protect-mcp 0.9.1 → 0.9.3

package/CHANGELOG.md

@@ -1,5 +1,91 @@
 # Changelog
 
+## 0.9.3: the skeptic's tools sharpen
+
+Two verification upgrades: the anchor check moves into the verifier, and the
+record viewer proves signatures instead of just labelling them.
+
+- `verify-claim` now verifies the anchor automatically: it finds the
+  `<claim>.anchor.json` sidecar, checks offline that the anchored envelope binds
+  this exact claim (digest, record root, and the same issuer key), and confirms
+  against the public log that the digest sits at the recorded entry. A failed
+  binding makes the attestation INVALID; an unreachable log does not (the local
+  checks stand alone). `--check-anchor` makes a missing anchor fatal,
+  `--anchor-file <p>` overrides the path, `--offline` skips the network hop.
+- The `record` viewer now verifies Ed25519 signatures in the browser, locally:
+  each row shows `✓ verified`, `✗ invalid signature`, or `signed · unpinned
+  key`, and the stat strip counts how many verified. The CLI injects your
+  gateway's PUBLIC key so rows verify against your own key (the private key
+  never reaches the page).
+- Receipts now embed the signer's public key inside the signed payload
+  (`payload.public_key`), so a receipt is self-contained: any verifier can check
+  it without a side channel, and the key cannot be swapped without breaking the
+  signature. Older receipts still verify against a pinned or pasted key.
+
+## 0.9.2: anchor a claim to the public log
+
+Closes the one honest gap in a bare claim: that the disclosed set is complete.
+
+- Added `protect-mcp claim --anchor`: records the claim's digest in the public,
+  append-only ScopeBlind transparency log, so a counterparty who does not trust
+  you can confirm the exact claim existed at a time and was not quietly re-cut.
+  Only the hash is sent; the claim, its leaves, and every receipt stay on your
+  machine. Writes a `<claim>.anchor.json` sidecar with the log entry and a
+  verify URL. Anonymous and free; enrolling an org identity a counterparty can
+  pin is the paid upgrade (scopeblind.com/enroll).
+
+## 0.9.1: prove a claim without revealing the record
+
+The record viewer closes the loop from a decision to a portable proof.
+
+- The `record` viewer surfaces the exact `claim` command when you filter by a
+  capability, so a decision becomes a signed, position-blind attestation in one
+  step, with copy-to-clipboard and an offline `verify-claim` hint.
+- The browser drop-viewer (legate.scopeblind.com/record) reached parity with
+  the CLI: signed capability tags, a capability facet, and a provenance tree.
+
+## 0.9.0: signed, position-blind claim attestations
+
+Prove a predicate over the record without revealing it.
+
+- Added `protect-mcp claim`: mints a signed attestation of a predicate over the
+  record (`--no <cap>` for "no action carried this capability", `--only`,
+  `--count`/`--no-verdict <verdict>`), disclosing only per-decision categories
+  (receipt digest, verdict, capability tags), never inputs, outputs, or data.
+- Added `protect-mcp verify-claim`: checks it offline via Ed25519 over the pack,
+  a recomputed Merkle root over the disclosed set, and the predicate recomputed
+  independently. Honest trust model: an accountable position-blind attestation,
+  not zero-knowledge; set-completeness is issuer-attested.
+
+## 0.8.0: deterministic receipt enrichment
+
+Each signed decision now carries minimum-disclosure, rule-derived metadata.
+
+- `input_digest`: SHA-256 of the canonicalized tool input, so you can prove what
+  was requested without storing it.
+- Signed `capabilities`: deterministic, rule-derived tags (fs.read, fs.write,
+  net.egress, secret.adjacent, destructive, financial, exec.shell, ...) so the
+  record is queryable by what an action touched.
+- `resource`: the hashed target (path, host, or command). The gate sees tool
+  calls, not the model's prompt or reasoning, and does not claim to.
+
+## 0.7.6: the live record viewer
+
+- Added `protect-mcp record --live`: a local, streaming view of the receipt
+  file that turns decisions into a searchable, auto-labelled record as the agent
+  runs (stat strip, per-row signed badge and digest, a List/Tree provenance
+  view), all local, nothing uploaded.
+- One-click export: `.jsonl` carrying the real signatures (so a recipient
+  verifies offline with `npx @veritasacta/verify`) plus a Markdown report.
