pecta-proxy 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing the Work or
+      Derivative Works thereof, You may choose to offer, and charge a
+      fee for, acceptance of support, warranty, indemnity, or other
+      liability obligations and/or rights consistent with this License.
+      However, in accepting such obligations, You may act only on Your
+      own behalf and on Your sole responsibility, not on behalf of any
+      other Contributor, and only if You agree to indemnify, defend, and
+      hold each Contributor harmless for any liability incurred by, or
+      claims asserted against, such Contributor by reason of your accepting
+      any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Pecta
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,87 @@
+# pecta-proxy
+
+> Wrap any MCP server with quality gates that block dangerous tool calls before they reach the user.
+
+`pecta-proxy` spawns an MCP server as a subprocess, intercepts every JSON-RPC `tools/call` response, runs Pecta gates over it, and either forwards the original response or replaces it with a `-32000` error if a gate fails.
+
+## Install
+
+```bash
+npx pecta-proxy <command> [args...]
+```
+
+Or install globally:
+
+```bash
+npm install -g pecta-proxy
+```
+
+## Quickstart — local mode (no key required)
+
+```bash
+npx pecta-proxy --verbose npx -y @modelcontextprotocol/server-filesystem /tmp
+```
+
+When a tool call returns an `rm -rf` or path-traversal payload, the proxy replaces the response with a structured error and logs the decision to `~/.pecta/logs/YYYY-MM-DD.jsonl`.
+
+## With cloud telemetry
+
+Get a publishable key from [pecta.ai](https://pecta.ai) (or `pnpm --filter @pecta/api admin issue-key` if you're self-hosting), then:
+
+```bash
+npx pecta-proxy --key pk_live_xxx node my-mcp-server.js
+```
+
+Evaluations show up in your dashboard at `dashboard.pecta.ai` and feed into the agent's portable reputation score.
+
+## Claude Desktop config
+
+Edit `~/Library/Application Support/Claude/claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": [
+        "-y", "pecta-proxy",
+        "--key", "pk_live_xxx",
+        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/me/Documents"
+      ]
+    }
+  }
+}
+```
+
+## Flags
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--key <key>` | none | Publishable Pecta key for cloud telemetry. Without it, the proxy still gates locally and writes to `~/.pecta/logs/`. |
+| `--dry-run` | off | Log every gate decision but always forward the original response. |
+| `--verbose` | off | Print one-line summary per evaluation to stderr. |
+| `--timeout <ms>` | 50 | Total gate budget per response. |
+| `--max-message-size <bytes>` | 1048576 | Drop JSON-RPC messages larger than this. |
+| `--agent-id <id>` | `mcp-proxy` | Agent identifier reported to telemetry. |
+
+## How blocking works
+
+When gates fail, the proxy returns a JSON-RPC error to the upstream client:
+
+```json
+{
+  "jsonrpc": "2.0",
+  "id": 7,
+  "error": {
+    "code": -32000,
+    "message": "pecta: tool call blocked by quality gate",
+    "data": { "gates": [{ "name": "filesystem", "reason": "destructive rm command detected" }] }
+  }
+}
+```
+
+Use `--dry-run` to observe blocking decisions in production before flipping them on.
+
+## License
+
+Apache-2.0

package/dist/bin/pecta-proxy.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=pecta-proxy.d.ts.map

package/dist/bin/pecta-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pecta-proxy.d.ts","sourceRoot":"","sources":["../../bin/pecta-proxy.ts"],"names":[],"mappings":""}

package/dist/bin/pecta-proxy.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { run } from '../src/cli.js';
+run().then((code) => process.exit(code), (err) => {
+    process.stderr.write(`pecta-proxy: fatal: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=pecta-proxy.js.map

package/dist/bin/pecta-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pecta-proxy.js","sourceRoot":"","sources":["../../bin/pecta-proxy.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,GAAG,EAAE,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAY,EAAE,EAAE;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC5E,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}

package/dist/src/cli.d.ts

@@ -0,0 +1,2 @@
+export declare function run(argv?: string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAQA,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,EAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkExE"}

