ruflo 3.16.1 → 3.16.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruflo",
-  "version": "3.16.1",
+  "version": "3.16.3",
   "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "bin/ruflo.js",
   "type": "module",

package/src/mcp-bridge/index.js

@@ -1,6 +1,6 @@
 import express from "express";
 import { spawn } from "child_process";
-import { randomUUID } from "crypto";
+import { randomUUID, timingSafeEqual } from "crypto";
 
 // =============================================================================
 // CONFIGURATION
@@ -12,6 +12,7 @@ const CLOUD_FUNCTIONS = {
 };
 
 const PORT = parseInt(process.env.PORT || "3001", 10);
+const BIND_HOST = process.env.MCP_BIND_HOST || "127.0.0.1";
 
 // =============================================================================
 // TOOL GROUPS — Enable/disable categories of tools independently
@@ -771,7 +772,30 @@ async function executeGoapSearch(query, args) {
 // TOOL EXECUTOR
 // =============================================================================
 
+// ADR-166 §6 Phase 1d + 2a — server-side tool gate.
+// Enforced HERE (not just in the autopilot handler) so /mcp, /mcp/:group,
+// autopilot, and any future path share ONE denial gate. Was the missing
+// link that made the disclosed unauthenticated-RCE chain reach shell.
+const DANGEROUS_TOOLS = Object.freeze(new Set([
+  "terminal_execute",
+  "ruflo__terminal_execute",
+  "devtools__terminal_execute",
+]));
+function isTerminalTool(name) {
+  return DANGEROUS_TOOLS.has(name) || /terminal_execute/i.test(name);
+}
+const MCP_ENABLE_TERMINAL = process.env.MCP_ENABLE_TERMINAL === "true";
+
 async function executeTool(name, args) {
+  // Deny dangerous tools unless the operator explicitly opted in.
+  // Enforced on every path (not just autopilot) — root cause of ADR-166 V2/V3.
+  if (isTerminalTool(name) && !MCP_ENABLE_TERMINAL) {
+    return {
+      error:
+        `Tool "${name}" is disabled by default. Set MCP_ENABLE_TERMINAL=true to allow.`,
+      code: "TOOL_DISABLED",
+    };
+  }
   // Validate that search-like tools have a non-empty query to prevent 400 errors
   if (!args || typeof args !== "object") args = {};
   const rawQuery = args.query ?? args.q ?? args.input ?? "";
@@ -858,15 +882,39 @@ const GROUP_DISPLAY_NAMES = {
 const app = express();
 app.use(express.json({ limit: "10mb" }));
 
-// ---------- CORS middleware ----------
+// ---------- CORS middleware (ADR-166 §6 Phase 3b) ----------
+const CORS_ALLOWLIST = (process.env.MCP_CORS_ORIGIN || "*")
+  .split(",").map(s => s.trim()).filter(Boolean);
+const CORS_WILDCARD = CORS_ALLOWLIST.length === 1 && CORS_ALLOWLIST[0] === "*";
 app.use((req, res, next) => {
-  res.setHeader("Access-Control-Allow-Origin", "*");
+  const origin = req.get("origin") || "";
+  if (CORS_WILDCARD) {
+    res.setHeader("Access-Control-Allow-Origin", "*");
+  } else if (origin && CORS_ALLOWLIST.includes(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+  }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
   res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
   if (req.method === "OPTIONS") return res.sendStatus(204);
   next();
 });
 
+// ---------- Auth middleware ----------
+// No-op in local-only mode (MCP_AUTH_TOKEN unset). Enforces 401 when token is set.
+const MCP_TOKEN = process.env.MCP_AUTH_TOKEN || "";
+function requireAuth(req, res, next) {
+  if (req.path === "/health") return next();
+  if (!MCP_TOKEN) return next();
+  const expected = `Bearer ${MCP_TOKEN}`;
+  const got = req.get("authorization") || "";
+  const ok = got.length === expected.length &&
+    timingSafeEqual(Buffer.from(got), Buffer.from(expected));
+  if (!ok) return res.status(401).json({ error: "unauthorized" });
+  next();
+}
+app.use(requireAuth);
+
 // ---------- Shared MCP handler ----------
 function createMcpHandler(groupName) {
   return async (req, res) => {
@@ -1676,10 +1724,30 @@ app.get("/groups", (_, res) => {
 // =============================================================================
 