+
+## 0.7.5: honest version strings and the record viewer
+
+- Added `protect-mcp record`, a local browser viewer over the receipts file
+  (the answer to "the receipts are a hidden dotfile I cannot find").
+- Fixed hard-coded version strings in the banner and health/serverInfo: they
+  read the resolved package version now.
+- WebAuthn co-sign hardening: verify the rpIdHash and enforce challenge expiry.
+
 ## 0.7.4: the self-serve trial path
 
 Everything the scopeblind.com trial and docs pages describe now ships in the

package/README.md

@@ -148,6 +148,43 @@ disclosure, not full zero-knowledge, but it makes the privacy claim concrete:
 auditors can verify selected facts without receiving the full tool payload or
 sensitive desk context.
 
+### Prove a claim over the record (position-blind attestations)
+
+You can prove a CLAIM over your record without revealing it. Mint a signed,
+position-blind attestation over the whole record that discloses only per-decision
+categories (a receipt digest, the verdict, capability tags), never your tool
+inputs, outputs, or data:
+
+```bash
+# "No action reached the network across the record":
+npx protect-mcp claim --no net.egress
+
+# other predicates:
+#   --only fs.read,fs.write     all actions were confined to these capabilities
+#   --no-verdict blocked        no action was blocked
+#   --count blocked             how many were blocked
+```
+
+Anyone verifies it offline, seeing only the categories, never the content:
+
+```bash
+npx protect-mcp verify-claim claim-<id>.json
+```
+
+The verifier recomputes a Merkle root over the disclosed set and recomputes the
+predicate independently, so the issuer cannot lie about the claim given the
+disclosure. Add `--anchor` to record the claim's digest in the public,
+append-only ScopeBlind transparency log, so a counterparty who does not trust you
+can confirm the disclosed set is complete and was not quietly re-cut (only the
+hash is sent; the record stays local):
+
+```bash
+npx protect-mcp claim --no net.egress --anchor
+```
+
+This is an accountable, position-blind attestation, not full zero-knowledge: it
+reveals the shape, not the content.
+
 ## Claude Code hook quickstart
 
 ```bash
@@ -189,7 +226,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.3 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
+            "command": "npx protect-mcp@0.9.1 evaluate --cedar ./cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\""
           }
         ]
       }
@@ -200,7 +237,7 @@ session always runs the gate you tested:
         "hooks": [
           {
             "type": "command",
-            "command": "npx protect-mcp@0.7.3 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
+            "command": "npx protect-mcp@0.9.1 sign --tool \"$TOOL_NAME\" --receipts ./receipts --key ./keys/gateway.json"
           }
         ]
       }
@@ -335,6 +372,9 @@ To report a vulnerability, see [SECURITY.md](./SECURITY.md).
 | `dashboard` | Start a local-only dashboard on `127.0.0.1` showing tool inventory, risk, policy coverage, exact-action approvals, receipt chains, and audit export. |
 | `recommend` | Draft a reviewable JSON policy from observed local calls. Dry-run by default; use `--write` to create `protect-mcp.recommended.json`. |
 | `registry` | Create an org identity, anchor receipt digests, and write a static verifier page. Hosted mode uploads digests only. |
+| `record` | Open a local, searchable viewer over your receipts (`--live` streams as the agent runs): Ed25519 signatures verified in your browser against your gateway key, capability tags, a provenance tree, and one-click signed export. All local, nothing uploaded. |
+| `claim` | Mint a signed, position-blind attestation of a predicate over the record (`--no <cap>`, `--only <c1,c2>`, `--no-verdict <verdict>`, `--count <verdict>`), disclosing only decision categories. Add `--anchor` to record the claim digest in the public transparency log. |
