protect-mcp 0.7.4 → 0.7.5

package/dist/{chunk-NVJHGXXG.mjs → chunk-6E2DHBAR.mjs}

@@ -12,7 +12,7 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-D2RDY2JR.mjs";
+} from "./chunk-WIPWNWMJ.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";
@@ -829,7 +829,7 @@ async function startHookServer(options = {}) {
       res.end(JSON.stringify({
         status: "ok",
         server: "protect-mcp-hooks",
-        version: "0.5.0",
+        version: process.env.PROTECT_MCP_VERSION || "unknown",
         uptime_ms: Date.now() - state.startTime,
         mode: enforce ? "enforce" : "shadow",
         policy_digest: policyDigest,
@@ -916,9 +916,10 @@ async function startHookServer(options = {}) {
     const pad = (s, n = 46) => s.padEnd(n);
     w(`
 `);
-    w(`  protect-mcp v0.5.4
+    w(process.env.PROTECT_MCP_VERSION ? `  protect-mcp v${process.env.PROTECT_MCP_VERSION}
+` : `  protect-mcp
 `);
-    w(`  ScopeBlind \u2014 https://scopeblind.com
+    w(`  ScopeBlind \xB7 https://scopeblind.com
 `);
     w(`
 `);
@@ -946,7 +947,13 @@ async function startHookServer(options = {}) {
 `);
     w(`
 `);
-    w(`  deny is authoritative \u2014 cannot be overridden.
+    w(`  deny is authoritative: it cannot be overridden.
+`);
+    w(`
+`);
+    w(`  See your record   npx protect-mcp record
+`);
+    w(`                    a searchable view of every decision, all on this machine
 `);
     w(`
 `);

package/dist/{chunk-36UID5WY.mjs → chunk-JCMDLN5I.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-UBZJ3VI2.mjs";
+} from "./chunk-VTPZ4G5I.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-D2RDY2JR.mjs";
+} from "./chunk-WIPWNWMJ.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";
@@ -331,12 +331,298 @@ function policyPackIds() {
 }
 
 // src/connector-pilots.ts
-import { existsSync, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { join } from "path";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, join, normalize } from "path";
 var defaultPermit2 = `
 // Default posture: observe all non-matching tools so the connector can be piloted in shadow mode.
 permit(principal, action == Action::"MCP::Tool::call", resource);
 `;
+var nautilusBridgePy = String.raw`#!/usr/bin/env python3
+"""
+ScopeBlind external bridge for NautilusTrader-compatible pilots.
+
+This file is intentionally outside NautilusTrader. It gives protect-mcp a stable
+JSONL command boundary for staging, approval-gated submission, cancellation, and
+event export while keeping the trading engine customer-owned.
+
+Mock mode runs without NautilusTrader installed. Real mode is enabled by setting
+NAUTILUS_BRIDGE_MODULE to "module.path:ClassName"; the class may implement:
+  submit_order(order), modify_order(order), cancel_order(order), reconcile(order),
+  export_events(since=None)
+"""
+
+from __future__ import annotations
+
+import hashlib
+import importlib
+import json
+import os
+import sys
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Callable
+
+
+def canonical_json(value: Any) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
+
+
+def sha256_json(value: Any) -> str:
+    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()
+
+
+def now_ms() -> int:
+    return int(time.time() * 1000)
+
+
+@dataclass
+class BridgeState:
+    root: Path = field(default_factory=lambda: Path(os.environ.get("SCOPEBLIND_NAUTILUS_STATE_DIR", ".protect-mcp/nautilus")))
+
+    def __post_init__(self) -> None:
+        self.root.mkdir(parents=True, exist_ok=True)
+        self.orders_path.touch(exist_ok=True)
+        self.events_path.touch(exist_ok=True)
+
+    @property
+    def orders_path(self) -> Path:
+        return self.root / "orders.jsonl"
+
+    @property
+    def events_path(self) -> Path:
+        return self.root / "events.jsonl"
+
+    def append_order(self, order: dict[str, Any]) -> None:
+        with self.orders_path.open("a", encoding="utf-8") as handle:
+            handle.write(canonical_json(order) + "\n")
+
+    def append_event(self, event: dict[str, Any]) -> dict[str, Any]:
+        enriched = {
+            "event_id": event.get("event_id") or f"nt-{now_ms()}-{len(event)}",
+            "observed_at_ms": now_ms(),
+            **event,
+        }
+        enriched["event_digest"] = sha256_json(enriched)
+        with self.events_path.open("a", encoding="utf-8") as handle:
+            handle.write(canonical_json(enriched) + "\n")
+        return enriched
+
+    def events(self) -> list[dict[str, Any]]:
+        rows: list[dict[str, Any]] = []
+        with self.events_path.open("r", encoding="utf-8") as handle:
+            for line in handle:
+                if line.strip():
+                    rows.append(json.loads(line))
