@adtl/gateway 0.7.0 → 0.8.1

package/dist/hooks/agentLinks.js

@@ -0,0 +1,48 @@
+/**
+ * Which session a Claude Code sub-agent belongs to.
+ *
+ * Claude Code's SubagentStart hook reports the parent's `session_id` with the
+ * new sub-agent's `agent_id`. Recording that link lets the sub-agent's later
+ * hook calls use the parent's label even if they ever report a session id of
+ * their own: the sub-agent starts from what its parent has seen, and what it
+ * reads taints the parent. Links live beside the session files, which the
+ * hooks already protect from the agent.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+export class FileAgentLinks {
+    dir;
+    constructor(sessionsDir) {
+        this.dir = join(sessionsDir, "agents");
+    }
+    pathOf(agentId) {
+        const name = SAFE_ID.test(agentId) ? agentId : `h-${createHash("sha256").update(agentId).digest("hex")}`;
+        return join(this.dir, `${name}.parent`);
+    }
+    parentOf(agentId) {
+        try {
+            return readFileSync(this.pathOf(agentId), "utf8").trim() || undefined;
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return undefined;
+            throw err;
+        }
+    }
+    link(agentId, sessionId) {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        writeFileSync(this.pathOf(agentId), sessionId, { encoding: "utf8", mode: 0o600 });
+    }
+}
+export class InMemoryAgentLinks {
+    links = new Map();
+    parentOf(agentId) {
+        return this.links.get(agentId);
+    }
+    link(agentId, sessionId) {
+        this.links.set(agentId, sessionId);
+    }
+}
+//# sourceMappingURL=agentLinks.js.map

package/dist/hooks/agentLinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentLinks.js","sourceRoot":"","sources":["../../src/hooks/agentLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,MAAM,OAAO,GAAG,wBAAwB,CAAC;AAEzC,MAAM,OAAO,cAAc;IACR,GAAG,CAAS;IAE7B,YAAY,WAAmB;QAC7B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,MAAM,CAAC,OAAe;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,QAAQ,CAAC,OAAe;QACtB,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,SAAiB;QACrC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IACZ,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,QAAQ,CAAC,OAAe;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,OAAe,EAAE,SAAiB;QACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/hooks/claudeCode.d.ts

@@ -1,6 +1,7 @@
 import { type AdtlConfig, type SessionStore } from "@adtl/labels";
 import { type Ledger } from "@adtl/ledger";
 import type { AuditSink } from "../audit.js";
+import type { AgentLinks } from "./agentLinks.js";
 export interface HookInput {
     session_id?: string;
     hook_event_name?: string;
@@ -24,6 +25,8 @@ export interface HookOptions {
     audit?: AuditSink;
     /** Label ledger shared with the gateway. */
     ledger?: Ledger;
+    /** Sub-agent → parent session links, from SubagentStart. */
+    agents?: AgentLinks;
     /** Files the agent must not change: the ADTL config, the session directory and the ledger. */
     protect?: {
         configPath?: string;
@@ -31,6 +34,7 @@ export interface HookOptions {
         ledgerPath?: string;
         auditPath?: string;
         signingKeyPath?: string;
+        totpPath?: string;
     };
 }
 /** What the hook process prints and exits with. */

package/dist/hooks/claudeCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claudeCode.d.ts","sourceRoot":"","sources":["../../src/hooks/claudeCode.ts"],"names":[],"mappings":"AA2BA,OAAO,EAKL,KAAK,UAAU,EAGf,KAAK,YAAY,EAElB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,aAAa,CAAC;AAGzD,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3H;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAanE;AAED,uGAAuG;AACvG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKhH;AA4DD,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAUpD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,WAAW,CA0E3E;AAED,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAG3E"}
+{"version":3,"file":"claudeCode.d.ts","sourceRoot":"","sources":["../../src/hooks/claudeCode.ts"],"names":[],"mappings":"AA6BA,OAAO,EAKL,KAAK,UAAU,EAIf,KAAK,YAAY,EAElB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGlD,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9I;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAanE;AAED,uGAAuG;AACvG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKhH;AAkED,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAUpD;AAaD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,WAAW,CAiF3E;AAED,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAG3E"}

