@agentwares/agentguard 0.1.7 → 0.1.10

package/dist/chunk-DEVXG3IB.js

@@ -0,0 +1,113 @@
+import {
+  ProxyRuntime
+} from "./chunk-TJXZBOHL.js";
+import {
+  flagBool,
+  loadPolicyFor
+} from "./chunk-4WTFMFRY.js";
+
+// src/commands/tools.ts
+import {
+  Guard,
+  classifyTool,
+  parsePolicy
+} from "@agentwares/agentguard-core";
+async function probeUpstreams(upstreams, opts = {}) {
+  const policy = opts.policy ?? parsePolicy({ upstreams });
+  const loaded = {
+    policy: { ...policy, upstreams },
+    path: "",
+    baseDir: process.cwd(),
+    stateDir: "",
+    auditPath: "",
+    killPath: ""
+  };
+  const guard = new Guard({ policy: loaded.policy, env: opts.env ?? {} });
+  const runtime = new ProxyRuntime({
+    loaded,
+    guard,
+    defaultRunId: "probe",
+    log: opts.log ?? (() => void 0),
+    connectTimeoutMs: opts.timeoutMs ?? 15e3
+  });
+  try {
+    await runtime.start();
+    return {
+      tools: runtime.listTools().map((t) => ({
+        upstream: t.upstream,
+        name: t.name,
+        tool: t.tool,
+        classification: classifyTool(
+          { name: t.name, annotations: t.tool.annotations },
+          loaded.policy
+        )
+      })),
+      upstreams: runtime.upstreamStatus()
+    };
+  } finally {
+    await runtime.close();
+  }
+}
+function formatToolTable(tools) {
+  const width = Math.min(48, Math.max(12, ...tools.map((t) => t.name.length)));
+  const lines = [
+    `${"tool".padEnd(width)}  ${"class".padEnd(8)}${"verb".padEnd(9)}${"upstream".padEnd(14)}why`
+  ];
+  for (const t of tools) {
+    const c = t.classification;
+    lines.push(
+      `${t.name.padEnd(width)}  ${c.class.padEnd(8)}${c.verb.padEnd(9)}${t.upstream.padEnd(14)}${c.source}: ${c.reason}`
+    );
+  }
+  return lines;
+}
+async function toolsCommand(args, io) {
+  const loaded = loadPolicyFor(args, io);
+  const result = await probeUpstreams(loaded.policy.upstreams, {
+    policy: loaded.policy,
+    log: io.err,
+    env: io.env
+  });
+  if (flagBool(args, "json")) {
+    io.out(
+      JSON.stringify(
+        {
+          upstreams: result.upstreams,
+          tools: result.tools.map((t) => ({
+            name: t.name,
+            upstream: t.upstream,
+            ...t.classification
+          }))
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  for (const u of result.upstreams)
+    io.err(
+      `${u.connected ? "ok  " : "down"} ${u.name}: ${u.connected ? `${u.tools} tools` : u.error}`
+    );
+  if (result.upstreams.length === 0)
+    io.err(
+      "no upstreams in the policy: an MCP client sees okgate's own read-only tools instead (okgate_get_status, okgate_get_report, okgate_verify_audit_log)"
+    );
+  for (const line of formatToolTable(result.tools)) io.out(line);
+  const counts = result.tools.reduce(
+    (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
+    {}
+  );
+  io.err(
+    `
+${result.tools.length} tools: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")} \xB7 mode ${loaded.policy.mode}`
+  );
+  return result.upstreams.every((u) => u.connected) ? 0 : 2;
+}
+
+export {
+  probeUpstreams,
+  formatToolTable,
+  toolsCommand
+};
+//# sourceMappingURL=chunk-DEVXG3IB.js.map

package/dist/chunk-DEVXG3IB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/tools.ts"],"sourcesContent":["/**\n * `okgate tools` — connect to every upstream and print the tools the agent will see,\n * with their class and why. Also the probe `init` uses to seed the policy.\n */\nimport {\n  Guard,\n  classifyTool,\n  parsePolicy,\n  type Classification,\n  type Policy,\n  type Upstream,\n} from \"@agentwares/agentguard-core\";\nimport type { LoadedPolicy } from \"@agentwares/agentguard-core/node\";\nimport type { Tool } from \"@modelcontextprotocol/sdk/types.js\";\nimport { ProxyRuntime } from \"../proxy/runtime.js\";\nimport { loadPolicyFor, type Io } from \"../context.js\";\nimport type { ParsedArgs } from \"../args.js\";\nimport { flagBool } from \"../args.js\";\n\nexport interface ProbedTool {\n  upstream: string;\n  name: string;\n  tool: Tool;\n  classification: Classification;\n}\n\nexport interface ProbeResult {\n  tools: ProbedTool[];\n  upstreams: { name: string; connected: boolean; tools: number; error?: string }[];\n}\n\n/** Connect to the upstreams (with a policy for classification), list tools, disconnect. */\nexport async function probeUpstreams(\n  upstreams: Upstream[],\n  opts: {\n    policy?: Policy;\n    timeoutMs?: number;\n    log?: (l: string) => void;\n    env?: NodeJS.ProcessEnv;\n  } = {},\n): Promise<ProbeResult> {\n  const policy = opts.policy ?? parsePolicy({ upstreams });\n  const loaded: LoadedPolicy = {\n    policy: { ...policy, upstreams },\n    path: \"\",\n    baseDir: process.cwd(),\n    stateDir: \"\",\n    auditPath: \"\",\n    killPath: \"\",\n  };\n  const guard = new Guard({ policy: loaded.policy, env: opts.env ?? {} });\n  const runtime = new ProxyRuntime({\n    loaded,\n    guard,\n    defaultRunId: \"probe\",\n    log: opts.log ?? (() => undefined),\n    connectTimeoutMs: opts.timeoutMs ?? 