+        return rows
+
+
+class ScopeBlindNautilusBridge:
+    def __init__(self) -> None:
+        self.state = BridgeState()
+        self.real = self._load_real_bridge()
+
+    def _load_real_bridge(self) -> Any | None:
+        target = os.environ.get("NAUTILUS_BRIDGE_MODULE")
+        if not target:
+            return None
+        module_name, _, class_name = target.partition(":")
+        if not module_name or not class_name:
+            raise ValueError("NAUTILUS_BRIDGE_MODULE must be module.path:ClassName")
+        module = importlib.import_module(module_name)
+        return getattr(module, class_name)()
+
+    def handle(self, command: dict[str, Any]) -> dict[str, Any]:
+        action = command.get("action")
+        handlers: dict[str, Callable[[dict[str, Any]], dict[str, Any]]] = {
+            "stage_order": self.stage_order,
+            "submit_order": self.submit_order,
+            "modify_order": self.modify_order,
+            "cancel_order": self.cancel_order,
+            "reconcile": self.reconcile,
+            "export_events": self.export_events,
+        }
+        if action not in handlers:
+            return self.error(command, "unknown_action", f"Unsupported action: {action}")
+        try:
+            return handlers[action](command)
+        except Exception as exc:
+            return self.error(command, "bridge_error", str(exc))
+
+    def require(self, command: dict[str, Any], *fields: str) -> None:
+        missing = [field for field in fields if command.get(field) in (None, "")]
+        if missing:
+            raise ValueError(f"missing required field(s): {', '.join(missing)}")
+
+    def require_approved(self, command: dict[str, Any]) -> None:
+        self.require(command, "approval_receipt")
+        if command.get("mandate_passed") is not True:
+            raise ValueError("mandate_passed must be true before live order mutation")
+
+    def stage_order(self, command: dict[str, Any]) -> dict[str, Any]:
+        self.require(command, "client_order_id", "instrument_id", "side", "quantity")
+        order = self.order_projection(command, status="staged")
+        self.state.append_order(order)
+        event = self.state.append_event({
+            "type": "scopeblind.nautilus.order_staged.v1",
+            "client_order_id": order["client_order_id"],
+            "order_digest": sha256_json(order),
+            "disclosure": "position_blind",
+        })
+        return self.ok(command, {"status": "staged", "order": order, "event": event})
+
+    def submit_order(self, command: dict[str, Any]) -> dict[str, Any]:
+        self.require_approved(command)
+        order = self.order_projection(command, status="submitted")
+        if self.real and hasattr(self.real, "submit_order"):
+            external = self.real.submit_order(order)
+        else:
+            external = {"mode": "mock", "external_order_id": f"MOCK-{order['client_order_id']}"}
+        event = self.state.append_event({
+            "type": "scopeblind.nautilus.order_submitted.v1",
+            "client_order_id": order["client_order_id"],
+            "order_digest": sha256_json(order),
+            "external_digest": sha256_json(external),
+            "disclosure": "position_blind",
+        })
+        return self.ok(command, {"status": "submitted", "order": order, "external": external, "event": event})
+
+    def modify_order(self, command: dict[str, Any]) -> dict[str, Any]:
+        self.require_approved(command)
+        self.require(command, "client_order_id")
+        if self.real and hasattr(self.real, "modify_order"):
+            external = self.real.modify_order(command)
+        else:
+            external = {"mode": "mock", "modified": command["client_order_id"]}
+        event = self.state.append_event({
+            "type": "scopeblind.nautilus.order_modified.v1",
+            "client_order_id": command["client_order_id"],
+            "command_digest": sha256_json(command),
+            "external_digest": sha256_json(external),
+            "disclosure": "position_blind",
+        })
+        return self.ok(command, {"status": "modified", "external": external, "event": event})
+
+    def cancel_order(self, command: dict[str, Any]) -> dict[str, Any]:
+        self.require_approved(command)
+        self.require(command, "client_order_id")
+        if self.real and hasattr(self.real, "cancel_order"):
+            external = self.real.cancel_order(command)
+        else:
+            external = {"mode": "mock", "cancelled": command["client_order_id"]}
+        event = self.state.append_event({
+            "type": "scopeblind.nautilus.order_cancelled.v1",