+| `verify-claim` | Verify a claim pack offline: signature, recomputed Merkle root, independently recomputed predicate, and the anchor sidecar when present (binds the anchored envelope to this exact claim, then confirms the public log holds it). `--check-anchor` requires the anchor; `--offline` skips the log hop. |
 | `killer-demo` | Generate a complete shadow-mode to policy to approval to signed-receipt demo pack. |
 | `verify-disclosure` | Verify a `scopeblind.selective_disclosure.v0` package and explain disclosed versus hidden fields. |
 | `policy-packs` | List, inspect, and install starter Cedar policy packs. |

package/dist/{chunk-CXW2EIRM.mjs → chunk-7MHK5RF4.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-GHR65WVD.mjs";
+} from "./chunk-PB3TC7E3.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";

package/dist/{chunk-744JMCY4.mjs → chunk-DX7QOA3E.mjs}

@@ -1,6 +1,6 @@
 import {
   buildEnrichment
-} from "./chunk-KMNXHGGT.mjs";
+} from "./chunk-HPKHMVZX.mjs";
 import {
   ReceiptBuffer,
   buildActionReadback,
@@ -15,7 +15,7 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";

package/dist/{chunk-KMNXHGGT.mjs → chunk-HPKHMVZX.mjs}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-D733KAPG.mjs";
 
 // src/receipt-enrichment.ts
-var ENRICHMENT_VERSION = 1;
+var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();
   const enc = (v) => {

package/dist/{chunk-GHR65WVD.mjs → chunk-PB3TC7E3.mjs}

@@ -8,7 +8,7 @@ import {
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";

package/dist/{chunk-IDUH2O4Q.mjs → chunk-XLJUZ4WO.mjs}

@@ -177,7 +177,13 @@ function signDecision(entry) {
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
       // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified"
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
     };
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;

package/dist/claim-3EBRPP5U.mjs

@@ -0,0 +1,276 @@
+import {
+  canonicalJson
+} from "./chunk-HPKHMVZX.mjs";
+import {
+  sha256
+} from "./chunk-AYNQIEN7.mjs";
+import {
+  ed25519
+} from "./chunk-FFVJL3KQ.mjs";
+import "./chunk-JIDDQUSQ.mjs";
+import {
+  bytesToHex,
+  hexToBytes
+} from "./chunk-D733KAPG.mjs";
+import "./chunk-PQJP2ZCI.mjs";
+
+// src/claim.ts
+var CLAIM_TYPE = "scopeblind.claim.v1";
+function sha256Hex(input) {
+  const bytes = typeof input === "string" ? new TextEncoder().encode(input) : input;
+  return bytesToHex(sha256(bytes));
+}
+function receiptToLeaf(e) {
+  const p = e && typeof e.payload === "object" && e.payload || e;
+  const dec = String(p.decision || e.decision || "").toLowerCase();
+  const v = /den|block|reject|refus/.test(dec) ? "blocked" : /ask|approv|hold|escal|review|pending/.test(dec) ? "held" : "allowed";
+  const enr = p.enrichment;
+  const c = enr && Array.isArray(enr.capabilities) ? enr.capabilities.map(String).sort() : [];
+  const tsRaw = e.issued_at || p.timestamp || p.issued_at;
+  const ms = typeof tsRaw === "number" ? tsRaw : typeof tsRaw === "string" ? Date.parse(tsRaw) : NaN;
+  const t = isFinite(ms) ? new Date(ms).toISOString() : "";
+  const d = sha256Hex(canonicalJson(e));
+  return { d, v, c, t };
+}
+function leafHash(leaf) {
+  return sha256Hex(canonicalJson(leaf));
+}
+function merkleRoot(leafHashes) {
+  if (leafHashes.length === 0) return sha256Hex("scopeblind.claim.empty");
+  let level = [...leafHashes].sort();
+  while (level.length > 1) {
+    const next = [];
+    for (let i = 0; i < level.length; i += 2) {
+      const a = level[i];
+      const b = i + 1 < level.length ? level[i + 1] : level[i];
+      next.push(sha256Hex(a + b));
+    }
+    level = next;
+  }
+  return level[0];
+}
+function evaluate(pred, leaves) {
+  if (pred.kind === "no_capability") {
+    const matched2 = leaves.filter((l) => l.c.indexOf(pred.capability) >= 0).length;
+    return { statement: `No action used capability "${pred.capability}"`, holds: matched2 === 0, matched: matched2 };
+  }
+  if (pred.kind === "only_capabilities") {
+    const allow = new Set(pred.capabilities);
+    const matched2 = leaves.filter((l) => !l.c.every((c) => allow.has(c))).length;
+    return { statement: `All actions were confined to capabilities {${pred.capabilities.join(", ")}}`, holds: matched2 === 0, matched: matched2 };
