@agentwares/agentguard 0.1.6 → 0.1.9

package/dist/chunk-6TUQD666.js

@@ -0,0 +1,828 @@
+import {
+  CLIENT_ALIASES,
+  hookSettingsFiles,
+  hooksCommand
+} from "./chunk-3O6KWT3E.js";
+import {
+  PROXY_SERVER_NAME,
+  describeConfigPath,
+  detectClientConfigs,
+  isGeminiConfig,
+  mergeServerIntoConfig
+} from "./chunk-TW5KJREH.js";
+import {
+  DEFAULT_POLICY_FILE,
+  approvalUrlFor,
+  createFileGuard,
+  defaultIo,
+  describeError,
+  flagBool,
+  flagList,
+  flagNumber,
+  flagString,
+  homeFrom,
+  loadPolicyFor,
+  parseArgs,
+  policyPathFrom,
+  readRegistration,
+  version
+} from "./chunk-SUXQTT3X.js";
+
+// src/commands/connect.ts
+import { existsSync } from "fs";
+import { relative } from "path";
+var DEFAULT_PROXY_URL = "https://agentwares-agentguard-proxy.vercel.app";
+function fail(e) {
+  throw e;
+}
+async function connectCommand(args, io, fetchImpl = fetch) {
+  const key = args.positionals[0] ?? io.env.AGENTGUARD_KEY;
+  if (!key) {
+    io.err("usage: agentguard connect <key> [--write] [--client <path>] [--url <proxy-url>]");
+    io.err("  the key is on your dashboard; it starts with agk_");
+    return 2;
+  }
+  const base = (flagString(args, "url") ?? io.env.AGENTGUARD_PROXY_URL ?? DEFAULT_PROXY_URL).replace(/\/+$/, "");
+  let res;
+  try {
+    res = await fetchImpl(`${base}/connect`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ key })
+    });
+  } catch (err) {
+    fail({
+      code: "PROXY_UNREACHABLE",
+      cause: `could not reach ${base}: ${err instanceof Error ? err.message : String(err)}`,
+      fix: "check the network, or pass --url if you run your own proxy",
+      retryable: true
+    });
+  }
+  const text = await res.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    fail({
+      code: "PROXY_BAD_RESPONSE",
+      cause: `${base}/connect returned ${res.status} that was not JSON: ${text.slice(0, 200)}`,
+      fix: "check --url points at an agentguard proxy, not at the dashboard",
+      retryable: false
+    });
+  }
+  if (!res.ok) {
+    const e = body;
+    fail({
+      code: e.code ?? "CONNECT_REFUSED",
+      cause: e.cause ?? `${base}/connect returned ${res.status}`,
+      fix: e.fix ?? "check the key on your dashboard; revoked keys stop working immediately",
+      retryable: e.retryable ?? false
+    });
+  }
+  const conn = body;
+  if (flagBool(args, "json")) {
+    io.out(JSON.stringify(conn, null, 2));
+    return 0;
+  }
+  const rel = (p) => p.startsWith(io.cwd + "/") ? relative(io.cwd, p) : p;
+  const entry = conn.mcpServers[PROXY_SERVER_NAME] ?? {
+    type: "http",
+    url: conn.mcpUrl,
+    headers: conn.headers
+  };
+  if (!flagBool(args, "write")) {
+    io.out(JSON.stringify({ mcpServers: { [PROXY_SERVER_NAME]: entry } }, null, 2));
+  } else {
+    const explicit = flagString(args, "client");
+    const configs = explicit ? [describeConfigPath(explicit)] : detectClientConfigs(io.cwd, homeFrom(io), io.env);
+    const projectLevel = configs.filter((c) => c.path.startsWith(io.cwd + "/"));
+    let chosen;
+    if (explicit || flagBool(args, "all")) chosen = configs;
+    else chosen = projectLevel.slice(0, 1);
+    if (chosen.length === 0) {
+      io.err(
+        "no MCP config found here (.mcp.json, .cursor/mcp.json, .vscode/mcp.json). Create one, or paste this into your client:"
+      );
+      io.out(JSON.stringify({ mcpServers: { [PROXY_SERVER_NAME]: entry } }, null, 2));
+      return 1;
+    }
+    for (const c of chosen) {
+      if (!existsSync(c.path)) {
+        io.err(`no MCP config at ${c.path}`);
+        return 1;
+      }
+      const forClient = isGeminiConfig(c) ? { httpUrl: entry.url, ...entry.headers ? { headers: entry.headers } : {} } : entry;
+      const { backup, replaced } = mergeServerIntoConfig(c, PROXY_SERVER_NAME, forClient);
