protect-mcp 0.9.2 → 0.9.4

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## 0.9.4: agent payments get receipts, records get heartbeats, anchors get names
+
+The provenance layer reaches the agentic economy's payment rails (x402), the
+record gains continuous completeness, and anchoring can carry an identity.
+
+- **Payment receipts (x402 interop).** The gate now tags agent payments with a
+  signed `payment` capability, detected broadly across x402 wire shapes
+  (`paymentRequirements`, `X-PAYMENT`, EIP-3009 `transferWithAuthorization`)
+  and payment-shaped tools. Receipts carry minimum-disclosure payment facts:
+  amount (only when clearly readable in human units), asset, a HASHED recipient,
+  and the x402 scheme. `claim --no payment` proves no agent paid anything;
+  `claim --payment-under <cap>` proves every payment stayed under a cap, and an
+  amount the gate could not read counts as OVER (you cannot prove an amount you
+  could not read, so the claim cannot lie).
+- **Record checkpoints (`anchor-record`).** Anchors the record's CURRENT
+  commitment (the same Merkle root a claim commits to, plus count and time
+  range) into the public log. Run it on a heartbeat and the record grows an
+  anchored history: a later claim whose root matches a checkpoint is provably
+  over the complete set as of that checkpoint. Skips when the record is
+  unchanged; writes a local `.protect-mcp-anchors.jsonl` history; only the
+  root, count, and time range leave the machine.
+- **Pinned identity in the anchor loop.** `claim --anchor`, `anchor-record`,
+  and `verify-claim` now resolve the anchoring key against the public ScopeBlind
+  key directory: an enrolled key shows "anchored as <Org> (key pinned)", a
+  revoked key fails verification, an anonymous key points at enrollment. The
+  free anchor stays anonymous; the named identity is the paid upgrade.
+
+## 0.9.3: the skeptic's tools sharpen
+
+Two verification upgrades: the anchor check moves into the verifier, and the
+record viewer proves signatures instead of just labelling them.
+
+- `verify-claim` now verifies the anchor automatically: it finds the
+  `<claim>.anchor.json` sidecar, checks offline that the anchored envelope binds
+  this exact claim (digest, record root, and the same issuer key), and confirms
+  against the public log that the digest sits at the recorded entry. A failed
+  binding makes the attestation INVALID; an unreachable log does not (the local
+  checks stand alone). `--check-anchor` makes a missing anchor fatal,
+  `--anchor-file <p>` overrides the path, `--offline` skips the network hop.
+- The `record` viewer now verifies Ed25519 signatures in the browser, locally:
+  each row shows `✓ verified`, `✗ invalid signature`, or `signed · unpinned
+  key`, and the stat strip counts how many verified. The CLI injects your
+  gateway's PUBLIC key so rows verify against your own key (the private key
+  never reaches the page).
+- Receipts now embed the signer's public key inside the signed payload
+  (`payload.public_key`), so a receipt is self-contained: any verifier can check
+  it without a side channel, and the key cannot be swapped without breaking the
+  signature. Older receipts still verify against a pinned or pasted key.
+
 ## 0.9.2: anchor a claim to the public log
 
 Closes the one honest gap in a bare claim: that the disclosed set is complete.

package/README.md

@@ -148,6 +148,43 @@ disclosure, not full zero-knowledge, but it makes the privacy claim concrete:
 auditors can verify selected facts without receiving the full tool payload or
 sensitive desk context.
 
+### Prove a claim over the record (position-blind attestations)
+
+You can prove a CLAIM over your record without revealing it. Mint a signed,
+position-blind attestation over the whole record that discloses only per-decision
+categories (a receipt digest, the verdict, capability tags), never your tool
+inputs, outputs, or data:
+
+```bash
+# "No action reached the network across the record":
+npx protect-mcp claim --no net.egress
+
+# other predicates:
+#   --only fs.read,fs.write     all actions were confined to these capabilities
+#   --no-verdict blocked        no action was blocked
+#   --count blocked             how many were blocked
+```
+
+Anyone verifies it offline, seeing only the categories, never the content:
+
+```bash
+npx protect-mcp verify-claim claim-<id>.json
+```
+
+The verifier recomputes a Merkle root over the disclosed set and recomputes the
+predicate independently, so the issuer cannot lie about the claim given the
+disclosure. Add `--anchor` to record the claim's digest in the public,
+append-only ScopeBlind transparency log, so a counterparty who does not trust you
+can confirm the disclosed set is complete and was not quietly re-cut (only the
+hash is sent; the record stays local):
+
+```bash
+npx protect-mcp claim --no net.egress --anchor
+```
+
+This is an accountable, position-blind attestation, not full zero-knowledge: it
+reveals the shape, not the content.
