protect-mcp 0.7.3 → 0.7.4

package/dist/{chunk-5JXFV37Y.mjs → chunk-PM2ZO57M.mjs}

@@ -1,7 +1,7 @@
 // src/bundle.ts
 function createAuditBundle(opts) {
   const receipts = opts.receipts.filter(
-    (r) => r && typeof r === "object" && typeof r.signature === "string"
+    (r) => r && typeof r === "object" && (typeof r.signature === "string" || r.signature !== null && typeof r.signature === "object")
   );
   if (receipts.length === 0) {
     throw new Error("Audit bundle requires at least one signed receipt");
@@ -30,10 +30,18 @@ function createAuditBundle(opts) {
     time_range: timeRange,
     receipts,
     anchors: opts.anchors || [],
+    selective_disclosures: opts.selectiveDisclosures || [],
+    privacy: {
+      selective_disclosure: {
+        supported: true,
+        model: "salted_commitments_merkle_v0",
+        statement: "Committed receipts may disclose selected fields with salted Merkle openings. Undisclosed committed fields remain hidden while staying bound to the signed commitment root."
+      }
+    },
     verification: {
       algorithm: "ed25519",
       signing_keys: Array.from(keyMap.values()),
-      instructions: `Verify each receipt by: (1) remove the "signature" field, (2) canonicalize the remaining object with JCS (sorted keys at every level), (3) encode as UTF-8 bytes, (4) verify the Ed25519 signature using the signing key matching the receipt's "kid" field. CLI: npx @veritasacta/verify bundle.json --bundle`
+      instructions: `Verify each receipt by: (1) remove the "signature" field, (2) canonicalize the remaining object with JCS (sorted keys at every level), (3) encode as UTF-8 bytes, (4) verify the Ed25519 signature using the signing key matching the receipt's "kid" field. For scopeblind.selective_disclosure.v0 packages, recompute each disclosed leaf and verify it against the receipt committed_fields_root; fields not disclosed remain hidden. CLI: npx @veritasacta/verify bundle.json --bundle`
     }
   };
 }