+      io.out(
+        `${replaced ? "updated" : "wrote  "} ${rel(c.path)} (${c.label}) \u2192 ${PROXY_SERVER_NAME} = ${conn.mcpUrl}`
+      );
+      io.out(`backup  ${rel(backup)}`);
+    }
+    for (const c of configs.filter((c2) => !chosen.includes(c2)))
+      io.out(
+        `found   ${c.path} (${c.label}, user-level) \u2014 not touched; pass --client ${JSON.stringify(c.path)} to write it too`
+      );
+  }
+  const band = conn.band ? ` band=${conn.band.tier} (${conn.band.quantity} calls/mo)` : "";
+  io.out(`
+proxy ${conn.slug} (${conn.proxyId}) mode=${conn.mode}${band}`);
+  if (conn.upstreams?.length) io.out(`upstreams: ${conn.upstreams.join(", ")}`);
+  if (conn.dashboardUrl) io.out(`dashboard: ${conn.dashboardUrl}`);
+  if (conn.claudeCode) io.out(`claude code: ${conn.claudeCode}`);
+  if (!flagBool(args, "write"))
+    io.out(`
+run again with --write to add this to your MCP client config`);
+  return 0;
+}
+
+// src/commands/control.ts
+async function pokeHttp(io, reg, path, body) {
+  if (!reg) return;
+  try {
+    const res = await fetch(`${reg.baseUrl}${path}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${reg.token}`, "Content-Type": "application/json" },
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (!res.ok)
+      io.err(
+        `running proxy at ${reg.baseUrl} answered ${res.status} (the file switch still applies)`
+      );
+  } catch {
+    io.err(
+      `no proxy answering at ${reg.baseUrl} (stale ${reg.pid}?) \u2014 the file switch still applies`
+    );
+  }
+}
+async function killCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });
+  const reason = args.positionals.join(" ") || flagString(args, "reason") || `agentguard kill by ${io.env.USER ?? "operator"}`;
+  kill.kill(reason);
+  await pokeHttp(io, readRegistration(loaded), "/kill", { reason });
+  io.out(
+    `KILLED: ${kill.path} written \u2014 every tool call through this policy now returns KILLED. Clear with: agentguard resume`
+  );
+  return 0;
+}
+async function resumeCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });
+  kill.resume();
+  await pokeHttp(io, readRegistration(loaded), "/resume");
+  io.out(`resumed: ${kill.path} removed`);
+  if (io.env[loaded.policy.kill.env])
+    io.err(
+      `note: ${loaded.policy.kill.env} is set in this shell's environment; proxies started from it stay killed`
+    );
+  return 0;
+}
+async function decideCommand(decision, args, io) {
+  const id = args.positionals[0];
+  if (!id) {
+    io.err(
+      `usage: agentguard ${decision === "approved" ? "approve" : "deny"} <approval-id> [--by name] [--note text]`
+    );
+    return 1;
+  }
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });
+  const record = await guard.decide(
+    id,
+    decision,
+    flagString(args, "by") ?? io.env.USER ?? "cli",
+    flagString(args, "note")
+  );
+  if (!record) {
+    io.err(`no approval ${id} \u2014 pending ones: agentguard approvals`);
+    return 1;
+  }
+  io.out(
+    `${record.status}: ${record.tool} (${record.id}, run ${record.run_id})${record.status === "approved" ? " \u2014 the agent may now retry the identical call once" : ""}`
+  );
+  return 0;
+}
+async function approvalsCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });
+  const list = await guard.approvals.list(flagBool(args, "all") ? void 0 : "pending");
+  if (flagBool(args, "json")) {
+    io.out(JSON.stringify(list, null, 2));
+    return 0;
+  }
+  if (list.length === 0) {
+    io.out(flagBool(args, "all") ? "no approvals recorded" : "no pending approvals");
+    return 0;
+  }
+  for (const r of list) {
+    io.out(
+      `${r.id}  ${r.status.padEnd(9)} ${r.tool}  run ${r.run_id}${r.agent ? ` agent ${r.agent}` : ""}  expires ${r.expires_at}`