package/dist/hooks/claudeCode.js

@@ -8,6 +8,8 @@
  *                       allow → no answer, so Claude Code's own permissions apply
  *   PostToolUse         labels the tool's output and adds it to the session label
  *   PostToolUseFailure  same: a failed tool's error output still reaches the model
+ *   SubagentStart       links the new sub-agent to its parent's session, so its
+ *                       calls start from the parent's label and taint it
  *
  * Built-in tools are labeled as the server `claude-code` (see preset.ts); MCP
  * tools `mcp__<server>__<tool>` as `<server>`. Tools of the gateway's own MCP
@@ -24,9 +26,10 @@
  *
  * Errors fail closed: a PreToolUse hook that can't decide denies the call.
  */
-import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { callHash, evaluatePolicy, labelResult, toolEgress, join, } from "@adtl/labels";
 import { chunkHashes, valueHashes } from "@adtl/ledger";
+import { TOTP_KEYCHAIN_SERVICE } from "../totp.js";
 import { CLAUDE_CODE_PRESET, CLAUDE_CODE_SERVER } from "./preset.js";
 const NOTHING = { exitCode: 0 };
 /** `config` with labels for Claude Code's built-in tools; rules under `servers.claude-code` win. */
@@ -89,6 +92,9 @@ function protectedTarget(input, route, protect) {
         if (protect.signingKeyPath && abs === resolve(protect.signingKeyPath)) {
             return { decision: "block", reason: "The agent may not touch the ADTL signing key" };
         }
+        if (protect.totpPath && abs.startsWith(dirname(resolve(protect.totpPath)) + sep + "totp-")) {
+            return { decision: "block", reason: "The agent may not touch the ADTL TOTP secret" };
+        }
     }
     const command = typeof args.command === "string" ? args.command : undefined;
     if (command !== undefined && ["Bash", "Monitor"].includes(route.tool)) {
@@ -106,6 +112,9 @@ function protectedTarget(input, route, protect) {
         if (protect.signingKeyPath && command.includes(basename(protect.signingKeyPath))) {
             return { decision: "ask", reason: "This command touches the ADTL signing key" };
         }
+        if ([TOTP_KEYCHAIN_SERVICE, "totp-secret", "totp-last-step", protect.totpPath].some((m) => m && command.includes(m))) {
+            return { decision: "ask", reason: "This command touches the ADTL TOTP secret" };
+        }
     }
     return undefined;
 }
@@ -122,20 +131,38 @@ export function addedLines(output) {
     }
     return out;
 }
+/**
+ * The session whose label a hook call reads and adds to: a linked sub-agent's
+ * parent session, else the call's own. When the two differ, the sub-agent's own
+ * label is read too, so nothing it saw is lost.
+ */
+function sessionFor(input, opts) {
+    const parent = typeof input.agent_id === "string" ? opts.agents?.parentOf(input.agent_id) : undefined;
+    if (!parent || parent === input.session_id)
+        return { id: input.session_id, get: () => opts.sessions.get(input.session_id) };
+    return { id: parent, get: () => join(opts.sessions.get(parent), opts.sessions.get(input.session_id)) };
+}
 export function handleHook(input, opts) {
     const event = input.hook_event_name;
+    if (event === "SubagentStart") {
+        if (typeof input.agent_id === "string" && typeof input.session_id === "string" && input.session_id !== "") {
+            opts.agents?.link(input.agent_id, input.session_id);
+        }
+        return NOTHING;
+    }
     if (event !== "PreToolUse" && event !== "PostToolUse" && event !== "PostToolUseFailure")
         return NOTHING;
     if (typeof input.tool_name !== "string" || typeof input.session_id !== "string" || input.session_id === "") {
         return failure(event, "hook input has no tool_name or session_id");
     }
+    const session = sessionFor(input, opts);
     const route = routeTool(input.tool_name, opts.gatewayServer);
     if (!route)
         return NOTHING;
     const config = withClaudeCodePreset(opts.config);
     const ts = new Date().toISOString();
     const agent = typeof input.agent_id === "string" ? { agent: { id: input.agent_id, ...(typeof input.agent_type === "string" ? { type: input.agent_type } : {}) } } : {};
-    const base = { ts, sessionId: input.session_id, event: "tools/call", ...route, via: "claude-code-hook", ...agent };
+    const base = { ts, sessionId: session.id, event: "tools/call", ...route, via: "claude-code-hook", ...agent };
     if (event !== "PreToolUse") {
         const output = input.tool_response ?? input.error ?? null;
         let label = labelResult({ ...route, result: output }, config);
@@ -147,19 +174,19 @@ export function handleHook(input, opts) {
                 ledger = { chunks: match.chunks, writers: match.writers };
             }
             // What the tool was given came from the session as it was before this output.
-            const before = opts.sessions.get(input.session_id);
+            const before = session.get();
             const written = [...valueHashes(input.tool_input ?? {}), ...addedLines(output).flatMap(chunkHashes)];
-            opts.ledger.record(written, before, input.session_id, route);
+            opts.ledger.record(written, before, session.id, route);
         }
-        const sessionLabel = opts.sessions.observe(input.session_id, label);
+        const sessionLabel = join(session.get(), opts.sessions.observe(session.id, label));
         opts.audit?.write({ ...base, outcome: "forwarded", label, ...(ledger ? { ledger } : {}), sessionLabel, durationMs: 0 });
         return NOTHING;
     }
     const hash = callHash(route.server, route.tool, input.tool_input ?? {});
-    const session = opts.sessions.get(input.session_id);
+    const current = session.get();
     const guard = protectedTarget(input, route, opts.protect);
     const policy = evaluatePolicy(config.policy, {
-        session,
+        session: current,
         ...route,
         egress: toolEgress(config, route.server, route.tool),
     });
@@ -177,7 +204,7 @@ export function handleHook(input, opts) {
         reason: d.reason,
         matched: d.matched,
         callHash: hash,
-        sessionLabel: session,
+        sessionLabel: current,
         durationMs: 0,
     };
     opts.audit?.write(entry);

