 202 Accepted with no body can precede the response on the stream.
+            if (res.status === 202) {
+                const text = await res.text().catch(() => '');
+                if (text.trim()) {
+                    try {
+                        const body = JSON.parse(text);
+                        if (body && typeof body === 'object' && 'error' in body && body.error) {
+                            drop();
+                            throw new McpError(`mcp server "${this.name}" error`, 'SERVER_ERROR', body.error);
+                        }
+                        if (body && typeof body === 'object' && 'result' in body) {
+                            drop();
+                            return body.result;
+                        }
+                    }
+                    catch (err) {
+                        if (err instanceof McpError)
+                            throw err;
+                        // Not inline JSON — fall through to stream matching.
+                    }
+                }
+            }
+        }
+        catch (err) {
+            if (err instanceof McpError && err.code !== 'HTTP_ERROR')
+                throw err;
+            if (err instanceof McpError)
+                throw err;
+            drop();
+            throw new McpError(`mcp call "${method}" failed: ${err instanceof Error ? err.message : String(err)}`, 'IO_ERROR');
+        }
+        return out;
+    }
+    async listTools(signal) {
+        const res = (await this.request('tools/list', {}, signal));
+        return Array.isArray(res.tools) ? res.tools : [];
+    }
+    async callTool(name, args, signal) {
+        const res = (await this.request('tools/call', { name, arguments: args ?? {} }, signal));
+        const blocks = Array.isArray(res.content) ? res.content : [];
+        const text = blocks.map((b) => (typeof b.text === 'string' ? b.text : JSON.stringify(b))).join('\n');
+        return { text, isError: res.isError === true, raw: res };
+    }
+    async listResources(signal) {
+        const res = (await this.request('resources/list', {}, signal));
+        return Array.isArray(res.resources) ? res.resources : [];
+    }
+    async promptsList(signal) {
+        try {
+            const res = (await this.request('prompts/list', {}, signal));
+            return Array.isArray(res.prompts) ? res.prompts : [];
+        }
+        catch (err) {
+            if (err instanceof McpError && err.code === 'SERVER_ERROR' && err.details?.code === -32601)
+                return [];
+            throw err;
+        }
+    }
+    async promptsGet(name, args, signal) {
+        const res = (await this.request('prompts/get', { name, arguments: args ?? {} }, signal));
+        const parts = [];
+        if (typeof res.description === 'string' && res.description)
+            parts.push(res.description);
+        for (const m of Array.isArray(res.messages) ? res.messages : []) {
+            const c = m.content;
+            if (c && typeof c.text === 'string')
+                parts.push(c.text);
+            else if (c !== undefined)
+                parts.push(JSON.stringify(c));
+        }
+        return parts.join('\n\n');
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        try {
+            this.streamAbort?.abort();
+        }
+        catch { /* ignore */ }
+        this.failAll(new McpError(`mcp server "${this.name}" closed`, 'CLOSED'));
+        try {
+            await this.pumpDone;
+        }
+        catch { /* ignore */ }
+    }
+}

package/dist/persistence/audit.d.ts

@@ -84,19 +84,31 @@ export declare function canonicalJson(value: unknown): string;
 export declare function sha256Hex(s: string): string;
 /** Hash of a chained record excluding its own `hash` field. */
 export declare function hashAuditRecord(record: Record<string, unknown>): string;
+/** Default rotation bound: 1 MiB live segment, 5 rotated segments kept. */
+export declare const AUDIT_MAX_BYTES = 1048576;
+export declare const AUDIT_ROTATE_KEEP = 5;
 export declare class AuditLog {
     private readonly filePath;
+    private readonly maxBytes;
+    private readonly keepSegments;
     /** Serializes chained appends so concurrent writes can't fork the chain. */
     private chain;
-    constructor(filePath: string);
+    /**
+     * Cached last-written hash: avoids re-reading the whole file (O(n) per
+     * write) on every append. Null = not loaded yet — first append reads the
+     * file (picks up an existing chain), then the cache takes over.
+     */
+    private lastHash;
+    constructor(filePath: string, maxBytes?: number, keepSegments?: number);
     write(event: AuditEvent): Promise<void>;
     private appendChained;
 }
 /**
- * Recompute the hash chain of a session JSONL file.
+ * Recompute the hash chain of a session JSONL file, including rotated
+ * segments (`.jsonl.1` … `.jsonl.keep` each verified as its own chain).
  * Sessions live at `<sessionsDir>/<sessionId>.jsonl` (see SessionStore).
  */
-export declare function verifyAuditChain(sessionsDir: string, sessionId: string): Promise<{
+export declare function verifyAuditChain(sessionsDir: string, sessionId: string, keepSegments?: number): Promise<{
     ok: boolean;
     events: number;
     error?: string;

