protect-mcp 0.7.2 → 0.7.4

package/dist/index.js

@@ -1002,10 +1002,10 @@ var require_types = __commonJS({
       if (!jwtRegex.test(jwt))
         return false;
       try {
-        const [header] = jwt.split(".");
-        if (!header)
+        const [header2] = jwt.split(".");
+        if (!header2)
           return false;
-        const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "=");
+        const base64 = header2.replace(/-/g, "+").replace(/_/g, "/").padEnd(header2.length + (4 - header2.length % 4) % 4, "=");
         const decoded = JSON.parse(atob(base64));
         if (typeof decoded !== "object" || decoded === null)
           return false;
@@ -6486,10 +6486,10 @@ var require_schemas = __commonJS({
         const tokensParts = token.split(".");
         if (tokensParts.length !== 3)
           return false;
-        const [header] = tokensParts;
-        if (!header)
+        const [header2] = tokensParts;
+        if (!header2)
           return false;
-        const parsedHeader = JSON.parse(atob(header));
+        const parsedHeader = JSON.parse(atob(header2));
         if ("typ" in parsedHeader && parsedHeader?.typ !== "JWT")
           return false;
         if (!parsedHeader.alg)
@@ -35019,7 +35019,9 @@ var require_mcp = __commonJS({
 var index_exports = {};
 __export(index_exports, {
   BUILTIN_PATTERNS: () => BUILTIN_PATTERNS,
+  CONNECTOR_PILOTS: () => CONNECTOR_PILOTS,
   ConfidentialGate: () => ConfidentialGate,
+  POLICY_PACKS: () => POLICY_PACKS,
   ProtectGateway: () => ProtectGateway,
   ReceiptPropagator: () => ReceiptPropagator,
   ScopeBlindBridge: () => ScopeBlindBridge,
@@ -35029,6 +35031,9 @@ __export(index_exports, {
   collectSignedReceipts: () => collectSignedReceipts,
   computeCalibration: () => computeCalibration,
   confidentialInference: () => confidentialInference,
+  connectorDirectory: () => connectorDirectory,
+  connectorDoctor: () => connectorDoctor,
+  connectorPilotIds: () => connectorPilotIds,
   createApprovalChallenge: () => createApprovalChallenge,
   createApprovalReceiptPayload: () => createApprovalReceiptPayload,
   createAttestationField: () => createAttestationField,
@@ -35040,6 +35045,7 @@ __export(index_exports, {
   createReceiptChannel: () => createReceiptChannel,
   createSandbox: () => createSandbox,
   createSandboxServer: () => createSandboxServer,
+  createSelectiveDisclosurePackage: () => createSelectiveDisclosurePackage,
   destroySandbox: () => destroySandbox,
   discloseField: () => discloseField,
   ed25519ToDIDKey: () => ed25519ToDIDKey,
@@ -35060,6 +35066,8 @@ __export(index_exports, {
   generateSampleCedarPolicy: () => generateSampleCedarPolicy,
   generateSchemaStub: () => generateSchemaStub,
   generateVerifyReceiptSkill: () => generateVerifyReceiptSkill,
+  getConnectorPilot: () => getConnectorPilot,
+  getPolicyPack: () => getPolicyPack,
   getScopeBlindBridge: () => getScopeBlindBridge,
   getSignerInfo: () => getSignerInfo,
   getToolPolicy: () => getToolPolicy,
@@ -35080,8 +35088,10 @@ __export(index_exports, {
   parseLogFile: () => parseLogFile,
   parseNotificationConfigFromEnv: () => parseNotificationConfigFromEnv,
   parseRateLimit: () => parseRateLimit,
+  policyPackIds: () => policyPackIds,
   policySetFromSource: () => policySetFromSource,
   queryExternalPDP: () => queryExternalPDP,
+  readInstalledConnectorPilots: () => readInstalledConnectorPilots,
   receiptToVP: () => receiptToVP,
   receiptsToHFRows: () => receiptsToHFRows,
   redactFields: () => redactFields,
@@ -35105,13 +35115,15 @@ __export(index_exports, {
   verifyApprovalAssertion: () => verifyApprovalAssertion,
   verifyCommitment: () => verifyCommitment,
   verifyEvidenceAttestation: () => verifyEvidenceAttestation,
-  verifyRekorAnchor: () => verifyRekorAnchor
+  verifyRekorAnchor: () => verifyRekorAnchor,
+  verifySelectiveDisclosurePackage: () => verifySelectiveDisclosurePackage,
+  writeConnectorPilots: () => writeConnectorPilots
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/gateway.ts
 var import_node_child_process = require("child_process");
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_node_readline = require("readline");
 var import_node_fs6 = require("fs");
 var import_node_path4 = require("path");
@@ -35541,6 +35553,7 @@ function signDecision(entry) {
     if (entry.timing) payload.timing = entry.timing;
     if (entry.swarm) payload.swarm = entry.swarm;
     if (entry.payload_digest) payload.payload_digest = entry.payload_digest;
+    if (entry.action_readback) payload.action_readback = entry.action_readback;
     if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
     const result = artifactsModule.createSignedArtifact(
       artifactType,
@@ -36347,6 +36360,95 @@ function handleListApprovals(res, approvalStore) {
   res.end(JSON.stringify({ grants }));
 }
 
+// src/action-readback.ts
+var import_node_crypto3 = require("crypto");
+var SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|credential|password|secret|session|token|private[_-]?key)/i;
+var DESTINATION_KEYS = [
+  "path",
+  "file_path",
+  "filePath",
+  "url",
+  "uri",
+  "endpoint",
+  "host",
+  "hostname",
+  "repo",
+  "repository",
+  "branch",
+  "channel",
+  "to",
+  "recipient",
+  "symbol",
+  "account",
+  "bucket",
+  "database",
+  "table",
+  "service"
+];
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(obj[key])}`).join(",")}}`;
+}
+function redact(value, path = [], redacted = [], disclosed = [], depth = 0) {
+  if (depth > 4) return "[truncated-depth]";
+  if (value === null || value === void 0) return value;
+  if (typeof value !== "object") {
+    if (path.length > 0) disclosed.push(path.join("."));
+    if (typeof value === "string" && value.length > 240) return `${value.slice(0, 240)}...`;
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.slice(0, 20).map((item, idx) => redact(item, [...path, String(idx)], redacted, disclosed, depth + 1));
+  }
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = [...path, key];
+    if (SECRET_KEY_RE.test(key)) {
+      redacted.push(childPath.join("."));
+      out[key] = "[redacted]";
+      continue;
+    }
+    out[key] = redact(child, childPath, redacted, disclosed, depth + 1);
+  }
+  return out;
+}
+function firstStringValue(input, keys) {
+  for (const key of keys) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+    if (typeof value === "number" || typeof value === "boolean") return String(value);
+  }
+  return void 0;
+}
+function actionFor(tool, input) {
+  const explicit = firstStringValue(input, ["action", "operation", "method", "verb", "command"]);
+  if (explicit) return explicit.length > 90 ? `${explicit.slice(0, 90)}...` : explicit;
+  return tool;
+}
+function buildActionReadback(tool, input) {
+  const normalized = input && typeof input === "object" && !Array.isArray(input) ? input : { value: input };
+  const canonical = stableStringify(normalized);
+  const redactedFields = [];
+  const disclosedFields = [];
+  const payloadPreview = redact(normalized, [], redactedFields, disclosedFields);
+  const action = actionFor(tool, normalized);
+  const destination = firstStringValue(normalized, DESTINATION_KEYS);
+  const summary = destination ? `${tool} -> ${destination}` : `${tool} request`;
+  return {
+    tool,
+    action,
+    destination,
+    payload_preview: payloadPreview,
+    payload_hash: (0, import_node_crypto3.createHash)("sha256").update(canonical).digest("hex"),
+    payload_bytes: Buffer.byteLength(canonical, "utf-8"),
+    disclosed_fields: [...new Set(disclosedFields)].slice(0, 80),
+    redacted_fields: [...new Set(redactedFields)].slice(0, 80),
+    summary
+  };
+}
+
 // src/gateway.ts
 var LOG_FILE2 = ".protect-mcp-log.jsonl";
 var RECEIPTS_FILE = ".protect-mcp-receipts.jsonl";
@@ -36362,7 +36464,7 @@ var ProtectGateway = class {
   /** Approval grants keyed by request_id (scoped to the specific action that was requested) */
   approvalStore = /* @__PURE__ */ new Map();
   /** Random nonce generated at startup — required for approval endpoint authentication */
-  approvalNonce = (0, import_node_crypto3.randomBytes)(16).toString("hex");
+  approvalNonce = (0, import_node_crypto4.randomBytes)(16).toString("hex");
   currentTier = "unknown";
   admissionResult = null;
   /** Notification config for approval gates (SMS, webhook, email) */
@@ -36516,8 +36618,10 @@ var ProtectGateway = class {
   }
   async interceptToolCall(request) {
     const toolName = request.params?.name || "unknown";
-    const requestId = (0, import_node_crypto3.randomUUID)().slice(0, 12);
+    const requestId = (0, import_node_crypto4.randomUUID)().slice(0, 12);
     const mode = this.config.enforce ? "enforce" : "shadow";
+    const toolInput = request.params?.arguments && typeof request.params.arguments === "object" ? request.params.arguments : request.params || {};
+    const actionReadback = buildActionReadback(toolName, toolInput);
     let resolvedAgentKid = this.admissionResult?.agent_id;
     let effectiveToolPolicy;
     if (this.config.multiAgent?.enabled) {
@@ -36527,7 +36631,7 @@ var ProtectGateway = class {
       if (agentOverrides && agentOverrides[toolName]) {
         effectiveToolPolicy = { ...getToolPolicy(toolName, this.config.policy), ...agentOverrides[toolName] };
       } else if (!resolvedAgentKid && this.config.multiAgent.unknownAgentPolicy === "deny") {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "unknown_agent_denied", request_id: requestId, tier: this.currentTier });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "unknown_agent_denied", request_id: requestId, tier: this.currentTier, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied: unidentified agent`);
         }
@@ -36548,7 +36652,7 @@ var ProtectGateway = class {
       if (cred.resolved) {
         credentialRef = cred.label;
       } else if (cred.error && !cred.error.includes("not configured")) {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "credential_error", request_id: requestId, tier: this.currentTier, credential_ref: toolName });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "credential_error", request_id: requestId, tier: this.currentTier, credential_ref: toolName, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Credential error for tool "${toolName}"`);
         }
@@ -36563,13 +36667,13 @@ var ProtectGateway = class {
         });
         if (!cedarDecision.allowed) {
           const reason = cedarDecision.reason || "cedar_deny";
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied by Cedar policy`);
           }
           return null;
