protect-mcp 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.7.3: tool input reaches `context.input`, and the hook path fails closed
+
+Two correctness fixes for policy authors who rely on the documented Cedar shape.
+
+The evaluator maps tool input to Cedar `context.input`, and the bundled policy
+examples are written against `context.input.*`, but the `evaluate` CLI path and
+the HTTP hook server only flattened tool input into top-level context fields. So
+a policy keyed on `context.input.path` silently saw nothing on those paths: a
+`forbid` that should have denied never fired, and the call was allowed. Both
+paths now pass the tool input through, so nested-shape policies match. The
+existing flattened fields are kept for back-compat. (Thanks to @koriyoshi2041,
+scopeblind-gateway#8, for the report and repro.)
+
+Separately, the hook server's Cedar evaluation fell through to **allow** on an
+unexpected evaluator throw, which contradicted the "denies on any error"
+guarantee from 0.7.0 (the CLI path already failed closed). The hook path now
+denies on an unexpected eval error while a policy is configured.
+
+Regression coverage added on all three paths; `npm ci` from a clean clone also
+works again (the lockfile was out of sync).
+
 ## 0.7.2: run the gate in other agents (Codex, Cursor, Gemini, Hermes)
 
 The `evaluate` and `sign` verbs now accept `--format <host>`

package/README.md

@@ -68,7 +68,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.0 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
+            "command": "npx protect-mcp@0.7.3 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
           }
         ]
       }
@@ -79,7 +79,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.0 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
+            "command": "npx protect-mcp@0.7.3 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
           }
         ]
       }

package/dist/{chunk-X63ELMU4.mjs → chunk-G67NUBML.mjs}

@@ -258,7 +258,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -297,10 +300,29 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {

package/dist/cli.js

@@ -5096,7 +5096,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -5135,10 +5138,29 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {
@@ -7700,7 +7722,7 @@ async function handleEvaluate(argv) {
   if (typeof input.command === "string" && context.command_pattern === void 0) {
     context.command_pattern = input.command;
   }
-  const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context }, void 0, { failClosed: true });
+  const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context, toolInput: input }, void 0, { failClosed: true });
   if (format) emitDecision(format, decision.allowed, decision.reason || (decision.allowed ? "allowed" : "denied by policy"));
   process.stdout.write(JSON.stringify({ allowed: decision.allowed, reason: decision.reason, policy_digest: policySet.digest }) + "\n");
   process.exit(decision.allowed ? 0 : 2);

package/dist/cli.mjs

@@ -1375,7 +1375,7 @@ async function handleEvaluate(argv) {
   if (typeof input.command === "string" && context.command_pattern === void 0) {
     context.command_pattern = input.command;
   }
-  const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context }, void 0, { failClosed: true });
+  const decision = await evaluateCedar(policySet, { tool, tier: "unknown", context, toolInput: input }, void 0, { failClosed: true });
   if (format) emitDecision(format, decision.allowed, decision.reason || (decision.allowed ? "allowed" : "denied by policy"));
   process.stdout.write(JSON.stringify({ allowed: decision.allowed, reason: decision.reason, policy_digest: policySet.digest }) + "\n");
   process.exit(decision.allowed ? 0 : 2);

package/dist/hook-server.js

@@ -701,7 +701,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -740,10 +743,29 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {

package/dist/hook-server.mjs

@@ -1,6 +1,6 @@
 import {
   startHookServer
-} from "./chunk-X63ELMU4.mjs";
+} from "./chunk-G67NUBML.mjs";
 import "./chunk-546U3A7R.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 export {

package/dist/index.js

@@ -39960,7 +39960,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -39999,10 +40002,29 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {

package/dist/index.mjs

@@ -33,7 +33,7 @@ import {
   forwardReceipt,
   getScopeBlindBridge,
   startHookServer
-} from "./chunk-X63ELMU4.mjs";
+} from "./chunk-G67NUBML.mjs";
 import {
   checkRateLimit,
   evaluateCedar,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protect-mcp",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "mcpName": "com.scopeblind/protect-mcp",
   "description": "Fail-closed Cedar policy gate + signed receipts for AI agent tool calls. Blocks what breaks the rules before it runs, denies on any policy error, and proves the gate is live with a startup self-test.",
   "main": "dist/index.js",