package/dist/hooks/claudeCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"claudeCode.js","sourceRoot":"","sources":["../../src/hooks/claudeCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EACL,QAAQ,EACR,cAAc,EACd,WAAW,EACX,UAAU,EAKV,IAAI,GACL,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAqCrE,MAAM,OAAO,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAE7C,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,OAAO;YACjB,CAAC,kBAAkB,CAAC,EAAE;gBACpB,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,IAAI,KAAK;gBACpD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,KAAK,EAAE,EAAE,GAAG,kBAAkB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE;aAChD;SACF;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,aAAa,GAAG,MAAM;IAChE,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAgB,EAAE,KAAuC,EAAE,OAA+B;IACjH,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;QACD,yDAAyD;QACzD,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QACnF,CAAC;QACD,2CAA2C;QAC3C,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7I,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,IAAiB;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC;IACpC,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,oBAAoB;QAAE,OAAO,OAAO,CAAC;IACxG,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3G,OAAO,OAAO,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3J,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,YAAqB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,kBAA2B,EAAE,GAAG,KAAK,EAAE,CAAC;IAErI,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,GAAG,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,MAAyD,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC5D,CAAC;YACD,8EAA8E;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAmB,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3D,OAAO;QACP,GAAG,KAAK;QACR,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;KACrD,CAAC,CAAC;IACH,MAAM,CAAC,GACL,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAClE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE;QACvF,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IACpC,MAAM,KAAK,GAAe;QACxB,GAAG,IAAI;QACP,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACzE,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,CAAC;KACd,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK;QAAE,OAAO,OAAO,CAAC;IAE1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE;YACN,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBACzD,wBAAwB,EACtB,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,2CAA2C,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,MAAM,GAAG;aAC/H;SACF;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,OAAO,CAAC,KAAyB,EAAE,GAAW;IAC5D,MAAM,OAAO,GAAG,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,OAAO,EAAE,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"claudeCode.js","sourceRoot":"","sources":["../../src/hooks/claudeCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EACL,QAAQ,EACR,cAAc,EACd,WAAW,EACX,UAAU,EAMV,IAAI,GACL,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuCrE,MAAM,OAAO,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAE7C,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,OAAO;YACjB,CAAC,kBAAkB,CAAC,EAAE;gBACpB,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,IAAI,KAAK;gBACpD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,KAAK,EAAE,EAAE,GAAG,kBAAkB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE;aAChD;SACF;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,aAAa,GAAG,MAAM;IAChE,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAgB,EAAE,KAAuC,EAAE,OAA+B;IACjH,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;QACD,yDAAyD;QACzD,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QACnF,CAAC;QACD,2CAA2C;QAC3C,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7I,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAyC,EAAE,IAAiB;IAC9E,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5H,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,IAAiB;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC;IACpC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YAC1G,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,oBAAoB;QAAE,OAAO,OAAO,CAAC;IACxG,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3G,OAAO,OAAO,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAA2C,EAAE,IAAI,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3J,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,YAAqB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,kBAA2B,EAAE,GAAG,KAAK,EAAE,CAAC;IAE/H,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,GAAG,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,MAAyD,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC5D,CAAC;YACD,8EAA8E;YAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAmB,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3D,OAAO,EAAE,OAAO;QAChB,GAAG,KAAK;QACR,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;KACrD,CAAC,CAAC;IACH,MAAM,CAAC,GACL,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAClE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE;QACvF,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IACpC,MAAM,KAAK,GAAe;QACxB,GAAG,IAAI;QACP,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACzE,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,CAAC;KACd,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK;QAAE,OAAO,OAAO,CAAC;IAE1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE;YACN,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBACzD,wBAAwB,EACtB,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,2CAA2C,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,MAAM,GAAG;aAC/H;SACF;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,OAAO,CAAC,KAAyB,EAAE,GAAW;IAC5D,MAAM,OAAO,GAAG,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,OAAO,EAAE,EAAE,CAAC;AACvE,CAAC"}