 async function main() {
-  app.listen(PORT, () => {
-    console.log(`MCP Bridge v2.0.0 on port ${PORT}`);
+  const isPublic = BIND_HOST !== "127.0.0.1" && BIND_HOST !== "localhost";
+  if (isPublic && !process.env.MCP_AUTH_TOKEN) {
+    console.error(
+      "FATAL: refusing to bind a public interface without MCP_AUTH_TOKEN. " +
+      "Generate one with: MCP_AUTH_TOKEN=$(openssl rand -base64 32)"
+    );
+    process.exit(1);
+  }
+  app.listen(PORT, BIND_HOST, () => {
+    console.log(`MCP Bridge v2.0.0 on port ${PORT} (${BIND_HOST})`);
     const enabled = Object.entries(TOOL_GROUPS).filter(([, g]) => g.enabled).map(([n]) => n);
     console.log(`Active groups: ${enabled.join(", ")}`);
+    // ADR-166 §6 — startup posture banner
+    console.log(
+      `[security] bind=${BIND_HOST} auth=${process.env.MCP_AUTH_TOKEN ? "bearer" : "off (local-only)"} ` +
+      `terminal=${MCP_ENABLE_TERMINAL ? "ENABLED (⚠ opt-in)" : "disabled"}`,
+    );
+    if (MCP_ENABLE_TERMINAL) {
+      console.warn(
+        "[security] WARNING: terminal_execute is enabled. This tool grants shell access " +
+        "inside the bridge container to any client the auth layer accepts. Ensure " +
+        "MCP_AUTH_TOKEN is set on any non-loopback bind. See ADR-166 §6 Phase 1d.",
+      );
+    }
   });
 
   const anyBackendNeeded = BACKEND_DEFS.some(isBackendNeeded);