+  }
+  if (pred.kind === "no_verdict") {
+    const matched2 = leaves.filter((l) => l.v === pred.verdict).length;
+    return { statement: `No action was ${pred.verdict}`, holds: matched2 === 0, matched: matched2 };
+  }
+  const matched = leaves.filter((l) => l.v === pred.verdict).length;
+  return { statement: `${matched} action${matched === 1 ? " was" : "s were"} ${pred.verdict}`, holds: true, matched };
+}
+function messageHash(unsigned) {
+  return sha256(new TextEncoder().encode(canonicalJson(unsigned)));
+}
+function buildClaim(receipts, predicate, key, issuedAt) {
+  const leaves = receipts.map(receiptToLeaf);
+  const root = merkleRoot(leaves.map(leafHash));
+  const claim = evaluate(predicate, leaves);
+  const times = leaves.map((l) => l.t).filter(Boolean).sort();
+  const unsigned = {
+    type: CLAIM_TYPE,
+    predicate,
+    claim,
+    scope: { total: leaves.length, from: times[0] || "", to: times[times.length - 1] || "" },
+    record: { root },
+    leaves,
+    issuer: { kid: key.kid, publicKey: key.publicKey, issuer: key.issuer || "protect-mcp" },
+    issued_at: issuedAt
+  };
+  const signature = bytesToHex(ed25519.sign(messageHash(unsigned), hexToBytes(key.privateKey)));
+  return { ...unsigned, signature };
+}
+function verifyClaim(pack, overridePublicKey) {
+  const reasons = [];
+  const leaves = Array.isArray(pack.leaves) ? pack.leaves : [];
+  const recomputedRoot = merkleRoot(leaves.map(leafHash));
+  const root_ok = !!pack.record && recomputedRoot === pack.record.root;
+  if (!root_ok) reasons.push("record commitment (Merkle root) does not match the disclosed decisions");
+  const recomputed = evaluate(pack.predicate, leaves);
+  const predicate_ok = !!pack.claim && recomputed.holds === pack.claim.holds && recomputed.matched === pack.claim.matched;
+  if (!predicate_ok) reasons.push("claim result does not match the predicate recomputed over the disclosed decisions");
+  let authentic = false;
+  try {
+    const { signature, ...unsigned } = pack;
+    const pub = overridePublicKey || pack.issuer && pack.issuer.publicKey;
+    if (pub && signature) {
+      authentic = ed25519.verify(hexToBytes(signature), messageHash(unsigned), hexToBytes(pub));
+    }
+  } catch {
+  }
+  if (!authentic) reasons.push("signature does not verify against the issuer public key");
+  return {
+    valid: authentic && root_ok && predicate_ok,
+    authentic,
+    root_ok,
+    predicate_ok,
+    holds: !!(pack.claim && pack.claim.holds),
+    matched: pack.claim ? pack.claim.matched : recomputed.matched,
+    total: leaves.length,
+    statement: pack.claim ? pack.claim.statement : recomputed.statement,
+    reasons
+  };
+}
+var ANCHOR_SCHEMA = "scopeblind.protect-mcp.anchor.v1";
+var DEFAULT_LOG = "https://scopeblind.com";
+function anchorDeepSort(o) {
+  if (o === null || typeof o !== "object") return o;
+  if (Array.isArray(o)) return o.map(anchorDeepSort);
+  const src = o;
+  const out = {};
+  for (const k of Object.keys(src).sort()) out[k] = anchorDeepSort(src[k]);
+  return out;
+}
+function toBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function claimDigest(pack) {
+  return sha256Hex(canonicalJson(pack));
+}
+function buildAnchorEnvelope(pack, key, issuedAt) {
+  const signed = {
+    type: "evidence_pack",
+    schema: ANCHOR_SCHEMA,
+    anchors: "protect-mcp-claim",
+    claim_digest: claimDigest(pack),
+    record_root: pack.record.root,
+    statement: pack.claim.statement,
+    holds: pack.claim.holds,
+    matched: pack.claim.matched,
+    total: pack.scope.total,
+    issued_at: issuedAt,
+    verification_key: key.publicKey,
+    disclosure: "internal"
+  };
+  const hash = sha256(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+  const digest = bytesToHex(hash);
+  const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
+  return { ...signed, signature, digest };
+}
+function verifyAnchorEnvelope(pack, envelope) {
+  const reasons = [];
+  if (!envelope || envelope.type !== "evidence_pack" || envelope.anchors !== "protect-mcp-claim") {