package/dist/hooks/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./claudeCode.js";
 export * from "./preset.js";
 export * from "./run.js";
+export * from "./agentLinks.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/hooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC"}

package/dist/hooks/index.js

@@ -1,4 +1,5 @@
 export * from "./claudeCode.js";
 export * from "./preset.js";
 export * from "./run.js";
+export * from "./agentLinks.js";
 //# sourceMappingURL=index.js.map

package/dist/hooks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC"}

package/dist/hooks/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/hooks/run.ts"],"names":[],"mappings":"AAeA,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAiCxE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/hooks/run.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAkCxE"}

package/dist/hooks/run.js

@@ -1,6 +1,6 @@
 /**
  * `adtl-gateway hook --config adtl.yaml`: the command Claude Code runs for
- * PreToolUse, PostToolUse and PostToolUseFailure. Reads the hook event from
+ * PreToolUse, PostToolUse, PostToolUseFailure and SubagentStart. Reads the hook event from
  * stdin and answers on stdout (JSON) or stderr (with exit code 2).
  *
  * The config needs no `gateway:` section; if there is one, its `audit` log and
@@ -13,6 +13,8 @@ import { Ledger, defaultLedgerPath } from "@adtl/ledger";
 import { parseConfigText } from "@adtl/interceptors";
 import { parse as parseYaml } from "yaml";
 import { JsonlAuditLog } from "../audit.js";
+import { totpSecretPath } from "../totp.js";
+import { FileAgentLinks } from "./agentLinks.js";
 import { failure, handleHook } from "./claudeCode.js";
 export async function runHook(opts) {
     let input;
@@ -39,11 +41,12 @@ export async function runHook(opts) {
         return handleHook(input, {
             config,
             sessions: new FileSessionStore(sessionsDir),
+            agents: new FileAgentLinks(sessionsDir),
             ...(ledger ? { ledger } : {}),
             ...(opts.gatewayServer ? { gatewayServer: opts.gatewayServer } : {}),
             mode: gw.mode === "audit" ? "audit" : "active",
             ...(auditPath ? { audit: new JsonlAuditLog(auditPath) } : {}),
-            protect: { configPath: path, sessionsDir, ledgerPath, ...(auditPath ? { auditPath } : {}), signingKeyPath: defaultSigningKeyPath(env) },
+            protect: { configPath: path, sessionsDir, ledgerPath, ...(auditPath ? { auditPath } : {}), signingKeyPath: defaultSigningKeyPath(env), totpPath: totpSecretPath(env) },
         });
     }
     catch (err) {