package/src/mcp-bridge/test-runtime-security.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+/**
+ * ADR-166 runtime verification — spawn each bridge with a test env and
+ * assert the load-bearing behaviors observed OVER THE WIRE. Complements
+ * test-security-lock.js (which is static-source only).
+ *
+ * Behaviors verified:
+ *   R1. bridge starts on 127.0.0.1 by default
+ *   R2. with MCP_AUTH_TOKEN set: unauthenticated POST /mcp → 401
+ *   R3. with MCP_AUTH_TOKEN set: authenticated POST /mcp → 200 (or ≠401)
+ *   R4. terminal_execute call → TOOL_DISABLED error unless MCP_ENABLE_TERMINAL=true
+ *   R5. public bind without MCP_AUTH_TOKEN → process exits ≠0 within 3s
+ *
+ *   node test-runtime-security.mjs
+ */
+
+import { spawn } from "node:child_process";
+import { setTimeout as sleep } from "node:timers/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const BRIDGES = [
+  { label: "src/mcp-bridge",          entry: path.join(HERE, "index.js") },
+  { label: "src/ruvocal/mcp-bridge",  entry: path.join(HERE, "..", "ruvocal", "mcp-bridge", "index.js") },
+];
+
+const TOKEN = "test-token-" + Math.random().toString(36).slice(2);
+let passed = 0, failed = 0;
+const failures = [];
+
+function assert(cond, label) {
+  if (cond) { console.log(`    ✓ ${label}`); passed++; }
+  else      { console.log(`    ✗ ${label}`); failures.push(label); failed++; }
+}
+
+async function pickPort() {
+  // Pick a random port in the ephemeral range and hope for the best;
+  // if the bridge fails to bind, the fetch will time out and we fail.
+  return 20000 + Math.floor(Math.random() * 10000);
+}
+
+async function startBridge(entry, env, { waitMs = 1500 } = {}) {
+  const child = spawn("node", [entry], {
+    env: { ...process.env, ...env },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  let stdout = "", stderr = "";
+  child.stdout.on("data", (d) => { stdout += d.toString(); });
+  child.stderr.on("data", (d) => { stderr += d.toString(); });
+  const exitPromise = new Promise((resolve) => {
+    child.on("exit", (code) => resolve({ exited: true, code }));
+  });
+  const ready = Promise.race([
+    exitPromise,
+    sleep(waitMs).then(() => ({ exited: false, code: null })),
+  ]);
+  return { child, stdout: () => stdout, stderr: () => stderr, ready };
+}
+
+async function killAndWait(child) {
+  if (child.exitCode !== null) return;
+  try { child.kill("SIGTERM"); } catch { /* ignore */ }
+  await sleep(100);
+  if (child.exitCode === null) try { child.kill("SIGKILL"); } catch { /* ignore */ }
+}
+
+async function testBridge(label, entry) {
+  console.log(`\n# ${label}`);
+
+  // R1 + R2 + R3 + R4 — bridge starts with token, auth behavior + terminal gate
+  {
+    const port = await pickPort();
+    const b = await startBridge(entry, {
+      PORT: String(port),
+      MCP_BIND_HOST: "127.0.0.1",
+      MCP_AUTH_TOKEN: TOKEN,
+      MCP_ENABLE_TERMINAL: "false",
+      MCP_GROUP_DEVTOOLS: "false",
+      MCP_GROUP_INTELLIGENCE: "false",
+      MCP_GROUP_AGENTS: "false",
+      MCP_GROUP_MEMORY: "false",
+    });
+    const state = await b.ready;
+    if (state.exited) {
+      assert(false, `R1. bridge starts on 127.0.0.1 (exited early, code=${state.code}; stderr=${b.stderr().slice(0, 200)})`);
+    } else {
+      assert(true, "R1. bridge starts on 127.0.0.1 (didn't exit within 1.5s)");
+
+      // R2 — unauthenticated POST /mcp → 401
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
+        });
+        assert(r.status === 401, `R2. unauthenticated POST /mcp → 401 (got ${r.status})`);
+      } catch (e) {
+        assert(false, `R2. unauthenticated POST /mcp threw: ${e.message}`);
+      }
+
+      // R3 — authenticated POST /mcp → not 401
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${TOKEN}`,
+          },
+          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
+        });
+        assert(r.status !== 401, `R3. authenticated POST /mcp → ≠401 (got ${r.status})`);
+      } catch (e) {
+        assert(false, `R3. authenticated POST /mcp threw: ${e.message}`);
+      }
+
+      // R4 — terminal_execute → TOOL_DISABLED (denied at executeTool, not just autopilot)
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${TOKEN}`,
+          },
+          body: JSON.stringify({
+            jsonrpc: "2.0", id: 1, method: "tools/call",
+            params: { name: "terminal_execute", arguments: { command: "id" } },
+          }),
+        });
+        const body = await r.json();
+        // The response wraps the executeTool result in `result.content[0].text` as JSON string.
+        const text = JSON.stringify(body);
+        assert(text.includes("TOOL_DISABLED") || text.includes("disabled by default"),
+          "R4. terminal_execute denied server-side (TOOL_DISABLED)");
+      } catch (e) {
+        assert(false, `R4. terminal_execute threw: ${e.message}`);
+      }
+    }
+    await killAndWait(b.child);
+  }
+
+  // R5 — public bind without token → process exits ≠0 within 3s
+  {
+    const port = await pickPort();
+    const b = await startBridge(entry, {
+      PORT: String(port),
+      MCP_BIND_HOST: "0.0.0.0",
+      MCP_AUTH_TOKEN: "",
+      MCP_GROUP_DEVTOOLS: "false",
+      MCP_GROUP_INTELLIGENCE: "false",
+      MCP_GROUP_AGENTS: "false",
+      MCP_GROUP_MEMORY: "false",
+    }, { waitMs: 3000 });
+    const state = await b.ready;
+    assert(state.exited && state.code !== 0,
+      `R5. public bind without token exits ≠0 (exited=${state.exited}, code=${state.code})`);
+    if (b.stderr().includes("FATAL")) {
+      assert(true, "R5b. FATAL message logged to stderr");
+    } else {
+      assert(false, "R5b. FATAL message expected in stderr");
+    }
+    await killAndWait(b.child);
+  }
+}
+
+(async () => {
+  for (const { label, entry } of BRIDGES) {
+    await testBridge(label, entry);
+  }
+  console.log(`\n${passed} passed, ${failed} failed`);
+  if (failed > 0) {
+    console.log("\nFailures:");
+    for (const f of failures) console.log(`  - ${f}`);
+    process.exit(1);
+  }
+  console.log("ADR-166 runtime verification: OK");
+})();