         }
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "cedar_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "cedar_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         return null;
       } catch (err) {
         if (this.config.verbose) this.log(`Cedar evaluation error: ${err instanceof Error ? err.message : err}`);
@@ -36587,7 +36691,7 @@ var ProtectGateway = class {
         const externalDecision = await queryExternalPDP(ctx, this.config.policy.external);
         if (!externalDecision.allowed) {
           const reason = `external_pdp_deny${externalDecision.reason ? ": " + externalDecision.reason : ""}`;
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied by external policy engine`);
           }
@@ -36599,7 +36703,7 @@ var ProtectGateway = class {
     }
     if (toolPolicy.min_tier) {
       if (!meetsMinTier(this.currentTier, toolPolicy.min_tier)) {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "tier_insufficient", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "tier_insufficient", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" requires tier "${toolPolicy.min_tier}"`);
         }
@@ -36607,7 +36711,7 @@ var ProtectGateway = class {
       }
     }
     if (toolPolicy.block) {
-      this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "policy_block", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "policy_block", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       if (this.config.enforce) {
         return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" is blocked by policy`);
       }
@@ -36618,10 +36722,10 @@ var ProtectGateway = class {
       const alwaysGrant = this.approvalStore.get(`always:${toolName}`);
       if (grant && Date.now() < grant.expires_at || alwaysGrant && Date.now() < alwaysGrant.expires_at) {
         if (grant && grant.mode === "once") this.approvalStore.delete(requestId);
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "approval_granted", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "approval_granted", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         return null;
       }
-      this.emitDecisionLog({ tool: toolName, decision: "require_approval", reason_code: "requires_human_approval", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "require_approval", reason_code: "requires_human_approval", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       if (this.notificationConfig) {
         sendApprovalNotification(this.notificationConfig, {
           requestId,
@@ -36644,7 +36748,7 @@ var ProtectGateway = class {
             content: [
               {
                 type: "text",
-                text: `REQUIRES_APPROVAL: The tool "${toolName}" requires human approval before execution. Request ID: ${requestId}. Approval nonce: ${this.approvalNonce}. Tell the user you need their approval to use "${toolName}" and will retry when granted. Do NOT retry this tool call until the user explicitly approves it.`
+                text: `REQUIRES_APPROVAL: The tool "${toolName}" requires human approval before execution. Exact action: ${actionReadback.summary}. Payload hash: ${actionReadback.payload_hash.slice(0, 16)}\u2026 Request ID: ${requestId}. Approval nonce: ${this.approvalNonce}. Tell the user you need their approval to use "${toolName}" and will retry when granted. Do NOT retry this tool call until the user explicitly approves it.`
               }
             ],
             isError: true
@@ -36660,19 +36764,19 @@ var ProtectGateway = class {
         const key = `tool:${toolName}:${this.currentTier}`;
         const { allowed, remaining } = checkRateLimit(key, limit, this.rateLimitStore);
         if (!allowed) {
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "rate_limit_exceeded", request_id: requestId, rate_limit_remaining: 0, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "rate_limit_exceeded", request_id: requestId, rate_limit_remaining: 0, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" rate limit exceeded (${rateSpec})`);
           }
           return null;
         }
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "policy_allow", request_id: requestId, rate_limit_remaining: remaining, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "policy_allow", request_id: requestId, rate_limit_remaining: remaining, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       } catch {
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "default_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "default_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       }
     } else {
       const reasonCode = this.config.enforce ? "policy_allow" : "observe_mode";
-      this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: reasonCode, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: reasonCode, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
     }
     return null;
   }
@@ -36694,8 +36798,8 @@ var ProtectGateway = class {
    */
   emitDecisionLog(entry) {
     const mode = this.config.enforce ? "enforce" : "shadow";
-    const otelTraceId = entry.otel_trace_id || (0, import_node_crypto3.randomBytes)(16).toString("hex");
-    const otelSpanId = entry.otel_span_id || (0, import_node_crypto3.randomBytes)(8).toString("hex");
+    const otelTraceId = entry.otel_trace_id || (0, import_node_crypto4.randomBytes)(16).toString("hex");
+    const otelSpanId = entry.otel_span_id || (0, import_node_crypto4.randomBytes)(8).toString("hex");
     const log = {
       v: 2,
       tool: entry.tool || "unknown",
@@ -36703,12 +36807,13 @@ var ProtectGateway = class {
       reason_code: entry.reason_code || "default_allow",
       policy_digest: this.config.policyDigest,
       policy_engine: this.config.policy?.policy_engine || "built-in",
-      request_id: entry.request_id || (0, import_node_crypto3.randomUUID)().slice(0, 12),
+      request_id: entry.request_id || (0, import_node_crypto4.randomUUID)().slice(0, 12),
       timestamp: Date.now(),
       mode,
       ...entry.rate_limit_remaining !== void 0 && { rate_limit_remaining: entry.rate_limit_remaining },
       ...entry.tier && { tier: entry.tier },
       ...entry.credential_ref && { credential_ref: entry.credential_ref },
+      ...entry.action_readback && { action_readback: entry.action_readback },
       otel_trace_id: otelTraceId,
       otel_span_id: otelSpanId
     };
@@ -39058,6 +39163,50 @@ function collectPath(leaves, index, out) {
     out.push(merkleRoot(leaves.slice(0, k)));
   }
 }
+function verifyProof(expectedRootHex, leafHash, proof) {
+  if (proof.index < 0 || proof.index >= proof.treeSize) return false;
+  if (proof.treeSize === 1) {
+    return proof.siblings.length === 0 && bytesToHex(leafHash).toLowerCase() === expectedRootHex.toLowerCase();
+  }
+  let result;
+  try {
+    result = reconstructRoot(
+      leafHash,
+      proof.index,
+      proof.treeSize,
+      proof.siblings
+    );
+  } catch {
+    return false;
+  }
+  return bytesToHex(result).toLowerCase() === expectedRootHex.toLowerCase();
+}
+function reconstructRoot(leafHash, index, treeSize, siblings) {
+  if (treeSize === 1) {
+    if (siblings.length !== 0) {
+      throw new Error("reconstructRoot: extra siblings at single-leaf level");
+    }
+    return leafHash;
+  }
+  if (siblings.length === 0) {
+    throw new Error("reconstructRoot: ran out of siblings before single-leaf");
+  }
+  const k = largestPowerOfTwoLessThan(treeSize);
+  const outermostSibling = hexToBytes(siblings[siblings.length - 1]);
+  const innerSiblings = siblings.slice(0, -1);
+  if (index < k) {
+    const leftHash = reconstructRoot(leafHash, index, k, innerSiblings);
+    return hashInternal(leftHash, outermostSibling);
+  } else {
+    const rightHash = reconstructRoot(
+      leafHash,
+      index - k,
+      treeSize - k,
+      innerSiblings
+    );
+    return hashInternal(outermostSibling, rightHash);
+  }
+}
 function largestPowerOfTwoLessThan(n) {
   if (n < 2) {
     throw new Error(`largestPowerOfTwoLessThan: n must be >= 2 (got ${n})`);
@@ -39085,6 +39234,17 @@ function base64urlNoPad(bytes) {
   const std = typeof Buffer !== "undefined" ? Buffer.from(bytes).toString("base64") : btoa(String.fromCharCode(...bytes));
   return std.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+function base64urlDecode(s) {
+  const std = s.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = std + "=".repeat((4 - std.length % 4) % 4);
+  if (typeof Buffer !== "undefined") {
+    return new Uint8Array(Buffer.from(padded, "base64"));
+  }
+  const bin = atob(padded);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
 function encodeLeaf(field) {
   const obj = {
     name: field.name,
@@ -39218,11 +39378,128 @@ function discloseField(receiptHash, fieldName, openings) {
     proof
   };
 }
+function createSelectiveDisclosurePackage(receipt, fieldNames, openings) {
+  const receiptHash = receiptHashHex(receipt);
+  const committedFieldsRoot = typeof receipt.committed_fields_root === "string" ? receipt.committed_fields_root : "";
+  if (!committedFieldsRoot) {
+    throw new Error("selective disclosure requires a committed receipt with committed_fields_root");
+  }
+  const committedFieldNames = committedFieldNamesFromReceipt(receipt, openings);
+  const uniqueFields = Array.from(new Set(fieldNames));
+  for (const fieldName of uniqueFields) {
+    if (!committedFieldNames.includes(fieldName)) {
+      throw new Error(`selective disclosure: field "${fieldName}" is not committed by this receipt`);
+    }
+  }
+  const disclosures = uniqueFields.map((fieldName) => discloseField(receiptHash, fieldName, openings));
+  const hiddenFields = committedFieldNames.filter((fieldName) => !uniqueFields.includes(fieldName));
+  return {
+    type: "scopeblind.selective_disclosure.v0",
+    version: 0,
+    parent_receipt_hash: receiptHash,
+    committed_fields_root: committedFieldsRoot,
+    disclosed_fields: uniqueFields,
+    hidden_fields: hiddenFields,
+    disclosures,
+    verifier_explanation: {
+      summary: "This package opens selected committed receipt fields and leaves the rest hidden.",
+      disclosed: uniqueFields.length ? `Disclosed fields: ${uniqueFields.join(", ")}.` : "No fields were disclosed.",
+      hidden: hiddenFields.length ? `Hidden committed fields: ${hiddenFields.join(", ")}. Their salted commitments remain bound to the signed receipt root.` : "No committed fields remain hidden.",
+      limitation: "Selective Disclosure v0 uses salted SHA-256 commitments and Merkle proofs. It is not a full zero-knowledge proof."