+
 ## Claude Code hook quickstart
 
 ```bash
@@ -335,6 +372,10 @@ To report a vulnerability, see [SECURITY.md](./SECURITY.md).
 | `dashboard` | Start a local-only dashboard on `127.0.0.1` showing tool inventory, risk, policy coverage, exact-action approvals, receipt chains, and audit export. |
 | `recommend` | Draft a reviewable JSON policy from observed local calls. Dry-run by default; use `--write` to create `protect-mcp.recommended.json`. |
 | `registry` | Create an org identity, anchor receipt digests, and write a static verifier page. Hosted mode uploads digests only. |
+| `record` | Open a local, searchable viewer over your receipts (`--live` streams as the agent runs): Ed25519 signatures verified in your browser against your gateway key, capability tags, a provenance tree, and one-click signed export. All local, nothing uploaded. |
+| `claim` | Mint a signed, position-blind attestation of a predicate over the record (`--no <cap>` incl. `--no payment`, `--only <c1,c2>`, `--no-verdict <verdict>`, `--count <verdict>`, `--payment-under <cap>`), disclosing only decision categories. Add `--anchor` to record the claim digest in the public transparency log; enrolled keys anchor as a named org. |
+| `anchor-record` | Checkpoint the record's Merkle root + count + time range into the public log (heartbeat-friendly: skips when unchanged). A later claim whose commitment matches an anchored checkpoint is provably over the complete record as of that checkpoint. |
+| `verify-claim` | Verify a claim pack offline: signature, recomputed Merkle root, independently recomputed predicate, and the anchor sidecar when present (binds the anchored envelope to this exact claim, then confirms the public log holds it). `--check-anchor` requires the anchor; `--offline` skips the log hop. |
 | `killer-demo` | Generate a complete shadow-mode to policy to approval to signed-receipt demo pack. |
 | `verify-disclosure` | Verify a `scopeblind.selective_disclosure.v0` package and explain disclosed versus hidden fields. |
 | `policy-packs` | List, inspect, and install starter Cedar policy packs. |

package/dist/{chunk-CXW2EIRM.mjs → chunk-7MHK5RF4.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-GHR65WVD.mjs";
+} from "./chunk-PB3TC7E3.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";

package/dist/{chunk-744JMCY4.mjs → chunk-H332ZNJ6.mjs}

@@ -1,6 +1,6 @@
 import {
   buildEnrichment
-} from "./chunk-KMNXHGGT.mjs";
+} from "./chunk-WWPQNIVF.mjs";
 import {
   ReceiptBuffer,
   buildActionReadback,
@@ -15,7 +15,7 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";

package/dist/{chunk-GHR65WVD.mjs → chunk-PB3TC7E3.mjs}

@@ -8,7 +8,7 @@ import {
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";

package/dist/{chunk-KMNXHGGT.mjs → chunk-WWPQNIVF.mjs}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-D733KAPG.mjs";
 
 // src/receipt-enrichment.ts
-var ENRICHMENT_VERSION = 1;
+var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();
   const enc = (v) => {
@@ -43,7 +43,11 @@ var RULES = [
   { cap: "secret.adjacent", text: /\.env\b|secret|credential|passwd|password|api[_-]?key|private[_-]?key|\.pem\b|\.key\b|id_rsa|bearer\s|aws_(access|secret)|authorization/ },
   { cap: "destructive", text: /rm\s+-[a-z]*[rf]|\brmdir\b|drop\s+table|truncate\s+table|delete\s+from|reset\s+--hard|--force\b|\bmkfs\b|\bdd\s+if=|shutdown|reboot|kill\s+-9|>\s*\/dev\/sd/ },
   { cap: "financial", text: /\b(order|trade|buy|sell|transfer|wire|payment|withdraw|deposit|swap|invoice|charge|refund|settle)\b/ },
-  { cap: "data.query", text: /\bselect\s+[\s\S]+\bfrom\b|\binsert\s+into\b|\bupdate\s+[\s\S]+\bset\b|\bdelete\s+from\b/ }
+  { cap: "data.query", text: /\bselect\s+[\s\S]+\bfrom\b|\binsert\s+into\b|\bupdate\s+[\s\S]+\bset\b|\bdelete\s+from\b/ },
+  // Agent payments (x402 / value transfer). Deliberately BROAD: a false positive
+  // only makes a `claim --no payment` harder to assert (conservative); a false
+  // negative would let a real payment escape the record's payment claims.