+            "client_order_id": command["client_order_id"],
+            "command_digest": sha256_json(command),
+            "external_digest": sha256_json(external),
+            "disclosure": "position_blind",
+        })
+        return self.ok(command, {"status": "cancelled", "external": external, "event": event})
+
+    def reconcile(self, command: dict[str, Any]) -> dict[str, Any]:
+        self.require(command, "client_order_id")
+        if self.real and hasattr(self.real, "reconcile"):
+            external = self.real.reconcile(command)
+        else:
+            external = {"mode": "mock", "client_order_id": command["client_order_id"], "state": "accepted"}
+        event = self.state.append_event({
+            "type": "scopeblind.nautilus.reconciled.v1",
+            "client_order_id": command["client_order_id"],
+            "external_digest": sha256_json(external),
+            "disclosure": "position_blind",
+        })
+        return self.ok(command, {"status": "reconciled", "external": external, "event": event})
+
+    def export_events(self, command: dict[str, Any]) -> dict[str, Any]:
+        if self.real and hasattr(self.real, "export_events"):
+            external_events = self.real.export_events(command.get("since"))
+        else:
+            external_events = self.state.events()
+        return self.ok(command, {
+            "status": "exported",
+            "event_count": len(external_events),
+            "commitment_root": sha256_json(external_events),
+            "events": external_events,
+        })
+
+    def order_projection(self, command: dict[str, Any], status: str) -> dict[str, Any]:
+        return {
+            "client_order_id": command["client_order_id"],
+            "instrument_id": command["instrument_id"],
+            "side": command["side"],
+            "quantity": command["quantity"],
+            "price": command.get("price"),
+            "time_in_force": command.get("time_in_force", "GTC"),
+            "strategy_id": command.get("strategy_id"),
+            "mandate_digest": command.get("mandate_digest"),
+            "approval_receipt": command.get("approval_receipt"),
+            "status": status,
+            "created_at_ms": now_ms(),
+        }
+
+    def ok(self, command: dict[str, Any], result: dict[str, Any]) -> dict[str, Any]:
+        return {
+            "ok": True,
+            "bridge": "scopeblind.nautilus.external.v1",
+            "mode": "real" if self.real else "mock",
+            "request_digest": sha256_json(command),
+            **result,
+        }
+
+    def error(self, command: dict[str, Any], code: str, message: str) -> dict[str, Any]:
+        return {
+            "ok": False,
+            "bridge": "scopeblind.nautilus.external.v1",
+            "mode": "real" if self.real else "mock",
+            "error": {"code": code, "message": message},
+            "request_digest": sha256_json(command),
+        }
+
+
+def main() -> int:
+    bridge = ScopeBlindNautilusBridge()
+    for line in sys.stdin:
+        if not line.strip():
+            continue
+        command = json.loads(line)
+        print(canonical_json(bridge.handle(command)), flush=True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
+`;
+var nautilusAdapterReadme = `# NautilusTrader-compatible external bridge
+
+This connector is intentionally external to NautilusTrader. It lets protect-mcp
+control and receipt high-risk order actions while a customer-owned Nautilus
+process remains the trading engine.
+
+## Local mock run
+
+\`\`\`bash
+python3 .protect-mcp/connectors/nautilus-trader/bridge.py <<'JSONL'
+{"action":"stage_order","client_order_id":"SB-1","instrument_id":"AAPL.NASDAQ","side":"BUY","quantity":"50","price":"182.40","mandate_digest":"demo"}
+{"action":"submit_order","client_order_id":"SB-1","instrument_id":"AAPL.NASDAQ","side":"BUY","quantity":"50","price":"182.40","mandate_digest":"demo","mandate_passed":true,"approval_receipt":"receipt-demo"}
+{"action":"export_events"}
+JSONL
+\`\`\`
+
+## Real mode
+
+Set \`NAUTILUS_BRIDGE_MODULE=customer_module:BridgeClass\`. The class can
+implement \`submit_order\`, \`modify_order\`, \`cancel_order\`, \`reconcile\`,
+and \`export_events\`. Keep that glue in the customer's repository so Nautilus
+licensing, credentials, and trading logic stay outside ScopeBlind.
+
+## Upstream contribution posture
+
+The best NautilusTrader contribution is not this bridge or a UI. It is a small,
+vendor-neutral audit/event sink RFC: a documented way to export normalized order
+commands, execution reports, fills, cancels, and reconciliation events so
+external compliance wrappers can prove what happened without mutating the
+engine.