+    }
+  };
+}
+function verifySelectiveDisclosurePackage(receipt, disclosure) {
+  const errors = [];
+  if (disclosure.type !== "scopeblind.selective_disclosure.v0") {
+    errors.push("disclosure.type is not scopeblind.selective_disclosure.v0");
+  }
+  const actualReceiptHash = receiptHashHex(receipt);
+  const receiptHashValid = disclosure.parent_receipt_hash === actualReceiptHash;
+  if (!receiptHashValid) {
+    errors.push("parent_receipt_hash does not match the supplied receipt");
+  }
+  const root = typeof receipt.committed_fields_root === "string" ? receipt.committed_fields_root : "";
+  const commitmentRootValid = Boolean(root) && disclosure.committed_fields_root === root;
+  if (!commitmentRootValid) {
+    errors.push("committed_fields_root does not match the supplied receipt");
+  }
+  const signatureValid = verifyCommittedReceiptSignature(receipt);
+  if (signatureValid === false) {
+    errors.push("receipt signature failed verification");
+  }
+  const committedFieldNames = committedFieldNamesFromReceipt(receipt, {});
+  const disclosed = /* @__PURE__ */ new Set();
+  for (const item of disclosure.disclosures || []) {
+    if (item.parent_receipt_hash !== disclosure.parent_receipt_hash) {
+      errors.push(`disclosure for "${item.name}" targets a different receipt hash`);
+      continue;
+    }
+    if (!committedFieldNames.includes(item.name)) {
+      errors.push(`field "${item.name}" is not listed in committed_field_names`);
+      continue;
+    }
+    const leafBytes = encodeLeaf({
+      name: item.name,
+      salt: base64urlDecode(item.salt),
+      value: item.value
+    });
+    const ok = root ? verifyProof(root, hashLeaf(leafBytes), item.proof) : false;
+    if (!ok) {
+      errors.push(`field "${item.name}" failed Merkle inclusion verification`);
+    } else {
+      disclosed.add(item.name);
+    }
+  }
+  const disclosedFields = Array.from(disclosed);
+  const hiddenFields = committedFieldNames.filter((fieldName) => !disclosed.has(fieldName));
+  const valid = errors.length === 0 && receiptHashValid && commitmentRootValid && signatureValid !== false;
+  const explanation = [
+    valid ? "Selective disclosure verified: the disclosed fields open to the signed receipt commitment root." : "Selective disclosure failed verification.",
+    signatureValid === true ? "Receipt signature verified against the embedded Ed25519 public key." : signatureValid === null ? "Receipt signature was not checked because the committed receipt did not carry an embedded Ed25519 signature object." : "Receipt signature did not verify.",
+    disclosedFields.length ? `Disclosed fields: ${disclosedFields.join(", ")}.` : "No fields were disclosed.",
+    hiddenFields.length ? `Hidden fields: ${hiddenFields.join(", ")}. These remain private but bound to the same commitment root.` : "No committed fields remain hidden.",
+    "Limitation: this is salted commitment disclosure, not full zero-knowledge."
+  ];
+  return {
+    valid,
+    receipt_hash_valid: receiptHashValid,
+    signature_valid: signatureValid,
+    commitment_root_valid: commitmentRootValid,
+    disclosed_fields: disclosedFields,
+    hidden_fields: hiddenFields,
+    errors,
+    explanation
+  };
+}
+function committedFieldNamesFromReceipt(receipt, openings) {
+  const fromReceipt = Array.isArray(receipt.committed_field_names) ? receipt.committed_field_names.filter((fieldName) => typeof fieldName === "string") : [];
+  const names = fromReceipt.length ? fromReceipt : Object.keys(openings);
+  return Array.from(new Set(names)).sort();
+}
+function receiptHashHex(receipt) {
+  return bytesToHex(sha2562(new TextEncoder().encode(jcs(receipt))));
+}
+function verifyCommittedReceiptSignature(receipt) {
+  const signature = receipt.signature;
+  if (!signature || typeof signature !== "object") return null;
+  const sig = signature;
+  if (sig.alg !== "EdDSA" || typeof sig.sig !== "string" || typeof sig.public_key !== "string") {
+    return null;
+  }
+  const { signature: _signature, ...payloadWithoutSig } = receipt;
+  const messageHash = sha2562(new TextEncoder().encode(jcs(payloadWithoutSig)));
+  try {
+    return ed25519.verify(base64urlDecode(sig.sig), messageHash, hexToBytes(sig.public_key));
+  } catch {
+    return false;
+  }
+}
 
 // src/bundle.ts
 function createAuditBundle(opts) {
   const receipts = opts.receipts.filter(
-    (r) => r && typeof r === "object" && typeof r.signature === "string"
+    (r) => r && typeof r === "object" && (typeof r.signature === "string" || r.signature !== null && typeof r.signature === "object")
   );
   if (receipts.length === 0) {
     throw new Error("Audit bundle requires at least one signed receipt");
@@ -39251,10 +39528,18 @@ function createAuditBundle(opts) {
     time_range: timeRange,
     receipts,
     anchors: opts.anchors || [],
+    selective_disclosures: opts.selectiveDisclosures || [],
+    privacy: {
+      selective_disclosure: {
+        supported: true,
+        model: "salted_commitments_merkle_v0",
+        statement: "Committed receipts may disclose selected fields with salted Merkle openings. Undisclosed committed fields remain hidden while staying bound to the signed commitment root."
+      }
+    },
     verification: {
       algorithm: "ed25519",
       signing_keys: Array.from(keyMap.values()),
-      instructions: `Verify each receipt by: (1) remove the "signature" field, (2) canonicalize the remaining object with JCS (sorted keys at every level), (3) encode as UTF-8 bytes, (4) verify the Ed25519 signature using the signing key matching the receipt's "kid" field. CLI: npx @veritasacta/verify bundle.json --bundle`
+      instructions: `Verify each receipt by: (1) remove the "signature" field, (2) canonicalize the remaining object with JCS (sorted keys at every level), (3) encode as UTF-8 bytes, (4) verify the Ed25519 signature using the signing key matching the receipt's "kid" field. For scopeblind.selective_disclosure.v0 packages, recompute each disclosed leaf and verify it against the receipt committed_fields_root; fields not disclosed remain hidden. CLI: npx @veritasacta/verify bundle.json --bundle`
     }
   };
 }
@@ -39717,7 +40002,7 @@ function validateEvidenceReceipt(receipt) {
 
 // src/hook-server.ts
 var import_node_http2 = require("http");
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_node_fs9 = require("fs");
 var import_node_path5 = require("path");
 
@@ -39900,7 +40185,7 @@ function computePayloadDigest(input) {
     return void 0;
   }
   return {
-    input_hash: (0, import_node_crypto4.createHash)("sha256").update(content).digest("hex"),
+    input_hash: (0, import_node_crypto5.createHash)("sha256").update(content).digest("hex"),
     input_size: size,
     truncated: true,
     preview: content.slice(0, 256)
@@ -39913,7 +40198,7 @@ function computeOutputDigest(output) {
     return void 0;
   }
   return {
-    output_hash: (0, import_node_crypto4.createHash)("sha256").update(content).digest("hex"),
+    output_hash: (0, import_node_crypto5.createHash)("sha256").update(content).digest("hex"),
     output_size: size
   };
 }
@@ -39936,13 +40221,14 @@ function detectSandboxState() {
 async function handlePreToolUse(input, state) {
   const hookStart = Date.now();
   const toolName = input.toolName || "unknown";
-  const requestId = input.toolUseId || (0, import_node_crypto4.randomUUID)().slice(0, 12);
+  const requestId = input.toolUseId || (0, import_node_crypto5.randomUUID)().slice(0, 12);
   state.inflightTools.set(requestId, {
     tool: toolName,
     startedAt: hookStart,
     requestId
   });
   const payloadDigest = computePayloadDigest(input.toolInput);
+  const actionReadback = buildActionReadback(toolName, input.toolInput || {});
   const swarm = {
     ...state.swarmContext,
     ...input.agentId && { agent_id: input.agentId },
@@ -39960,7 +40246,10 @@ async function handlePreToolUse(input, state) {
         context: {
           hook_event: "PreToolUse",
           ...input.toolInput || {}
-        }
+        },
+        // Also expose the raw tool input under context.input so policies written
+        // against the documented nested shape match on the hook path too.