+  { cap: "payment", tool: /(^|[_.-])(pay|payment|x402|checkout)($|[_.-])|wallet.*send|send.*payment/, text: /x402|x-payment|paymentrequirements|maxamountrequired|payto|"pay_to"|eip-3009|transferwithauthorization|payment_intent|send_payment|create_payment/ }
 ];
 function deriveCapabilities(tool, input) {
   const t = String(tool || "").toLowerCase();
@@ -77,6 +81,33 @@ function deriveResource(input) {
   }
   return void 0;
 }
+function findField(input, names, depth = 0) {
+  if (depth > 4 || input === null || typeof input !== "object") return void 0;
+  const o = input;
+  const keys = Object.keys(o).sort();
+  for (const k of keys) {
+    if (names.indexOf(k.toLowerCase()) >= 0 && o[k] !== void 0 && o[k] !== null) return o[k];
+  }
+  for (const k of keys) {
+    const v = findField(o[k], names, depth + 1);
+    if (v !== void 0) return v;
+  }
+  return void 0;
+}
+function derivePayment(tool, input) {
+  if (deriveCapabilities(tool, input).indexOf("payment") < 0) return void 0;
+  const p = { amount: null, asset: null, recipient_digest: null };
+  const amt = findField(input, ["amount"]);
+  if (typeof amt === "number" && Number.isFinite(amt) && amt >= 0) p.amount = amt;
+  else if (typeof amt === "string" && /^\d{1,15}(\.\d{1,18})?$/.test(amt.trim()) && amt.indexOf(".") >= 0) p.amount = parseFloat(amt);
+  const asset = findField(input, ["asset", "currency", "token"]);
+  if (typeof asset === "string" && asset.trim()) p.asset = asset.trim().slice(0, 64);
+  const to = findField(input, ["payto", "pay_to", "recipient", "destination", "to"]);
+  if (typeof to === "string" && to.trim()) p.recipient_digest = sha256Hex(to.trim().toLowerCase());
+  const scheme = findField(input, ["scheme"]);
+  if (typeof scheme === "string" && scheme.trim()) p.scheme = scheme.trim().slice(0, 32);
+  return p;
+}
 function buildEnrichment(tool, input) {
   const e = {
     v: ENRICHMENT_VERSION,
@@ -85,6 +116,8 @@ function buildEnrichment(tool, input) {
   };
   const resource = deriveResource(input);
   if (resource) e.resource = resource;
+  const payment = derivePayment(tool, input);
+  if (payment) e.payment = payment;
   return e;
 }
 

package/dist/{chunk-IDUH2O4Q.mjs → chunk-XLJUZ4WO.mjs}

@@ -177,7 +177,13 @@ function signDecision(entry) {
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
       // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified"
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
     };
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;

package/dist/{claim-TUDH2WPB.mjs → claim-RIXFOQM7.mjs}

@@ -1,6 +1,6 @@
 import {
   canonicalJson
-} from "./chunk-KMNXHGGT.mjs";
+} from "./chunk-WWPQNIVF.mjs";
 import {
   sha256
 } from "./chunk-AYNQIEN7.mjs";
@@ -30,7 +30,13 @@ function receiptToLeaf(e) {
   const ms = typeof tsRaw === "number" ? tsRaw : typeof tsRaw === "string" ? Date.parse(tsRaw) : NaN;
   const t = isFinite(ms) ? new Date(ms).toISOString() : "";
   const d = sha256Hex(canonicalJson(e));
-  return { d, v, c, t };
+  const leaf = { d, v, c, t };
+  const pay = enr && enr.payment;
+  if (pay && typeof pay === "object") {
+    const amt = pay.amount;
+    leaf.p = typeof amt === "number" && Number.isFinite(amt) ? amt : null;
+  }
+  return leaf;
 }
 function leafHash(leaf) {
   return sha256Hex(canonicalJson(leaf));
@@ -63,6 +69,10 @@ function evaluate(pred, leaves) {
     const matched2 = leaves.filter((l) => l.v === pred.verdict).length;
     return { statement: `No action was ${pred.verdict}`, holds: matched2 === 0, matched: matched2 };
   }
+  if (pred.kind === "payment_under") {
+    const matched2 = leaves.filter((l) => "p" in l && (l.p === null || l.p >= pred.cap)).length;
+    return { statement: `Every payment stayed under ${pred.cap} (unknown amounts count as over)`, holds: matched2 === 0, matched: matched2 };
+  }
   const matched = leaves.filter((l) => l.v === pred.verdict).length;
   return { statement: `${matched} action${matched === 1 ? " was" : "s were"} ${pred.verdict}`, holds: true, matched };