15_000,\n  });\n  try {\n    await runtime.start();\n    return {\n      tools: runtime.listTools().map((t) => ({\n        upstream: t.upstream,\n        name: t.name,\n        tool: t.tool,\n        classification: classifyTool(\n          { name: t.name, annotations: t.tool.annotations },\n          loaded.policy,\n        ),\n      })),\n      upstreams: runtime.upstreamStatus(),\n    };\n  } finally {\n    await runtime.close();\n  }\n}\n\nexport function formatToolTable(tools: ProbedTool[]): string[] {\n  const width = Math.min(48, Math.max(12, ...tools.map((t) => t.name.length)));\n  const lines = [\n    `${\"tool\".padEnd(width)}  ${\"class\".padEnd(8)}${\"verb\".padEnd(9)}${\"upstream\".padEnd(14)}why`,\n  ];\n  for (const t of tools) {\n    const c = t.classification;\n    lines.push(\n      `${t.name.padEnd(width)}  ${c.class.padEnd(8)}${c.verb.padEnd(9)}${t.upstream.padEnd(14)}${c.source}: ${c.reason}`,\n    );\n  }\n  return lines;\n}\n\nexport async function toolsCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io);\n  const result = await probeUpstreams(loaded.policy.upstreams, {\n    policy: loaded.policy,\n    log: io.err,\n    env: io.env,\n  });\n  if (flagBool(args, \"json\")) {\n    io.out(\n      JSON.stringify(\n        {\n          upstreams: result.upstreams,\n          tools: result.tools.map((t) => ({\n            name: t.name,\n            upstream: t.upstream,\n            ...t.classification,\n          })),\n        },\n        null,\n        2,\n      ),\n    );\n    return 0;\n  }\n  for (const u of result.upstreams)\n    io.err(\n      `${u.connected ? \"ok  \" : \"down\"} ${u.name}: ${u.connected ? `${u.tools} tools` : u.error}`,\n    );\n  if (result.upstreams.length === 0)\n    io.err(\n      \"no upstreams in the policy: an MCP client sees okgate's own read-only tools instead (okgate_get_status, okgate_get_report, okgate_verify_audit_log)\",\n    );\n  for (const line of formatToolTable(result.tools)) io.out(line);\n  const counts = result.tools.reduce<Record<string, number>>(\n    (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),\n    {},\n  );\n  io.err(\n    `\\n${result.tools.length} tools: ${Object.entries(counts)\n      .map(([k, v]) => `${v} ${k}`)\n      .join(\", \")} · mode ${loaded.policy.mode}`,\n  );\n  return result.upstreams.every((u) => u.connected) ? 0 : 2;\n}\n"],"mappings":";;;;;;;;;AAIA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAqBP,eAAsB,eACpB,WACA,OAKI,CAAC,GACiB;AACtB,QAAM,SAAS,KAAK,UAAU,YAAY,EAAE,UAAU,CAAC;AACvD,QAAM,SAAuB;AAAA,IAC3B,QAAQ,EAAE,GAAG,QAAQ,UAAU;AAAA,IAC/B,MAAM;AAAA,IACN,SAAS,QAAQ,IAAI;AAAA,IACrB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU;AAAA,EACZ;AACA,QAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,OAAO,QAAQ,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC;AACtE,QAAM,UAAU,IAAI,aAAa;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,KAAK,KAAK,QAAQ,MAAM;AAAA,IACxB,kBAAkB,KAAK,aAAa;AAAA,EACtC,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,MAAM;AACpB,WAAO;AAAA,MACL,OAAO,QAAQ,UAAU,EAAE,IAAI,CAAC,OAAO;AAAA,QACrC,UAAU,EAAE;AAAA,QACZ,MAAM,EAAE;AAAA,QACR,MAAM,EAAE;AAAA,QACR,gBAAgB;AAAA,UACd,EAAE,MAAM,EAAE,MAAM,aAAa,EAAE,KAAK,YAAY;AAAA,UAChD,OAAO;AAAA,QACT;AAAA,MACF,EAAE;AAAA,MACF,WAAW,QAAQ,eAAe;AAAA,IACpC;AAAA,EACF,UAAE;AACA,UAAM,QAAQ,MAAM;AAAA,EACtB;AACF;AAEO,SAAS,gBAAgB,OAA+B;AAC7D,QAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,MAAM,CAAC,CAAC;AAC3E,QAAM,QAAQ;AAAA,IACZ,GAAG,OAAO,OAAO,KAAK,CAAC,KAAK,QAAQ,OAAO,CAAC,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,GAAG,WAAW,OAAO,EAAE,CAAC;AAAA,EAC1F;AACA,aAAW,KAAK,OAAO;AACrB,UAAM,IAAI,EAAE;AACZ,UAAM;AAAA,MACJ,GAAG,EAAE,KAAK,OAAO,KAAK,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,OAAO,CAAC,CAAC,GAAG,EAAE,SAAS,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,EAAE,MAAM;AAAA,IAClH