package/dist/hooks/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/hooks/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtG,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAoC,MAAM,iBAAiB,CAAC;AASxF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAc,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,OAAO,OAAO,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAuD,CAAC,OAAO,IAAI,EAAE,CAAC;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO;YAClC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACvG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,OAAO,UAAU,CAAC,KAAK,EAAE;YACvB,MAAM;YACN,QAAQ,EAAE,IAAI,gBAAgB,CAAC,WAAW,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YAC9C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE;SACxI,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,KAAK,CAAC,eAAe,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/hooks/run.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtG,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAoC,MAAM,iBAAiB,CAAC;AASxF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAc,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,OAAO,OAAO,CAAC,YAAY,EAAE,iCAAiC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAuD,CAAC,OAAO,IAAI,EAAE,CAAC;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACpC,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO;YAClC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACvG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,OAAO,UAAU,CAAC,KAAK,EAAE;YACvB,MAAM;YACN,QAAQ,EAAE,IAAI,gBAAgB,CAAC,WAAW,CAAC;YAC3C,MAAM,EAAE,IAAI,cAAc,CAAC,WAAW,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YAC9C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE;SACvK,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,KAAK,CAAC,eAAe,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -13,6 +13,9 @@ export * from "./ledgerCli.js";
 export * from "./auditCli.js";
 export * from "./roles.js";
 export * from "./cedar.js";
+export * from "./openfga.js";
+export * from "./totp.js";
+export * from "./totpCli.js";
 export * from "./elicitation.js";
 export * from "./receipt.js";
 export * from "./receiptCli.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -13,6 +13,9 @@ export * from "./ledgerCli.js";
 export * from "./auditCli.js";
 export * from "./roles.js";
 export * from "./cedar.js";
+export * from "./openfga.js";
+export * from "./totp.js";
+export * from "./totpCli.js";
 export * from "./elicitation.js";
 export * from "./receipt.js";
 export * from "./receiptCli.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/init/suggest.d.ts

@@ -4,13 +4,15 @@
  * Without a preset, rules come from the MCP tool annotations. Those are the
  * server's own claims, so they only decide egress; integrity is always
  * untrusted and confidentiality private until the owner says otherwise.
+ * The draft action-metadata extension's `inputMetadata.destination`, when a
+ * tool declares one, decides egress ahead of the legacy hints.
  * Missing hints take the MCP spec defaults (readOnlyHint false, openWorldHint true).
  *
  * Merging never changes an entry that is already in the file: the owner's
  * choices win, and `init` can be re-run to pick up new tools.
  */
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
-import type { ToolRule } from "@adtl/labels";
+import { type ToolRule } from "@adtl/labels";
 import { type Document } from "yaml";
 import { type Preset } from "./presets.js";
 export interface ServerScan {