package/dist/src/cli.js

@@ -0,0 +1,61 @@
+import { Command } from 'commander';
+import { createEngine, gates, PectaTelemetry } from '@pecta/core';
+import { runProxy } from './proxy.js';
+import { JsonlLogger } from './logger.js';
+const DEFAULT_TIMEOUT_MS = 50;
+const DEFAULT_MAX_MESSAGE_SIZE = 1_048_576;
+export async function run(argv = process.argv) {
+    const program = new Command();
+    program
+        .name('pecta-proxy')
+        .description('Run Pecta quality gates over an MCP server\'s tools/call responses')
+        .argument('<command>', 'command to spawn (e.g. node, npx)')
+        .argument('[args...]', 'arguments forwarded to the command')
+        .option('--key <key>', 'Pecta API key (pk_live_...) for cloud telemetry')
+        .option('--dry-run', 'log gate decisions but always forward responses', false)
+        .option('--verbose', 'write gate decisions to stderr', false)
+        .option('--timeout <ms>', 'total gate timeout in ms', (v) => parseIntPositive(v, 'timeout'), DEFAULT_TIMEOUT_MS)
+        .option('--config <path>', 'path to pecta.config.json (reserved)')
+        .option('--max-message-size <bytes>', 'max JSON-RPC message size', (v) => parseIntPositive(v, 'max-message-size'), DEFAULT_MAX_MESSAGE_SIZE)
+        .option('--agent-id <id>', 'agent identifier reported to Pecta', 'mcp-proxy')
+        .allowExcessArguments(true)
+        .passThroughOptions();
+    program.parse(argv);
+    const opts = program.opts();
+    const [command, ...args] = program.args;
+    if (!command) {
+        program.error('error: missing required argument <command>');
+        return 2;
+    }
+    const engine = createEngine({
+        gates: [gates.filesystem(), gates.pii(), gates.content()],
+        timeout: opts.timeout,
+    });
+    const logger = new JsonlLogger();
+    void logger.rotate();
+    let telemetry;
+    if (opts.key) {
+        telemetry = new PectaTelemetry({ publishableKey: opts.key });
+    }
+    const exitCode = await runProxy({
+        command,
+        args,
+        engine,
+        agentId: opts.agentId,
+        dryRun: opts.dryRun,
+        verbose: opts.verbose,
+        maxMessageSize: opts.maxMessageSize,
+        ...(telemetry ? { telemetry } : {}),
+        logger,
+    });
+    await telemetry?.shutdown();
+    return exitCode;
+}
+function parseIntPositive(value, label) {
+    const n = Number.parseInt(value, 10);
+    if (!Number.isFinite(n) || n <= 0) {
+        throw new Error(`pecta-proxy: --${label} must be a positive integer, got "${value}"`);
+    }
+    return n;
+}
+//# sourceMappingURL=cli.js.map

package/dist/src/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAiB,OAAO,CAAC,IAAI;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,aAAa,CAAC;SACnB,WAAW,CAAC,oEAAoE,CAAC;SACjF,QAAQ,CAAC,WAAW,EAAE,mCAAmC,CAAC;SAC1D,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,aAAa,EAAE,iDAAiD,CAAC;SACxE,MAAM,CAAC,WAAW,EAAE,iDAAiD,EAAE,KAAK,CAAC;SAC7E,MAAM,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC;SAC5D,MAAM,CAAC,gBAAgB,EAAE,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,kBAAkB,CAAC;SAC/G,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;SACjE,MAAM,CACL,4BAA4B,EAC5B,2BAA2B,EAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAC9C,wBAAwB,CACzB;SACA,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,EAAE,WAAW,CAAC;SAC5E,oBAAoB,CAAC,IAAI,CAAC;SAC1B,kBAAkB,EAAE,CAAC;IAExB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAOrB,CAAC;IACL,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,KAAK,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACzD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAErB,IAAI,SAAqC,CAAC;IAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,SAAS,GAAG,IAAI,cAAc,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;QAC9B,OAAO;QACP,IAAI;QACJ,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,qCAAqC,KAAK,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/jsonrpc.d.ts