+    );
+    io.out(`  args: ${JSON.stringify(r.args).slice(0, 300)}`);
+    if (r.status === "pending")
+      io.out(`  \u2192 agentguard approve ${r.id}   |   agentguard deny ${r.id}`);
+  }
+  return 0;
+}
+
+// src/commands/hook.ts
+import { existsSync as existsSync3 } from "fs";
+import { tmpdir } from "os";
+import { dirname, join, resolve } from "path";
+import {
+  assessHookAction,
+  detectHookClient,
+  hookActionFromInput
+} from "@agentwares/agentguard-core";
+
+// src/hooks/transcript-file.ts
+import { closeSync, existsSync as existsSync2, openSync, readSync, statSync } from "fs";
+import { scanTranscript } from "@agentwares/agentguard-core";
+var STEPS = [1 << 20, 8 << 20, 64 << 20];
+function readTail(path, bytes, size) {
+  const length = Math.min(bytes, size);
+  const fd = openSync(path, "r");
+  try {
+    const buf = Buffer.alloc(length);
+    readSync(fd, buf, 0, length, size - length);
+    return buf.toString("utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+function humanTurnFromTranscript(path, opts = {}) {
+  if (!path) return { missing: "the hook input carried no transcript_path" };
+  if (!existsSync2(path)) return { missing: `no transcript at ${path}` };
+  let size;
+  try {
+    size = statSync(path).size;
+  } catch (err) {
+    return {
+      missing: `transcript unreadable: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  let scan;
+  for (const step of STEPS) {
+    try {
+      scan = scanTranscript(readTail(path, step, size), opts);
+    } catch (err) {
+      return {
+        missing: `transcript unreadable: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    if (scan.turn || step >= size) break;
+  }
+  if (scan?.turn) return { turn: scan.turn, scan };
+  return {
+    missing: size > STEPS[STEPS.length - 1] ? "none in the last 64 MB of the transcript" : void 0,
+    scan
+  };
+}
+
+// src/commands/hook.ts
+import { loadPolicyFile } from "@agentwares/agentguard-core/node";
+var RUN_PREFIX = {
+  "claude-code": "cc",
+  codex: "codex",
+  "gemini-cli": "gemini"
+};
+function findPolicyUpwards(start) {
+  let dir = resolve(start);
+  for (let i = 0; i < 64; i += 1) {
+    const candidate = join(dir, DEFAULT_POLICY_FILE);
+    if (existsSync3(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+  return void 0;
+}
+function projectDir(io, inputCwd) {
+  return io.env.CLAUDE_PROJECT_DIR || io.env.GEMINI_PROJECT_DIR || inputCwd || void 0;
+}
+function resolveHookPolicy(args, io, inputCwd) {
+  const flag = flagString(args, "config");
+  if (flag) return { path: resolve(io.cwd, flag), found: "flag" };
+  if (io.env.AGENTGUARD_CONFIG)
+    return { path: resolve(io.cwd, io.env.AGENTGUARD_CONFIG), found: "env" };
+  const start = projectDir(io, inputCwd) ?? io.cwd;
+  const near = findPolicyUpwards(start);
+  if (near) return { path: near, found: "project" };
+  const fallback = flagString(args, "fallback-config");
+  if (fallback && existsSync3(resolve(io.cwd, fallback)))
+    return { path: resolve(io.cwd, fallback), found: "fallback" };
+  return void 0;
+}
+function out(io, value) {
+  io.out(JSON.stringify(value));
+}
+function warn(io, message) {
+  out(io, { systemMessage: message });
+}
+function respond(io, client, result, summary, approveCommand) {
+  if (result.decision === "deny" && result.error) {
+    const e = result.error;
+    const reason = JSON.stringify(e);
+    const id = result.approvalId ? `, approval ${result.approvalId}` : "";
+    const approve = e.code === "APPROVAL_REQUIRED" && result.approvalId ? ` To let this exact command run once: ${approveCommand(result.approvalId)}` : "";
+    const systemMessage = `agentguard refused "${summary.slice(0, 120)}" (${e.code}${id}): ${e.cause}${approve}`;