package/dist/init/suggest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../src/init/suggest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAmB,KAAK,QAAQ,EAAgB,MAAM,MAAM,CAAC;AACpE,OAAO,EAAyB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,UAAU;IACzB,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAID,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAM5F;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,WAAU,GAAG,gBAAgB,CAU7E;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,kFAAkF;IAClF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;CACxB;AAYD,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,WAAW,EAAE,CA2C/F"}
+{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../src/init/suggest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAyC,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAmB,KAAK,QAAQ,EAAgB,MAAM,MAAM,CAAC;AACpE,OAAO,EAAyB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,UAAU;IACzB,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAID,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAa5F;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,WAAU,GAAG,gBAAgB,CAU7E;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,kFAAkF;IAClF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;CACxB;AAYD,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,WAAW,EAAE,CA2C/F"}

package/dist/init/suggest.js

@@ -1,8 +1,16 @@
+import { destinationEgress, readActionMetadata } from "@adtl/labels";
 import { isMap, isScalar } from "yaml";
 import { choosePreset, PRESETS } from "./presets.js";
 const UNKNOWN_DEFAULTS = { integrity: "untrusted", confidentiality: "private" };
 /** A rule from the tool's MCP annotations alone. */
 export function ruleFromHints(annotations) {
+    const meta = readActionMetadata(annotations);
+    const declared = destinationEgress(meta.destination);
+    if (declared) {
+        const extra = [meta.outcome, meta.requiresReview ? "requires review" : undefined].filter(Boolean).join(", ");
+        const why = `action-metadata: destination ${meta.destination}${extra ? `, ${extra}` : ""} (review)`;
+        return { rule: { integrity: "untrusted", confidentiality: "private", egress: declared }, why };
+    }
     const readOnly = annotations?.readOnlyHint === true;
     const openWorld = annotations?.openWorldHint !== false;
     const egress = readOnly ? (openWorld ? "external" : "none") : openWorld ? "public" : "internal";

package/dist/init/suggest.js.map

@@ -1 +1 @@
-{"version":3,"file":"suggest.js","sourceRoot":"","sources":["../../src/init/suggest.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAA+B,MAAM,MAAM,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AAwBlE,MAAM,gBAAgB,GAAa,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAE1F,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,WAAgC;IAC5D,MAAM,QAAQ,GAAG,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,EAAE,aAAa,KAAK,KAAK,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;IAChG,MAAM,GAAG,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC;IACjH,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAgB,EAAE,OAAO,GAAG,OAAO;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAkB,EAAE;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACnH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;AAC/G,CAAC;AAaD,SAAS,KAAK,CAAC,GAAa,EAAE,MAAe,EAAE,GAAW,EAAE,aAAsB;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAY,CAAC;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC;QAAE,CAAC,CAAC,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,WAA+B;IAC9E,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAY,CAAC;QACxC,qDAAqD;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,IAAI,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;;YACnE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAU,CAAC;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,OAAkB,CAAC;IAEtC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC/F,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,wCAAwC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE9H,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,OAAO,GAAG,iDAAiD,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;QACnB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"suggest.js","sourceRoot":"","sources":["../../src/init/suggest.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAiB,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAA+B,MAAM,MAAM,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AAwBlE,MAAM,gBAAgB,GAAa,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAE1F,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,WAAgC;IAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7G,MAAM,GAAG,GAAG,gCAAgC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QACpG,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,EAAE,aAAa,KAAK,KAAK,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;IAChG,MAAM,GAAG,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,WAAW,CAAC;IACjH,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAgB,EAAE,OAAO,GAAG,OAAO;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAkB,EAAE;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACnH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;AAC/G,CAAC;AAaD,SAAS,KAAK,CAAC,GAAa,EAAE,MAAe,EAAE,GAAW,EAAE,aAAsB;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAY,CAAC;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC;QAAE,CAAC,CAAC,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,WAA+B;IAC9E,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAY,CAAC;QACxC,qDAAqD;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,IAAI,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;;YACnE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAU,CAAC;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,OAAkB,CAAC;IAEtC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC/F,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,wCAAwC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE9H,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,OAAO,GAAG,iDAAiD,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;QACnB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/invoker.d.ts