@@ -0,0 +1,45 @@
+/**
+ * JSON-RPC 2.0 parsing helpers, defensive enough to run on untrusted child
+ * stdout. Every parse is wrapped in try/catch — malformed input returns null
+ * rather than throwing.
+ */
+export interface JsonRpcRequest {
+    jsonrpc: '2.0';
+    id: number | string;
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcNotification {
+    jsonrpc: '2.0';
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcSuccessResponse {
+    jsonrpc: '2.0';
+    id: number | string | null;
+    result: unknown;
+}
+export interface JsonRpcErrorResponse {
+    jsonrpc: '2.0';
+    id: number | string | null;
+    error: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export type JsonRpcResponse = JsonRpcSuccessResponse | JsonRpcErrorResponse;
+export type JsonRpcMessage = JsonRpcRequest | JsonRpcNotification | JsonRpcResponse;
+declare const TOOL_CALL_METHOD = "tools/call";
+export declare function parseMessage(data: string): JsonRpcMessage | null;
+export declare function isRequest(msg: JsonRpcMessage): msg is JsonRpcRequest;
+export declare function isNotification(msg: JsonRpcMessage): msg is JsonRpcNotification;
+export declare function isResponse(msg: JsonRpcMessage): msg is JsonRpcResponse;
+export declare function isToolCallRequest(msg: JsonRpcMessage): msg is JsonRpcRequest & {
+    method: typeof TOOL_CALL_METHOD;
+};
+/** Pull the `name` field out of a tools/call request's params. */
+export declare function extractToolName(req: JsonRpcRequest): string | undefined;
+export declare function buildErrorResponse(id: number | string | null, code: number, message: string, data?: unknown): JsonRpcErrorResponse;
+export {};
+//# sourceMappingURL=jsonrpc.d.ts.map

package/dist/src/jsonrpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../../src/jsonrpc.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,MAAM,eAAe,GAAG,sBAAsB,GAAG,oBAAoB,CAAC;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,mBAAmB,GAAG,eAAe,CAAC;AAEpF,QAAA,MAAM,gBAAgB,eAAe,CAAC;AAEtC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAYhE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,GAAG,IAAI,cAAc,CAOpE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,GAAG,IAAI,mBAAmB,CAG9E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,GAAG,IAAI,eAAe,CAGtE;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,GAClB,GAAG,IAAI,cAAc,GAAG;IAAE,MAAM,EAAE,OAAO,gBAAgB,CAAA;CAAE,CAE7D;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAKvE;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,OAAO,GACb,oBAAoB,CAMtB"}

package/dist/src/jsonrpc.js

@@ -0,0 +1,56 @@
+/**
+ * JSON-RPC 2.0 parsing helpers, defensive enough to run on untrusted child
+ * stdout. Every parse is wrapped in try/catch — malformed input returns null
+ * rather than throwing.
+ */
+const TOOL_CALL_METHOD = 'tools/call';
+export function parseMessage(data) {
+    if (!data || data.length === 0)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        return null;
+    const obj = parsed;
+    if (obj['jsonrpc'] !== '2.0')
+        return null;
+    return obj;
+}
+export function isRequest(msg) {
+    const m = msg;
+    return (typeof m['method'] === 'string' &&
+        m['id'] !== undefined &&
+        (typeof m['id'] === 'string' || typeof m['id'] === 'number'));
+}
+export function isNotification(msg) {
+    const m = msg;
+    return typeof m['method'] === 'string' && m['id'] === undefined;
+}
+export function isResponse(msg) {
+    const m = msg;
+    return ('result' in m || 'error' in m) && 'id' in m && typeof m['method'] !== 'string';
+}
+export function isToolCallRequest(msg) {
+    return isRequest(msg) && msg.method === TOOL_CALL_METHOD;
+}
+/** Pull the `name` field out of a tools/call request's params. */
+export function extractToolName(req) {
+    const params = req.params;
+    if (!params || typeof params !== 'object' || Array.isArray(params))
+        return undefined;
+    const name = params['name'];
+    return typeof name === 'string' ? name : undefined;
+}
+export function buildErrorResponse(id, code, message, data) {
+    return {
+        jsonrpc: '2.0',
+        id,
+        error: data !== undefined ? { code, message, data } : { code, message },
+    };
+}
+//# sourceMappingURL=jsonrpc.js.map

