protect-mcp 0.9.1 → 0.9.3

package/dist/cli.js

@@ -456,7 +456,13 @@ function signDecision(entry) {
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
       // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified"
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
     };
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
@@ -5156,7 +5162,7 @@ var init_receipt_enrichment = __esm({
     "use strict";
     init_sha256();
     init_utils();
-    ENRICHMENT_VERSION = 1;
+    ENRICHMENT_VERSION = 2;
     RULES = [
       { cap: "exec.shell", tool: /bash|shell|exec|terminal|run_command|command/ },
       { cap: "fs.read", tool: /(^|[_.])(read|cat|glob|grep|search|ls|view|list_files|open)/ },
@@ -5176,12 +5182,19 @@ var init_receipt_enrichment = __esm({
 // src/claim.ts
 var claim_exports = {};
 __export(claim_exports, {
+  ANCHOR_SCHEMA: () => ANCHOR_SCHEMA,
   CLAIM_TYPE: () => CLAIM_TYPE,
+  DEFAULT_LOG: () => DEFAULT_LOG,
+  anchorClaim: () => anchorClaim,
+  buildAnchorEnvelope: () => buildAnchorEnvelope,
   buildClaim: () => buildClaim,
+  checkClaimAnchor: () => checkClaimAnchor,
+  claimDigest: () => claimDigest,
   evaluate: () => evaluate,
   leafHash: () => leafHash,
   merkleRoot: () => merkleRoot,
   receiptToLeaf: () => receiptToLeaf,
+  verifyAnchorEnvelope: () => verifyAnchorEnvelope,
   verifyClaim: () => verifyClaim
 });
 function sha256Hex3(input) {
@@ -5286,7 +5299,145 @@ function verifyClaim(pack, overridePublicKey) {
     reasons
   };
 }
-var CLAIM_TYPE;
+function anchorDeepSort(o) {
+  if (o === null || typeof o !== "object") return o;
+  if (Array.isArray(o)) return o.map(anchorDeepSort);
+  const src = o;
+  const out = {};
+  for (const k of Object.keys(src).sort()) out[k] = anchorDeepSort(src[k]);
+  return out;
+}
+function toBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function claimDigest(pack) {
+  return sha256Hex3(canonicalJson(pack));
+}
+function buildAnchorEnvelope(pack, key, issuedAt) {
+  const signed = {
+    type: "evidence_pack",
+    schema: ANCHOR_SCHEMA,
+    anchors: "protect-mcp-claim",
+    claim_digest: claimDigest(pack),
+    record_root: pack.record.root,
+    statement: pack.claim.statement,
+    holds: pack.claim.holds,
+    matched: pack.claim.matched,
+    total: pack.scope.total,
+    issued_at: issuedAt,
+    verification_key: key.publicKey,
+    disclosure: "internal"
+  };
+  const hash = sha2562(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+  const digest = bytesToHex(hash);
+  const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
+  return { ...signed, signature, digest };
+}
+function verifyAnchorEnvelope(pack, envelope) {
+  const reasons = [];
+  if (!envelope || envelope.type !== "evidence_pack" || envelope.anchors !== "protect-mcp-claim") {
+    return { ok: false, reasons: ["sidecar does not contain a protect-mcp claim anchor envelope"] };
+  }
+  const expected = claimDigest(pack);
+  if (envelope.claim_digest !== expected) {
+    reasons.push("anchored envelope binds a DIFFERENT claim (claim_digest mismatch)");
+  }
+  if (envelope.record_root !== pack.record.root) {
+    reasons.push("anchored envelope commits to a different record root");
+  }
+  if (pack.issuer && envelope.verification_key !== pack.issuer.publicKey) {
+    reasons.push("anchor was signed by a different key than the claim issuer");
+  }
+  try {
+    const { signature, digest, ...signed } = envelope;