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,aAAa,MAAkB,IAAyB;AAC5E,QAAM,SAAS,cAAc,MAAM,EAAE;AACrC,QAAM,SAAS,MAAM,eAAe,OAAO,OAAO,WAAW;AAAA,IAC3D,QAAQ,OAAO;AAAA,IACf,KAAK,GAAG;AAAA,IACR,KAAK,GAAG;AAAA,EACV,CAAC;AACD,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG;AAAA,MACD,KAAK;AAAA,QACH;AAAA,UACE,WAAW,OAAO;AAAA,UAClB,OAAO,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,YAC9B,MAAM,EAAE;AAAA,YACR,UAAU,EAAE;AAAA,YACZ,GAAG,EAAE;AAAA,UACP,EAAE;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,aAAW,KAAK,OAAO;AACrB,OAAG;AAAA,MACD,GAAG,EAAE,YAAY,SAAS,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,YAAY,GAAG,EAAE,KAAK,WAAW,EAAE,KAAK;AAAA,IAC3F;AACF,MAAI,OAAO,UAAU,WAAW;AAC9B,OAAG;AAAA,MACD;AAAA,IACF;AACF,aAAW,QAAQ,gBAAgB,OAAO,KAAK,EAAG,IAAG,IAAI,IAAI;AAC7D,QAAM,SAAS,OAAO,MAAM;AAAA,IAC1B,CAAC,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,eAAe,KAAK,IAAI,IAAI,EAAE,eAAe,KAAK,KAAK,KAAK,EAAE;AAAA,IACxF,CAAC;AAAA,EACH;AACA,KAAG;AAAA,IACD;AAAA,EAAK,OAAO,MAAM,MAAM,WAAW,OAAO,QAAQ,MAAM,EACrD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAC3B,KAAK,IAAI,CAAC,cAAW,OAAO,OAAO,IAAI;AAAA,EAC5C;AACA,SAAO,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI;AAC1D;","names":[]}

package/dist/chunk-F73VDY3W.js

@@ -0,0 +1,202 @@
+import {
+  CLIENT_ALIASES,
+  hookTarget,
+  installHook,
+  installedHandlers,
+  uninstallHook
+} from "./chunk-2QDPPTPY.js";
+import {
+  npxCommand
+} from "./chunk-XPNBYSIN.js";
+import {
+  flagBool,
+  flagList,
+  flagNumber,
+  flagString,
+  homeFrom,
+  version
+} from "./chunk-4WTFMFRY.js";
+
+// src/commands/hooks.ts
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join, relative, resolve } from "path";
+import {
+  LEGACY_POLICY_FILE,
+  LEGACY_STATE_DIR,
+  POLICY_FILE,
+  STATE_DIR
+} from "@agentwares/agentguard-core";
+import { findPolicyFile } from "@agentwares/agentguard-core/node";
+function userPolicyPath(home) {
+  const next = join(home, STATE_DIR, POLICY_FILE);
+  const legacy = join(home, LEGACY_STATE_DIR, LEGACY_POLICY_FILE);
+  return !existsSync(next) && existsSync(legacy) ? legacy : next;
+}
+var HOOKS_POLICY_BLOCK = `
+# Hook mode: your coding agent's own shell commands and file edits (Claude Code, Codex, Gemini CLI),
+# checked before they run. \`okgate hooks install\` wired it; \`okgate report\` shows the decisions.
+hooks:
+  # dry-run: every decision is logged and nothing is blocked. Read \`okgate report\`, then set
+  # enforce. The kill switch (\`okgate kill\`) stops guarded calls in both modes.
+  mode: dry-run
+  # Irreversible commands run only on a turn a person typed: after the session's previous
+  # irreversible command, recent, and naming the action ("push it", or "yes" to "shall I push?").
+  # Text the model writes, tool output and injected messages never count. Otherwise the agent
+  # gets APPROVAL_REQUIRED and an id; \`okgate approve <id>\` lets that exact command run once.
+  # Built in: git-push, merge, tag-delete, rm-outside-workspace, publish, send, guard-config.
+  irreversible:
+    builtins: true
+    window_s: 1800          # the authorizing turn is at most 30 minutes old
+    require_mention: true   # ...and names the action
+    require_origin: false   # true: only entries Claude Code labels as typed by a person
+    mentions: {}            # extra words per class, e.g. { git-push: [deploy] }
+    rules: []
+    #  - name: deploy
+    #    shell: ["vercel --prod*", "fly deploy*"]
+    #    mentions: [deploy]
+  shell:
+    deny: []                # e.g. ["terraform destroy*", "curl * | sh"]
+    approval: []            # e.g. ["kubectl delete *"]
+  paths:
+    deny: []                # e.g. [".env", "*.pem"]
+    approval: []            # e.g. ["**/migrations/**"]
+`;
+function renderHooksStarterPolicy(generatedAt = /* @__PURE__ */ new Date()) {
+  return `# okgate.yaml \u2014 generated by \`okgate hooks install\` on ${generatedAt.toISOString().slice(0, 10)}
+# Docs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli#hook-mode-a-coding-agents-own-commands
+version: 1
+
+# MCP proxy mode (okgate init) reads upstreams; hook mode needs none.
+mode: dry-run
+upstreams: []
+${HOOKS_POLICY_BLOCK}
+# Kill switch: \`okgate kill\` creates this file; every guarded call is refused until
+# \`okgate resume\`. OKGATE_KILL=1 (or AGENTGUARD_KILL=1) in the environment does the same.
+kill:
+  file: .okgate/KILL
+
+# Hash-chained JSONL of every decision; \`okgate verify\` proves it was not edited.