 }
@@ -156,11 +166,82 @@ function buildAnchorEnvelope(pack, key, issuedAt) {
   const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
   return { ...signed, signature, digest };
 }
-async function anchorClaim(pack, key, opts) {
-  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
-  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
-  const doFetch = opts.fetchImpl || globalThis.fetch;
-  if (!doFetch) return { ok: false, claim_digest: envelope.claim_digest, error: "fetch_unavailable", envelope };
+function verifyAnchorEnvelope(pack, envelope) {
+  const reasons = [];
+  if (!envelope || envelope.type !== "evidence_pack" || envelope.anchors !== "protect-mcp-claim") {
+    return { ok: false, reasons: ["sidecar does not contain a protect-mcp claim anchor envelope"] };
+  }
+  const expected = claimDigest(pack);
+  if (envelope.claim_digest !== expected) {
+    reasons.push("anchored envelope binds a DIFFERENT claim (claim_digest mismatch)");
+  }
+  if (envelope.record_root !== pack.record.root) {
+    reasons.push("anchored envelope commits to a different record root");
+  }
+  if (pack.issuer && envelope.verification_key !== pack.issuer.publicKey) {
+    reasons.push("anchor was signed by a different key than the claim issuer");
+  }
+  try {
+    const { signature, digest, ...signed } = envelope;
+    const hash = sha256(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+    if (bytesToHex(hash) !== String(digest).toLowerCase()) {
+      reasons.push("envelope digest does not match its contents");
+    } else if (!ed25519.verify(hexToBytes(String(signature)), hash, hexToBytes(envelope.verification_key))) {
+      reasons.push("envelope signature does not verify");
+    }
+  } catch {
+    reasons.push("envelope signature does not verify");
+  }
+  return { ok: reasons.length === 0, reasons };
+}
+async function checkClaimAnchor(pack, sidecar, opts) {
+  const reasons = [];
+  const envelope = sidecar && sidecar.envelope;
+  if (!envelope) {
+    return { local_ok: false, log_ok: null, reasons: ["sidecar has no anchor envelope"] };
+  }
+  const local = verifyAnchorEnvelope(pack, envelope);
+  reasons.push(...local.reasons);
+  const base = (sidecar.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = {
+    local_ok: local.ok,
+    log_ok: null,
+    seq: sidecar.seq,
+    anchored_at: sidecar.anchored_at,
+    entry_url: sidecar.entry_url || (typeof sidecar.seq === "number" ? `${base}/fn/log/${sidecar.seq}` : void 0),
+    reasons
+  };
+  if (opts?.offline) return out;
+  const doFetch = opts?.fetchImpl || globalThis.fetch;
+  if (!doFetch) return out;
+  try {
+    const resp = await doFetch(`${base}/fn/log/digest/sha256:${envelope.digest}`, { headers: { accept: "application/json" } });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data) {
+      out.log_ok = null;
+      return out;
+    }
+    if (data.anchored !== true) {
+      out.log_ok = false;
+      out.reasons.push("the public log does not contain this anchor digest");
+      return out;
+    }
+    if (typeof sidecar.seq === "number" && typeof data.seq === "number" && data.seq !== sidecar.seq) {
+      out.log_ok = false;
+      out.reasons.push(`log holds the digest at entry #${data.seq}, sidecar says #${sidecar.seq}`);
+      return out;
+    }
+    out.log_ok = true;
+    if (typeof data.seq === "number") out.seq = data.seq;
+    return out;
+  } catch {
+    out.log_ok = null;
+    return out;
+  }
+}
+async function submitEnvelope(envelope, base, fetchImpl) {
+  const doFetch = fetchImpl || globalThis.fetch;
+  if (!doFetch) return { ok: false, error: "fetch_unavailable" };
   const encoded = toBase64(new TextEncoder().encode(JSON.stringify(envelope)));
   try {
     const resp = await doFetch(`${base}/fn/log/anchor-pack`, {
@@ -170,32 +251,103 @@ async function anchorClaim(pack, key, opts) {
     });
     const data = await resp.json().catch(() => null);