+    const hash = sha2562(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+    if (bytesToHex(hash) !== String(digest).toLowerCase()) {
+      reasons.push("envelope digest does not match its contents");
+    } else if (!ed25519.verify(hexToBytes(String(signature)), hash, hexToBytes(envelope.verification_key))) {
+      reasons.push("envelope signature does not verify");
+    }
+  } catch {
+    reasons.push("envelope signature does not verify");
+  }
+  return { ok: reasons.length === 0, reasons };
+}
+async function checkClaimAnchor(pack, sidecar, opts) {
+  const reasons = [];
+  const envelope = sidecar && sidecar.envelope;
+  if (!envelope) {
+    return { local_ok: false, log_ok: null, reasons: ["sidecar has no anchor envelope"] };
+  }
+  const local = verifyAnchorEnvelope(pack, envelope);
+  reasons.push(...local.reasons);
+  const base = (sidecar.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = {
+    local_ok: local.ok,
+    log_ok: null,
+    seq: sidecar.seq,
+    anchored_at: sidecar.anchored_at,
+    entry_url: sidecar.entry_url || (typeof sidecar.seq === "number" ? `${base}/fn/log/${sidecar.seq}` : void 0),
+    reasons
+  };
+  if (opts?.offline) return out;
+  const doFetch = opts?.fetchImpl || globalThis.fetch;
+  if (!doFetch) return out;
+  try {
+    const resp = await doFetch(`${base}/fn/log/digest/sha256:${envelope.digest}`, { headers: { accept: "application/json" } });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data) {
+      out.log_ok = null;
+      return out;
+    }
+    if (data.anchored !== true) {
+      out.log_ok = false;
+      out.reasons.push("the public log does not contain this anchor digest");
+      return out;
+    }
+    if (typeof sidecar.seq === "number" && typeof data.seq === "number" && data.seq !== sidecar.seq) {
+      out.log_ok = false;
+      out.reasons.push(`log holds the digest at entry #${data.seq}, sidecar says #${sidecar.seq}`);
+      return out;
+    }
+    out.log_ok = true;
+    if (typeof data.seq === "number") out.seq = data.seq;
+    return out;
+  } catch {
+    out.log_ok = null;
+    return out;
+  }
+}
+async function anchorClaim(pack, key, opts) {
+  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const doFetch = opts.fetchImpl || globalThis.fetch;
+  if (!doFetch) return { ok: false, claim_digest: envelope.claim_digest, error: "fetch_unavailable", envelope };
+  const encoded = toBase64(new TextEncoder().encode(JSON.stringify(envelope)));
+  try {
+    const resp = await doFetch(`${base}/fn/log/anchor-pack`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ encoded })
+    });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data || !data.ok || typeof data.seq !== "number") {
+      return { ok: false, claim_digest: envelope.claim_digest, error: data && data.error || `http_${resp.status}`, envelope };
+    }
+    return {
+      ok: true,
+      claim_digest: envelope.claim_digest,
+      seq: data.seq,
+      entry_url: `${base}/fn/log/${data.seq}`,
+      anchored_at: data.anchored_at,
+      already_anchored: !!data.already_anchored,
+      envelope
+    };
+  } catch {
+    return { ok: false, claim_digest: envelope.claim_digest, error: "network_error", envelope };
+  }
+}
+var CLAIM_TYPE, ANCHOR_SCHEMA, DEFAULT_LOG;
 var init_claim = __esm({
   "src/claim.ts"() {
     "use strict";
@@ -5295,6 +5446,8 @@ var init_claim = __esm({
     init_ed25519();
     init_receipt_enrichment();
     CLAIM_TYPE = "scopeblind.claim.v1";
+    ANCHOR_SCHEMA = "scopeblind.protect-mcp.anchor.v1";