package/dist/persistence/audit.js

@@ -57,12 +57,56 @@ async function prevHashFor(filePath) {
         return sha256Hex(last);
     }
 }
+/** Default rotation bound: 1 MiB live segment, 5 rotated segments kept. */
+export const AUDIT_MAX_BYTES = 1_048_576;
+export const AUDIT_ROTATE_KEEP = 5;
+/**
+ * Rotate an audit log once it exceeds `maxBytes`: shift the newest segment
+ * over the oldest (deleted), leave a fresh live file. Each segment carries
+ * its own GENESIS-rooted chain, so rotation is tamper-evident per segment.
+ * Returns true when a rotation actually happened (the caller must reset its
+ * in-memory chain tip to GENESIS — the next live record starts a fresh
+ * chain). Best-effort — rotation failures never break appends.
+ */
+async function rotateAuditLog(filePath, maxBytes, keep) {
+    try {
+        const stat = await fs.stat(filePath);
+        if (stat.size <= maxBytes)
+            return false;
+        try {
+            await fs.rm(`${filePath}.${keep}`, { force: true });
+        }
+        catch { /* best-effort */ }
+        for (let i = keep - 1; i >= 1; i--) {
+            try {
+                await fs.rename(`${filePath}.${i}`, `${filePath}.${i + 1}`);
+            }
+            catch { /* missing segment */ }
+        }
+        await fs.rename(filePath, `${filePath}.1`);
+        return true;
+    }
+    catch {
+        /* stat failure (no file yet) — nothing to rotate */
+        return false;
+    }
+}
 export class AuditLog {
     filePath;
+    maxBytes;
+    keepSegments;
     /** Serializes chained appends so concurrent writes can't fork the chain. */
     chain = Promise.resolve();
-    constructor(filePath) {
+    /**
+     * Cached last-written hash: avoids re-reading the whole file (O(n) per
+     * write) on every append. Null = not loaded yet — first append reads the
+     * file (picks up an existing chain), then the cache takes over.
+     */
+    lastHash = null;
+    constructor(filePath, maxBytes = AUDIT_MAX_BYTES, keepSegments = AUDIT_ROTATE_KEEP) {
         this.filePath = filePath;
+        this.maxBytes = maxBytes;
+        this.keepSegments = keepSegments;
     }
     async write(event) {
         const task = this.chain.then(() => this.appendChained(event));
@@ -71,24 +115,28 @@ export class AuditLog {
         return task;
     }
     async appendChained(event) {
-        const prevHash = await prevHashFor(this.filePath);
+        // Rotation leaves a fresh live file and resets the in-memory tip: the
+        // next live record restarts at GENESIS (each segment is its own chain).
+        const rotated = await rotateAuditLog(this.filePath, this.maxBytes, this.keepSegments);
+        if (rotated)
+            this.lastHash = AUDIT_GENESIS;
+        if (this.lastHash === null)
+            this.lastHash = await prevHashFor(this.filePath);
+        const prevHash = this.lastHash;
         const body = { ...event, prevHash };
         const record = { ...body, prevHash, hash: sha256Hex(canonicalJson(body)) };
+        this.lastHash = record.hash;
         await SessionStore.appendJsonl(this.filePath, record);
     }
 }
-/**
- * Recompute the hash chain of a session JSONL file.
- * Sessions live at `<sessionsDir>/<sessionId>.jsonl` (see SessionStore).
- */
-export async function verifyAuditChain(sessionsDir, sessionId) {
-    const filePath = path.join(sessionsDir, `${sessionId}.jsonl`);
+/** Recompute one segment's chain; returns verified lines or a numbered error. */
+async function verifySegment(filePath, segmentLabel) {
     let raw;
     try {
         raw = await fs.readFile(filePath, 'utf-8');
     }
     catch {
-        return { ok: false, events: 0, error: `audit log not found: ${filePath}` };
+        return { events: 0, error: `${segmentLabel}: not found` };
     }
     const lines = raw.split('\n').filter((l) => l.trim());
     let expectedPrev = AUDIT_GENESIS;
@@ -100,16 +148,39 @@ export async function verifyAuditChain(sessionsDir, sessionId) {
             parsed = JSON.parse(line);
         }
         catch {
-            return { ok: false, events, error: `line ${i + 1}: unparseable JSON` };
+            return { events, error: `${segmentLabel}:${i + 1}: unparseable JSON` };
         }
         if (parsed.prevHash !== expectedPrev) {
-            return { ok: false, events, error: `line ${i + 1}: prevHash mismatch (chain fork or truncation)` };
+            return { events, error: `${segmentLabel}:${i + 1}: prevHash mismatch (chain fork or truncation)` };
         }
         if (typeof parsed.hash !== 'string' || parsed.hash !== hashAuditRecord(parsed)) {
-            return { ok: false, events, error: `line ${i + 1}: hash mismatch (tampered record)` };
+            return { events, error: `${segmentLabel}:${i + 1}: hash mismatch (tampered record)` };
         }
         expectedPrev = parsed.hash;
         events++;
     }
-    return { ok: true, events };
+    return { events };
+}
+/**
+ * Recompute the hash chain of a session JSONL file, including rotated
+ * segments (`.jsonl.1` … `.jsonl.keep` each verified as its own chain).
+ * Sessions live at `<sessionsDir>/<sessionId>.jsonl` (see SessionStore).
+ */
+export async function verifyAuditChain(sessionsDir, sessionId, keepSegments = AUDIT_ROTATE_KEEP) {
+    let totalEvents = 0;
+    for (let i = keepSegments; i >= 1; i--) {
+        const label = `${sessionId}.jsonl.${i}`;
+        const seg = await verifySegment(path.join(sessionsDir, label), label);
+        if (seg.error) {
+            if (seg.error.endsWith(': not found'))
+                continue; // missing rotated segment is fine
+            return { ok: false, events: totalEvents, error: seg.error };
+        }
+        totalEvents += seg.events;
+    }
+    const live = await verifySegment(path.join(sessionsDir, `${sessionId}.jsonl`), `${sessionId}.jsonl`);
+    if (live.error)
+        return { ok: false, events: totalEvents, error: live.error };
+    totalEvents += live.events;
+    return { ok: true, events: totalEvents };
 }