+    if (client === "gemini-cli") out(io, { decision: "deny", reason, systemMessage });
+    else
+      out(io, {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: reason
+        },
+        systemMessage
+      });
+    return;
+  }
+  if (result.would) {
+    out(io, {
+      systemMessage: `agentguard (hooks.mode: dry-run) would have stopped "${summary.slice(0, 120)}" with ${result.would.code}: ${result.would.cause} \u2014 it ran; nothing is blocked until hooks.mode is enforce`
+    });
+  }
+}
+async function hookCommand(args, io) {
+  const event = args.positionals[0];
+  if (event !== "pre-tool-use") {
+    io.err(
+      "usage: agentguard hook pre-tool-use [--client claude|codex|gemini] [--config agentguard.yaml] [--fallback-config path]\n  run by a coding agent's pre-execution hook, with the hook's JSON on stdin; `agentguard hooks install` sets it up"
+    );
+    return 1;
+  }
+  const flagClient = flagString(args, "client");
+  let client = flagClient && CLIENT_ALIASES[flagClient] || "claude-code";
+  try {
+    const raw = await io.stdin?.() ?? "";
+    const input = JSON.parse(raw);
+    if (!flagClient) client = detectHookClient(input);
+    const inputCwd = typeof input.cwd === "string" ? input.cwd : void 0;
+    const policyRef = resolveHookPolicy(args, io, inputCwd);
+    if (!policyRef) return 0;
+    const loaded = loadPolicyFile(policyRef.path, { env: io.env, allowMissingEnv: true });
+    const action = hookActionFromInput(client, input, inputCwd ?? io.cwd);
+    if (!action) return 0;
+    const home = homeFrom(io);
+    const workspace = projectDir(io, void 0) ?? (policyRef.found === "project" ? dirname(policyRef.path) : void 0) ?? action.cwd;
+    const tmpDirs = [
+      tmpdir(),
+      io.env.TMPDIR,
+      typeof input.scratchpad_dir === "string" ? input.scratchpad_dir : void 0,
+      "/tmp",
+      "/private/tmp",
+      "/var/folders",
+      "/private/var/folders"
+    ].filter((d) => Boolean(d));
+    const ctx = {
+      workspace: resolve(workspace),
+      home,
+      tmpDirs,
+      stateDir: loaded.stateDir,
+      guardFiles: [loaded.path, ...hookSettingsFiles({ cwd: resolve(workspace), home })]
+    };
+    const assessment = assessHookAction(loaded.policy, action, ctx);
+    const reg = readRegistration(loaded);
+    const { guard } = createFileGuard(loaded, {
+      env: io.env,
+      approvalUrl: approvalUrlFor(reg),
+      log: (line) => io.err(line)
+    });
+    const configHint = policyRef.found === "project" && dirname(policyRef.path) === resolve(workspace) ? "" : ` --config ${JSON.stringify(policyRef.path)}`;
+    const approveCommand = (id) => `npx @agentwares/agentguard approve ${id}${configHint}`;
+    const result = await guard.preflight({
+      action,
+      assessment,
+      runId: `${RUN_PREFIX[client]}_${action.sessionId}`,
+      humanTurn: () => client === "claude-code" ? humanTurnFromTranscript(action.transcriptPath, {
+        requireOrigin: loaded.policy.hooks.irreversible.require_origin
+      }) : {
+        missing: `${client} transcripts are not a verified format for this check, so an irreversible command needs \`agentguard approve\``
+      },
+      approveCommand
+    });
+    respond(io, client, result, assessment.summary, approveCommand);
+    return 0;
+  } catch (err) {
+    warn(
+      io,
+      `agentguard hook error \u2014 this call was NOT checked: ${describeError(err).replace(/\s+/g, " ").slice(0, 400)}`
+    );
+    return 0;
+  }
+}
+
+// src/commands/keys.ts
+import { readFileSync, writeFileSync } from "fs";
+import YAML, { isMap, isSeq, YAMLSeq } from "yaml";
+import { generateAgentKey, hashAgentKey } from "@agentwares/agentguard-core";
+async function keyCommand(args, io) {
+  const [sub, name] = args.positionals;
+  const path = policyPathFrom(args, io);