+    DEFAULT_LOG = "https://scopeblind.com";
   }
 });
 
@@ -10491,6 +10644,16 @@ Start the gate with ${bold("npx protect-mcp serve")}, use your agent, then run t
       return null;
     }
   }).filter((x) => x !== null).map(mapRecordEntry);
+  let pinnedKey = "";
+  let pinnedKid = "";
+  try {
+    const kd = JSON.parse(readFileSync11(join8(dir, "keys", "gateway.json"), "utf-8"));
+    if (kd && typeof kd.publicKey === "string" && /^[0-9a-f]{64}$/i.test(kd.publicKey)) {
+      pinnedKey = kd.publicKey;
+      pinnedKid = typeof kd.kid === "string" ? kd.kid : "";
+    }
+  } catch {
+  }
   const openTarget = (target) => {
     if (argv.includes("--no-open")) return;
     const platform = process.platform;
@@ -10518,7 +10681,7 @@ Start the gate with ${bold("npx protect-mcp serve")}, use your agent, then run t
         res.end(JSON.stringify({ recs: recs2, signed: f === recPath }));
         return;
       }
-      const meta2 = { file: chosen, signed: pick() === recPath, count: 0, live: true };
+      const meta2 = { file: chosen, signed: pick() === recPath, count: 0, live: true, pinned_key: pinnedKey, pinned_kid: pinnedKid };
       const page = RECORD_HTML.replace("__DATA__", () => "[]").replace("__META__", () => JSON.stringify(meta2));
       res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
       res.end(page);
@@ -10543,7 +10706,7 @@ ${bold("\u{1F6E1}\uFE0F  Your record")} ${dim("\xB7")} live at ${url}
     return;
   }
   const recs = readRecs(chosen);
-  const meta = { file: chosen, signed: chosen === recPath, count: recs.length, live: false };
+  const meta = { file: chosen, signed: chosen === recPath, count: recs.length, live: false, pinned_key: pinnedKey, pinned_kid: pinnedKid };
   const html = RECORD_HTML.replace("__DATA__", () => JSON.stringify(recs)).replace("__META__", () => JSON.stringify(meta));
   const out = join8(osMod.tmpdir(), "protect-mcp-record-" + Date.now() + ".html");
   writeFileSync4(out, html);
@@ -10609,6 +10772,9 @@ input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9p
 .badge{font-size:10.5px;font-weight:600;padding:1px 7px;border-radius:100px}
 .badge.sgn{background:var(--gb);color:var(--g)}
 .badge.log{background:var(--paper);color:var(--faint);border:1px solid var(--line)}
+.badge.vbad{background:#fbecec;color:#b3382f;border:1px solid #edc6c2}
+.badge.vfor{background:#fbf3df;color:#8a6d1a;border:1px solid #e8d8ae}
+.stat .badk{color:#b3382f;font-weight:680}.stat .warnk{color:#8a6d1a}.stat .dim2{color:var(--faint);font-weight:400}
 .dg{font-size:10.5px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .when{margin-left:auto;font-size:12px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .det{margin-top:8px;padding-top:8px;border-top:1px solid var(--line);font-size:12px;color:var(--soft);font-family:ui-monospace,Menlo,monospace;white-space:pre-wrap;word-break:break-all;display:none}
@@ -10655,6 +10821,30 @@ input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9p
 </div>
 <script>
 var RECORDS=__DATA__;var META=__META__;var Q="",ACT={},VIEW="list",OPEN={};var NL=String.fromCharCode(10);
+// In-browser signature verification. Mirrors @veritasacta/artifacts exactly:
+// preimage = JCS-style canonical JSON (sorted keys) of the receipt minus its
+// signature, verified with WebCrypto Ed25519. Pinned key (your keys/gateway.json
+// public half, injected by the CLI) = authenticity; key embedded in the receipt
+// payload (0.9.3+) = self-consistency. Everything runs locally.