package/dist/src/jsonrpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../../src/jsonrpc.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8BH,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,GAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAmB;IAC3C,MAAM,CAAC,GAAG,GAAyC,CAAC;IACpD,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;QACrB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAmB;IAChD,MAAM,CAAC,GAAG,GAAyC,CAAC;IACpD,OAAO,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAmB;IAC5C,MAAM,CAAC,GAAG,GAAyC,CAAC;IACpD,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAmB;IAEnB,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB,CAAC;AAC3D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,IAAI,GAAI,MAAkC,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,EAA0B,EAC1B,IAAY,EACZ,OAAe,EACf,IAAc;IAEd,OAAO;QACL,OAAO,EAAE,KAAK;QACd,EAAE;QACF,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;KACxE,CAAC;AACJ,CAAC"}

package/dist/src/line-buffer.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Splits arriving stdio chunks on '\n'. Caps a single message at `max` bytes
+ * — when a line grows past that without a newline, the buffer is dropped.
+ */
+export declare class LineBuffer {
+    private readonly max;
+    private buf;
+    constructor(max: number);
+    push(chunk: string): {
+        lines: string[];
+        oversized: number;
+    };
+    /** Force-flush any trailing partial buffer (e.g. on stream end). */
+    flush(): string[];
+}
+//# sourceMappingURL=line-buffer.d.ts.map

package/dist/src/line-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"line-buffer.d.ts","sourceRoot":"","sources":["../../src/line-buffer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,UAAU;IAGT,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,GAAG,CAAM;gBAEY,GAAG,EAAE,MAAM;IAMxC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAwB3D,oEAAoE;IACpE,KAAK,IAAI,MAAM,EAAE;CAMlB"}

package/dist/src/line-buffer.js

@@ -0,0 +1,46 @@
+/**
+ * Splits arriving stdio chunks on '\n'. Caps a single message at `max` bytes
+ * — when a line grows past that without a newline, the buffer is dropped.
+ */
+export class LineBuffer {
+    max;
+    buf = '';
+    constructor(max) {
+        this.max = max;
+        if (!Number.isFinite(max) || max <= 0) {
+            throw new Error('pecta:LineBuffer: max must be positive');
+        }
+    }
+    push(chunk) {
+        this.buf += chunk;
+        const lines = [];
+        let oversized = 0;
+        while (true) {
+            const nl = this.buf.indexOf('\n');
+            if (nl === -1) {
+                if (this.buf.length > this.max) {
+                    oversized++;
+                    this.buf = '';
+                }
+                break;
+            }
+            const line = this.buf.slice(0, nl);
+            this.buf = this.buf.slice(nl + 1);
+            if (line.length > this.max) {
+                oversized++;
+                continue;
+            }
+            lines.push(line);
+        }
+        return { lines, oversized };
+    }
+    /** Force-flush any trailing partial buffer (e.g. on stream end). */
+    flush() {
+        if (this.buf.length === 0)
+            return [];
+        const out = this.buf.length > this.max ? [] : [this.buf];
+        this.buf = '';
+        return out;
+    }
+}
+//# sourceMappingURL=line-buffer.js.map

package/dist/src/line-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"line-buffer.js","sourceRoot":"","sources":["../../src/line-buffer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,UAAU;IAGQ;IAFrB,GAAG,GAAG,EAAE,CAAC;IAEjB,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC;QAClB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACd,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC/B,SAAS,EAAE,CAAC;oBACZ,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;gBAChB,CAAC;gBACD,MAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,SAAS,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/src/logger.d.ts