+  const doc = YAML.parseDocument(readFileSync(path, "utf8"));
+  let agents = doc.get("agents");
+  if (!isSeq(agents)) {
+    agents = new YAMLSeq();
+    doc.set("agents", agents);
+  }
+  const seq = agents;
+  const items = seq.items.filter(isMap);
+  if (sub === "list" || sub === void 0) {
+    if (items.length === 0)
+      io.out(
+        "no agents in agentguard.yaml \u2014 create one: agentguard key create <name> --allow 'crm_get_*'"
+      );
+    for (const a of items) {
+      const allow2 = a.get("allow");
+      io.out(
+        `${String(a.get("name")).padEnd(20)} key: ${a.get("key_hash") ? "set" : "none (stdio --agent only)"}  allow: ${isSeq(allow2) ? allow2.items.map(String).join(", ") : "all"}`
+      );
+    }
+    return 0;
+  }
+  if (!name) {
+    io.err(
+      "usage: agentguard key create <agent> [--allow pattern]... [--deny pattern]... [--writes n] [--spend n] [--deletes n] [--emails n] [--tool-calls n] [--mode dry-run|enforce] [--upstream name]..."
+    );
+    return 1;
+  }
+  if (sub === "revoke") {
+    const idx = items.findIndex((a) => a.get("name") === name);
+    if (idx < 0) {
+      io.err(`no agent "${name}"`);
+      return 1;
+    }
+    seq.items.splice(seq.items.indexOf(items[idx]), 1);
+    writeFileSync(path, doc.toString());
+    io.out(`revoked ${name}: removed from agentguard.yaml (running proxies pick it up on restart)`);
+    return 0;
+  }
+  if (sub !== "create") {
+    io.err(`unknown subcommand "${sub}" \u2014 use create, list or revoke`);
+    return 1;
+  }
+  const key = generateAgentKey();
+  const keyHash = await hashAgentKey(key);
+  const existing = items.find((a) => a.get("name") === name);
+  const entry = { name, key_hash: keyHash };
+  const allow = flagList(args, "allow");
+  const deny = flagList(args, "deny");
+  if (allow.length) entry.allow = allow;
+  if (deny.length) entry.deny = deny;
+  const upstreams = flagList(args, "upstream");
+  if (upstreams.length) entry.upstreams = upstreams;
+  const mode = flagString(args, "mode");
+  if (mode) entry.mode = mode;
+  const perRun = {};
+  for (const [flag, counter] of [
+    ["writes", "writes"],
+    ["spend", "spend_usd"],
+    ["deletes", "deletes"],
+    ["emails", "emails"],
+    ["tool-calls", "tool_calls"]
+  ]) {
+    const n = flagNumber(args, flag);
+    if (n !== void 0) perRun[counter] = n;
+  }
+  if (Object.keys(perRun).length) entry.caps = { per_run: perRun };
+  if (existing) {
+    for (const [k, v] of Object.entries(entry)) existing.set(k, v);
+  } else {
+    seq.add(doc.createNode(entry));
+  }
+  writeFileSync(path, doc.toString());
+  io.err(
+    `${existing ? "rotated" : "created"} agent "${name}" in ${path}${allow.length ? ` (allow: ${allow.join(", ")})` : " (allow: all tools)"}`
+  );
+  io.err(
+    "the key is shown once; give it to the agent as `Authorization: Bearer <key>` (HTTP) \u2014 over stdio use `agentguard proxy --agent " + name + "`"
+  );
+  io.out(key);
+  return 0;
+}
+
+// src/commands/permission-diff.ts
+import { execFileSync } from "child_process";
+import {
+  diffPermissionFile,
+  renderPermissionDiffMarkdown
+} from "@agentwares/agentguard-core";
+var DEFAULT_PERMISSION_PATHS = [
+  "agentguard.yaml",
+  "agentguard.yml",
+  ".claude/settings.json",
+  ".claude/settings.local.json",
+  ".mcp.json",
+  "mcp.json",
+  ".cursor/mcp.json",
+  ".vscode/mcp.json"
+];
+var PERMISSION_FILE = /(^|\/)(agentguard[^/]*\.ya?ml|\.claude\/settings(\.local)?\.json|[^/]*mcp[^/]*\.json|claude_desktop_config\.json)$/;
+function git(cwd, argv) {
+  try {
+    return execFileSync("git", argv, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return void 0;
+  }
+}
+function showAt(cwd, ref, path) {
+  return git(cwd, ["show", `${ref}:${path}`]);