+var VSTATE={},VDONE=false,VBUSY=false,VUNSUP=false;
+function vkey(r){return "row:"+(r.id||"")+"|"+(r.ts||"")}
+function hexb(h){h=String(h||"");var a=new Uint8Array(h.length>>1);for(var i=0;i<a.length;i++)a[i]=parseInt(h.substr(i*2,2),16);return a}
+function canon(v){return JSON.stringify(v,function(k,x){if(x&&typeof x==="object"&&!Array.isArray(x)){var s={},ks=Object.keys(x).sort();for(var i=0;i<ks.length;i++)s[ks[i]]=x[ks[i]];return s}return x})}
+async function edv(sig,msg,pub){var key=await crypto.subtle.importKey("raw",hexb(pub),{name:"Ed25519"},false,["verify"]);return crypto.subtle.verify({name:"Ed25519"},key,hexb(sig),msg)}
+async function verifyRow(r){var raw=r.raw;if(!raw||typeof raw.signature!=="string")return"unsigned";
+var rest={},k;for(k in raw)if(k!=="signature")rest[k]=raw[k];
+var msg=new TextEncoder().encode(canon(rest));
+var pin=String(META.pinned_key||"").toLowerCase();
+var emb=String((raw.payload&&raw.payload.public_key)||raw.public_key||"").toLowerCase();
+if(!/^[0-9a-f]{64}$/.test(emb))emb="";
+if(pin){if(await edv(raw.signature,msg,pin))return"ok";if(emb&&emb!==pin&&await edv(raw.signature,msg,emb))return"foreign";return"bad"}
+if(emb)return(await edv(raw.signature,msg,emb))?"ok":"bad";
+return"nokey"}
+function vsum(){var s={ok:0,bad:0,foreign:0,nokey:0};RECORDS.forEach(function(r){if(!r.signed)return;var v=VSTATE[vkey(r)];if(v&&s[v]!==undefined)s[v]++});return s}
+async function kickVerify(){if(VBUSY||VUNSUP||!(window.crypto&&crypto.subtle))return;VBUSY=true;
+try{var rows=RECORDS.slice(0,1500);for(var i=0;i<rows.length;i++){var r=rows[i],kk=vkey(r);if(VSTATE[kk])continue;
+try{VSTATE[kk]=await verifyRow(r)}catch(e){if(e&&e.name==="NotSupportedError"){VUNSUP=true;break}VSTATE[kk]="bad"}}}
+finally{VDONE=true;VBUSY=false;render()}}
 function esc(s){return String(s).replace(/[&<>"]/g,function(c){return{"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c]})}
 function vlabel(v){return v==="allowed"?"Allowed":v==="held"?"Held":"Blocked"}
 function when(ts){if(!ts)return"";var d=new Date(ts);return d.toLocaleDateString(undefined,{month:"short",day:"numeric"})+" "+d.toLocaleTimeString(undefined,{hour:"2-digit",minute:"2-digit"})}
@@ -10668,8 +10858,9 @@ function exportJsonl(){var rows=filtered();if(!rows.length)return;var lines=rows
 function exportMd(){var rows=filtered();if(!rows.length)return;var c=counts(rows);var head=["# Agent decision record","",rows.length+" decisions from "+META.file,c.allowed+" allowed, "+c.held+" held, "+c.blocked+" blocked, "+c.signed+" signed.","","Generated locally by protect-mcp. These are signed receipts; verify offline with npx @veritasacta/verify (our code removed).","","| When | Decision | Tool | Reason | Hook | Signed |","|---|---|---|---|---|---|"];var body=rows.slice(0,3000).map(function(r){return "| "+(r.ts||"")+" | "+vlabel(r.verdict)+" | "+String(r.tool||"").replace(/\\|/g,"/")+" | "+String(r.reason||"").replace(/\\|/g,"/")+" | "+(r.hook||"")+" | "+(r.signed?"yes":"no")+" |"});dl("protect-mcp-record-"+stamp()+".md",head.concat(body).join(NL)+NL,"text/markdown")}
 function copyAttest(){var a=document.getElementById("attest");var cmd=a?a.getAttribute("data-cmd"):"";try{navigator.clipboard&&cmd&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpa");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
 function copyVerify(){var cmd="npx @veritasacta/verify";try{navigator.clipboard&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpv");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
-function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');p.push('<span class="stat sig">'+c.signed+' signed, verifiable offline</span>');document.getElementById("stats").innerHTML=p.join("")}
-function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var sig=r.signed?'<span class="badge sgn">signed</span>':'<span class="badge log">log</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