+    return { ok: false, reasons: ["sidecar does not contain a protect-mcp claim anchor envelope"] };
+  }
+  const expected = claimDigest(pack);
+  if (envelope.claim_digest !== expected) {
+    reasons.push("anchored envelope binds a DIFFERENT claim (claim_digest mismatch)");
+  }
+  if (envelope.record_root !== pack.record.root) {
+    reasons.push("anchored envelope commits to a different record root");
+  }
+  if (pack.issuer && envelope.verification_key !== pack.issuer.publicKey) {
+    reasons.push("anchor was signed by a different key than the claim issuer");
+  }
+  try {
+    const { signature, digest, ...signed } = envelope;
+    const hash = sha256(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+    if (bytesToHex(hash) !== String(digest).toLowerCase()) {
+      reasons.push("envelope digest does not match its contents");
+    } else if (!ed25519.verify(hexToBytes(String(signature)), hash, hexToBytes(envelope.verification_key))) {
+      reasons.push("envelope signature does not verify");
+    }
+  } catch {
+    reasons.push("envelope signature does not verify");
+  }
+  return { ok: reasons.length === 0, reasons };
+}
+async function checkClaimAnchor(pack, sidecar, opts) {
+  const reasons = [];
+  const envelope = sidecar && sidecar.envelope;
+  if (!envelope) {
+    return { local_ok: false, log_ok: null, reasons: ["sidecar has no anchor envelope"] };
+  }
+  const local = verifyAnchorEnvelope(pack, envelope);
+  reasons.push(...local.reasons);
+  const base = (sidecar.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = {
+    local_ok: local.ok,
+    log_ok: null,
+    seq: sidecar.seq,
+    anchored_at: sidecar.anchored_at,
+    entry_url: sidecar.entry_url || (typeof sidecar.seq === "number" ? `${base}/fn/log/${sidecar.seq}` : void 0),
+    reasons
+  };
+  if (opts?.offline) return out;
+  const doFetch = opts?.fetchImpl || globalThis.fetch;
+  if (!doFetch) return out;
+  try {
+    const resp = await doFetch(`${base}/fn/log/digest/sha256:${envelope.digest}`, { headers: { accept: "application/json" } });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data) {
+      out.log_ok = null;
+      return out;
+    }
+    if (data.anchored !== true) {
+      out.log_ok = false;
+      out.reasons.push("the public log does not contain this anchor digest");
+      return out;
+    }
+    if (typeof sidecar.seq === "number" && typeof data.seq === "number" && data.seq !== sidecar.seq) {
+      out.log_ok = false;
+      out.reasons.push(`log holds the digest at entry #${data.seq}, sidecar says #${sidecar.seq}`);
+      return out;
+    }
+    out.log_ok = true;
+    if (typeof data.seq === "number") out.seq = data.seq;
+    return out;
+  } catch {
+    out.log_ok = null;
+    return out;
+  }
+}
+async function anchorClaim(pack, key, opts) {
+  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const doFetch = opts.fetchImpl || globalThis.fetch;
+  if (!doFetch) return { ok: false, claim_digest: envelope.claim_digest, error: "fetch_unavailable", envelope };
+  const encoded = toBase64(new TextEncoder().encode(JSON.stringify(envelope)));
+  try {
+    const resp = await doFetch(`${base}/fn/log/anchor-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ encoded })
+    });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data || !data.ok || typeof data.seq !== "number") {
+      return { ok: false, claim_digest: envelope.claim_digest, error: data && data.error || `http_${resp.status}`, envelope };
+    }
+    return {
+      ok: true,
+      claim_digest: envelope.claim_digest,
+      seq: data.seq,
+      entry_url: `${base}/fn/log/${data.seq}`,
+      anchored_at: data.anchored_at,
+      already_anchored: !!data.already_anchored,
+      envelope
+    };
+  } catch {
+    return { ok: false, claim_digest: envelope.claim_digest, error: "network_error", envelope };
+  }
+}
+export {
+  ANCHOR_SCHEMA,
+  CLAIM_TYPE,
+  DEFAULT_LOG,
+  anchorClaim,
+  buildAnchorEnvelope,
+  buildClaim,
+  checkClaimAnchor,
+  claimDigest,
+  evaluate,
+  leafHash,
+  merkleRoot,
+  receiptToLeaf,
+  verifyAnchorEnvelope,
+  verifyClaim
+};