+}
+function changedPermissionFiles(cwd, base, head) {
+  const out2 = git(cwd, ["diff", "--name-only", base, head]) ?? "";
+  return out2.split("\n").map((l) => l.trim()).filter((l) => l && PERMISSION_FILE.test(l));
+}
+function resolveBase(cwd, explicit) {
+  if (explicit) return explicit;
+  for (const candidate of ["origin/main", "main", "origin/master", "master"]) {
+    if (git(cwd, ["rev-parse", "--verify", "--quiet", candidate]) !== void 0) return candidate;
+  }
+  return "HEAD~1";
+}
+function runPermissionDiff(cwd, opts) {
+  const base = resolveBase(cwd, opts.base);
+  const head = opts.head ?? "HEAD";
+  const files = [
+    .../* @__PURE__ */ new Set([
+      ...opts.paths ?? DEFAULT_PERMISSION_PATHS,
+      ...changedPermissionFiles(cwd, base, head)
+    ])
+  ];
+  const findings = [];
+  const touched = [];
+  for (const file of files) {
+    const before = showAt(cwd, base, file);
+    const after = showAt(cwd, head, file);
+    if (before === void 0 && after === void 0) continue;
+    if (before === after) continue;
+    touched.push(file);
+    findings.push(...diffPermissionFile(file, before, after));
+  }
+  return {
+    base,
+    head,
+    files: touched,
+    findings,
+    markdown: renderPermissionDiffMarkdown(findings, { title: opts.title })
+  };
+}
+async function permissionDiffCommand(args, io) {
+  const paths = flagList(args, "paths");
+  const result = runPermissionDiff(io.cwd, {
+    base: flagString(args, "base"),
+    head: flagString(args, "head"),
+    paths: paths.length ? paths : void 0
+  });
+  const format = flagString(args, "format") ?? (flagBool(args, "json") ? "json" : "markdown");
+  if (format === "json") io.out(JSON.stringify(result, null, 2));
+  else io.out(result.markdown);
+  const widen = result.findings.filter((f) => f.severity === "widen").length;
+  if (flagBool(args, "fail-on-widen") && widen > 0) return 1;
+  return 0;
+}
+
+// src/commands/report.ts
+import { resolve as resolve2 } from "path";
+import {
+  buildReport,
+  latestRunId,
+  listRuns,
+  renderMutationDiff,
+  renderReportMarkdown
+} from "@agentwares/agentguard-core";
+import { readAuditFile, verifyAuditFile } from "@agentwares/agentguard-core/node";
+function pickRun(args, entries) {
+  if (flagBool(args, "all")) return void 0;
+  return flagString(args, "run") ?? latestRunId(entries);
+}
+async function reportCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const entries = readAuditFile(loaded.auditPath);
+  const runId = pickRun(args, entries);
+  const report = buildReport(entries, { runId });
+  if (flagBool(args, "json")) {
+    io.out(
+      JSON.stringify(
+        {
+          ...report,
+          mutations: report.mutations.map((m) => ({
+            seq: m.seq,
+            ts: m.ts,
+            tool: m.tool,
+            mutation: m.mutation
+          }))
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  io.out(renderReportMarkdown(report));
+  const chain = await verifyAuditFile(loaded.auditPath);
+  io.out(
+    chain.ok ? `Audit chain: ${chain.entries} entries, verified (${loaded.auditPath}).` : `Audit chain BROKEN at entry ${chain.brokenAt}: ${chain.reason}`
+  );
+  if (runId && listRuns(entries).length > 1) io.out(`Other runs: agentguard report --all`);
+  return 0;
+}
+async function diffCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const entries = readAuditFile(loaded.auditPath);
+  const runId = pickRun(args, entries);
+  io.out(renderMutationDiff(entries, { runId }).trimEnd());
+  return 0;
+}
+async function verifyCommand(args, io) {
+  let path = args.positionals[0];
+  if (!path) path = loadPolicyFor(args, io, { allowMissingEnv: true }).auditPath;
+  path = resolve2(io.cwd, path);
+  const result = await verifyAuditFile(path);