package/src/mcp-bridge/test-security-lock.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+/**
+ * ADR-166 §6 acceptance #9 — anti-regression lock for the MCP-bridge
+ * security surface. Runs on the source of BOTH bridge files (the ruvocal
+ * variant that ships in docker-compose, and the sibling REST bridge).
+ *
+ * Fails if any of the following load-bearing controls silently disappears:
+ *   1. `MCP_BIND_HOST` default is `127.0.0.1` (loopback default — Phase 1a)
+ *   2. Public bind without `MCP_AUTH_TOKEN` calls `process.exit(1)` at boot (Phase 1b)
+ *   3. `requireAuth` middleware exists and is mounted with `app.use(requireAuth)` (Phase 1c)
+ *   4. `requireAuth` uses `timingSafeEqual` (constant-time compare)
+ *   5. `executeTool` denies terminal_execute unless `MCP_ENABLE_TERMINAL === "true"` (Phase 1d + 2a)
+ *   6. CORS respects `MCP_CORS_ORIGIN` allowlist (Phase 3b)
+ *
+ * Runs offline (no server, no deps). CI-safe.
+ *
+ *   node test-security-lock.js       # → exit 0 on green, exit 1 on regression
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const BRIDGES = [
+  path.join(HERE, "index.js"),                           // ruflo/src/mcp-bridge/index.js
+  path.join(HERE, "..", "ruvocal", "mcp-bridge", "index.js"), // ruvocal variant (deployed)
+];
+
+const CHECKS = [
+  {
+    id: "1. bind-loopback-default",
+    rx: /BIND_HOST\s*=\s*process\.env\.MCP_BIND_HOST\s*\|\|\s*["']127\.0\.0\.1["']/,
+    hint: "MCP_BIND_HOST must default to 127.0.0.1 (ADR-166 §6 Phase 1a)",
+  },
+  {
+    id: "2. fail-closed-public-bind",
+    rx: /isPublic\s*&&\s*!process\.env\.MCP_AUTH_TOKEN[\s\S]*?process\.exit\(\s*1\s*\)/,
+    hint: "public bind without MCP_AUTH_TOKEN must process.exit(1) at boot (Phase 1b)",
+  },
+  {
+    id: "3. auth-middleware-mounted",
+    rx: /app\.use\(\s*requireAuth\s*\)/,
+    hint: "requireAuth middleware must be mounted via app.use() (Phase 1c)",
+  },
+  {
+    id: "4. constant-time-token-compare",
+    rx: /timingSafeEqual\s*\(/,
+    hint: "auth compare must use timingSafeEqual (Phase 1c)",
+  },
+  {
+    id: "5. terminal-gate-server-side",
+    rx: /MCP_ENABLE_TERMINAL[\s\S]*?executeTool[\s\S]*?TOOL_DISABLED|executeTool[\s\S]*?MCP_ENABLE_TERMINAL[\s\S]*?TOOL_DISABLED/,
+    hint: "terminal_execute must be denied at executeTool unless MCP_ENABLE_TERMINAL=true (Phase 1d + 2a)",
+  },
+  {
+    id: "6. cors-allowlist-respected",
+    rx: /MCP_CORS_ORIGIN[\s\S]*?CORS_ALLOWLIST/,
+    hint: "CORS must respect MCP_CORS_ORIGIN allowlist (Phase 3b)",
+  },
+];
+
+let hardFail = false;
+for (const bridge of BRIDGES) {
+  if (!fs.existsSync(bridge)) {
+    console.error(`FAIL: bridge missing: ${bridge}`);
+    hardFail = true;
+    continue;
+  }
+  const src = fs.readFileSync(bridge, "utf-8");
+  const rel = path.relative(path.join(HERE, "..", ".."), bridge);
+  console.log(`\n# ${rel}`);
+  for (const check of CHECKS) {
+    if (check.rx.test(src)) {
+      console.log(`  ✓ ${check.id}`);
+    } else {
+      console.log(`  ✗ ${check.id}`);
+      console.log(`    hint: ${check.hint}`);
+      hardFail = true;
+    }
+  }
+}
+
+if (hardFail) {
+  console.error("\nADR-166 security lock FAILED — a load-bearing control was removed or drifted.");
+  process.exit(1);
+}
+console.log("\nADR-166 security lock: OK");