+audit:
+  path: .okgate/audit.jsonl
+  redact: true
+`;
+}
+function quoteArg(arg) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(arg) ? arg : JSON.stringify(arg);
+}
+function clientsFrom(args) {
+  const names = flagList(args, "client");
+  if (names.length === 0) return ["claude-code"];
+  if (names.includes("all")) return ["claude-code", "codex", "gemini-cli"];
+  return names.map((n) => {
+    const c = CLIENT_ALIASES[n.trim()];
+    if (!c) throw new Error(`unknown --client "${n}" (claude, codex, gemini or all)`);
+    return c;
+  });
+}
+function hasTopLevelHooks(yamlText) {
+  return /^hooks\s*:/m.test(yamlText);
+}
+async function hooksCommand(args, io) {
+  const sub = args.positionals[0] ?? "status";
+  const scope = flagBool(args, "user") ? "user" : "project";
+  const home = homeFrom(io);
+  const where = { cwd: io.cwd, home };
+  const rel = (p) => {
+    const r = relative(io.cwd, p);
+    return r.startsWith("..") ? p : r || ".";
+  };
+  const clients = clientsFrom(args);
+  const named = flagString(args, "config");
+  const policyPath = named !== void 0 ? resolve(io.cwd, named) : scope === "user" ? userPolicyPath(home) : findPolicyFile(io.cwd);
+  const base = flagString(args, "command") ?? npxCommand(version());
+  const commandFor = (client) => {
+    let cmd = `${base} hook pre-tool-use --client ${client === "claude-code" ? "claude" : client === "gemini-cli" ? "gemini" : "codex"}`;
+    if (flagString(args, "config")) cmd += ` --config ${quoteArg(policyPath)}`;
+    else if (scope === "user") cmd += ` --fallback-config ${quoteArg(policyPath)}`;
+    return cmd;
+  };
+  const timeoutS = Math.max(30, flagNumber(args, "timeout") ?? 30);
+  if (sub === "install") {
+    if (!existsSync(policyPath)) {
+      mkdirSync(dirname(policyPath), { recursive: true });
+      writeFileSync(policyPath, renderHooksStarterPolicy());
+      io.out(`wrote   ${rel(policyPath)} (hooks.mode: dry-run)`);
+    } else if (!hasTopLevelHooks(readFileSync(policyPath, "utf8"))) {
+      appendFileSync(policyPath, HOOKS_POLICY_BLOCK);
+      io.out(`added   a hooks: block to ${rel(policyPath)} (hooks.mode: dry-run)`);
+    } else io.out(`kept    ${rel(policyPath)} (it already has a hooks: block)`);
+    for (const client of clients) {
+      const target = hookTarget(client, scope, where, commandFor(client), timeoutS);
+      const { status, backup } = installHook(target);
+      const verb = status === "unchanged" ? "kept   " : status === "updated" ? "updated" : "added  ";
+      io.out(
+        `${verb} ${target.label} ${target.event} hook in ${rel(target.settingsPath)}${backup ? ` (backup: ${rel(backup)})` : ""}`
+      );
+      if (target.note) io.out(`        ${target.note}`);
+    }
+    if (scope === "project" && existsSync(join(io.cwd, ".git"))) {
+      const gitignore = join(io.cwd, ".gitignore");
+      const text = existsSync(gitignore) ? readFileSync(gitignore, "utf8") : "";
+      if (!/^\/?\.okgate\/?$/m.test(text)) {
+        appendFileSync(gitignore, `${text && !text.endsWith("\n") ? "\n" : ""}.okgate/
+`);
+        io.out(`added   .okgate/ to .gitignore (approvals, counters and the audit log stay local)`);
+      }
+    }
+    io.out("");
+    io.out("Next:");
+    io.out("  1. start a new session of your coding agent (hooks are read at start)");
+    io.out("  2. work as usual \u2014 hooks.mode is dry-run: decisions are logged, nothing is blocked");
+    io.out("  3. okgate report    # what enforce mode would have stopped, and why");
+    io.out(`  4. set \`hooks.mode: enforce\` in ${rel(policyPath)} when it looks right`);
+    io.out("  undo: okgate hooks uninstall" + (scope === "user" ? " --user" : ""));
+    return 0;
+  }
+  if (sub === "uninstall") {
+    let total = 0;
+    for (const client of flagString(args, "client") ? clients : ["claude-code", "codex", "gemini-cli"]) {
+      const target = hookTarget(client, scope, where, commandFor(client), timeoutS);
+      const removed = uninstallHook(target);
+      total += removed;
+      if (removed) io.out(`removed ${target.label} hook from ${rel(target.settingsPath)}`);
+    }
+    if (total === 0) io.out(`no okgate hooks in ${scope}-level settings`);
+    else
+      io.out(
+        `kept    ${rel(policyPath)} and its state directory (${STATE_DIR}/ or ${LEGACY_STATE_DIR}/); delete them yourself if you want them gone`
+      );
+    return 0;
+  }
+  if (sub === "status") {
+    for (const s of ["project", "user"]) {
+      for (const client of ["claude-code", "codex", "gemini-cli"]) {
+        const target = hookTarget(client, s, where, "", timeoutS);
+        let handlers;
+        try {
+          handlers = installedHandlers(target);
+        } catch (err) {
+          io.out(
+            `${s.padEnd(7)} ${target.label.padEnd(11)} unreadable: ${err instanceof Error ? err.message : String(err)}`
+          );
+          continue;
+        }
+        io.out(
+          `${s.padEnd(7)} ${target.label.padEnd(11)} ${handlers.length ? `installed: ${String(handlers[0].command)}` : "\u2014"}  (${rel(target.settingsPath)})`