@@ -11,16 +11,37 @@
  * their mutations are not applied. An interceptor that fails (error or
  * timeout) blocks the message unless it declares `failOpen: true`.
  *
- * The invoker may override every interceptor's `mode`, as SEP-2624 allows
- * (e.g. audit in staging, active in production).
+ * The invoker may override execution policy, as SEP-2624 allows: every
+ * interceptor's `mode` at once (e.g. audit in staging, active in production),
+ * and per interceptor its `failOpen`, `priorityHint`, `mode`, `timeoutMs` and
+ * `hooks` (narrowed only, never widened). A global mode wins over a
+ * per-interceptor one, so `--audit` always stops nothing.
  */
 import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { type ConfirmationRequest, type InterceptorDefinition, type InterceptorResult, type InvocationContext, type Phase } from "@adtl/interceptors";
+import { type ConfirmationRequest, type InterceptorDefinition, type InterceptorHook, type InterceptorResult, type InvocationContext, type Phase } from "@adtl/interceptors";
 import type { Decision } from "@adtl/labels";
 export type InterceptorMode = NonNullable<InterceptorDefinition["mode"]>;
+/** Invoker-side execution policy for one interceptor (SEP-2624 "Invoker Overrides"). */
+export interface InterceptorOverrides {
+    failOpen?: boolean;
+    /** Ignored for validators. */
+    priorityHint?: InterceptorDefinition["priorityHint"];
+    mode?: InterceptorMode;
+    timeoutMs?: number;
+    /** Must be a subset of the interceptor's declared hooks. */
+    hooks?: InterceptorHook[];
+}
 export interface BoundInterceptor {
     client: Client;
     definition: InterceptorDefinition;
+    /** Id of the interceptor server that advertised it, for messages. */
+    server?: string;
+    /**
+     * Whether the gateway's per-call `config` (ADTL's server, tool and
+     * annotations) is sent. Other servers' interceptors get none, so their
+     * own defaults apply. Default: true.
+     */
+    sendConfig?: boolean;
 }
 export interface Blocked {
     interceptor: string;
@@ -42,6 +63,7 @@ export interface InterceptorRun {
     modeFrom: "override" | "default";
     failOpen: boolean;
     failOpenFrom: "override" | "default";
+    timeoutMs: number;
     /** Set when the invocation errored or timed out. */
     failed?: true;
 }
@@ -60,21 +82,49 @@ export interface InvokeOptions {
     config: Record<string, unknown>;
     context: InvocationContext;
 }
+/** SEP-2624 `resolvePriority`: the override's hint, else the interceptor's. */
+export declare function resolvePriority(def: InterceptorDefinition, overrides: InterceptorOverrides | undefined, phase: Phase): number;
+/**
+ * Problems with `overrides` for these interceptors: an unknown name, or hooks
+ * that widen what the interceptor declares (which SEP-2624 says to reject).
+ */
+export declare function checkOverrides(defs: InterceptorDefinition[], overrides: Record<string, InterceptorOverrides>): string[];
+/** Interceptors of a type this invoker doesn't run (e.g. the proposed `sink`). They are never invoked. */
+export declare function unsupportedInterceptors(bound: BoundInterceptor[]): string[];
+/** Interceptor names offered by more than one server: each must be invoked on its own server, so names must be unique. */
+export declare function duplicateInterceptors(bound: BoundInterceptor[]): string[];
+/**
+ * Mutators that would run after `name` on a phase both hook, so they see (and
+ * could change or drop) what it wrote. Used to warn when another server's
+ * mutator runs after adtl.label.
+ */
+export declare function mutatorsAfter(bound: BoundInterceptor[], name: string, overrides?: Record<string, InterceptorOverrides>): string[];
 export declare class InterceptorInvoker {
     private readonly interceptors;
     private readonly timeoutMs;
     /** Overrides the mode every interceptor declares. */
     readonly modeOverride?: InterceptorMode | undefined;
+    /** Per-interceptor overrides, by name. Check them with `checkOverrides` first. */
+    private readonly overrides;
     constructor(interceptors: BoundInterceptor[], timeoutMs?: number, 
     /** Overrides the mode every interceptor declares. */
-    modeOverride?: InterceptorMode | undefined);
+    modeOverride?: InterceptorMode | undefined, 
+    /** Per-interceptor overrides, by name. Check them with `checkOverrides` first. */
+    overrides?: Record<string, InterceptorOverrides>);
     /** Discover the interceptors an interceptor server offers. */
-    static discover(client: Client): Promise<BoundInterceptor[]>;
+    static discover(client: Client, opts?: {
+        server?: string;
+        sendConfig?: boolean;
+    }): Promise<BoundInterceptor[]>;
     get definitions(): InterceptorDefinition[];
     runRequest(opts: InvokeOptions): Promise<PhaseOutcome>;
     runResponse(opts: InvokeOptions): Promise<PhaseOutcome>;
+    private override;
+    private mode;
     private isAudit;
-    /** Record that `i` runs in `phase`, with its resolved policy. The gateway has no failOpen overrides. */
+    private failOpen;
+    private timeout;
+    /** Record that `i` runs in `phase`, with its resolved policy. */
     private run;
     private select;
     private invoke;