@@ -0,0 +1,23 @@
+export interface JsonlLoggerOptions {
+    dir?: string;
+    retentionDays?: number;
+    /** Inject a clock for tests. */
+    now?: () => number;
+}
+/**
+ * Append-only JSONL logger. One file per UTC day. Auto-rotates files older
+ * than retentionDays. Never throws — errors go silently to stderr.
+ */
+export declare class JsonlLogger {
+    private readonly dir;
+    private readonly retentionDays;
+    private readonly now;
+    private ensureDirOnce;
+    constructor(opts?: JsonlLoggerOptions);
+    log(entry: Record<string, unknown>): Promise<void>;
+    /** Delete .jsonl files older than retentionDays. Safe to call repeatedly. */
+    rotate(): Promise<void>;
+    private ensureDir;
+    private todayKey;
+}
+//# sourceMappingURL=logger.d.ts.map

package/dist/src/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/logger.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,aAAa,CAA8B;gBAEvC,IAAI,GAAE,kBAAuB;IAMnC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD,6EAA6E;IACvE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAoBf,SAAS;IAOvB,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/src/logger.js

@@ -0,0 +1,61 @@
+import { mkdir, appendFile, readdir, stat, unlink } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+const DEFAULT_DIR = path.join(homedir(), '.pecta', 'logs');
+const RETENTION_DAYS = 7;
+const MS_PER_DAY = 86_400_000;
+/**
+ * Append-only JSONL logger. One file per UTC day. Auto-rotates files older
+ * than retentionDays. Never throws — errors go silently to stderr.
+ */
+export class JsonlLogger {
+    dir;
+    retentionDays;
+    now;
+    ensureDirOnce = null;
+    constructor(opts = {}) {
+        this.dir = opts.dir ?? DEFAULT_DIR;
+        this.retentionDays = opts.retentionDays ?? RETENTION_DAYS;
+        this.now = opts.now ?? Date.now;
+    }
+    async log(entry) {
+        try {
+            await this.ensureDir();
+            const file = path.join(this.dir, `${this.todayKey()}.jsonl`);
+            await appendFile(file, `${JSON.stringify(entry)}\n`, 'utf8');
+        }
+        catch (err) {
+            process.stderr.write(`pecta-proxy: log write failed: ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+    }
+    /** Delete .jsonl files older than retentionDays. Safe to call repeatedly. */
+    async rotate() {
+        try {
+            await this.ensureDir();
+            const files = await readdir(this.dir);
+            const cutoff = this.now() - this.retentionDays * MS_PER_DAY;
+            await Promise.all(files.map(async (f) => {
+                if (!f.endsWith('.jsonl'))
+                    return;
+                const fp = path.join(this.dir, f);
+                const s = await stat(fp);
+                if (s.mtimeMs < cutoff) {
+                    await unlink(fp);
+                }
+            }));
+        }
+        catch {
+            // never throw from a logger
+        }
+    }
+    async ensureDir() {
+        if (!this.ensureDirOnce) {
+            this.ensureDirOnce = mkdir(this.dir, { recursive: true }).then(() => undefined);
+        }
+        await this.ensureDirOnce;
+    }
+    todayKey() {
+        return new Date(this.now()).toISOString().slice(0, 10);
+    }
+}
+//# sourceMappingURL=logger.js.map

package/dist/src/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,UAAU,GAAG,UAAU,CAAC;AAS9B;;;GAGG;AACH,MAAM,OAAO,WAAW;IACL,GAAG,CAAS;IACZ,aAAa,CAAS;IACtB,GAAG,CAAe;IAC3B,aAAa,GAAyB,IAAI,CAAC;IAEnD,YAAY,OAA2B,EAAE;QACvC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC;QAC1D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAA8B;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC7D,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC;YAC5D,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACpB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,OAAO;gBAClC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;gBACzB,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;oBACvB,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC;IAC3B,CAAC;IAEO,QAAQ;QACd,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/src/pipeline.d.ts

