protect-mcp 0.7.2 → 0.7.4

package/dist/{chunk-X63ELMU4.mjs → chunk-NVJHGXXG.mjs}

@@ -1,5 +1,6 @@
 import {
   ReceiptBuffer,
+  buildActionReadback,
   checkRateLimit,
   evaluateCedar,
   getSignerInfo,
@@ -11,7 +12,7 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-546U3A7R.mjs";
+} from "./chunk-D2RDY2JR.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";
@@ -241,6 +242,7 @@ async function handlePreToolUse(input, state) {
     requestId
   });
   const payloadDigest = computePayloadDigest(input.toolInput);
+  const actionReadback = buildActionReadback(toolName, input.toolInput || {});
   const swarm = {
     ...state.swarmContext,
     ...input.agentId && { agent_id: input.agentId },
@@ -258,7 +260,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -277,6 +282,7 @@ async function handlePreToolUse(input, state) {
           swarm: swarm.team_name ? swarm : void 0,
           timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
           payload_digest: payloadDigest,
+          action_readback: actionReadback,
           deny_iteration: denyCount,
           sandbox_state: detectSandboxState(),
           plan_receipt_id: state.activePlanReceiptId || void 0
@@ -297,10 +303,30 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        action_readback: actionReadback,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {
@@ -316,6 +342,7 @@ async function handlePreToolUse(input, state) {
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
         payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
@@ -336,13 +363,15 @@ async function handlePreToolUse(input, state) {
         hook_event: "PreToolUse",
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
         hookSpecificOutput: {
           hookEventName: "PreToolUse",
           permissionDecision: "ask",
-          permissionDecisionReason: `[ScopeBlind] "${toolName}" requires human approval. Policy: ${state.policyDigest}`
+          permissionDecisionReason: `[ScopeBlind] Approval required for exactly this action: ${actionReadback.summary}. Payload hash: ${actionReadback.payload_hash.slice(0, 16)}\u2026 Policy: ${state.policyDigest}`
         }
       };
     }
@@ -387,6 +416,7 @@ async function handlePreToolUse(input, state) {
     swarm: swarm.team_name ? swarm : void 0,
     timing: { hook_latency_ms: hookLatency, started_at: hookStart },
     payload_digest: payloadDigest,
+    action_readback: actionReadback,
     sandbox_state: detectSandboxState(),
     plan_receipt_id: state.activePlanReceiptId || void 0
   });

package/dist/{chunk-5JXFV37Y.mjs → chunk-PM2ZO57M.mjs}

@@ -1,7 +1,7 @@
 // src/bundle.ts
 function createAuditBundle(opts) {
   const receipts = opts.receipts.filter(
-    (r) => r && typeof r === "object" && typeof r.signature === "string"
+    (r) => r && typeof r === "object" && (typeof r.signature === "string" || r.signature !== null && typeof r.signature === "object")
   );
   if (receipts.length === 0) {
     throw new Error("Audit bundle requires at least one signed receipt");
@@ -30,10 +30,18 @@ function createAuditBundle(opts) {
     time_range: timeRange,
     receipts,
     anchors: opts.anchors || [],
+    selective_disclosures: opts.selectiveDisclosures || [],
+    privacy: {
+      selective_disclosure: {
+        supported: true,
+        model: "salted_commitments_merkle_v0",
+        statement: "Committed receipts may disclose selected fields with salted Merkle openings. Undisclosed committed fields remain hidden while staying bound to the signed commitment root."
+      }
+    },
     verification: {
       algorithm: "ed25519",
       signing_keys: Array.from(keyMap.values()),
-      instructions: `Verify each receipt by: (1) remove the "signature" field, (2) canonicalize the remaining object with JCS (sorted keys at every level), (3) encode as UTF-8 bytes, (4) verify the Ed25519 signature using the signing key matching the receipt's "kid" field. CLI: npx @veritasacta/verify bundle.json --bundle`
+      instructions: `Verify each receipt by: (1) remove the "signature" field, (2) canonicalize the remaining object with JCS (sorted keys at every level), (3) encode as UTF-8 bytes, (4) verify the Ed25519 signature using the signing key matching the receipt's "kid" field. For scopeblind.selective_disclosure.v0 packages, recompute each disclosed leaf and verify it against the receipt committed_fields_root; fields not disclosed remain hidden. CLI: npx @veritasacta/verify bundle.json --bundle`
     }
   };
 }