+function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');var st;if(!c.signed){st='0 signed, verifiable offline'}else if(VUNSUP||!(window.crypto&&crypto.subtle)){st=c.signed+' signed, verifiable offline <span class="dim2">(in-browser check unavailable here; run npx protect-mcp receipts)</span>'}else if(!VDONE){st=c.signed+' signed \xB7 verifying in your browser\u2026'}else{var s=vsum();st=s.ok+' of '+c.signed+' signatures verified in your browser';if(s.foreign)st+=' <span class="warnk">\xB7 '+s.foreign+' signed by an unpinned key</span>';if(s.bad)st+=' <span class="badk">\xB7 '+s.bad+' INVALID</span>';if(s.nokey)st+=' <span class="dim2">\xB7 '+s.nokey+' need a key to check</span>'}
+p.push('<span class="stat sig">'+st+'</span>');document.getElementById("stats").innerHTML=p.join("")}
+function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var vs=VSTATE[vkey(r)];var sig=!r.signed?'<span class="badge log">log</span>':vs==="ok"?'<span class="badge sgn">\u2713 verified</span>':vs==="bad"?'<span class="badge vbad">\u2717 invalid signature</span>':vs==="foreign"?'<span class="badge vfor">signed \xB7 unpinned key</span>':'<span class="badge sgn">signed</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
 function isLifecycle(r){var h=r.hook||"";return h==="SessionStart"||h==="SessionEnd"||h==="Stop"||h==="SubagentStart"||h==="SubagentStop"||h==="TaskCreated"||h==="TaskCompleted"||h==="ConfigChange"||h==="Notification"||h==="PreCompact";}
 function buildTree(rows){var ags={},order=[];rows.forEach(function(r){var a=r.agent||"main agent";if(!ags[a]){ags[a]={name:a,byId:{},items:[],caps:{},blocked:0,actions:0};order.push(a);}var g=ags[a];(r.caps||[]).forEach(function(c){g.caps[c]=(g.caps[c]||0)+1;});if(isLifecycle(r)){g.items.push({t:"e",ts:r.ts,r:r});return;}var id=r.id||("_"+r.ts);var n=g.byId[id];if(!n){n={t:"a",id:id,tool:r.tool,verdict:r.verdict,caps:(r.caps||[]).slice(),ts:r.ts,dur:0,signed:!!r.signed,raw:r.raw};g.byId[id]=n;g.items.push(n);g.actions++;}if(r.hook==="PostToolUse"){if(r.dur)n.dur=r.dur;if(!n.raw)n.raw=r.raw;}else{n.verdict=r.verdict;if((r.caps||[]).length)n.caps=r.caps.slice();n.raw=r.raw;n.ts=r.ts;}if(r.signed)n.signed=true;});order.forEach(function(a){var g=ags[a];g.blocked=g.items.filter(function(it){return it.t==="a"&&it.verdict==="blocked";}).length;g.items.sort(function(x,y){return (x.ts<y.ts)?-1:1;});});return order.map(function(a){return ags[a];});}
 function renderTree(ags){if(!ags.length){document.getElementById("list").innerHTML='<p style="color:#8a837a">No records match.</p>';return;}var html="",N=0;ags.forEach(function(g,gi){var capstr=Object.keys(g.caps).sort(function(a,b){return g.caps[b]-g.caps[a];}).slice(0,5).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var ak="ag:"+g.name;var op=(OPEN.hasOwnProperty(ak)?OPEN[ak]:(ags.length===1||gi===0))?" open":"";html+='<div class="agent'+op+'" data-k="'+esc(ak)+'"><div class="ahead"><span class="atwist">\u25B8</span><b>'+esc(g.name)+'</b><span class="acount">'+g.actions+' action'+(g.actions===1?'':'s')+'</span>'+(g.blocked?'<span class="badge blk">'+g.blocked+' blocked</span>':'')+capstr+'</div><div class="akids">';g.items.forEach(function(it){if(N++>1500)return;if(it.t==="e"){var r=it.r;html+='<div class="ev"><span class="evdot"></span>'+esc(r.hook||r.tool)+' <span class="evre">'+esc(r.reason)+'</span><span class="when">'+esc(when(r.ts))+'</span></div>';}else{var ct=(it.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var dur=it.dur?'<span class="dg">'+it.dur+'ms</span>':'';var ik="act:"+it.id;html+='<div class="act '+it.verdict+(OPEN[ik]?" open":"")+'" data-k="'+esc(ik)+'"><span class="pill '+it.verdict+'">'+vlabel(it.verdict)+'</span><b>'+esc(it.tool)+'</b>'+ct+(it.signed?'<span class="badge sgn">signed</span>':'')+dur+'<span class="when">'+esc(when(it.ts))+'</span><div class="det">'+esc(JSON.stringify(it.raw||{},null,2))+'</div></div>';}});html+='</div></div>';});if(N>1500)html+='<p style="color:#8a837a;font-size:12px;margin-top:10px">Showing the first 1500 items. Search or pick a facet to narrow.</p>';document.getElementById("list").innerHTML=html;}
