Harden artifact lifecycle and `tool_view` access controls for MCP gateway mode

[dgenio]

Problem

The context firewall is one of contextweaver's strongest features: large raw tool outputs are replaced with compact summaries plus artifact handles. However, in real MCP gateway deployments, especially local IDE agents, those artifact handles may reference sensitive raw data from filesystem, GitHub, cloud, database, or shell-like tools.

If tool_view can freely drill into any stored artifact without lifecycle controls, the firewall reduces prompt size but does not fully address data exposure risk.

Goal

Make artifact storage and tool_view safe enough for local coding-agent use.

Risks to address

• Raw tool outputs may contain secrets, tokens, file paths, customer data, logs, or proprietary code.
• Artifact handles may persist longer than the user expects.
• Very large artifacts may consume memory unexpectedly.
• tool_view may expose sensitive raw output that was deliberately kept out of the prompt.
• Diagnostics or errors may leak artifact labels or raw content.
• Binary/resource artifacts may be hard to inspect safely.

Proposed controls

Add configurable artifact policy such as:

artifacts:
  store: memory
  ttl_seconds: 3600
  max_artifact_bytes: 1048576
  max_total_bytes: 10485760
  allow_tool_view: true
  require_policy_for_view: true
  redact_patterns:
    - name: github_token
      pattern: "gh[pousr]_[A-Za-z0-9_]+"
    - name: generic_bearer
      pattern: "Bearer\\s+[A-Za-z0-9._-]+"

Implementation notes

• Add artifact TTL support or a cleanup hook for in-memory artifacts.
• Add max per-artifact and max total artifact size limits.
• Add optional redaction before storing or before viewing text artifacts.
• Add a policy decision point for tool_view, similar to the proposed tool_execute policy gate.
• Ensure tool_view selectors are bounded: max bytes/lines returned per call.
• Avoid logging raw artifact contents.
• Include provenance: which tool created the artifact, when, size, media type, and whether redaction was applied.
• Consider making raw tool_view disabled by default in safe mode.

Acceptance criteria

• Artifact storage has configurable size limits.
• tool_view responses are bounded by default.
• Optional redaction can be applied to viewed or stored text artifacts.
• A policy hook can deny access to a handle before raw content is returned.
• Tests cover TTL/expiry, size limits, bounded selectors, redaction, and denied view access.
• Docs explain that the firewall saves prompt tokens but raw artifacts still need lifecycle/security controls.
• VS Code/Copilot and Claude recipes show safe artifact defaults.