+        );
+      }
+    }
+    return 0;
+  }
+  io.err(
+    "usage: okgate hooks install|uninstall|status [--project|--user] [--client claude|codex|gemini|all] [--command cmd] [--config path]"
+  );
+  return 1;
+}
+
+export {
+  HOOKS_POLICY_BLOCK,
+  renderHooksStarterPolicy,
+  hooksCommand
+};
+//# sourceMappingURL=chunk-F73VDY3W.js.map

package/dist/chunk-F73VDY3W.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/hooks.ts"],"sourcesContent":["/**\n * `okgate hooks install|uninstall|status [--project|--user] [--client claude|codex|gemini]`\n *\n * Install writes the coding agent's pre-execution hook entry (Claude Code `PreToolUse`, Codex\n * `PreToolUse`, Gemini CLI `BeforeTool`) pointing at `okgate hook pre-tool-use`, and makes\n * sure the policy has a `hooks:` block in dry-run. Uninstall removes only okgate's entries.\n */\nimport { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join, relative, resolve } from \"node:path\";\nimport {\n  LEGACY_POLICY_FILE,\n  LEGACY_STATE_DIR,\n  POLICY_FILE,\n  STATE_DIR,\n  type HookClient,\n} from \"@agentwares/agentguard-core\";\nimport { findPolicyFile } from \"@agentwares/agentguard-core/node\";\nimport { flagBool, flagList, flagNumber, flagString, type ParsedArgs } from \"../args.js\";\nimport { homeFrom, type Io } from \"../context.js\";\nimport {\n  CLIENT_ALIASES,\n  hookTarget,\n  installHook,\n  installedHandlers,\n  uninstallHook,\n  type InstallScope,\n} from \"../hooks/clients.js\";\nimport { npxCommand } from \"../install.js\";\nimport { version } from \"../version.js\";\n\n/** `~/.okgate/okgate.yaml`, or the `~/.agentguard/agentguard.yaml` an earlier install wrote. */\nexport function userPolicyPath(home: string): string {\n  const next = join(home, STATE_DIR, POLICY_FILE);\n  const legacy = join(home, LEGACY_STATE_DIR, LEGACY_POLICY_FILE);\n  return !existsSync(next) && existsSync(legacy) ? legacy : next;\n}\n\n/** The commented `hooks:` block: the file people read, so every knob explains itself. */\nexport const HOOKS_POLICY_BLOCK = `\n# Hook mode: your coding agent's own shell commands and file edits (Claude Code, Codex, Gemini CLI),\n# checked before they run. \\`okgate hooks install\\` wired it; \\`okgate report\\` shows the decisions.\nhooks:\n  # dry-run: every decision is logged and nothing is blocked. Read \\`okgate report\\`, then set\n  # enforce. The kill switch (\\`okgate kill\\`) stops guarded calls in both modes.\n  mode: dry-run\n  # Irreversible commands run only on a turn a person typed: after the session's previous\n  # irreversible command, recent, and naming the action (\"push it\", or \"yes\" to \"shall I push?\").\n  # Text the model writes, tool output and injected messages never count. Otherwise the agent\n  # gets APPROVAL_REQUIRED and an id; \\`okgate approve <id>\\` lets that exact command run once.\n  # Built in: git-push, merge, tag-delete, rm-outside-workspace, publish, send, guard-config.\n  irreversible:\n    builtins: true\n    window_s: 1800          # the authorizing turn is at most 30 minutes old\n    require_mention: true   # ...and names the action\n    require_origin: false   # true: only entries Claude Code labels as typed by a person\n    mentions: {}            # extra words per class, e.g. { git-push: [deploy] }\n    rules: []\n    #  - name: deploy\n    #    shell: [\"vercel --prod*\", \"fly deploy*\"]\n    #    mentions: [deploy]\n  shell:\n    deny: []                # e.g. [\"terraform destroy*\", \"curl * | sh\"]\n    approval: []            # e.g. [\"kubectl delete *\"]\n  paths:\n    deny: []                # e.g. [\".env\", \"*.pem\"]\n    approval: []            # e.g. [\"**/migrations/**\"]\n`;\n\n/** A policy for a project that has no okgate.yaml yet: hooks only, no MCP upstreams. */\nexport function renderHooksStarterPolicy(generatedAt = new Date()): string {\n  return `# okgate.yaml — generated by \\`okgate hooks install\\` on ${generatedAt.toISOString().slice(0, 10)}\n# Docs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli#hook-mode-a-coding-agents-own-commands\nversion: 1\n\n# MCP proxy mode (okgate init) reads upstreams; hook mode needs none.\nmode: dry-run\nupstreams: []\n${HOOKS_POLICY_BLOCK}\n# Kill switch: \\`okgate kill\\` creates this file; every guarded call is refused until\n# \\`okgate resume\\`. OKGATE_KILL=1 (or AGENTGUARD_KILL=1) in the environment does the same.\nkill:\n  file: .okgate/KILL\n\n# Hash-chained JSONL of every decision; \\`okgate verify\\` proves it was not edited.\naudit:\n  path: .okgate/audit.jsonl\n  redact: true\n`;\n}\n\nfunction quoteArg(arg: string): string {\n  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(arg) ? arg : JSON.stringify(arg);\n}\n\nfunction clientsFrom(args: ParsedArgs): HookClient[] {\n  const names = flagList(args, \"client\");\n  if (names.length === 0) return [\"claude-code\"];\n  if (names.includes(\"all\")) return [\"claude-code\", \"codex\", \"gemini-cli\"];\n  return names.map((n) => {\n    const c = CLIENT_ALIASES[n.trim()];\n    if (!c) throw new Error(`unknown --client \"${n}\" (claude, codex, gemini or all)`);\n    return c;\n  });\n}\n\nfunction hasTopLevelHooks(yamlText: string): boolean {\n  return /^hooks\\s*:/m.test(yamlText);\n}\n\nexport async function hooksCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const sub = args.positionals[0] ?? \"status\";\n  const scope: InstallScope = flagBool(args, \"user\") ? \"user\" : \"project\";\n  const home = homeFrom(io);\n  const where = { cwd: io.cwd, home };\n  const rel = (p: string): string => {\n    const r = relative(io.cwd, p);\n    return r.startsWith(\"..