@@ -10687,8 +10878,8 @@ if(VIEW==="tree"){renderTree(buildTree(rows));}else{renderList(rows);}}
 document.getElementById("q").addEventListener("input",function(e){Q=e.target.value.toLowerCase().trim();render()});
 document.getElementById("chips").addEventListener("click",function(e){var c=e.target.closest(".chip");if(!c)return;var k=c.getAttribute("data-k"),v=c.getAttribute("data-v");ACT[k]=ACT[k]===v?undefined:v;render()});
 document.getElementById("list").addEventListener("click",function(e){var ah=e.target.closest(".ahead");if(ah){var ag=ah.parentNode;ag.classList.toggle("open");var ak=ag.getAttribute("data-k");if(ak)OPEN[ak]=ag.classList.contains("open");return;}var el=e.target.closest(".act")||e.target.closest(".row");if(el){el.classList.toggle("open");var k=el.getAttribute("data-k");if(k)OPEN[k]=el.classList.contains("open");}});
-render();
-if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed)render()}).catch(function(){})};poll();setInterval(poll,2000);}
+render();kickVerify();
+if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed){render();kickVerify()}}).catch(function(){})};poll();setInterval(poll,2000);}
 </script></body></html>`;
 async function handleClaim(argv) {
   const { readFileSync: readFileSync11, existsSync: existsSync9, writeFileSync: writeFileSync4 } = await import("fs");
@@ -10712,8 +10903,11 @@ Attest a signed, position-blind claim over your record:
   --only <c1,c2,...>       all actions confined to these capabilities
   --no-verdict <verdict>   e.g. ${dim("--no-verdict blocked")}
   --count <verdict>        how many, e.g. ${dim("--count blocked")}
+  --anchor                 also record the claim digest in the public append-only
+                           log so a counterparty can trust it is complete (only the
+                           hash is sent; your record stays local)
 
-Example: ${bold("npx protect-mcp claim --no net.egress")}
+Example: ${bold("npx protect-mcp claim --no net.egress --anchor")}
 
 `);
     process.exit(0);
@@ -10789,7 +10983,36 @@ ${bold("\u{1F6E1}\uFE0F  Signed claim")}
   process.stdout.write(`  Written to ${out}
 `);
   process.stdout.write(`  Hand it to anyone. They verify offline: ${bold("npx protect-mcp verify-claim " + out)}
-
+`);
+  if (argv.indexOf("--anchor") !== -1) {
+    const { anchorClaim: anchorClaim2 } = await Promise.resolve().then(() => (init_claim(), claim_exports));
+    const li = argv.indexOf("--log");
+    const logBase = li !== -1 && argv[li + 1] ? argv[li + 1] : void 0;
+    process.stdout.write(`
+  ${dim("Anchoring the claim digest to the public append-only log (only the hash leaves your machine)...")}
+`);
+    const res = await anchorClaim2(
+      pack,
+      { privateKey: key.privateKey, publicKey: key.publicKey, kid: key.kid || "gateway", issuer: "protect-mcp" },
+      { log: logBase, issuedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+    if (res.ok) {
+      const sidecar = out.replace(/\.json$/, "") + ".anchor.json";
+      writeFileSync4(sidecar, JSON.stringify({ log: logBase || "https://scopeblind.com", seq: res.seq, entry_url: res.entry_url, anchored_at: res.anchored_at, claim_digest: res.claim_digest, envelope: res.envelope }, null, 2) + "\n");
+      process.stdout.write(`  ${green("Anchored")} as log entry ${bold("#" + res.seq)}${res.already_anchored ? dim(" (already present)") : ""}  ${dim(res.entry_url || "")}
+`);
+      process.stdout.write(`  ${dim("A counterparty can now confirm this exact claim existed at " + (res.anchored_at || "this time") + " and cannot be quietly re-cut.")}
+`);
+      process.stdout.write(`  ${dim("Anchor record written to " + sidecar + ". Only the digest was sent; your record stayed local.")}