package/dist/{chunk-OHUTUFTC.mjs → chunk-UBZJ3VI2.mjs}

@@ -1,5 +1,6 @@
 import {
   ReceiptBuffer,
+  buildActionReadback,
   checkRateLimit,
   evaluateCedar,
   getToolPolicy,
@@ -7,7 +8,7 @@ import {
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-546U3A7R.mjs";
+} from "./chunk-D2RDY2JR.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";
@@ -758,6 +759,8 @@ var ProtectGateway = class {
     const toolName = request.params?.name || "unknown";
     const requestId = randomUUID().slice(0, 12);
     const mode = this.config.enforce ? "enforce" : "shadow";
+    const toolInput = request.params?.arguments && typeof request.params.arguments === "object" ? request.params.arguments : request.params || {};
+    const actionReadback = buildActionReadback(toolName, toolInput);
     let resolvedAgentKid = this.admissionResult?.agent_id;
     let effectiveToolPolicy;
     if (this.config.multiAgent?.enabled) {
@@ -767,7 +770,7 @@ var ProtectGateway = class {
       if (agentOverrides && agentOverrides[toolName]) {
         effectiveToolPolicy = { ...getToolPolicy(toolName, this.config.policy), ...agentOverrides[toolName] };
       } else if (!resolvedAgentKid && this.config.multiAgent.unknownAgentPolicy === "deny") {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "unknown_agent_denied", request_id: requestId, tier: this.currentTier });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "unknown_agent_denied", request_id: requestId, tier: this.currentTier, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied: unidentified agent`);
         }
@@ -788,7 +791,7 @@ var ProtectGateway = class {
       if (cred.resolved) {
         credentialRef = cred.label;
       } else if (cred.error && !cred.error.includes("not configured")) {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "credential_error", request_id: requestId, tier: this.currentTier, credential_ref: toolName });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "credential_error", request_id: requestId, tier: this.currentTier, credential_ref: toolName, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Credential error for tool "${toolName}"`);
         }
@@ -803,13 +806,13 @@ var ProtectGateway = class {
         });
         if (!cedarDecision.allowed) {
           const reason = cedarDecision.reason || "cedar_deny";
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied by Cedar policy`);
           }
           return null;
         }
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "cedar_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "cedar_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         return null;
       } catch (err) {
         if (this.config.verbose) this.log(`Cedar evaluation error: ${err instanceof Error ? err.message : err}`);
@@ -827,7 +830,7 @@ var ProtectGateway = class {
         const externalDecision = await queryExternalPDP(ctx, this.config.policy.external);
         if (!externalDecision.allowed) {
           const reason = `external_pdp_deny${externalDecision.reason ? ": " + externalDecision.reason : ""}`;
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: reason, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" denied by external policy engine`);
           }
@@ -839,7 +842,7 @@ var ProtectGateway = class {
     }
     if (toolPolicy.min_tier) {
       if (!meetsMinTier(this.currentTier, toolPolicy.min_tier)) {
-        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "tier_insufficient", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "tier_insufficient", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         if (this.config.enforce) {
           return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" requires tier "${toolPolicy.min_tier}"`);
         }
@@ -847,7 +850,7 @@ var ProtectGateway = class {
       }
     }
     if (toolPolicy.block) {
-      this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "policy_block", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "policy_block", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       if (this.config.enforce) {
         return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" is blocked by policy`);
       }
@@ -858,10 +861,10 @@ var ProtectGateway = class {
       const alwaysGrant = this.approvalStore.get(`always:${toolName}`);
       if (grant && Date.now() < grant.expires_at || alwaysGrant && Date.now() < alwaysGrant.expires_at) {
         if (grant && grant.mode === "once") this.approvalStore.delete(requestId);
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "approval_granted", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "approval_granted", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
         return null;
       }
-      this.emitDecisionLog({ tool: toolName, decision: "require_approval", reason_code: "requires_human_approval", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "require_approval", reason_code: "requires_human_approval", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       if (this.notificationConfig) {
         sendApprovalNotification(this.notificationConfig, {
           requestId,
@@ -884,7 +887,7 @@ var ProtectGateway = class {
             content: [
               {
                 type: "text",
-                text: `REQUIRES_APPROVAL: The tool "${toolName}" requires human approval before execution. Request ID: ${requestId}. Approval nonce: ${this.approvalNonce}. Tell the user you need their approval to use "${toolName}" and will retry when granted. Do NOT retry this tool call until the user explicitly approves it.`
+                text: `REQUIRES_APPROVAL: The tool "${toolName}" requires human approval before execution. Exact action: ${actionReadback.summary}. Payload hash: ${actionReadback.payload_hash.slice(0, 16)}\u2026 Request ID: ${requestId}. Approval nonce: ${this.approvalNonce}. Tell the user you need their approval to use "${toolName}" and will retry when granted. Do NOT retry this tool call until the user explicitly approves it.`
               }
             ],
             isError: true
@@ -900,19 +903,19 @@ var ProtectGateway = class {
         const key = `tool:${toolName}:${this.currentTier}`;
         const { allowed, remaining } = checkRateLimit(key, limit, this.rateLimitStore);
         if (!allowed) {
-          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "rate_limit_exceeded", request_id: requestId, rate_limit_remaining: 0, tier: this.currentTier, credential_ref: credentialRef });
+          this.emitDecisionLog({ tool: toolName, decision: "deny", reason_code: "rate_limit_exceeded", request_id: requestId, rate_limit_remaining: 0, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
           if (this.config.enforce) {
             return this.makeErrorResponse(request.id, -32600, `Tool "${toolName}" rate limit exceeded (${rateSpec})`);
           }
           return null;
         }
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "policy_allow", request_id: requestId, rate_limit_remaining: remaining, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "policy_allow", request_id: requestId, rate_limit_remaining: remaining, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       } catch {
-        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "default_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+        this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: "default_allow", request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
       }
     } else {
       const reasonCode = this.config.enforce ? "policy_allow" : "observe_mode";
-      this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: reasonCode, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef });
+      this.emitDecisionLog({ tool: toolName, decision: "allow", reason_code: reasonCode, request_id: requestId, tier: this.currentTier, credential_ref: credentialRef, action_readback: actionReadback });
     }
     return null;
   }
@@ -949,6 +952,7 @@ var ProtectGateway = class {
       ...entry.rate_limit_remaining !== void 0 && { rate_limit_remaining: entry.rate_limit_remaining },
       ...entry.tier && { tier: entry.tier },
       ...entry.credential_ref && { credential_ref: entry.credential_ref },
+      ...entry.action_readback && { action_readback: entry.action_readback },
       otel_trace_id: otelTraceId,
       otel_span_id: otelSpanId
     };