+        toolInput: input.toolInput || {}
       });
       if (!cedarDecision.allowed) {
         const reason = cedarDecision.reason || "cedar_deny";
@@ -39979,6 +40268,7 @@ async function handlePreToolUse(input, state) {
           swarm: swarm.team_name ? swarm : void 0,
           timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
           payload_digest: payloadDigest,
+          action_readback: actionReadback,
           deny_iteration: denyCount,
           sandbox_state: detectSandboxState(),
           plan_receipt_id: state.activePlanReceiptId || void 0
@@ -39999,10 +40289,30 @@ async function handlePreToolUse(input, state) {
         };
       }
     } catch (err) {
-      if (state.verbose) {
-        process.stderr.write(`[PROTECT_MCP] Cedar eval error: ${err instanceof Error ? err.message : err}
-`);
-      }
+      const hookLatency2 = Date.now() - hookStart;
+      process.stderr.write(
+        `[PROTECT_MCP] Cedar eval threw for "${toolName}", failing closed: ${err instanceof Error ? err.message : err}
+`
+      );
+      emitDecisionLog(state, {
+        tool: toolName,
+        decision: "deny",
+        reason_code: "cedar_eval_error",
+        request_id: requestId,
+        hook_event: "PreToolUse",
+        swarm: swarm.team_name ? swarm : void 0,
+        timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        action_readback: actionReadback,
+        sandbox_state: detectSandboxState()
+      });
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `[ScopeBlind] Denied: the policy engine errored while evaluating "${toolName}", so the gate fails closed rather than allow an unverified call. Check the policy set and server logs.`
+        }
+      };
     }
   }
   if (state.jsonPolicy?.policy) {
@@ -40018,6 +40328,7 @@ async function handlePreToolUse(input, state) {
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
         payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
@@ -40038,13 +40349,15 @@ async function handlePreToolUse(input, state) {
         hook_event: "PreToolUse",
         swarm: swarm.team_name ? swarm : void 0,
         timing: { hook_latency_ms: hookLatency2, started_at: hookStart },
+        payload_digest: payloadDigest,
+        action_readback: actionReadback,
         sandbox_state: detectSandboxState()
       });
       return {
         hookSpecificOutput: {
           hookEventName: "PreToolUse",
           permissionDecision: "ask",
-          permissionDecisionReason: `[ScopeBlind] "${toolName}" requires human approval. Policy: ${state.policyDigest}`
+          permissionDecisionReason: `[ScopeBlind] Approval required for exactly this action: ${actionReadback.summary}. Payload hash: ${actionReadback.payload_hash.slice(0, 16)}\u2026 Policy: ${state.policyDigest}`
         }
       };
     }
@@ -40089,6 +40402,7 @@ async function handlePreToolUse(input, state) {
     swarm: swarm.team_name ? swarm : void 0,
     timing: { hook_latency_ms: hookLatency, started_at: hookStart },
     payload_digest: payloadDigest,
+    action_readback: actionReadback,
     sandbox_state: detectSandboxState(),
     plan_receipt_id: state.activePlanReceiptId || void 0
   });
@@ -40105,7 +40419,7 @@ async function handlePreToolUse(input, state) {
 }
 async function handlePostToolUse(input, state) {
   const toolName = input.toolName || "unknown";
-  const requestId = input.toolUseId || (0, import_node_crypto4.randomUUID)().slice(0, 12);
+  const requestId = input.toolUseId || (0, import_node_crypto5.randomUUID)().slice(0, 12);
   const now = Date.now();
   const inflight = state.inflightTools.get(requestId);
   const timing = {
@@ -40117,7 +40431,7 @@ async function handlePostToolUse(input, state) {
     state.inflightTools.delete(requestId);
   }
   const outputDigest = computeOutputDigest(input.toolResult);
-  const receiptId = (0, import_node_crypto4.randomUUID)().slice(0, 8);
+  const receiptId = (0, import_node_crypto5.randomUUID)().slice(0, 8);
   const policyName = state.cedarPolicies ? `cedar:${state.policyDigest}` : state.policyDigest;
   const additionalContext = `[ScopeBlind] Tool call receipted. Policy: ${policyName}. Decision: allow. Receipt: #${receiptId}.` + (timing.tool_duration_ms !== void 0 ? ` Duration: ${timing.tool_duration_ms}ms.` : "") + (timing.hook_latency_ms !== void 0 ? ` Overhead: ${timing.hook_latency_ms}ms.` : "");
   emitDecisionLog(state, {
@@ -40149,7 +40463,7 @@ function handleSubagentStart(input, state) {
     tool: `subagent:${agentId}`,
     decision: "allow",
     reason_code: "subagent_started",
-    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto5.randomUUID)().slice(0, 12),
     hook_event: "SubagentStart",
     swarm: {
       ...state.swarmContext,
@@ -40170,7 +40484,7 @@ function handleSubagentStop(input, state) {
     tool: `subagent:${agentId}`,
     decision: "allow",
     reason_code: "subagent_stopped",
-    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto5.randomUUID)().slice(0, 12),
     hook_event: "SubagentStop",
     swarm: {
       ...state.swarmContext,
@@ -40185,7 +40499,7 @@ function handleTaskCreated(input, state) {
     tool: `task:${input.taskId || "unknown"}`,
     decision: "allow",
     reason_code: "task_created",
-    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto5.randomUUID)().slice(0, 12),
     hook_event: "TaskCreated",
     swarm: {
       ...state.swarmContext,
@@ -40199,7 +40513,7 @@ function handleTaskCompleted(input, state) {
     tool: `task:${input.taskId || "unknown"}`,
     decision: "allow",
     reason_code: "task_completed",
-    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto5.randomUUID)().slice(0, 12),
     hook_event: "TaskCompleted",
     swarm: state.swarmContext
   });
@@ -40210,7 +40524,7 @@ function handleSessionStart(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "session_started",
-    request_id: input.sessionId || (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: input.sessionId || (0, import_node_crypto5.randomUUID)().slice(0, 12),
     hook_event: "SessionStart",
     swarm: state.swarmContext,
     sandbox_state: detectSandboxState()
@@ -40233,7 +40547,7 @@ function handleSessionEnd(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "session_ended",
-    request_id: input.sessionId || (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: input.sessionId || (0, import_node_crypto5.randomUUID)().slice(0, 12),
     hook_event: "SessionEnd",
     swarm: state.swarmContext
   });
@@ -40244,7 +40558,7 @@ function handleTeammateIdle(input, state) {
     tool: `teammate:${input.agentId || "unknown"}`,
     decision: "allow",
     reason_code: "teammate_idle",
-    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto5.randomUUID)().slice(0, 12),
     hook_event: "TeammateIdle",
     swarm: {
       ...state.swarmContext,
@@ -40272,7 +40586,7 @@ function handleConfigChange(input, state) {
       tool: "config",
       decision: "deny",
       reason_code: "config_tamper_detected",
-      request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
+      request_id: (0, import_node_crypto5.randomUUID)().slice(0, 12),
       hook_event: "ConfigChange",
       swarm: state.swarmContext
     });
@@ -40281,7 +40595,7 @@ function handleConfigChange(input, state) {
       tool: "config",
       decision: "allow",
       reason_code: "config_changed",
-      request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
+      request_id: (0, import_node_crypto5.randomUUID)().slice(0, 12),
       hook_event: "ConfigChange"
     });
   }
@@ -40303,7 +40617,7 @@ function handleStop(input, state) {
     tool: "session",
     decision: "allow",
     reason_code: "agent_stopped",
-    request_id: (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: (0, import_node_crypto5.randomUUID)().slice(0, 12),
     hook_event: "Stop",
     swarm: state.swarmContext
   });
@@ -40311,8 +40625,8 @@ function handleStop(input, state) {
 }
 function emitDecisionLog(state, entry) {
   const mode = state.enforce ? "enforce" : "shadow";
-  const otelTraceId = (0, import_node_crypto4.randomBytes)(16).toString("hex");
-  const otelSpanId = (0, import_node_crypto4.randomBytes)(8).toString("hex");
+  const otelTraceId = (0, import_node_crypto5.randomBytes)(16).toString("hex");
+  const otelSpanId = (0, import_node_crypto5.randomBytes)(8).toString("hex");
   const log = {
     v: 2,
     tool: entry.tool || "unknown",
@@ -40320,7 +40634,7 @@ function emitDecisionLog(state, entry) {
     reason_code: entry.reason_code || "default_allow",
     policy_digest: state.policyDigest,
     policy_engine: state.cedarPolicies ? "cedar" : "built-in",
-    request_id: entry.request_id || (0, import_node_crypto4.randomUUID)().slice(0, 12),
+    request_id: entry.request_id || (0, import_node_crypto5.randomUUID)().slice(0, 12),
     timestamp: Date.now(),
     mode,
     otel_trace_id: otelTraceId,
@@ -41299,8 +41613,515 @@ function generateSchemaStub(namespace = "ScopeBlind") {
   ].join("\n");
 }
 
+// src/policy-packs.ts
+var header = (id, description) => `// ScopeBlind protect-mcp policy pack: ${id}
+// ${description}
+// Start in shadow mode, review receipts, then run with --enforce.
+
+`;
+var defaultPermit = `
+// Default posture: allow non-matching calls so teams can start in shadow mode.
+// Tighten this after reviewing your local action dashboard.
+permit(principal, action == Action::"MCP::Tool::call", resource);
+`;
+var filesystemSafe = `${header("filesystem-safe", "Block common destructive filesystem and secret-file access patterns.")}// Destructive file tools are never safe as an unattended default.
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"delete_file");
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"remove_file");
+
+// Secret-like reads by path.
+forbid(principal, action == Action::"MCP::Tool::call", resource) when {
+  context has "input" && context.input has "path" && (
+    context.input.path like "*/.env*" ||
+    context.input.path like "*/id_rsa*" ||
+    context.input.path like "*/.ssh/*" ||
+    context.input.path like "*secret*" ||
+    context.input.path like "*credential*"
+  )
+};
+
+// Dangerous shell operations that mutate or destroy local state.