package/dist/persistence/store.d.ts

@@ -74,6 +74,15 @@ export declare class SessionStore {
     appendObservation(id: string, obs: StoredObservation): Promise<void>;
     setStatus(id: string, status: SessionStatus, finalText?: string): Promise<void>;
     loadMessages(id: string): Promise<StoredMessage[]>;
+    /**
+     * Conversation rewind: drop messages (and observations) at or after
+     * `cutoffTs`, keeping everything older. Returns the removed counts.
+     * Used by `/rewind <n> full` to restore the conversation alongside code.
+     */
+    truncateMessages(id: string, cutoffTs: number): Promise<{
+        messages: number;
+        observations: number;
+    }>;
     loadObservations(id: string): Promise<StoredObservation[]>;
     list(filter?: {
         status?: SessionStatus;

package/dist/persistence/store.js

@@ -316,6 +316,23 @@ export class SessionStore {
         const data = await this.readSession(id);
         return data.messages;
     }
+    /**
+     * Conversation rewind: drop messages (and observations) at or after
+     * `cutoffTs`, keeping everything older. Returns the removed counts.
+     * Used by `/rewind <n> full` to restore the conversation alongside code.
+     */
+    async truncateMessages(id, cutoffTs) {
+        return this.withLock(id, async () => {
+            const data = await this.readSession(id);
+            const keptMessages = data.messages.filter((m) => (typeof m.ts === 'number' ? m.ts : 0) < cutoffTs);
+            const keptObs = data.observations.filter((o) => (typeof o.startedAt === 'number' ? o.startedAt : 0) < cutoffTs);
+            const removed = { messages: data.messages.length - keptMessages.length, observations: data.observations.length - keptObs.length };
+            data.messages = keptMessages;
+            data.observations = keptObs;
+            await this.writeSession(id, data);
+            return removed;
+        });
+    }
     async loadObservations(id) {
         const data = await this.readSession(id);
         return data.observations;

package/dist/policy/engine.js

@@ -353,6 +353,15 @@ export const shellDenyRule = {
         if (/\bStart-BitsTransfer\b/i.test(cmd)) {
             return { action: 'deny', reason: 'exfiltration: Start-BitsTransfer denied' };
         }
+        // Windows has no native sandbox backend, so PowerShell network primitives
+        // are the primary upload/exfil vectors there — denied outright (mirrors
+        // shell_exec DANGEROUS_PATTERNS).
+        if (/\b(Invoke-WebRequest|iwr)\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: Invoke-WebRequest/iwr denied (no win32 sandbox backend)' };
+        }
+        if (/\bSystem\.Net\.WebClient\b/i.test(cmd)) {
+            return { action: 'deny', reason: 'exfiltration: System.Net.WebClient denied (no win32 sandbox backend)' };
+        }
         // Protected-branch push deny (mirrors shell_exec DANGEROUS_PATTERNS).
         // Explicit `git push ... main|master|production` is denied outright;
         // a bare `git push` (no ref args) is denied when the checkout is on a