Audit: log denied/blocked write operations
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 102
- Forks
- 82
- Avg merge
- 21h 1m
- Merged PRs (30d)
- 66
Description
Context
From PR #115 review. When confirmViaElicitation returns !elicit.proceed (user declined or client doesn't support elicitation), the tool handler returns early before registry.dispatch(), so denied writes are never audited.
Files
src/tools/harness-create.ts(line 62-63)src/tools/harness-update.tssrc/tools/harness-execute.tssrc/tools/harness-delete.ts
Proposed fix
Emit an audit event with status: "denied" and the confirmation: "blocked" | "declined" method before returning the error result. This gives operators visibility into rejected operations.
Priority
Medium — improves audit completeness but no security risk (the operation never executed).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the early return around lines 62-63 in src/tools/harness-create.ts, then compare the corresponding handlers in src/tools/harness-update.ts, src/tools/harness-execute.ts, and src/tools/harness-delete.ts. Trace confirmViaElicitation and the existing audit events. Done means declined or unsupported confirmations emit status "denied" with confirmation "blocked" or "declined" before returning the error result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100