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"Bash") when {
+  context has "command" && (
+    context.command like "*rm -rf*" ||
+    context.command like "*mkfs*" ||
+    context.command like "*dd if=*" ||
+    context.command like "*chmod -R 777*" ||
+    context.command like "*chown -R*"
+  )
+};
+${defaultPermit}`;
+var gitSafe = `${header("git-safe", "Prevent unattended history rewrites, force pushes, and destructive repo cleanup.")}forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"Bash") when {
+  context has "command" && (
+    context.command like "*git push --force*" ||
+    context.command like "*git push -f*" ||
+    context.command like "*git reset --hard*" ||
+    context.command like "*git clean -fd*" ||
+    context.command like "*git checkout --*" ||
+    context.command like "*git branch -D*" ||
+    context.command like "*gh repo delete*"
+  )
+};
+${defaultPermit}`;
+var emailSafe = `${header("email-safe", "Permit drafting but block unattended external sends.")}forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"mail.send");
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"email.send");
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"send_email");
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"gmail.send");
+
+// Shell fallbacks that send mail are blocked too.
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"Bash") when {
+  context has "command" && (
+    context.command like "*sendmail*" ||
+    context.command like "*mailx*" ||
+    context.command like "*smtp*"
+  )
+};
+${defaultPermit}`;
+var databaseSafe = `${header("database-safe", "Allow reads, block write/admin SQL unless explicitly approved elsewhere.")}forbid(principal, action == Action::"MCP::Tool::call", resource) when {
+  context has "input" && context.input has "query" && (
+    context.input.query like "*DROP *" ||
+    context.input.query like "*TRUNCATE *" ||
+    context.input.query like "*DELETE *" ||
+    context.input.query like "*UPDATE *" ||
+    context.input.query like "*INSERT *" ||
+    context.input.query like "*ALTER *" ||
+    context.input.query like "*GRANT *" ||
+    context.input.query like "*REVOKE *"
+  )
+};
+${defaultPermit}`;
+var cloudSpendSafe = `${header("cloud-spend-safe", "Block cloud actions that can create spend or destroy infrastructure.")}forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"Bash") when {
+  context has "command" && (
+    context.command like "*terraform destroy*" ||
+    context.command like "*terraform apply*" ||
+    context.command like "*pulumi up*" ||
+    context.command like "*pulumi destroy*" ||
+    context.command like "*aws ec2 run-instances*" ||
+    context.command like "*aws rds create*" ||
+    context.command like "*gcloud compute instances create*" ||
+    context.command like "*az vm create*" ||
+    context.command like "*kubectl delete*"
+  )
+};
+${defaultPermit}`;
+var secretsSafe = `${header("secrets-safe", "Block secret exfiltration from files, env, shell, and common credential tools.")}forbid(principal, action == Action::"MCP::Tool::call", resource) when {
+  context has "input" && context.input has "path" && (
+    context.input.path like "*/.env*" ||
+    context.input.path like "*/.aws/credentials*" ||
+    context.input.path like "*/.npmrc*" ||
+    context.input.path like "*/.netrc*" ||
+    context.input.path like "*/id_rsa*" ||
+    context.input.path like "*secret*" ||
+    context.input.path like "*token*"
+  )
+};
+
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"Bash") when {
+  context has "command" && (
+    context.command like "*printenv*" ||
+    context.command like "*env |*" ||
+    context.command like "*security find-generic-password*" ||
+    context.command like "*aws secretsmanager get-secret-value*" ||
+    context.command like "*gcloud secrets versions access*" ||
+    context.command like "*op read*"
+  )
+};
+${defaultPermit}`;
+var financeMandateSafe = `${header("finance-mandate-safe", "Block restricted-list and concentration-limit breaches in booking tools.")}forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"pms.book") when {
+  context has "input" && context.input has "on_restricted_list" && context.input.on_restricted_list == true
+};
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"booking.execute") when {
+  context has "input" && context.input has "on_restricted_list" && context.input.on_restricted_list == true
+};
+forbid(principal, action == Action::"MCP::Tool::call", resource == Tool::"booking.ticket") when {
+  context has "input" && context.input has "on_restricted_list" && context.input.on_restricted_list == true
+};
+
+// Default example caps: single-name > 10%, gross > 200%, net > 100%.
+forbid(principal, action == Action::"MCP::Tool::call", resource) when {
+  context has "input" && context.input has "post_trade_weight_bps" && context.input.post_trade_weight_bps > 1000
+};
+forbid(principal, action == Action::"MCP::Tool::call", resource) when {
+  context has "input" && context.input has "post_trade_gross_exposure_bps" && context.input.post_trade_gross_exposure_bps > 20000
+};
+forbid(principal, action == Action::"MCP::Tool::call", resource) when {
+  context has "input" && context.input has "post_trade_net_exposure_bps" && context.input.post_trade_net_exposure_bps > 10000
+};
+${defaultPermit}`;
+var POLICY_PACKS = [
+  {
+    id: "filesystem-safe",
+    name: "Filesystem Safe",
+    description: "Blocks destructive filesystem calls and secret-like path reads.",
+    recommendedMode: "shadow-first",
+    files: [{ path: "filesystem-safe.cedar", contents: filesystemSafe }]
+  },
+  {
+    id: "git-safe",
+    name: "Git Safe",
+    description: "Blocks force pushes, hard resets, destructive cleanup, and repo deletion.",
+    recommendedMode: "shadow-first",
+    files: [{ path: "git-safe.cedar", contents: gitSafe }]
+  },
+  {
+    id: "email-safe",
+    name: "Email Safe",
+    description: "Allows drafting workflows while blocking unattended sends.",
+    recommendedMode: "shadow-first",
+    files: [{ path: "email-safe.cedar", contents: emailSafe }]
+  },
+  {
+    id: "database-safe",
+    name: "Database Safe",
+    description: "Allows read-oriented DB tools while blocking mutating/admin SQL.",
+    recommendedMode: "shadow-first",
+    files: [{ path: "database-safe.cedar", contents: databaseSafe }]
+  },
+  {
+    id: "cloud-spend-safe",
+    name: "Cloud Spend Safe",
+    description: "Blocks obvious cloud spend creation and infrastructure destruction.",
+    recommendedMode: "shadow-first",
+    files: [{ path: "cloud-spend-safe.cedar", contents: cloudSpendSafe }]
+  },
+  {
+    id: "secrets-safe",
+    name: "Secrets Safe",
+    description: "Blocks common file, env, shell, and cloud secret exfiltration paths.",
+    recommendedMode: "enforce-ready",
+    files: [{ path: "secrets-safe.cedar", contents: secretsSafe }]
+  },
+  {
+    id: "finance-mandate-safe",
+    name: "Finance Mandate Safe",
+    description: "Blocks restricted-list and concentration breaches in booking flows.",
+    recommendedMode: "shadow-first",
+    files: [{ path: "finance-mandate-safe.cedar", contents: financeMandateSafe }]
+  }
+];
+function getPolicyPack(id) {
+  return POLICY_PACKS.find((pack) => pack.id === id);
+}
+function policyPackIds() {
+  return POLICY_PACKS.map((pack) => pack.id);
+}
+
+// src/connector-pilots.ts
+var import_node_fs10 = require("fs");
+var import_node_path6 = require("path");
+var defaultPermit2 = `
+// Default posture: observe all non-matching tools so the connector can be piloted in shadow mode.
+permit(principal, action == Action::"MCP::Tool::call", resource);
+`;
+var CONNECTOR_PILOTS = [
+  {
+    id: "github",
+    category: "code",
+    name: "GitHub pull-request control",
+    status: "usable-pilot",
+    description: "Controls GitHub REST/MCP calls for issue, PR, branch, and workflow actions.",
+    value: "Useful when agents already have repo access through GitHub MCP, gh, or a GitHub-backed tool server.",
+    env: [
+      { name: "GITHUB_TOKEN", required: true, description: "Fine-grained token scoped to the pilot repo." },
+      { name: "GITHUB_REPOSITORY", required: true, description: "owner/repo target for the pilot." }
+    ],
+    tools: ["github.rest.request", "github.issue.create", "github.pull_request.merge", "github.workflow.dispatch"],
+    actions: [
+      { name: "Read repo metadata", tool: "github.rest.request", risk: "low", mode: "observe", description: "GET-only repository and PR inspection." },
+      { name: "Create issue or comment", tool: "github.issue.create", risk: "medium", mode: "require_approval", description: "External write to the system of record." },
+      { name: "Merge PR / dispatch workflow", tool: "github.pull_request.merge", risk: "high", mode: "require_approval", description: "Code-changing or CI-triggering action." }
+    ],
+    setup: [
+      "Create a fine-grained GitHub token for one repository.",
+      "Set GITHUB_TOKEN and GITHUB_REPOSITORY.",
+      "Run the agent through protect-mcp and review GitHub tool calls in the dashboard."
+    ],
+    config: {
+      type: "scopeblind.connector_pilot.v1",
+      provider: "github",
+      target_env: ["GITHUB_TOKEN", "GITHUB_REPOSITORY"],
+      safe_read_probe: "GET /repos/{GITHUB_REPOSITORY}",
+      controlled_tools: ["github.rest.request", "github.issue.create", "github.pull_request.merge", "github.workflow.dispatch"],
+      approval_required_for: ["POST", "PATCH", "PUT", "DELETE", "merge", "workflow_dispatch"],
+      receipt_fields: ["method", "path", "repo", "actor", "payload_hash", "approval_reason"]
+    },
+    cedar: `${defaultPermit2}
+// GitHub pilot: reads are observed; writes and merges need exact-action approval.