@@ -0,0 +1,26 @@
+import type { Engine, EvaluationResult } from '@pecta/core';
+export interface PipelineOptions {
+    engine: Engine;
+    /** Treat agent identifier surfaced to telemetry as this string. */
+    agentId: string;
+    /** Forward the original response even when gates fail. Just log. */
+    dryRun?: boolean;
+    /** Called for every evaluation — used for logging + telemetry. */
+    onEvaluation?: (result: EvaluationResult, blocked: boolean, toolName?: string) => void;
+}
+export declare class ProxyPipeline {
+    private readonly opts;
+    private readonly pending;
+    constructor(opts: PipelineOptions);
+    /** Inspect a parent→child line; record tools/call requests so we can match the response. */
+    onIncomingLine(line: string): void;
+    /**
+     * Inspect a child→parent line. Returns the line to forward — possibly a
+     * synthetic JSON-RPC error response when gates fail and dryRun is off.
+     */
+    onOutgoingLine(line: string): Promise<string>;
+    /** Number of in-flight tools/call requests we are tracking. */
+    get pendingSize(): number;
+    private runGates;
+}
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/src/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAU5D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACxF;AASD,qBAAa,aAAa;IAGZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;gBAEtC,IAAI,EAAE,eAAe;IAElD,4FAA4F;IAC5F,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAUlC;;;OAGG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBnD,+DAA+D;IAC/D,IAAI,WAAW,IAAI,MAAM,CAExB;YAEa,QAAQ;CAcvB"}

package/dist/src/pipeline.js

@@ -0,0 +1,66 @@
+import { buildErrorResponse, extractToolName, isResponse, isToolCallRequest, parseMessage, } from './jsonrpc.js';
+const PECTA_ERROR_CODE = -32000;
+export class ProxyPipeline {
+    opts;
+    pending = new Map();
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /** Inspect a parent→child line; record tools/call requests so we can match the response. */
+    onIncomingLine(line) {
+        const msg = parseMessage(line);
+        if (!msg)
+            return;
+        if (!isToolCallRequest(msg))
+            return;
+        this.pending.set(msg.id, {
+            toolName: extractToolName(msg),
+            startedAt: Date.now(),
+        });
+    }
+    /**
+     * Inspect a child→parent line. Returns the line to forward — possibly a
+     * synthetic JSON-RPC error response when gates fail and dryRun is off.
+     */
+    async onOutgoingLine(line) {
+        const msg = parseMessage(line);
+        if (!msg)
+            return line; // unparseable / non-JSON-RPC: forward as-is
+        if (!isResponse(msg))
+            return line;
+        if (msg.id === null)
+            return line;
+        const pending = this.pending.get(msg.id);
+        if (!pending)
+            return line;
+        this.pending.delete(msg.id);
+        const result = await this.runGates(msg, pending);
+        const blocked = !result.passed && this.opts.dryRun !== true;
+        this.opts.onEvaluation?.(result, blocked, pending.toolName);
+        if (!blocked)
+            return line;
+        const replacement = buildErrorResponse(msg.id, PECTA_ERROR_CODE, 'pecta: tool call blocked by quality gate', { gates: failingGateSummary(result) });
+        return JSON.stringify(replacement);
+    }
+    /** Number of in-flight tools/call requests we are tracking. */
+    get pendingSize() {
+        return this.pending.size;
+    }
+    async runGates(msg, pending) {
+        const m = msg;
+        const output = m.result !== undefined ? m.result : m.error;
+        const latency_ms = Date.now() - pending.startedAt;
+        return this.opts.engine.evaluate({
+            agent_id: this.opts.agentId,
+            ...(pending.toolName ? { tool: pending.toolName } : {}),
+            output,
+            latency_ms,
+        });
+    }
+}
+function failingGateSummary(result) {
+    return result.gates
+        .filter((g) => !g.passed && g.skipped !== true)
+        .map((g) => (g.reason !== undefined ? { name: g.name, reason: g.reason } : { name: g.name }));
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/src/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/pipeline.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,YAAY,GAEb,MAAM,cAAc,CAAC;AAYtB,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAOhC,MAAM,OAAO,aAAa;IAGK;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEnE,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,4FAA4F;IAC5F,cAAc,CAAC,IAAY;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;YACvB,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;YAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,4CAA4C;QACnE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,WAAW,GAAG,kBAAkB,CACpC,GAAG,CAAC,EAAE,EACN,gBAAgB,EAChB,0CAA0C,EAC1C,EAAE,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CACtC,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED,+DAA+D;IAC/D,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAmB,EACnB,OAAoB;QAEpB,MAAM,CAAC,GAAG,GAA4C,CAAC;QACvD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC3B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM;YACN,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,kBAAkB,CACzB,MAAwB;IAExB,OAAO,MAAM,CAAC,KAAK;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/dist/src/proxy.d.ts