package/src/ruvocal/mcp-bridge/.claude-flow/data/pending-insights.jsonl

@@ -0,0 +1,3 @@
+{"type":"edit","file":"/Users/cohen/Projects/ruflo/.github/workflows/adr-166-mcp-bridge-security.yml","timestamp":1782913295523}
+{"type":"edit","file":"/Users/cohen/Projects/ruflo/v3/docs/adr/ADR-166-mcp-bridge-unauthenticated-rce-remediation.md","timestamp":1782913317258}
+{"type":"edit","file":"/Users/cohen/Projects/ruflo/v3/docs/adr/ADR-166-mcp-bridge-unauthenticated-rce-remediation.md","timestamp":1782913344234}

package/src/ruvocal/mcp-bridge/.claude-flow/neural/stats.json

@@ -0,0 +1,6 @@
+{
+  "trajectoriesRecorded": 4,
+  "patternsLearned": 4,
+  "signalsProcessed": 0,
+  "lastAdaptation": 1782916325778
+}

package/src/ruvocal/mcp-bridge/index.js

@@ -1,6 +1,6 @@
 import express from "express";
 import { spawn } from "child_process";
-import { randomUUID } from "crypto";
+import { randomUUID, timingSafeEqual } from "crypto";
 
 // =============================================================================
 // CONFIGURATION
@@ -12,6 +12,7 @@ const CLOUD_FUNCTIONS = {
 };
 
 const PORT = parseInt(process.env.PORT || "3001", 10);
+const BIND_HOST = process.env.MCP_BIND_HOST || "127.0.0.1";
 
 // =============================================================================
 // TOOL GROUPS — Enable/disable categories of tools independently
@@ -942,7 +943,30 @@ async function executeGoapSearchGemini(query, args) {
 // TOOL EXECUTOR
 // =============================================================================
 
+// ADR-166 §6 Phase 1d + 2a — server-side tool gate.
+// Enforced HERE (not just in the autopilot handler) so /mcp, /mcp/:group,
+// autopilot, and any future path share ONE denial gate. Was the missing
+// link that made the disclosed unauthenticated-RCE chain reach shell.
+const DANGEROUS_TOOLS = Object.freeze(new Set([
+  "terminal_execute",
+  "ruflo__terminal_execute",
+  "devtools__terminal_execute",
+]));
+function isTerminalTool(name) {
+  return DANGEROUS_TOOLS.has(name) || /terminal_execute/i.test(name);
+}
+const MCP_ENABLE_TERMINAL = process.env.MCP_ENABLE_TERMINAL === "true";
+
 async function executeTool(name, args) {
+  // Deny dangerous tools unless the operator explicitly opted in.
+  // Enforced on every path (not just autopilot) — root cause of ADR-166 V2/V3.
+  if (isTerminalTool(name) && !MCP_ENABLE_TERMINAL) {
+    return {
+      error:
+        `Tool "${name}" is disabled by default. Set MCP_ENABLE_TERMINAL=true to allow.`,
+      code: "TOOL_DISABLED",
+    };
+  }
   switch (name) {
     case "search": {
       if (CLOUD_FUNCTIONS.search) {
@@ -1033,15 +1057,44 @@ const GROUP_DISPLAY_NAMES = {
 const app = express();
 app.use(express.json({ limit: "10mb" }));
 