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "github.pull_request.merge" };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "github.workflow.dispatch" && !context.approved };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "github.issue.create" && !context.approved };
+`
+  },
+  {
+    id: "email-gmail",
+    category: "communications",
+    name: "Gmail self-send / draft approval",
+    status: "usable-pilot",
+    description: "Uses the existing Gmail OAuth connector path and restricts send mode to email.self for the first production pilot.",
+    value: "Makes external communications reviewable before an agent can send mail.",
+    env: [
+      { name: "GOOGLE_CLIENT_ID", required: true, description: "OAuth client for Gmail." },
+      { name: "GOOGLE_CLIENT_SECRET", required: true, description: "OAuth client secret." },
+      { name: "CONNECTOR_TOKEN_KEY", required: true, description: "AES-GCM key material for sealed connector tokens." }
+    ],
+    tools: ["gmail.draft.create", "gmail.send.email_self", "email.send"],
+    actions: [
+      { name: "Create draft", tool: "gmail.draft.create", risk: "medium", mode: "require_approval", description: "Draft content can leak sensitive information." },
+      { name: "Self-send test", tool: "gmail.send.email_self", risk: "medium", mode: "require_approval", description: "First release allows only sending to the account owner." },
+      { name: "External send", tool: "email.send", risk: "high", mode: "deny", description: "Direct external send stays blocked until a customer-specific allowlist exists." }
+    ],
+    setup: [
+      "Configure Google OAuth redirect /fn/connectors/gmail/callback.",
+      "Connect Gmail through the hosted console or local connector flow.",
+      "Keep send mode to email.self until the customer approves recipient allowlists."
+    ],
+    config: {
+      type: "scopeblind.connector_pilot.v1",
+      provider: "gmail",
+      hosted_functions: ["/fn/connectors/gmail/start", "/fn/connectors/gmail/callback", "/fn/connectors/gmail/send", "/fn/connectors/gmail/status"],
+      first_release_scope: "email.self",
+      denied_until_configured: ["email.send.external", "email.bulk_send"],
+      receipt_fields: ["to_hash", "subject_hash", "body_hash", "approval_reason", "gmail_message_id"]
+    },
+    cedar: `${defaultPermit2}
+// Email pilot: no direct external send. Draft/self-send require exact approval.
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "email.send" };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "gmail.draft.create" && !context.approved };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "gmail.send.email_self" && !context.approved };
+`
+  },
+  {
+    id: "filesystem-git",
+    category: "local-computer",
+    name: "Filesystem and Git control",
+    status: "usable-pilot",
+    description: "Controls reads, writes, shell commands, and Git mutation in the local project.",
+    value: "Immediately useful with Claude Code, Codex, Cursor, and any agent that edits files or runs shell commands.",
+    env: [],
+    tools: ["Read", "Write", "Edit", "MultiEdit", "Bash", "git.commit", "git.push"],
+    actions: [
+      { name: "Read files", tool: "Read", risk: "low", mode: "observe", description: "Observe file reads for audit context." },
+      { name: "Write/edit files", tool: "Write", risk: "medium", mode: "require_approval", description: "Require approval for sensitive paths or broad rewrites." },
+      { name: "Git push/reset", tool: "Bash", risk: "high", mode: "require_approval", description: "Commands that publish, reset, or delete require exact-action approval." }
+    ],
+    setup: [
+      "Run protect-mcp init-hooks in the project.",
+      "Install filesystem-safe and Git-safe policy packs.",
+      "Review the dashboard before turning on enforce mode."
+    ],
+    config: {
+      type: "scopeblind.connector_pilot.v1",
+      provider: "filesystem-git",
+      local_only: true,
+      protected_paths: [".env", ".ssh", "keys/", "secrets/", "node_modules/"],
+      dangerous_command_patterns: ["rm -rf", "git push", "git reset --hard", "curl | sh", "chmod 777"],
+      receipt_fields: ["tool", "path_hash", "command_hash", "diff_hash", "approval_reason"]
+    },
+    cedar: `${defaultPermit2}
+// Filesystem/Git pilot: dangerous shell and protected-path writes need approval.
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "Bash" && context.command_pattern.contains("git reset --hard") && !context.approved };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "Bash" && context.command_pattern.contains("git push") && !context.approved };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { ["Write", "Edit", "MultiEdit"].contains(context.tool) && context.path.contains(".env") && !context.approved };
+`
+  },
+  {
+    id: "slack-teams",
+    category: "communications",
+    name: "Slack or Teams outbound approval",
+    status: "usable-pilot",
+    description: "Controls messages to Slack channels or Microsoft Teams webhooks.",
+    value: "Makes high-impact internal broadcasts and client channels approval-gated.",
+    env: [
+      { name: "SLACK_BOT_TOKEN", required: false, description: "Slack bot token for chat.postMessage pilots." },
+      { name: "SLACK_CHANNEL_ID", required: false, description: "Default Slack channel for the pilot." },
+      { name: "TEAMS_WEBHOOK_URL", required: false, description: "Teams incoming webhook URL if Teams is preferred." }
+    ],
+    tools: ["slack.chat.postMessage", "slack.files.upload", "teams.webhook.post"],
+    actions: [
+      { name: "Post internal message", tool: "slack.chat.postMessage", risk: "medium", mode: "require_approval", description: "Message text and channel are read back before send." },
+      { name: "Upload file", tool: "slack.files.upload", risk: "high", mode: "require_approval", description: "Files can leak customer data and need explicit approval." },
+      { name: "Teams webhook post", tool: "teams.webhook.post", risk: "medium", mode: "require_approval", description: "Webhook destination and payload hash are receipted." }
+    ],
+    setup: [
+      "Choose Slack or Teams for the first pilot, not both.",
+      "Set the relevant token/webhook environment variables.",
+      "Start with a private test channel and exact-action approval for every send."
+    ],
+    config: {
+      type: "scopeblind.connector_pilot.v1",
+      provider: "slack-or-teams",
+      supported_modes: ["slack.chat.postMessage", "teams.webhook.post"],
+      require_channel_allowlist: true,
+      receipt_fields: ["channel_hash", "message_hash", "file_hash", "approval_reason", "provider_message_id"]
+    },
+    cedar: `${defaultPermit2}
+// Slack/Teams pilot: all outbound posts and uploads require approval by default.
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { ["slack.chat.postMessage", "slack.files.upload", "teams.webhook.post"].contains(context.tool) && !context.approved };
+`
+  },
+  {
+    id: "finance-pms",
+    category: "finance",
+    name: "Finance PMS mock-to-real adapter",
+    status: "usable-pilot",
+    description: "Stages orders into a PMS adapter contract, with mock mode locally and real mode through PMS_ADAPTER_URL.",
+    value: "Gives hedge funds the controlled booking path: parse, mandate-check, approve, book, corroborate, receipt.",
+    env: [
+      { name: "PMS_ADAPTER_URL", required: false, description: "Customer-owned adapter endpoint. Omit for local mock mode." },
+      { name: "PMS_ADAPTER_TOKEN", required: false, description: "Bearer token for the customer-owned PMS adapter." }
+    ],
+    tools: ["pms.order.stage", "pms.order.book", "pms.order.cancel", "pms.reconcile"],
+    actions: [
+      { name: "Stage order", tool: "pms.order.stage", risk: "medium", mode: "require_approval", description: "Creates a booking ticket but does not execute." },
+      { name: "Book order", tool: "pms.order.book", risk: "high", mode: "require_approval", description: "Must pass mandate checks and human readback." },
+      { name: "Cancel/order correction", tool: "pms.order.cancel", risk: "high", mode: "require_approval", description: "Mutates book state and requires approval." }
+    ],
+    setup: [
+      "Run local mock mode first with the Legate finance pilot pack.",
+      "Point PMS_ADAPTER_URL at a customer-owned bridge when ready.",
+      "Require mandate checks and exact-action approval before pms.order.book."
+    ],
+    config: {
+      type: "scopeblind.connector_pilot.v1",
+      provider: "finance-pms",
+      mode: "mock-first",
+      adapter_contract: {
+        stage: "POST /orders/stage",
+        book: "POST /orders/book",
+        cancel: "POST /orders/{client_order_id}/cancel",
+        reconcile: "GET /orders/{client_order_id}"
+      },
+      receipt_fields: ["client_order_id", "side", "symbol_hash", "qty", "price", "mandate_digest", "approval_reason", "external_confirmation_hash"]
+    },
+    cedar: `${defaultPermit2}
+// Finance/PMS pilot: booking actions require mandate pass and exact approval.