@@ -0,0 +1,23 @@
+import type { Engine, PectaTelemetry } from '@pecta/core';
+import type { JsonlLogger } from './logger.js';
+export interface RunProxyOptions {
+    command: string;
+    args: string[];
+    engine: Engine;
+    agentId: string;
+    dryRun?: boolean;
+    verbose?: boolean;
+    maxMessageSize?: number;
+    telemetry?: PectaTelemetry;
+    logger?: JsonlLogger;
+    /** Override stdio for tests. Defaults to the parent process streams. */
+    stdin?: NodeJS.ReadableStream;
+    stdout?: NodeJS.WritableStream;
+    stderr?: NodeJS.WritableStream;
+}
+/**
+ * Spawn an MCP server as a child process and run gates on its tools/call
+ * responses. Resolves with the child's exit code.
+ */
+export declare function runProxy(opts: RunProxyOptions): Promise<number>;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/src/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAoB,cAAc,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAChC;AAID;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B/D"}

package/dist/src/proxy.js

@@ -0,0 +1,134 @@
+import { spawn } from 'node:child_process';
+import { LineBuffer } from './line-buffer.js';
+import { ProxyPipeline } from './pipeline.js';
+const DEFAULT_MAX_MESSAGE_SIZE = 1_048_576; // 1 MiB
+/**
+ * Spawn an MCP server as a child process and run gates on its tools/call
+ * responses. Resolves with the child's exit code.
+ */
+export function runProxy(opts) {
+    const max = opts.maxMessageSize ?? DEFAULT_MAX_MESSAGE_SIZE;
+    const stdin = opts.stdin ?? process.stdin;
+    const stdout = opts.stdout ?? process.stdout;
+    const stderr = opts.stderr ?? process.stderr;
+    const pipeline = new ProxyPipeline({
+        engine: opts.engine,
+        agentId: opts.agentId,
+        ...(opts.dryRun !== undefined ? { dryRun: opts.dryRun } : {}),
+        onEvaluation: (result, blocked, toolName) => {
+            handleEvaluation(result, blocked, toolName, opts, stderr);
+        },
+    });
+    const child = spawn(opts.command, opts.args, { stdio: ['pipe', 'pipe', 'inherit'] });
+    wireStdin(stdin, child, pipeline, max, stderr);
+    wireStdout(child, stdout, pipeline, max, stderr);
+    wireSignals(child);
+    return new Promise((resolve) => {
+        child.on('error', (err) => {
+            stderr.write(`pecta-proxy: child failed to spawn: ${err.message}\n`);
+            resolve(1);
+        });
+        child.on('exit', (code, signal) => {
+            if (signal)
+                stderr.write(`pecta-proxy: child exited via ${signal}\n`);
+            resolve(code ?? 0);
+        });
+    });
+}
+function wireStdin(stdin, child, pipeline, max, stderr) {
+    const buffer = new LineBuffer(max);
+    stdin.on('data', (chunk) => {
+        const text = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+        const { lines, oversized } = buffer.push(text);
+        if (oversized > 0) {
+            stderr.write(`pecta-proxy: dropped ${oversized} oversized inbound message(s)\n`);
+        }
+        for (const line of lines) {
+            pipeline.onIncomingLine(line);
+            child.stdin?.write(`${line}\n`);
+        }
+    });
+    stdin.on('end', () => {
+        for (const line of buffer.flush()) {
+            pipeline.onIncomingLine(line);
+            child.stdin?.write(`${line}\n`);
+        }
+        child.stdin?.end();
+    });
+}
+function wireStdout(child, stdout, pipeline, max, stderr) {
+    const buffer = new LineBuffer(max);
+    // Serialize gate evaluation per-line so output ordering matches input.
+    let queue = Promise.resolve();
+    const handle = (chunk) => {
+        const text = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+        const { lines, oversized } = buffer.push(text);
+        if (oversized > 0) {
+            stderr.write(`pecta-proxy: dropped ${oversized} oversized outbound message(s)\n`);
+        }
+        for (const line of lines) {
+            queue = queue.then(async () => {
+                try {
+                    const out = await pipeline.onOutgoingLine(line);
+                    stdout.write(`${out}\n`);
+                }
+                catch (err) {
+                    stderr.write(`pecta-proxy: pipeline error: ${err instanceof Error ? err.message : String(err)}\n`);
+                    stdout.write(`${line}\n`);
+                }
+            });
+        }
+    };
+    child.stdout?.on('data', handle);
+    child.stdout?.on('end', () => {
+        for (const tail of buffer.flush()) {
+            queue = queue.then(async () => {
+                try {
+                    const out = await pipeline.onOutgoingLine(tail);
+                    stdout.write(`${out}\n`);
+                }
+                catch {
+                    stdout.write(`${tail}\n`);
+                }
+            });
+        }
+    });
+}
+function wireSignals(child) {
+    const forward = (sig) => () => {
+        try {
+            child.kill(sig);
+        }
+        catch {
+            // child may already be gone
+        }
+    };
+    process.once('SIGTERM', forward('SIGTERM'));
+    process.once('SIGINT', forward('SIGINT'));
+}
+function handleEvaluation(result, blocked, toolName, opts, stderr) {
+    if (opts.verbose) {
+        const summary = result.gates
+            .map((g) => `${g.name}=${g.skipped ? 'skip' : g.passed ? 'pass' : 'FAIL'}`)
+            .join(' ');
+        stderr.write(`pecta-proxy: ${blocked ? 'BLOCKED' : 'allowed'} tool=${toolName ?? '?'} ${summary} (${result.total_latency_ms.toFixed(1)}ms)\n`);
+    }
+    opts.telemetry?.track(result);
+    if (opts.logger) {
+        void opts.logger.log({
+            timestamp: result.timestamp,
+            agent_id: result.agent_id,
+            tool: toolName,
+            passed: result.passed,
+            blocked,
+            total_latency_ms: result.total_latency_ms,
+            gates: result.gates.map((g) => ({
+                name: g.name,
+                passed: g.passed,
+                ...(g.reason ? { reason: g.reason } : {}),
+                ...(g.skipped ? { skipped: true } : {}),
+            })),
+        });
+    }
+}
+//# sourceMappingURL=proxy.js.map