+`;
 var CONNECTOR_PILOTS = [
   {
     id: "github",
@@ -540,6 +826,93 @@ when { ["pms.order.stage", "pms.order.book", "pms.order.cancel"].contains(contex
 
 forbid(principal, action == Action::"MCP::Tool::call", resource)
 when { context.tool == "pms.order.book" && context.mandate_passed != true };
+`
+  },
+  {
+    id: "nautilus-trader",
+    category: "finance",
+    name: "NautilusTrader-compatible external bridge",
+    status: "usable-pilot",
+    description: "Controls NautilusTrader-compatible staged orders through an external JSONL bridge, with local mock mode and customer-owned real mode.",
+    value: "Turns Nautilus into a strong Legate demo target: mandate-check, exact approval, external order event, position-blind audit bundle, and later reconciliation.",
+    env: [
+      { name: "NAUTILUS_BRIDGE_MODULE", required: false, description: "Optional customer glue in module.path:ClassName form for real Nautilus submission." },
+      { name: "SCOPEBLIND_NAUTILUS_STATE_DIR", required: false, description: "Optional state directory for local mock events. Defaults to .protect-mcp/nautilus." },
+      { name: "NAUTILUS_TRADER_PROJECT", required: false, description: "Optional path to the customer Nautilus project when running real mode." }
+    ],
+    tools: [
+      "nautilus.order.stage",
+      "nautilus.order.submit",
+      "nautilus.order.modify",
+      "nautilus.order.cancel",
+      "nautilus.strategy.deploy",
+      "nautilus.event.export",
+      "nautilus.reconcile"
+    ],
+    actions: [
+      { name: "Stage order", tool: "nautilus.order.stage", risk: "medium", mode: "require_approval", description: "Creates a position-blind booking intent and event commitment." },
+      { name: "Submit order", tool: "nautilus.order.submit", risk: "high", mode: "require_approval", description: "Requires mandate pass plus exact approval before live order mutation." },
+      { name: "Modify or cancel order", tool: "nautilus.order.modify", risk: "high", mode: "require_approval", description: "Mutates live order state and must carry a fresh approval receipt." },
+      { name: "Deploy strategy", tool: "nautilus.strategy.deploy", risk: "high", mode: "require_approval", description: "Requires signed strategy pack, mandate scope, and operator approval." },
+      { name: "Export event log", tool: "nautilus.event.export", risk: "low", mode: "observe", description: "Exports normalized event commitments for receipt corroboration." }
+    ],
+    setup: [
+      "Run mock mode first: protect-mcp connectors init nautilus-trader --force.",
+      "Pipe stage/submit/reconcile JSONL through .protect-mcp/connectors/nautilus-trader/bridge.py.",
+      "For real mode, set NAUTILUS_BRIDGE_MODULE to customer-owned glue that calls NautilusTrader APIs.",
+      "Open an upstream NautilusTrader RFC for a neutral audit/event sink before proposing any PR."
+    ],
+    config: {
+      type: "scopeblind.connector_pilot.v1",
+      provider: "nautilus-trader-compatible",
+      mode: "external-bridge-mock-first",
+      license_boundary: "No NautilusTrader code is bundled. Real mode calls a customer-owned process/module.",
+      adapter_contract: {
+        protocol: "stdin/stdout JSONL",
+        bridge: ".protect-mcp/connectors/nautilus-trader/bridge.py",
+        real_mode_env: "NAUTILUS_BRIDGE_MODULE=module.path:ClassName",
+        actions: ["stage_order", "submit_order", "modify_order", "cancel_order", "reconcile", "export_events"]
+      },
+      controlled_tools: [
+        "nautilus.order.stage",
+        "nautilus.order.submit",
+        "nautilus.order.modify",
+        "nautilus.order.cancel",
+        "nautilus.strategy.deploy",
+        "nautilus.event.export",
+        "nautilus.reconcile"
+      ],
+      approval_required_for: ["submit_order", "modify_order", "cancel_order", "strategy_deploy"],
+      receipt_fields: [
+        "client_order_id",
+        "instrument_id_hash",
+        "side",
+        "quantity",
+        "price",
+        "mandate_digest",
+        "approval_receipt",
+        "external_event_digest",
+        "commitment_root"
+      ],
+      upstream_rfc: {
+        title: "[RFC] Add a vendor-neutral order/execution audit event sink",
+        non_goals: ["ScopeBlind dependency", "UI dashboard", "AI tooling", "new venue adapter"]
+      }
+    },
+    artifacts: [
+      { path: "nautilus-trader/bridge.py", contents: nautilusBridgePy, executable: true },
+      { path: "nautilus-trader/README.md", contents: nautilusAdapterReadme }
+    ],
+    cedar: `${defaultPermit2}
+// NautilusTrader-compatible pilot: stage can be observed, but any live mutation requires exact approval.