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { ["pms.order.stage", "pms.order.book", "pms.order.cancel"].contains(context.tool) && !context.approved };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "pms.order.book" && context.mandate_passed != true };
+`
+  }
+];
+function connectorPilotIds() {
+  return CONNECTOR_PILOTS.map((pilot) => pilot.id);
+}
+function getConnectorPilot(id) {
+  return CONNECTOR_PILOTS.find((pilot) => pilot.id === id);
+}
+function connectorDirectory(dir) {
+  return (0, import_node_path6.join)(dir, ".protect-mcp", "connectors");
+}
+function writeConnectorPilots(opts) {
+  const directory = connectorDirectory(opts.dir);
+  (0, import_node_fs10.mkdirSync)(directory, { recursive: true });
+  const selected = opts.ids && opts.ids.length > 0 && !opts.ids.includes("all") ? opts.ids.map((id) => {
+    const pilot = getConnectorPilot(id);
+    if (!pilot) throw new Error(`Unknown connector pilot: ${id}`);
+    return pilot;
+  }) : CONNECTOR_PILOTS;
+  const written = [];
+  for (const pilot of selected) {
+    const configPath = (0, import_node_path6.join)(directory, `${pilot.id}.json`);
+    const policyPath = (0, import_node_path6.join)(directory, `${pilot.id}.cedar`);
+    if (!opts.force && ((0, import_node_fs10.existsSync)(configPath) || (0, import_node_fs10.existsSync)(policyPath))) {
+      throw new Error(`Refusing to overwrite ${pilot.id}. Re-run with --force if intentional.`);
+    }
+    (0, import_node_fs10.writeFileSync)(configPath, JSON.stringify({ ...pilot.config, id: pilot.id, name: pilot.name, category: pilot.category, tools: pilot.tools, actions: pilot.actions, setup: pilot.setup }, null, 2) + "\n");
+    (0, import_node_fs10.writeFileSync)(policyPath, pilot.cedar.endsWith("\n") ? pilot.cedar : `${pilot.cedar}
+`);
+    written.push(configPath, policyPath);
+  }
+  (0, import_node_fs10.writeFileSync)((0, import_node_path6.join)(directory, "README.md"), renderConnectorReadme(selected));
+  written.push((0, import_node_path6.join)(directory, "README.md"));
+  return { written, pilots: selected, directory };
+}
+function readInstalledConnectorPilots(dir) {
+  const directory = connectorDirectory(dir);
+  if (!(0, import_node_fs10.existsSync)(directory)) return [];
+  return (0, import_node_fs10.readdirSync)(directory).filter((name) => name.endsWith(".json")).map((name) => {
+    const configPath = (0, import_node_path6.join)(directory, name);
+    try {
+      const parsed = JSON.parse((0, import_node_fs10.readFileSync)(configPath, "utf-8"));
+      const id = String(parsed.id || name.replace(/\.json$/, ""));
+      const pilot = getConnectorPilot(id);
+      return {
+        id,
+        name: String(parsed.name || pilot?.name || id),
+        category: String(parsed.category || pilot?.category || "unknown"),
+        status: String(parsed.status || parsed.type || "installed"),
+        config_path: configPath,
+        policy_path: (0, import_node_path6.join)(directory, `${id}.cedar`)
+      };
+    } catch {
+      return null;
+    }
+  }).filter(Boolean);
+}
+function connectorDoctor(dir, env = process.env) {
+  const installed = new Set(readInstalledConnectorPilots(dir).map((pilot) => pilot.id));
+  return CONNECTOR_PILOTS.map((pilot) => {
+    const envRows = pilot.env.map((item) => ({
+      name: item.name,
+      required: item.required,
+      present: Boolean(env[item.name]),
+      description: item.description
+    }));
+    const missingRequired = envRows.filter((item) => item.required && !item.present).map((item) => item.name);
+    const optionalPresent = envRows.filter((item) => !item.required && item.present).map((item) => item.name);
+    const optionalProviderReady = pilot.id === "slack-teams" ? Boolean(env.SLACK_BOT_TOKEN || env.TEAMS_WEBHOOK_URL) : pilot.id === "finance-pms" ? Boolean(env.PMS_ADAPTER_URL) : false;
+    const mockModeReady = pilot.id === "finance-pms";
+    return {
+      id: pilot.id,
+      name: pilot.name,
+      category: pilot.category,
+      installed: installed.has(pilot.id),
+      usable: missingRequired.length === 0 && (pilot.env.some((item) => item.required) || pilot.env.length === 0 || optionalProviderReady || mockModeReady),
+      mode: pilot.id === "finance-pms" && !env.PMS_ADAPTER_URL ? "mock" : pilot.id === "slack-teams" && !env.SLACK_BOT_TOKEN && !env.TEAMS_WEBHOOK_URL ? "needs_provider_choice" : "configured_or_local",
+      missing_required: missingRequired,
+      optional_present: optionalPresent,
+      tools: pilot.tools,
+      next: missingRequired.length > 0 ? `Set ${missingRequired.join(", ")}` : installed.has(pilot.id) ? "Run through protect-mcp and inspect the dashboard." : `Install with protect-mcp connectors init ${pilot.id}`
+    };
+  });
+}
+function renderConnectorReadme(pilots) {
+  return `# protect-mcp connector pilots
+
+These files make real tool classes visible and controllable without uploading raw prompts or payloads.
+
+${pilots.map((pilot) => `## ${pilot.name}
+
+${pilot.description}
+
+Value: ${pilot.value}
+
+Tools: ${pilot.tools.map((tool) => `\`${tool}\``).join(", ")}
+
+Setup:
+${pilot.setup.map((step) => `- ${step}`).join("\n")}
+`).join("\n")}
+Next: run \`npx protect-mcp dashboard --open\` and review tool inventory, policy coverage, approvals, and receipts.
+`;
+}
+
 // src/rekor-anchor.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var REKOR_API = "https://rekor.sigstore.dev/api/v1";
 async function anchorToRekor(receiptHash, signature, publicKeyPem) {
   const entry = {
@@ -41369,7 +42190,7 @@ async function verifyRekorAnchor(logIndex, expectedHash) {
 }
 function hashReceipt(receipt) {
   const canonical = JSON.stringify(receipt, Object.keys(receipt).sort());
-  return (0, import_node_crypto5.createHash)("sha256").update(canonical).digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(canonical).digest("hex");
 }
 function createLogAnchorField(anchor) {
   return {
@@ -41382,7 +42203,7 @@ function createLogAnchorField(anchor) {
 }
 
 // src/selective-disclosure.ts
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 function redactFields(receipt, fieldsToRedact) {
   const redacted = JSON.parse(JSON.stringify(receipt));
   const salts = [];
@@ -41398,7 +42219,7 @@ function redactFields(receipt, fieldsToRedact) {
       if (i === parts.length - 1) {
         if (key in current) {
           const originalValue = current[key];
-          const salt = (0, import_node_crypto6.randomBytes)(16).toString("hex");
+          const salt = (0, import_node_crypto7.randomBytes)(16).toString("hex");
           const commitment = computeCommitment(salt, originalValue);
           salts.push({ field: fieldPath, salt, originalValue });
           current[key] = `sha256(salt + ${typeof originalValue === "string" ? "..." : JSON.stringify(originalValue).slice(0, 20) + "..."})`;
@@ -41470,11 +42291,11 @@ function createDisclosurePackage(allSalts, fieldsToDisclose) {
 }
 function computeCommitment(salt, value) {
   const serialized = typeof value === "string" ? value : JSON.stringify(value);
-  return (0, import_node_crypto6.createHash)("sha256").update(salt + serialized).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(salt + serialized).digest("hex");
 }
 function hashObject(obj) {
   const canonical = JSON.stringify(obj, Object.keys(obj).sort());
-  return (0, import_node_crypto6.createHash)("sha256").update(canonical).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(canonical).digest("hex");
 }
 
 // src/huggingface-export.ts
@@ -41615,10 +42436,10 @@ MIT
 }
 
 // src/webauthn-approval.ts
-var import_node_crypto7 = require("crypto");
+var import_node_crypto8 = require("crypto");
 function createApprovalChallenge(requestId, toolName, agentId, rpId = "scopeblind.com", timeoutSeconds = 300) {
-  const challengeBytes = (0, import_node_crypto7.randomBytes)(32);
-  const contextHash = (0, import_node_crypto7.createHash)("sha256").update(JSON.stringify({ requestId, toolName, agentId, timestamp: Date.now() })).digest("hex");
+  const challengeBytes = (0, import_node_crypto8.randomBytes)(32);
+  const contextHash = (0, import_node_crypto8.createHash)("sha256").update(JSON.stringify({ requestId, toolName, agentId, timestamp: Date.now() })).digest("hex");
   return {
     challenge: base64urlEncode(challengeBytes),
     requestId,
@@ -41633,14 +42454,14 @@ function createApprovalChallenge(requestId, toolName, agentId, rpId = "scopeblin
 function toCredentialRequestOptions(challenge, allowCredentials) {
   return {
     publicKey: {
-      challenge: base64urlDecode(challenge.challenge).buffer,
+      challenge: base64urlDecode2(challenge.challenge).buffer,
       rpId: challenge.rpId,
       timeout: challenge.timeoutSeconds * 1e3,
       userVerification: "required",
       // Always require biometric
       ...allowCredentials ? {
         allowCredentials: allowCredentials.map((c) => ({
-          id: base64urlDecode(c.id).buffer,
+          id: base64urlDecode2(c.id).buffer,
           type: "public-key"
         }))
       } : {}
@@ -41661,7 +42482,7 @@ function verifyApprovalAssertion(challenge, assertion) {
       approvedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
   }
-  const authData = base64urlDecode(assertion.authenticatorData);
+  const authData = base64urlDecode2(assertion.authenticatorData);
   const flags = authData[32];
   const userPresent = !!(flags & 1);
   const userVerified = !!(flags & 4);
@@ -41669,7 +42490,7 @@ function verifyApprovalAssertion(challenge, assertion) {
   const signCount = authData.length >= 37 ? authData[33] << 24 | authData[34] << 16 | authData[35] << 8 | authData[36] : 0;
   let authenticatorType = "unknown";
   try {
-    const clientData = JSON.parse(Buffer.from(base64urlDecode(assertion.clientDataJSON)).toString());
+    const clientData = JSON.parse(Buffer.from(base64urlDecode2(assertion.clientDataJSON)).toString());
     if (clientData.type === "webauthn.get") {
       authenticatorType = "platform";
     }