\") ? p : r || \".\";\n  };\n  const clients = clientsFrom(args);\n  const named = flagString(args, \"config\");\n  const policyPath =\n    named !== undefined\n      ? resolve(io.cwd, named)\n      : scope === \"user\"\n        ? userPolicyPath(home)\n        : findPolicyFile(io.cwd);\n  const base = flagString(args, \"command\") ?? npxCommand(version());\n  const commandFor = (client: HookClient): string => {\n    let cmd = `${base} hook pre-tool-use --client ${client === \"claude-code\" ? \"claude\" : client === \"gemini-cli\" ? \"gemini\" : \"codex\"}`;\n    if (flagString(args, \"config\")) cmd += ` --config ${quoteArg(policyPath)}`;\n    else if (scope === \"user\") cmd += ` --fallback-config ${quoteArg(policyPath)}`;\n    return cmd;\n  };\n  const timeoutS = Math.max(30, flagNumber(args, \"timeout\") ?? 30);\n\n  if (sub === \"install\") {\n    // the policy first: a hook with no policy to read guards nothing\n    if (!existsSync(policyPath)) {\n      mkdirSync(dirname(policyPath), { recursive: true });\n      writeFileSync(policyPath, renderHooksStarterPolicy());\n      io.out(`wrote   ${rel(policyPath)} (hooks.mode: dry-run)`);\n    } else if (!hasTopLevelHooks(readFileSync(policyPath, \"utf8\"))) {\n      appendFileSync(policyPath, HOOKS_POLICY_BLOCK);\n      io.out(`added   a hooks: block to ${rel(policyPath)} (hooks.mode: dry-run)`);\n    } else io.out(`kept    ${rel(policyPath)} (it already has a hooks: block)`);\n\n    for (const client of clients) {\n      const target = hookTarget(client, scope, where, commandFor(client), timeoutS);\n      const { status, backup } = installHook(target);\n      const verb =\n        status === \"unchanged\" ? \"kept   \" : status === \"updated\" ? \"updated\" : \"added  \";\n      io.out(\n        `${verb} ${target.label} ${target.event} hook in ${rel(target.settingsPath)}${backup ? ` (backup: ${rel(backup)})` : \"\"}`,\n      );\n      if (target.note) io.out(`        ${target.note}`);\n    }\n\n    if (scope === \"project\" && existsSync(join(io.cwd, \".git\"))) {\n      const gitignore = join(io.cwd, \".gitignore\");\n      const text = existsSync(gitignore) ? readFileSync(gitignore, \"utf8\") : \"\";\n      if (!/^\\/?\\.okgate\\/?$/m.test(text)) {\n        appendFileSync(gitignore, `${text && !text.endsWith(\"\\n\") ? \"\\n\" : \"\"}.okgate/\\n`);\n        io.out(`added   .okgate/ to .gitignore (approvals, counters and the audit log stay local)`);\n      }\n    }\n\n    io.out(\"\");\n    io.out(\"Next:\");\n    io.out(\"  1. start a new session of your coding agent (hooks are read at start)\");\n    io.out(\"  2. work as usual — hooks.mode is dry-run: decisions are logged, nothing is blocked\");\n    io.out(\"  3. okgate report    # what enforce mode would have stopped, and why\");\n    io.out(`  4. set \\`hooks.mode: enforce\\` in ${rel(policyPath)} when it looks right`);\n    io.out(\"  undo: okgate hooks uninstall\" + (scope === \"user\" ? \" --user\" : \"\"));\n    return 0;\n  }\n\n  if (sub === \"uninstall\") {\n    let total = 0;\n    for (const client of flagString(args, \"client\")\n      ? clients\n      : ([\"claude-code\", \"codex\", \"gemini-cli\"] as HookClient[])) {\n      const target = hookTarget(client, scope, where, commandFor(client), timeoutS);\n      const removed = uninstallHook(target);\n      total += removed;\n      if (removed) io.out(`removed ${target.label} hook from ${rel(target.settingsPath)}`);\n    }\n    if (total === 0) io.out(`no okgate hooks in ${scope}-level settings`);\n    else\n      io.out(\n        `kept    ${rel(policyPath)} and its state directory (${STATE_DIR}/ or ${LEGACY_STATE_DIR}/); delete them yourself if you want them gone`,\n      );\n    return 0;\n  }\n\n  if (sub === \"status\") {\n    for (const s of [\"project\", \"user\"] as InstallScope[]) {\n      for (const client of [\"claude-code\", \"codex\", \"gemini-cli\"] as HookClient[]) {\n        const target = hookTarget(client, s, where, \"\", timeoutS);\n        let handlers: Record<string, unknown>[];\n        try {\n          handlers = installedHandlers(target);\n        } catch (err) {\n          io.out(\n            `${s.padEnd(7)} ${target.label.padEnd(11)} unreadable: ${err instanceof Error ? err.message : String(err)}`,\n          );\n          continue;\n        }\n        io.out(\n          `${s.padEnd(7)} ${target.label.padEnd(11)} ${handlers.length ? `installed: ${String(handlers[0]!.command)}` : \"—\"}  (${rel(target.settingsPath)})`,\n        );\n      }\n    }\n    return 0;\n  }\n\n  io.err(\n    \"usage: okgate hooks install|uninstall|status [--project|--user] [--client claude|codex|gemini|all] [--command cmd] [--config path]\",\n  );\n  return 1;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAOA,SAAS,gBAAgB,YAAY,WAAW,cAAc,qBAAqB;AACnF,SAAS,SAAS,MAAM,UAAU,eAAe;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,sBAAsB;AAexB,SAAS,eAAe,MAAsB;AACnD,QAAM,OAAO,KAAK,MAAM,WAAW,WAAW;AAC9C,QAAM,SAAS,KAAK,MAAM,kBAAkB,kBAAkB;AAC9D,SAAO,CAAC,WAAW,IAAI,KAAK,WAAW,MAAM,IAAI,SAAS;AAC5D;AAGO,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+B3B,SAAS,yBAAyB,cAAc,oBAAI,KAAK,GAAW;AACzE,SAAO,iEAA4D,YAAY,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzG,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWpB;AAEA,SAAS,SAAS,KAAqB;AACrC,SAAO,2BAA2B,KAAK,GAAG,IAAI,MAAM,KAAK,UAAU,GAAG;AACxE;AAEA,SAAS,YAAY,MAAgC;AACnD,QAAM,QAAQ,SAAS,MAAM,QAAQ;AACrC,MAAI,MAAM,WAAW,EAAG,QAAO,CAAC,aAAa;AAC7C,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO,CAAC,eAAe,SAAS,YAAY;AACvE,SAAO,MAAM,IAAI,CAAC,MAAM;AACtB,UAAM,IAAI,eAAe,EAAE,KAAK,CAAC;AACjC,QAAI,CAAC,EAAG,OAAM,IAAI,MAAM,qBAAqB,CAAC,kCAAkC;AAChF,WAAO;AAAA,EACT,CAAC;AACH;AAEA,SAAS,iBAAiB,UAA2B;AACnD,SAAO,cAAc,KAAK,QAAQ;AACpC;AAEA,eAAsB,aAAa,MAAkB,IAAyB;AAC5E,QAAM,MAAM,KAAK,YAAY,CAAC,KAAK;AACnC,QAAM,QAAsB,SAAS,MAAM,MAAM,IAAI,SAAS;AAC9D,QAAM,OAAO,SAAS,EAAE;AACxB,QAAM,QAAQ,EAAE,KAAK,GAAG,KAAK,KAAK;AAClC,QAAM,MAAM,CAAC,MAAsB;AACjC,UAAM,IAAI,SAAS,GAAG,KAAK,CAAC;AAC5B,WAAO,EAAE,WAAW,IAAI,IAAI,IAAI,KAAK;AAAA,EACvC;AACA,QAAM,UAAU,YAAY,IAAI;AAChC,QAAM,QAAQ,WAAW,MAAM,QAAQ;AACvC,QAAM,aACJ,UAAU,SACN,QAAQ,GAAG,KAAK,KAAK,IACrB,UAAU,SACR,eAAe,IAAI,IACnB,eAAe,GAAG,GAAG;AAC7B,QAAM,OAAO,WAAW,MAAM,SAAS,KAAK,WAAW,QAAQ,CAAC;AAChE,QAAM,aAAa,CAAC,WAA+B;AACjD,QAAI,MAAM,GAAG,IAAI,+BAA+B,WAAW,gBAAgB,WAAW,WAAW,eAAe,WAAW,OAAO;AAClI,QAAI,WAAW,MAAM,QAAQ,EAAG,QAAO,aAAa,SAAS,UAAU,CAAC;AAAA,aAC/D,UAAU,OAAQ,QAAO,sBAAsB,SAAS,UAAU,CAAC;AAC5E,WAAO;AAAA,EACT;AACA,QAAM,WAAW,KAAK,IAAI,IAAI,WAAW,MAAM,SAAS,KAAK,EAAE;AAE/D,MAAI,QAAQ,WAAW;AAErB,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,gBAAU,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,oBAAc,YAAY,yBAAyB,CAAC;AACpD,SAAG,IAAI,WAAW,IAAI,UAAU,CAAC,wBAAwB;AAAA,IAC3D,WAAW,CAAC,iBAAiB,aAAa,YAAY,MAAM,CAAC,GAAG;AAC9D,qBAAe,YAAY,kBAAkB;AAC7C,SAAG,IAAI,6BAA6B,IAAI,UAAU,CAAC,wBAAwB;AAAA,IAC7E,MAAO,IAAG,IAAI,WAAW,IAAI,UAAU,CAAC,kCAAkC;AAE1E,eAAW,UAAU,SAAS;AAC5B,YAAM,SAAS,WAAW,QAAQ,OAAO,OAAO,WAAW,MAAM,GAAG,QAAQ;AAC5E,YAAM,EAAE,QAAQ,OAAO,IAAI,YAAY,MAAM;AAC7C,YAAM,OACJ,WAAW,cAAc,YAAY,WAAW,YAAY,YAAY;AAC1E,SAAG;AAAA,QACD,GAAG,IAAI,IAAI,OAAO,KAAK,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,YAAY,CAAC,GAAG,SAAS,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE;AAAA,MACzH;AACA,UAAI,OAAO,KAAM,IAAG,IAAI,WAAW,OAAO,IAAI,EAAE;AAAA,IAClD;AAEA,QAAI,UAAU,aAAa,WAAW,KAAK,GAAG,KAAK,MAAM,CAAC,GAAG;AAC3D,YAAM,YAAY,KAAK,GAAG,KAAK,YAAY;AAC3C,YAAM,OAAO,WAAW,SAAS,IAAI,aAAa,WAAW,MAAM,IAAI;AACvE,UAAI,CAAC,oBAAoB,KAAK,IAAI,GAAG;AACnC,uBAAe,WAAW,GAAG,QAAQ,CAAC,KAAK,SAAS,IAAI,IAAI,OAAO,EAAE;AAAA,CAAY;AACjF,WAAG,IAAI,mFAAmF;AAAA,MAC5F;AAAA,IACF;AAEA,OAAG,IAAI,EAAE;AACT,OAAG,IAAI,OAAO;AACd,OAAG,IAAI,yEAAyE;AAChF,OAAG,IAAI,2FAAsF;AAC7F,OAAG,IAAI,uEAAuE;AAC9E,OAAG,IAAI,uCAAuC,IAAI,UAAU,CAAC,sBAAsB;AACnF,OAAG,IAAI,oCAAoC,UAAU,SAAS,YAAY,GAAG;AAC7E,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,aAAa;AACvB,QAAI,QAAQ;AACZ,eAAW,UAAU,WAAW,MAAM,QAAQ,IAC1C,UACC,CAAC,eAAe,SAAS,YAAY,GAAoB;AAC5D,YAAM,SAAS,WAAW,QAAQ,OAAO,OAAO,WAAW,MAAM,GAAG,QAAQ;AAC5E,YAAM,UAAU,cAAc,MAAM;AACpC,eAAS;AACT,UAAI,QAAS,IAAG,IAAI,WAAW,OAAO,KAAK,cAAc,IAAI,OAAO,YAAY,CAAC,EAAE;AAAA,IACrF;AACA,QAAI,UAAU,EAAG,IAAG,IAAI,sBAAsB,KAAK,iBAAiB;AAAA;AAElE,SAAG;AAAA,QACD,WAAW,IAAI,UAAU,CAAC,6BAA6B,SAAS,QAAQ,gBAAgB;AAAA,MAC1F;AACF,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,UAAU;AACpB,eAAW,KAAK,CAAC,WAAW,MAAM,GAAqB;AACrD,iBAAW,UAAU,CAAC,eAAe,SAAS,YAAY,GAAmB;AAC3E,cAAM,SAAS,WAAW,QAAQ,GAAG,OAAO,IAAI,QAAQ;AACxD,YAAI;AACJ,YAAI;AACF,qBAAW,kBAAkB,MAAM;AAAA,QACrC,SAAS,KAAK;AACZ,aAAG;AAAA,YACD,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,MAAM,OAAO,EAAE,CAAC,gBAAgB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UAC3G;AACA;AAAA,QACF;AACA,WAAG;AAAA,UACD,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,MAAM,OAAO,EAAE,CAAC,IAAI,SAAS,SAAS,cAAc,OAAO,SAAS,CAAC,EAAG,OAAO,CAAC,KAAK,QAAG,MAAM,IAAI,OAAO,YAAY,CAAC;AAAA,QACjJ;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,KAAG;AAAA,IACD;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-IEJK7N3B.js

@@ -0,0 +1,275 @@
+import {
+  describeConfigPath,
+  detectClientConfigs,
+  readServers,
+  restoreClientConfig,
+  rewriteClientConfig,
+  serversToUpstreams
+} from "./chunk-OM5L7A32.js";
+import {
+  probeUpstreams
+} from "./chunk-DEVXG3IB.js";
+import {
+  RUN
+} from "./chunk-XPNBYSIN.js";
+import {
+  flagBool,
+  flagString,
+  homeFrom,
+  policyPathFrom
+} from "./chunk-4WTFMFRY.js";
+
+// src/commands/init.ts
+import { existsSync, writeFileSync } from "fs";
+import { relative, resolve } from "path";
+import YAML from "yaml";
+function dump(value, indent = 0) {
+  const text = YAML.stringify(value, { indent: 2, lineWidth: 100 }).trimEnd();