     if (!resp.ok || !data || !data.ok || typeof data.seq !== "number") {
-      return { ok: false, claim_digest: envelope.claim_digest, error: data && data.error || `http_${resp.status}`, envelope };
+      return { ok: false, error: data && data.error || `http_${resp.status}` };
     }
+    return { ok: true, seq: data.seq, anchored_at: data.anchored_at, already_anchored: !!data.already_anchored };
+  } catch {
+    return { ok: false, error: "network_error" };
+  }
+}
+async function anchorClaim(pack, key, opts) {
+  const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = await submitEnvelope(envelope, base, opts.fetchImpl);
+  if (!out.ok) return { ok: false, claim_digest: envelope.claim_digest, error: out.error, envelope };
+  return {
+    ok: true,
+    claim_digest: envelope.claim_digest,
+    seq: out.seq,
+    entry_url: `${base}/fn/log/${out.seq}`,
+    anchored_at: out.anchored_at,
+    already_anchored: out.already_anchored,
+    envelope
+  };
+}
+var CHECKPOINT_SCHEMA = "scopeblind.protect-mcp.record-checkpoint.v1";
+function buildRecordCheckpoint(receipts, key, issuedAt) {
+  const leaves = receipts.map(receiptToLeaf);
+  const times = leaves.map((l) => l.t).filter(Boolean).sort();
+  const signed = {
+    type: "evidence_pack",
+    schema: CHECKPOINT_SCHEMA,
+    anchors: "protect-mcp-record",
+    record_root: merkleRoot(leaves.map(leafHash)),
+    total: leaves.length,
+    from: times[0] || "",
+    to: times[times.length - 1] || "",
+    issued_at: issuedAt,
+    verification_key: key.publicKey,
+    disclosure: "internal"
+  };
+  const hash = sha256(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+  const digest = bytesToHex(hash);
+  const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
+  return { ...signed, signature, digest };
+}
+async function anchorRecordCheckpoint(receipts, key, opts) {
+  const checkpoint = buildRecordCheckpoint(receipts, key, opts.issuedAt);
+  const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = await submitEnvelope(checkpoint, base, opts.fetchImpl);
+  if (!out.ok) return { ok: false, record_root: checkpoint.record_root, total: checkpoint.total, checkpoint, error: out.error };
+  return {
+    ok: true,
+    record_root: checkpoint.record_root,
+    total: checkpoint.total,
+    seq: out.seq,
+    entry_url: `${base}/fn/log/${out.seq}`,
+    anchored_at: out.anchored_at,
+    already_anchored: out.already_anchored,
+    checkpoint
+  };
+}
+async function lookupPinnedIdentity(publicKey, opts) {
+  const base = (opts && opts.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const doFetch = opts && opts.fetchImpl || globalThis.fetch;
+  if (!doFetch || !/^[0-9a-f]{64}$/i.test(publicKey)) return null;
+  try {
+    const resp = await doFetch(`${base}/fn/log/keys/lookup/${publicKey.toLowerCase()}`, { headers: { accept: "application/json" } });
+    const data = await resp.json().catch(() => null);
+    if (!data || data.ok !== true) return null;
+    if (!data.found) return { found: false };
     return {
-      ok: true,
-      claim_digest: envelope.claim_digest,
-      seq: data.seq,
-      entry_url: `${base}/fn/log/${data.seq}`,
-      anchored_at: data.anchored_at,
-      already_anchored: !!data.already_anchored,
-      envelope
+      found: true,
+      name: data.name,
+      slug: data.slug,
+      kid: data.kid,
+      enrolled_at: data.enrolled_at,
+      revoked: !!(data.revoked || data.revoked_at)
     };
   } catch {
-    return { ok: false, claim_digest: envelope.claim_digest, error: "network_error", envelope };
+    return null;
   }
 }
 export {
   ANCHOR_SCHEMA,
+  CHECKPOINT_SCHEMA,
   CLAIM_TYPE,
   DEFAULT_LOG,
   anchorClaim,
+  anchorRecordCheckpoint,
   buildAnchorEnvelope,
   buildClaim,
+  buildRecordCheckpoint,
+  checkClaimAnchor,
   claimDigest,
   evaluate,
   leafHash,
+  lookupPinnedIdentity,
   merkleRoot,
   receiptToLeaf,
+  verifyAnchorEnvelope,
   verifyClaim
 };