package/dist/invoker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoker.d.ts","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAEtB,KAAK,KAAK,EAEX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAa7C,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,qBAAqB,CAAC;CACnC;AAED,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,UAAU,GAAG,SAAS,CAAC;IACrC,oDAAoD;IACpD,MAAM,CAAC,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+CAA+C;IAC/C,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAaD,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe;gBAHtB,YAAY,EAAE,gBAAgB,EAAE,EAChC,SAAS,SAAO;IACjC,qDAAqD;IAC5C,YAAY,CAAC,EAAE,eAAe,YAAA;IAGzC,8DAA8D;WACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAMlE,IAAI,WAAW,IAAI,qBAAqB,EAAE,CAEzC;IAEK,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAOtD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAO7D,OAAO,CAAC,OAAO;IAIf,wGAAwG;IACxG,OAAO,CAAC,GAAG;IAaX,OAAO,CAAC,MAAM;YAIA,MAAM;IAUpB,2EAA2E;IAC3E,OAAO,CAAC,MAAM;IAUd,6EAA6E;YAC/D,MAAM;IAsBpB,0DAA0D;YAC5C,QAAQ;CA4BvB"}
+{"version":3,"file":"invoker.d.ts","sourceRoot":"","sources":["../src/invoker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAEtB,KAAK,KAAK,EAEX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AA0B7C,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzE,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,qBAAqB,CAAC;IAClC,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,UAAU,GAAG,SAAS,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+CAA+C;IAC/C,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,GAAG,EAAE,qBAAqB,EAAE,SAAS,EAAE,oBAAoB,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,CAK7H;AAMD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAgBvH;AAED,0GAA0G;AAC1G,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,MAAM,EAAE,CAI3E;AAED,0HAA0H;AAC1H,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,MAAM,EAAE,CAIzE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAM,GAAG,MAAM,EAAE,CAkBrI;AAED,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe;IACvC,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS;gBALT,YAAY,EAAE,gBAAgB,EAAE,EAChC,SAAS,SAAO;IACjC,qDAAqD;IAC5C,YAAY,CAAC,EAAE,eAAe,YAAA;IACvC,kFAAkF;IACjE,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAM;IAGvE,8DAA8D;WACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAMxH,IAAI,WAAW,IAAI,qBAAqB,EAAE,CAEzC;IAEK,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAOtD,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAO7D,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,OAAO;IAIf,iEAAiE;IACjE,OAAO,CAAC,GAAG;IAeX,OAAO,CAAC,MAAM;YAMA,MAAM;IAmBpB,2EAA2E;IAC3E,OAAO,CAAC,MAAM;IAUd,6EAA6E;YAC/D,MAAM;IAwBpB,0DAA0D;YAC5C,QAAQ;CA4BvB"}