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { ["nautilus.order.submit", "nautilus.order.modify", "nautilus.order.cancel", "nautilus.strategy.deploy"].contains(context.tool) && !context.approved };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { ["nautilus.order.submit", "nautilus.order.modify", "nautilus.order.cancel"].contains(context.tool) && context.mandate_passed != true };
+
+forbid(principal, action == Action::"MCP::Tool::call", resource)
+when { context.tool == "nautilus.strategy.deploy" && context.strategy_pack_signed != true };
 `
   }
 ];
@@ -571,11 +944,26 @@ function writeConnectorPilots(opts) {
     writeFileSync(policyPath, pilot.cedar.endsWith("\n") ? pilot.cedar : `${pilot.cedar}
 `);
     written.push(configPath, policyPath);
+    for (const artifact of pilot.artifacts || []) {
+      const artifactPath = connectorArtifactPath(directory, artifact.path);
+      mkdirSync(dirname(artifactPath), { recursive: true });
+      writeFileSync(artifactPath, artifact.contents.endsWith("\n") ? artifact.contents : `${artifact.contents}
+`);
+      if (artifact.executable) chmodSync(artifactPath, 493);
+      written.push(artifactPath);
+    }
   }
   writeFileSync(join(directory, "README.md"), renderConnectorReadme(selected));
   written.push(join(directory, "README.md"));
   return { written, pilots: selected, directory };
 }
+function connectorArtifactPath(directory, relativePath) {
+  const clean = normalize(relativePath).replace(/^(\.\.(\/|\\|$))+/, "");
+  if (clean.startsWith("/") || clean.includes("..")) {
+    throw new Error(`Unsafe connector artifact path: ${relativePath}`);
+  }
+  return join(directory, clean);
+}
 function readInstalledConnectorPilots(dir) {
   const directory = connectorDirectory(dir);
   if (!existsSync(directory)) return [];
@@ -609,15 +997,15 @@ function connectorDoctor(dir, env = process.env) {
     }));
     const missingRequired = envRows.filter((item) => item.required && !item.present).map((item) => item.name);
     const optionalPresent = envRows.filter((item) => !item.required && item.present).map((item) => item.name);
-    const optionalProviderReady = pilot.id === "slack-teams" ? Boolean(env.SLACK_BOT_TOKEN || env.TEAMS_WEBHOOK_URL) : pilot.id === "finance-pms" ? Boolean(env.PMS_ADAPTER_URL) : false;
-    const mockModeReady = pilot.id === "finance-pms";
+    const optionalProviderReady = pilot.id === "slack-teams" ? Boolean(env.SLACK_BOT_TOKEN || env.TEAMS_WEBHOOK_URL) : pilot.id === "finance-pms" ? Boolean(env.PMS_ADAPTER_URL) : pilot.id === "nautilus-trader" ? Boolean(env.NAUTILUS_BRIDGE_MODULE || env.NAUTILUS_TRADER_PROJECT) : false;
+    const mockModeReady = pilot.id === "finance-pms" || pilot.id === "nautilus-trader";
     return {
       id: pilot.id,
       name: pilot.name,
       category: pilot.category,
       installed: installed.has(pilot.id),
       usable: missingRequired.length === 0 && (pilot.env.some((item) => item.required) || pilot.env.length === 0 || optionalProviderReady || mockModeReady),
-      mode: pilot.id === "finance-pms" && !env.PMS_ADAPTER_URL ? "mock" : pilot.id === "slack-teams" && !env.SLACK_BOT_TOKEN && !env.TEAMS_WEBHOOK_URL ? "needs_provider_choice" : "configured_or_local",
+      mode: pilot.id === "finance-pms" && !env.PMS_ADAPTER_URL ? "mock" : pilot.id === "nautilus-trader" && !env.NAUTILUS_BRIDGE_MODULE ? "mock_bridge" : pilot.id === "slack-teams" && !env.SLACK_BOT_TOKEN && !env.TEAMS_WEBHOOK_URL ? "needs_provider_choice" : "configured_or_local",
       missing_required: missingRequired,
       optional_present: optionalPresent,
       tools: pilot.tools,
@@ -640,7 +1028,10 @@ Tools: ${pilot.tools.map((tool) => `\`${tool}\``).join(", ")}
 
 Setup:
 ${pilot.setup.map((step) => `- ${step}`).join("\n")}
-`).join("\n")}
+${pilot.artifacts?.length ? `
+Generated files:
+${pilot.artifacts.map((artifact) => `- \`${artifact.path}\``).join("\n")}
+` : ""}`).join("\n")}
 Next: run \`npx protect-mcp dashboard --open\` and review tool inventory, policy coverage, approvals, and receipts.
 `;
 }