package/dist/src/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAkB9C,MAAM,wBAAwB,GAAG,SAAS,CAAC,CAAC,QAAQ;AAEpD;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAqB;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAE7C,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YAC1C,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAErF,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,MAAM;gBAAE,MAAM,CAAC,KAAK,CAAC,iCAAiC,MAAM,IAAI,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAChB,KAA4B,EAC5B,KAAmB,EACnB,QAAuB,EACvB,GAAW,EACX,MAA6B;IAE7B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,wBAAwB,SAAS,iCAAiC,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9B,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YAClC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9B,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,KAAmB,EACnB,MAA6B,EAC7B,QAAuB,EACvB,GAAW,EACX,MAA6B;IAE7B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACnC,uEAAuE;IACvE,IAAI,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAQ,EAAE;QAC9C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,wBAAwB,SAAS,kCAAkC,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;oBAChD,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;gBAC3B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CACV,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACrF,CAAC;oBACF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YAClC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;oBAChD,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB;IACtC,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAE,EAAE,CAAC,GAAG,EAAE;QAC5C,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAwB,EACxB,OAAgB,EAChB,QAA4B,EAC5B,IAAqB,EACrB,MAA6B;IAE7B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aAC1E,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,CAAC,KAAK,CACV,gBAAgB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,QAAQ,IAAI,GAAG,IAAI,OAAO,KAAK,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CACjI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO;YACP,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "pecta-proxy",
+  "version": "0.1.0",
+  "description": "MCP proxy that runs Pecta quality gates on tool call responses",
+  "type": "module",
+  "bin": {
+    "pecta-proxy": "./dist/bin/pecta-proxy.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "commander": "^12.1.0",
+    "@pecta/core": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.7.5",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.3"
+  },
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc && chmod +x dist/bin/pecta-proxy.js",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
+  }
+}