package/dist/{chunk-OHUTUFTC.mjs → chunk-UBZJ3VI2.mjs}

@@ -1,5 +1,6 @@
 import {
   ReceiptBuffer,
+  buildActionReadback,
   checkRateLimit,
   evaluateCedar,
   getToolPolicy,
@@ -7,7 +8,7 @@ import {
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-546U3A7R.mjs";
+} from "./chunk-D2RDY2JR.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";
@@ -758,6 +759,8 @@ var ProtectGateway = class {
     const toolName = request.params?.name || "unknown";
     const requestId = randomUUID().slice(0, 12);
     const mode = this.config.enforce ? "enforce" : "shadow";
+    const toolInput = request.params?.arguments && typeof request.params.arguments === "object" ? request.params.arguments : request.params || {};
+    const actionReadback = buildActionReadback(toolName, toolInput);
     let resolvedAgentKid = this.admissionResult?.agent_id;
     let effectiveToolPolicy;
     if (this.config.multiAgent?.enabled) {
@@ -767,7 +770,7 @@ var ProtectGateway = class {
       if (agentOverrides && agentOverrides[toolName]) {
         effectiveToolPolicy = { ...getToolPolicy(toolName, this.config.policy), ...agentOverrides[toolName] };
       } else if (!resolvedAgentKid && this.config.multiAgent.unknownAgentPolicy === "deny") {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "unknown_agent_denied", request_id: requestId, tier: this.currentTier });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "unknown_agent_denied", request_id: requestId, tier: this.currentTier, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied: unidentified agent`);
         }
@@ -788,7 +791,7 @@ var ProtectGateway = class {
       if (cred.resolved) {
         credentialRef = cred.label;
       } else if (cred.error && !cred.error.includes("not configured")) {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "credential_error", request_id: requestId, tier: this.currentTier, credential_ref: toolName });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "credential_error", request_id: requestId, tier: this.currentTier, credential_ref: toolName, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Credential error for tool "${toolName}"`);
         }
@@ -803,13 +806,13 @@ var ProtectGateway = class {
         });
         if (!cedarDecision.allowed) {
           const reason = cedarDecision.reason || "cedar_deny";
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied by Cedar policy`);
           }
           return null;
         }
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "cedar_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "cedar_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         return null;
       } catch (err) {
         if (this.config.verbose) this.log(`Cedar evaluation error: ${err instanceof Error ? err.message : err}`);
@@ -827,7 +830,7 @@ var ProtectGateway = class {
         const externalDecision = await queryExternalPDP(ctx, this.config.policy.external);
         if (!externalDecision.allowed) {
           const reason = `external_pdp_deny${externalDecision.reason ? ": " + externalDecision.reason : ""}`;
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied by external policy engine`);
           }
@@ -839,7 +842,7 @@ var ProtectGateway = class {
     }
     if (toolPolicy.min_tier) {
       if (!meetsMinTier(this.currentTier, toolPolicy.min_tier)) {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "tier_insufficient", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "tier_insufficient", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" requires tier "${toolPolicy.min_tier}"`);
         }
@@ -847,7 +850,7 @@ var ProtectGateway = class {
       }
     }
     if (toolPolicy.block) {
-      this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "policy_block", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "policy_block", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       if (this.config.enforce) {
         return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" is blocked by policy`);
       }
@@ -858,10 +861,10 @@ var ProtectGateway = class {
       const alwaysGrant = this.approvalStore.get(`always:${toolName}`);
       if (grant && Date.now() < grant.expires_at || alwaysGrant && Date.now() < alwaysGrant.expires_at) {
         if (grant && grant.mode === "once") this.approvalStore.delete(requestId);
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "approval_granted", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "approval_granted", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         return null;
       }
-      this.emitDecisionLog({ tool: toolName, decision: "require_approval", reason_code: "requires_human_approval", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "require_approval", reason_code: "requires_human_approval", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       if (this.notificationConfig) {
         sendApprovalNotification(this.notificationConfig, {
           requestId,
@@ -884,7 +887,7 @@ var ProtectGateway = class {
             content: [
               {
                 type: "text",
-                text: `REQUIRES_APPROVAL: The tool "${toolName}" requires human approval before execution. Request ID: ${requestId}. Approval nonce: ${this.approvalNonce}. Tell the user you need their approval to use "${toolName}" and will retry when granted. Do NOT retry this tool call until the user explicitly approves it.`
+                text: `REQUIRES_APPROVAL: The tool "${toolName}" requires human approval before execution. Exact action: ${actionReadback.summary}. Payload hash: ${actionReadback.payload_hash.slice(0, 16)}\u2026 Request ID: ${requestId}. Approval nonce: ${this.approvalNonce}. Tell the user you need their approval to use "${toolName}" and will retry when granted. Do NOT retry this tool call until the user explicitly approves it.`
               }
             ],
             isError: true
@@ -900,19 +903,19 @@ var ProtectGateway = class {
         const key = `tool:${toolName}:${this.currentTier}`;
         const { allowed, remaining } = checkRateLimit(key, limit, this.rateLimitStore);
         if (!allowed) {
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "rate_limit_exceeded", request_id: requestId, rate_limit_remaining: 0, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "rate_limit_exceeded", request_id: requestId, rate_limit_remaining: 0, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" rate limit exceeded (${rateSpec})`);
           }
           return null;
         }
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "policy_allow", request_id: requestId, rate_limit_remaining: remaining, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "policy_allow", request_id: requestId, rate_limit_remaining: remaining, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       } catch {
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "default_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "default_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       }
     } else {
       const reasonCode = this.config.enforce ? "policy_allow" : "observe_mode";
-      this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: reasonCode, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: reasonCode, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
     }
     return null;
   }
@@ -949,6 +952,7 @@ var ProtectGateway = class {
       ...entry.rate_limit_remaining !== void 0 && { rate_limit_remaining: entry.rate_limit_remaining },
       ...entry.tier && { tier: entry.tier },
       ...entry.credential_ref && { credential_ref: entry.credential_ref },
+      ...entry.action_readback && { action_readback: entry.action_readback },
       otel_trace_id: otelTraceId,
       otel_span_id: otelSpanId
     };