+`);
+      process.stdout.write(`  ${dim("To anchor as your enrolled org identity (a key a counterparty can pin), see")} ${bold("scopeblind.com/enroll")}
+`);
+    } else {
+      process.stdout.write(`  ${yellow("Anchor skipped")} ${dim("(" + (res.error || "unavailable") + "). The claim above is complete and verifiable offline without it.")}
+`);
+    }
+  }
+  process.stdout.write(`
 `);
   process.exit(0);
 }
@@ -10842,17 +11065,64 @@ ${bold("protect-mcp verify-claim")}
 `);
   process.stdout.write(`  Predicate:  ${ok(v.predicate_ok)} ${v.predicate_ok ? "recomputed independently and matches" : "MISMATCH"}
 `);
+  const ai = argv.indexOf("--anchor-file");
+  const sidecarPath = ai !== -1 && argv[ai + 1] ? argv[ai + 1] : file.replace(/\.json$/, "") + ".anchor.json";
+  const requireAnchor = argv.includes("--check-anchor");
+  let anchorOk = true;
+  if (existsSync9(sidecarPath)) {
+    const { checkClaimAnchor: checkClaimAnchor2 } = await Promise.resolve().then(() => (init_claim(), claim_exports));
+    let sidecar = null;
+    try {
+      sidecar = JSON.parse(readFileSync11(sidecarPath, "utf-8"));
+    } catch {
+    }
+    if (!sidecar) {
+      anchorOk = false;
+      process.stdout.write(`  Anchor:     ${red("\u2717")} ${sidecarPath} is not valid JSON
+`);
+    } else {
+      const a = await checkClaimAnchor2(pack, sidecar, { offline: argv.includes("--offline") });
+      anchorOk = a.local_ok && a.log_ok !== false;
+      if (a.local_ok) {
+        process.stdout.write(`  Anchor:     ${green("\u2713")} anchored envelope binds this exact claim and its record root
+`);
+        process.stdout.write(`              ${green("\u2713")} envelope signed by the claim issuer's key
+`);
+      } else {
+        for (const r of a.reasons.slice(0, 3)) process.stdout.write(`  Anchor:     ${red("\u2717")} ${r}
+`);
+      }
+      if (a.log_ok === true) {
+        process.stdout.write(`              ${green("\u2713")} public log confirms it${typeof a.seq === "number" ? ": entry " + bold("#" + a.seq) : ""}${a.anchored_at ? dim(" \xB7 anchored " + a.anchored_at) : ""}
+`);
+      } else if (a.log_ok === false) {
+        process.stdout.write(`              ${red("\u2717")} ${a.reasons[a.reasons.length - 1]}
+`);
+      } else if (a.local_ok) {
+        process.stdout.write(`              ${yellow("~")} log not checked ${dim(argv.includes("--offline") ? "(--offline)" : "(unreachable; local binding checks stand)")}
+`);
+      }
+    }
+  } else if (requireAnchor) {
+    anchorOk = false;
+    process.stdout.write(`  Anchor:     ${red("\u2717")} no anchor sidecar at ${sidecarPath} ${dim("(mint with: protect-mcp claim ... --anchor)")}
+`);
+  } else {
+    process.stdout.write(`  Anchor:     ${dim("none found (" + sidecarPath + "). Anchoring proves the claim was fixed at a time: claim ... --anchor")}
+`);
+  }
+  const finalValid = v.valid && anchorOk;
   process.stdout.write(`
-  ${v.valid ? green("VALID") : red("INVALID")} attestation.
+  ${finalValid ? green("VALID") : red("INVALID")} attestation${v.valid && !anchorOk ? red(" (anchor check failed)") : ""}.
 `);
   process.stdout.write(`  ${dim("Proves the pack came from the issuer key and the claim is true over the disclosed decision")}
 `);
   process.stdout.write(`  ${dim("categories (verdict + capabilities), which reveal no tool inputs, outputs, or data. Completeness")}
 `);
-  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; pin the key or anchor to the log for more.")}
+  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; the anchor fixes it in a public append-only log.")}
 
 `);
-  process.exit(v.valid ? 0 : 1);
+  process.exit(finalValid ? 0 : 1);
 }
 async function handleBundle(argv) {
   const { readFileSync: readFileSync11, writeFileSync: writeFileSync4, existsSync: existsSync9 } = await import("fs");