protect-mcp 0.7.6 → 0.9.2

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog
 
+## 0.9.2: anchor a claim to the public log
+
+Closes the one honest gap in a bare claim: that the disclosed set is complete.
+
+- Added `protect-mcp claim --anchor`: records the claim's digest in the public,
+  append-only ScopeBlind transparency log, so a counterparty who does not trust
+  you can confirm the exact claim existed at a time and was not quietly re-cut.
+  Only the hash is sent; the claim, its leaves, and every receipt stay on your
+  machine. Writes a `<claim>.anchor.json` sidecar with the log entry and a
+  verify URL. Anonymous and free; enrolling an org identity a counterparty can
+  pin is the paid upgrade (scopeblind.com/enroll).
+
+## 0.9.1: prove a claim without revealing the record
+
+The record viewer closes the loop from a decision to a portable proof.
+
+- The `record` viewer surfaces the exact `claim` command when you filter by a
+  capability, so a decision becomes a signed, position-blind attestation in one
+  step, with copy-to-clipboard and an offline `verify-claim` hint.
+- The browser drop-viewer (legate.scopeblind.com/record) reached parity with
+  the CLI: signed capability tags, a capability facet, and a provenance tree.
+
+## 0.9.0: signed, position-blind claim attestations
+
+Prove a predicate over the record without revealing it.
+
+- Added `protect-mcp claim`: mints a signed attestation of a predicate over the
+  record (`--no <cap>` for "no action carried this capability", `--only`,
+  `--count`/`--no-verdict <verdict>`), disclosing only per-decision categories
+  (receipt digest, verdict, capability tags), never inputs, outputs, or data.
+- Added `protect-mcp verify-claim`: checks it offline via Ed25519 over the pack,
+  a recomputed Merkle root over the disclosed set, and the predicate recomputed
+  independently. Honest trust model: an accountable position-blind attestation,
+  not zero-knowledge; set-completeness is issuer-attested.
+
+## 0.8.0: deterministic receipt enrichment
+
+Each signed decision now carries minimum-disclosure, rule-derived metadata.
+
+- `input_digest`: SHA-256 of the canonicalized tool input, so you can prove what
+  was requested without storing it.
+- Signed `capabilities`: deterministic, rule-derived tags (fs.read, fs.write,
+  net.egress, secret.adjacent, destructive, financial, exec.shell, ...) so the
+  record is queryable by what an action touched.
+- `resource`: the hashed target (path, host, or command). The gate sees tool
+  calls, not the model's prompt or reasoning, and does not claim to.
+
+## 0.7.6: the live record viewer
+
+- Added `protect-mcp record --live`: a local, streaming view of the receipt
+  file that turns decisions into a searchable, auto-labelled record as the agent
+  runs (stat strip, per-row signed badge and digest, a List/Tree provenance
+  view), all local, nothing uploaded.
+- One-click export: `.jsonl` carrying the real signatures (so a recipient
+  verifies offline with `npx @veritasacta/verify`) plus a Markdown report.
+
+## 0.7.5: honest version strings and the record viewer
+
+- Added `protect-mcp record`, a local browser viewer over the receipts file
+  (the answer to "the receipts are a hidden dotfile I cannot find").
+- Fixed hard-coded version strings in the banner and health/serverInfo: they
+  read the resolved package version now.
+- WebAuthn co-sign hardening: verify the rpIdHash and enforce challenge expiry.
+
 ## 0.7.4: the self-serve trial path
 
 Everything the scopeblind.com trial and docs pages describe now ships in the

package/README.md

@@ -189,7 +189,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.3 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
+            "command": "npx protect-mcp@0.9.1 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
           }
         ]
       }
@@ -200,7 +200,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.3 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
+            "command": "npx protect-mcp@0.9.1 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
           }
         ]
       }

package/dist/{chunk-6E2DHBAR.mjs → chunk-744JMCY4.mjs}

@@ -1,3 +1,6 @@
+import {
+  buildEnrichment
+} from "./chunk-KMNXHGGT.mjs";
 import {
   ReceiptBuffer,
   buildActionReadback,
@@ -12,7 +15,7 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-WIPWNWMJ.mjs";
+} from "./chunk-IDUH2O4Q.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";
@@ -243,6 +246,9 @@ async function handlePreToolUse(input, state) {
   });
   const payloadDigest = computePayloadDigest(input.toolInput);
   const actionReadback = buildActionReadback(toolName, input.toolInput || {});
+  const enrichment = buildEnrichment(toolName, input.toolInput || {});
+  const inflightRec = state.inflightTools.get(requestId);
+  if (inflightRec) inflightRec.enrichment = enrichment;
   const swarm = {
     ...state.swarmContext,
     ...input.agentId && { agent_id: input.agentId },
@@ -662,6 +668,8 @@ function emitDecisionLog(state, entry) {
     ...entry.sandbox_state && { sandbox_state: entry.sandbox_state },
     ...entry.plan_receipt_id && { plan_receipt_id: entry.plan_receipt_id }
   };
+  const enr = state.inflightTools.get(log.request_id)?.enrichment;
+  if (enr) log.enrichment = enr;
   process.stderr.write(`[PROTECT_MCP] ${JSON.stringify(log)}
 `);
   try {

package/dist/chunk-AYNQIEN7.mjs

@@ -0,0 +1,10 @@
+import {
+  sha256
+} from "./chunk-JIDDQUSQ.mjs";
+
+// node_modules/@noble/hashes/esm/sha256.js
+var sha2562 = sha256;
+
+export {
+  sha2562 as sha256
+};

package/dist/{chunk-JCMDLN5I.mjs → chunk-CXW2EIRM.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-VTPZ4G5I.mjs";
+} from "./chunk-GHR65WVD.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-WIPWNWMJ.mjs";
+} from "./chunk-IDUH2O4Q.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";