@@ -41698,13 +42519,13 @@ function createApprovalReceiptPayload(challenge, result) {
     context_hash: result.contextHash,
     approved_at: result.approvedAt,
     // Hash the credential ID for privacy — don't store the raw ID
-    credential_id_hash: (0, import_node_crypto7.createHash)("sha256").update(result.credentialId).digest("hex").slice(0, 16)
+    credential_id_hash: (0, import_node_crypto8.createHash)("sha256").update(result.credentialId).digest("hex").slice(0, 16)
   };
 }
 function base64urlEncode(buffer) {
   return Buffer.from(buffer).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function base64urlDecode(str) {
+function base64urlDecode2(str) {
   const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
   const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
   return new Uint8Array(Buffer.from(padded, "base64"));
@@ -41952,7 +42773,7 @@ function evaluatePolicy(tool, policy) {
 }
 
 // src/evidence-authenticity.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 async function createEvidenceAttestation(input) {
   const tlsNotaryAvailable = await isTLSNotaryAvailable();
   if (tlsNotaryAvailable) {
@@ -42012,14 +42833,14 @@ async function verifyEvidenceAttestation(attestation) {
   }
 }
 function hashResponseBody(body) {
-  return (0, import_node_crypto8.createHash)("sha256").update(typeof body === "string" ? body : body).digest("hex");
+  return (0, import_node_crypto9.createHash)("sha256").update(typeof body === "string" ? body : body).digest("hex");
 }
 function createAttestationField(attestation) {
   return {
     evidence_authenticity: {
       version: attestation.version,
       method: attestation.method,
-      url_hash: (0, import_node_crypto8.createHash)("sha256").update(attestation.url).digest("hex").slice(0, 16),
+      url_hash: (0, import_node_crypto9.createHash)("sha256").update(attestation.url).digest("hex").slice(0, 16),
       response_hash: attestation.responseHash,
       fetched_at: attestation.fetchedAt,
       verified: attestation.verified,
@@ -42050,7 +42871,7 @@ async function createTLSNotaryAttestation(input) {
 }
 
 // src/c2pa-credentials.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 function createC2PAManifest(receipts, options) {
   const generator = options.generator || "protect-mcp";
   const version = options.version || "0.3.3";
@@ -42064,7 +42885,7 @@ function createC2PAManifest(receipts, options) {
     (r) => r.payload?.decision === "deny"
   );
   const receiptHashes = receipts.map(
-    (r) => (0, import_node_crypto9.createHash)("sha256").update(JSON.stringify(r)).digest("hex")
+    (r) => (0, import_node_crypto10.createHash)("sha256").update(JSON.stringify(r)).digest("hex")
   );
   const merkleRoot2 = computeMerkleRoot(receiptHashes);
   const assertions = [
@@ -42206,7 +43027,7 @@ function computeMerkleRoot(hashes) {
     const left = hashes[i];
     const right = i + 1 < hashes.length ? hashes[i + 1] : left;
     nextLevel.push(
-      (0, import_node_crypto9.createHash)("sha256").update(left + right).digest("hex")
+      (0, import_node_crypto10.createHash)("sha256").update(left + right).digest("hex")
     );
   }
   return computeMerkleRoot(nextLevel);
@@ -42259,7 +43080,7 @@ function toManifoldFormat(prediction) {
 }
 
 // src/agent-exchange.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var ReceiptPropagator = class {
   issuer;
   signer;
@@ -42280,7 +43101,7 @@ var ReceiptPropagator = class {
   delegate(delegateId, options) {
     const now = /* @__PURE__ */ new Date();
     const receipt = {
-      receipt_id: `del_${(0, import_node_crypto10.randomUUID)().slice(0, 12)}`,
+      receipt_id: `del_${(0, import_node_crypto11.randomUUID)().slice(0, 12)}`,
       receipt_type: "delegation",
       issuer_id: this.issuer,
       event_time: now.toISOString(),
@@ -42337,7 +43158,7 @@ var ReceiptPropagator = class {
     const currentCount = this.delegationCallCounts.get(options.delegation_receipt) || 0;
     this.delegationCallCounts.set(options.delegation_receipt, currentCount + 1);
     const receipt = {
-      receipt_id: `act_${(0, import_node_crypto10.randomUUID)().slice(0, 12)}`,
+      receipt_id: `act_${(0, import_node_crypto11.randomUUID)().slice(0, 12)}`,
       receipt_type: "execution",
       issuer_id: this.issuer,
       event_time: (/* @__PURE__ */ new Date()).toISOString(),
@@ -42429,7 +43250,7 @@ function createReceiptChannel(orchestratorId) {
     async withDelegation(delegateId, tools, fn, options) {
       const delegation = propagator.delegate(delegateId, {
         tools,
-        scope: options?.scope || `task-${(0, import_node_crypto10.randomUUID)().slice(0, 8)}`,
+        scope: options?.scope || `task-${(0, import_node_crypto11.randomUUID)().slice(0, 8)}`,
         ttl: options?.ttl || 3600,
         maxCalls: options?.maxCalls
       });
@@ -42579,6 +43400,48 @@ var TOOLS = [
       },
       required: ["environment"]
     }
+  },
+  {
+    name: "github_create_pr",
+    description: "Create a GitHub pull request",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo: { type: "string", description: "Repository name" },
+        branch: { type: "string", description: "Source branch" },
+        title: { type: "string", description: "Pull request title" }
+      },
+      required: ["repo", "branch", "title"]
+    }
+  },
+  {
+    name: "send_email",
+    description: "Send an email",
+    inputSchema: {
+      type: "object",
+      properties: {
+        to: { type: "string", description: "Recipient email address" },
+        subject: { type: "string", description: "Subject line" },
+        body: { type: "string", description: "Message body" }
+      },
+      required: ["to", "subject"]
+    }
+  },
+  {
+    name: "pms_book_fill",
+    description: "Book a fill into the mock portfolio management system",
+    inputSchema: {
+      type: "object",
+      properties: {
+        account: { type: "string", description: "Portfolio or fund account" },
+        symbol: { type: "string", description: "Instrument symbol" },
+        side: { type: "string", enum: ["BUY", "SELL"] },
+        quantity: { type: "number" },
+        price: { type: "number" },
+        strategy: { type: "string" }
+      },
+      required: ["account", "symbol", "side", "quantity", "price"]
+    }
   }
 ];
 function handleRequest(request) {
@@ -42626,6 +43489,15 @@ Contents: Hello from protect-mcp demo server!`;
       case "deploy":
         resultText = `[demo] Deployed to ${args.environment || "staging"}${args.reason ? ` (reason: ${args.reason})` : ""}`;
         break;
+      case "github_create_pr":
+        resultText = `[demo] Created PR in ${args.repo || "scopeblind/demo"} from ${args.branch || "agent/demo"}: ${args.title || "Agent change"}`;
+        break;
+      case "send_email":
+        resultText = `[demo] Drafted email to ${args.to || "pm@example.com"}: ${args.subject || "Agent update"}`;
+        break;
+      case "pms_book_fill":
+        resultText = `[demo] Booked ${args.side || "BUY"} ${args.quantity || 0} ${args.symbol || "AAPL"} @ ${args.price || 0} into ${args.account || "Demo Fund"} (${args.strategy || "Unassigned"})`;
+        break;
       default:
         resultText = `[demo] Unknown tool: ${toolName}`;
     }
@@ -42698,12 +43570,38 @@ function createSandboxServer() {
     { environment: z.enum(["staging", "production"]).describe("Target environment"), reason: z.string().optional().describe("Deployment reason") },
     async (args) => ({ content: [{ type: "text", text: `[demo] Deployed to ${args.environment}` }] })
   );
+  server.tool("github_create_pr", "Create a GitHub pull request", {
+    repo: z.string(),
+    branch: z.string(),
+    title: z.string()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] PR created in ${args.repo} from ${args.branch}: ${args.title}` }]
+  }));
+  server.tool("send_email", "Send an email", {
+    to: z.string(),
+    subject: z.string(),
+    body: z.string().optional()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] Email prepared for ${args.to}: ${args.subject}` }]
+  }));
+  server.tool("pms_book_fill", "Book a fill into a mock PMS", {
+    account: z.string(),
+    symbol: z.string(),
+    side: z.enum(["BUY", "SELL"]),
+    quantity: z.number(),
+    price: z.number(),
+    strategy: z.string().optional()
+  }, async (args) => ({
+    content: [{ type: "text", text: `[demo] Booked ${args.side} ${args.quantity} ${args.symbol} @ ${args.price} into ${args.account}` }]
+  }));
   return server;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BUILTIN_PATTERNS,
+  CONNECTOR_PILOTS,
   ConfidentialGate,
+  POLICY_PACKS,
   ProtectGateway,
   ReceiptPropagator,
   ScopeBlindBridge,
@@ -42713,6 +43611,9 @@ function createSandboxServer() {
   collectSignedReceipts,
   computeCalibration,
   confidentialInference,
+  connectorDirectory,
+  connectorDoctor,
+  connectorPilotIds,
   createApprovalChallenge,
   createApprovalReceiptPayload,
   createAttestationField,
@@ -42724,6 +43625,7 @@ function createSandboxServer() {
   createReceiptChannel,
   createSandbox,
   createSandboxServer,
+  createSelectiveDisclosurePackage,
   destroySandbox,
   discloseField,
   ed25519ToDIDKey,
@@ -42744,6 +43646,8 @@ function createSandboxServer() {
   generateSampleCedarPolicy,
   generateSchemaStub,
   generateVerifyReceiptSkill,
+  getConnectorPilot,
+  getPolicyPack,
   getScopeBlindBridge,
   getSignerInfo,
   getToolPolicy,
@@ -42764,8 +43668,10 @@ function createSandboxServer() {
   parseLogFile,
   parseNotificationConfigFromEnv,
   parseRateLimit,
+  policyPackIds,
   policySetFromSource,
   queryExternalPDP,
+  readInstalledConnectorPilots,
   receiptToVP,
   receiptsToHFRows,
   redactFields,
@@ -42789,7 +43695,9 @@ function createSandboxServer() {
   verifyApprovalAssertion,
   verifyCommitment,
   verifyEvidenceAttestation,
-  verifyRekorAnchor
+  verifyRekorAnchor,
+  verifySelectiveDisclosurePackage,
+  writeConnectorPilots
 });
 /**
  * scopeblind-bridge.ts