+  if (flagBool(args, "json")) io.out(JSON.stringify({ path, ...result }));
+  else if (result.ok)
+    io.out(
+      `ok: ${result.entries} entries, chain intact, head ${result.head?.slice(0, 16)}\u2026 (${path})`
+    );
+  else io.out(`BROKEN at entry ${result.brokenAt}: ${result.reason} (${path})`);
+  return result.ok ? 0 : 1;
+}
+async function statusCommand(args, io) {
+  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });
+  const { guard, kill } = createFileGuard(loaded, { alerts: false, env: io.env });
+  const entries = readAuditFile(loaded.auditPath);
+  const runId = flagString(args, "run") ?? latestRunId(entries) ?? "(none yet)";
+  const status = await guard.status(runId);
+  const killed = kill.check();
+  const reg = readRegistration(loaded);
+  const pending = await guard.approvals.list("pending");
+  if (flagBool(args, "json")) {
+    io.out(
+      JSON.stringify(
+        {
+          policy: loaded.path,
+          mode: loaded.policy.mode,
+          runId,
+          ...status,
+          killed,
+          pendingApprovals: pending.length,
+          http: reg ? { url: reg.url, pid: reg.pid } : void 0
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  io.out(
+    `policy   ${loaded.path} (mode: ${loaded.policy.mode}, ${loaded.policy.upstreams.length} upstreams)`
+  );
+  io.out(
+    `kill     ${killed.killed ? `ON \u2014 ${killed.reason} (agentguard resume to clear)` : "off"}`
+  );
+  io.out(
+    `http     ${reg ? `${reg.url} (pid ${reg.pid})` : "not running (agentguard proxy --http)"}`
+  );
+  io.out(`audit    ${entries.length} entries in ${loaded.auditPath}`);
+  io.out(
+    `pending  ${pending.length} approval${pending.length === 1 ? "" : "s"}${pending.length ? ` \u2014 agentguard approvals` : ""}`
+  );
+  io.out(`run      ${runId}`);
+  const fmt = (scope) => Object.entries(status.caps[scope]).map(([k, limit]) => `${k} ${status.usage[scope][k] ?? 0}/${limit}`).join("  ") || "no caps";
+  io.out(`  per_run  ${fmt("per_run")}`);
+  io.out(`  per_day  ${fmt("per_day")}`);
+  return 0;
+}
+
+// src/cli.ts
+var proxyCommand = async (args, io) => (await import("./proxy-3Z5YEZ4R.js")).proxyCommand(args, io);
+var initCommand = async (args, io) => (await import("./init-CWROGV5I.js")).initCommand(args, io);
+var toolsCommand = async (args, io) => (await import("./tools-3LLDG3XQ.js")).toolsCommand(args, io);
+var auditCommand = async (args, io) => (await import("./audit-2YCMHMCP.js")).auditCommand(args, io);
+var HELP = `agentguard \u2014 MCP policy proxy for agents that touch production
+
+  npx @agentwares/agentguard init                 read your MCP config, write agentguard.yaml (dry-run), route every server through the proxy
+  agentguard report [--run id|--all]  what this run did / would have destroyed / spent, where it was halted
+  agentguard diff [--run id]          record-by-record mutation diff from a dry run
+  agentguard verify [audit.jsonl]     prove the hash-chained audit log was not edited
+  agentguard connect <key> [--write]  point this machine at your hosted proxy (paid tiers)
+
+  agentguard hooks install [--project|--user] [--client claude|codex|gemini|all]
+                                      check a coding agent's own shell commands and file edits against agentguard.yaml (dry-run first);
+                                      irreversible commands (push, merge, publish, send, rm outside the repo) only on a turn a person typed
+  agentguard hooks uninstall | status
+  agentguard hook pre-tool-use        what the installed hook runs (reads the harness's JSON on stdin)
+
+  agentguard audit [--since 7d|30d|all] [--client claude|codex|all] [--json]
+                                      which rules in CLAUDE.md / AGENTS.md / GEMINI.md / .cursor/rules your coding agents broke,