-// ---------- CORS middleware ----------
+// ---------- CORS middleware (ADR-166 §6 Phase 3b) ----------
+// MCP_CORS_ORIGIN: comma-separated allowlist (e.g. "https://a.example,https://b.example").
+//   unset → "*" for back-compat (loopback default is same-origin anyway)
+//   "*"   → wildcard (explicit opt-in — same as legacy behavior)
+//   other → echo the request origin ONLY if it appears in the allowlist
+const CORS_ALLOWLIST = (process.env.MCP_CORS_ORIGIN || "*")
+  .split(",").map(s => s.trim()).filter(Boolean);
+const CORS_WILDCARD = CORS_ALLOWLIST.length === 1 && CORS_ALLOWLIST[0] === "*";
 app.use((req, res, next) => {
-  res.setHeader("Access-Control-Allow-Origin", "*");
+  const origin = req.get("origin") || "";
+  if (CORS_WILDCARD) {
+    res.setHeader("Access-Control-Allow-Origin", "*");
+  } else if (origin && CORS_ALLOWLIST.includes(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+  }
+  // If no match, do NOT set the header — browser will block the request.
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
   res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
   if (req.method === "OPTIONS") return res.sendStatus(204);
   next();
 });
 
+// ---------- Auth middleware ----------
+// No-op in local-only mode (MCP_AUTH_TOKEN unset). Enforces 401 when token is set.
+const MCP_TOKEN = process.env.MCP_AUTH_TOKEN || "";
+function requireAuth(req, res, next) {
+  if (req.path === "/health") return next();
+  if (!MCP_TOKEN) return next();
+  const expected = `Bearer ${MCP_TOKEN}`;
+  const got = req.get("authorization") || "";
+  const ok = got.length === expected.length &&
+    timingSafeEqual(Buffer.from(got), Buffer.from(expected));
+  if (!ok) return res.status(401).json({ error: "unauthorized" });
+  next();
+}
+app.use(requireAuth);
+
 // ---------- Shared MCP handler ----------
 function createMcpHandler(groupName) {
   return async (req, res) => {
@@ -1886,10 +1939,30 @@ app.get("/groups", (_, res) => {
 // =============================================================================
 
 async function main() {
-  app.listen(PORT, () => {
-    console.log(`MCP Bridge v2.0.0 on port ${PORT}`);
+  const isPublic = BIND_HOST !== "127.0.0.1" && BIND_HOST !== "localhost";
+  if (isPublic && !process.env.MCP_AUTH_TOKEN) {
+    console.error(
+      "FATAL: refusing to bind a public interface without MCP_AUTH_TOKEN. " +
+      "Generate one with: MCP_AUTH_TOKEN=$(openssl rand -base64 32)"
+    );
+    process.exit(1);
+  }
+  app.listen(PORT, BIND_HOST, () => {
+    console.log(`MCP Bridge v2.0.0 on port ${PORT} (${BIND_HOST})`);
     const enabled = Object.entries(TOOL_GROUPS).filter(([, g]) => g.enabled).map(([n]) => n);
     console.log(`Active groups: ${enabled.join(", ")}`);
+    // ADR-166 §6 — startup posture banner (helps operators see the security state at boot)
+    console.log(
+      `[security] bind=${BIND_HOST} auth=${process.env.MCP_AUTH_TOKEN ? "bearer" : "off (local-only)"} ` +
+      `terminal=${MCP_ENABLE_TERMINAL ? "ENABLED (⚠ opt-in)" : "disabled"}`,
+    );
+    if (MCP_ENABLE_TERMINAL) {
+      console.warn(
+        "[security] WARNING: terminal_execute is enabled. This tool grants shell access " +
+        "inside the bridge container to any client the auth layer accepts. Ensure " +
+        "MCP_AUTH_TOKEN is set on any non-loopback bind. See ADR-166 §6 Phase 1d.",
+      );
+    }
   });
 
   const anyBackendNeeded = BACKEND_DEFS.some(isBackendNeeded);