+                                      from this machine's Claude Code and Codex sessions in this repo (nothing is sent anywhere)
+  agentguard audit --enforce [--preview]
+                                      write the checkable rules into agentguard.yaml as hook rules, in dry-run, and install the hook
+
+  agentguard proxy [--http --port 8788] [--agent name] [--run-id id] [--mode dry-run|enforce]
+  agentguard tools [--json]           the tools your agent will see, with class and why
+  agentguard status [--run id]        counters vs caps, kill state, pending approvals
+
+  agentguard kill [reason]            halt every run now (file + running HTTP proxy);  agentguard resume
+  agentguard approvals [--all]        pending approvals;  agentguard approve <id> | deny <id> [--note text]
+  agentguard key create <agent> [--allow 'crm_get_*']... [--deny p] [--writes n] [--spend n] [--mode m]
+  agentguard key list | revoke <agent>
+  agentguard permission-diff [--base ref] [--head ref] [--paths a,b] [--format markdown|json] [--fail-on-widen]
+
+Options: --config <agentguard.yaml> (or AGENTGUARD_CONFIG), --json, --help, --version
+Docs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli`;
+async function main(argv, io = defaultIo()) {
+  const args = parseArgs(argv);
+  if (args.flags.version) {
+    io.out(version());
+    return 0;
+  }
+  if (args.command === void 0 && !args.flags.help && io.tty === false) {
+    try {
+      return await proxyCommand(args, io);
+    } catch (err) {
+      io.err(describeError(err));
+      return 1;
+    }
+  }
+  if (args.flags.help || args.command === void 0 || args.command === "help") {
+    io.out(HELP);
+    return args.command === void 0 && !args.flags.help ? 1 : 0;
+  }
+  try {
+    switch (args.command) {
+      case "init":
+        return await initCommand(args, io);
+      case "proxy":
+      case "serve":
+        return await proxyCommand(args, io);
+      case "report":
+        return await reportCommand(args, io);
+      case "diff":
+        return await diffCommand(args, io);
+      case "verify":
+        return await verifyCommand(args, io);
+      case "connect":
+        return await connectCommand(args, io);
+      case "status":
+        return await statusCommand(args, io);
+      case "tools":
+        return await toolsCommand(args, io);
+      case "kill":
+        return await killCommand(args, io);
+      case "resume":
+        return await resumeCommand(args, io);
+      case "approve":
+        return await decideCommand("approved", args, io);
+      case "deny":
+        return await decideCommand("denied", args, io);
+      case "approvals":
+        return await approvalsCommand(args, io);
+      case "key":
+      case "keys":
+        return await keyCommand(args, io);
+      case "permission-diff":
+        return await permissionDiffCommand(args, io);
+      case "hook":
+        return await hookCommand(args, io);
+      case "hooks":
+        return await hooksCommand(args, io);
+      case "audit":
+        return await auditCommand(args, io);
+      default:
+        io.err(`unknown command "${args.command}"
+`);
+        io.err(HELP);
+        return 1;
+    }
+  } catch (err) {
+    io.err(describeError(err));
+    return 1;
+  }
+}
+var isMain = process.argv[1] !== void 0 && /(^|\/)(cli\.[cm]?[jt]s|agentguard)$/.test(process.argv[1]);
+if (isMain) {
+  main(process.argv.slice(2)).then(
+    (code) => {
+      if (code !== 0) process.exitCode = code;
+    },
+    (err) => {
+      process.stderr.write(`${describeError(err)}
+`);
+      process.exitCode = 1;
+    }
+  );
+}
+
+export {
+  DEFAULT_PERMISSION_PATHS,
+  runPermissionDiff,
+  HELP,
+  main
+};
+//# sourceMappingURL=chunk-6TUQD666.js.map