+  const pad = " ".repeat(indent);
+  return text.split("\n").map((l) => pad + l).join("\n");
+}
+function flow(list) {
+  return list.length === 0 ? "[]" : `[${list.map((s) => JSON.stringify(s)).join(", ")}]`;
+}
+function renderStarterPolicy(opts) {
+  const tools = opts.tools ?? [];
+  const unknown = tools.filter((t) => t.classification.class === "unknown").map((t) => t.name);
+  const destructive = tools.filter((t) => t.classification.destructive || t.classification.verb === "delete").map((t) => t.name);
+  const spend = tools.filter((t) => t.classification.class === "spend").map((t) => t.name);
+  const date = (opts.generatedAt ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const counts = tools.reduce(
+    (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
+    {}
+  );
+  const detected = tools.length === 0 ? ["#   (no upstreams probed \u2014 run `okgate tools` after fixing the upstreams above)"] : tools.map(
+    (t) => `#   ${t.name.padEnd(36)} ${t.classification.class.padEnd(8)} ${t.classification.verb.padEnd(8)} ${t.classification.source}: ${t.classification.reason}`
+  );
+  const probeNotes = (opts.probeErrors ?? []).map((e) => `#   ! ${e}`);
+  const upstreamsYaml = opts.upstreams.length ? dump({ upstreams: opts.upstreams.map(cleanUpstream) }) : 'upstreams: []\n  # - name: crm\n  #   url: https://mcp.example.com/mcp\n  #   auth: ${CRM_TOKEN}\n  # - name: files\n  #   command: npx\n  #   args: [-y, "@modelcontextprotocol/server-filesystem", "."]';
+  return `# okgate.yaml \u2014 generated by \`okgate init\` on ${date}
+# Every knob is explained inline. Docs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli#policy
+version: 1
+
+# dry-run: reads pass through; writes and spends are FAKED (plausible success, nothing executes)
+# and recorded. Run your agent once, then \`okgate report\` and \`okgate diff\`.
+# Flip to \`enforce\` when the diff looks right. Caps and the loop breaker apply in both modes.
+mode: ${opts.mode ?? "dry-run"}
+
+# The servers your agent used to talk to directly. okgate connects to them and holds their
+# credentials; your agent only talks to okgate. Use \${ENV_VAR} for secrets.
+${upstreamsYaml}
+
+# Detected tools (${tools.length}${tools.length ? `: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")}` : ""}):
+${[...detected, ...probeNotes].join("\n")}
+# readOnlyHint annotations and verb heuristics classify most tools. List anything that is wrong here;
+# these patterns win over annotations. \`*\` matches anything.
+classify:
+  read: []
+  write: ${flow(unknown)}${unknown.length ? "   # could not be classified \u2014 treated as writes; move to read: if they only read" : ""}
+  spend: ${flow(spend)}
+  unknown: write   # a tool nobody can classify counts as a write (alternatives: read | block)
+
+# Blast-radius caps. The call that would exceed a cap gets CAP_EXCEEDED with the remaining budget.
+# \`writes\` counts every write or spend; \`deletes\`/\`emails\` count the subsets matched by \`counters\`.
+caps:
+  per_run:
+    tool_calls: 400
+    writes: 50
+    deletes: 10
+    emails: 5
+    spend_usd: 25
+  per_day:
+    spend_usd: 200
+
+# Dollar amounts. Declare how to read the amount from a spend tool's arguments; results reporting
+# cost_usd / amount_usd are picked up automatically. Unknown spend tools cost \`default_usd\`.
+spend:
+  tools: {}
+  #  stripe_create_charge: { amount_arg: amount, divisor: 100, currency_arg: currency }
+  #  openai_*: { fixed_usd: 0.01 }
+  default_usd: 0
+
+# Semantic loop breaker: the same (tool, normalized arguments) ${3} times in the last 30 calls, or a
+# repeating A\u2192B\u2192A\u2192B cycle, returns LOOP_DETECTED. Timestamps, ids and whitespace are ignored.
+loop:
+  window: 30
+  max_repeats: 3
+  max_cycle_len: 4
+  max_read_repeats: 10
+
+# Always fake these, even in enforce mode. Remove entries as you gain trust.
+dry_run:
+  tools: []
+  synthesize: true
+
+# Destructive actions that need a human. The agent gets APPROVAL_REQUIRED with an id; you run
+# \`okgate approve <id>\` (or click the link in Slack); the agent retries the identical call once.
+approval:
+  tools: ${flow(destructive)}
+  wait_s: 0          # > 0 holds the call open this long waiting for the decision
+  ttl_s: 3600
+  # notify:
+  #   slack: \${SLACK_WEBHOOK_URL}
+
+# Kill switch: \`okgate kill\` creates this file (or POST /kill on the HTTP proxy); every call
+# returns KILLED until \`okgate resume\`. OKGATE_KILL=1 (or AGENTGUARD_KILL=1) in the environment does the same.
+kill:
+  file: .okgate/KILL
+
+# Scoped agent keys for the HTTP proxy: \`okgate key create deployer --allow 'crm_get_*'\`.
+# Only the key's hash is stored here; the agent sends the key as a Bearer token.
+agents: []
+
+# Alerts on halts (Slack incoming webhook or any HTTPS endpoint; signed with X-Agentwares-Signature).
+# alerts:
+#   slack: \${SLACK_WEBHOOK_URL}
+#   on: [LOOP_DETECTED, CAP_EXCEEDED, KILLED, APPROVAL_REQUIRED]
+
+# Hash-chained JSONL of every call; \`okgate verify\` proves it was not edited.
+audit:
+  path: .okgate/audit.jsonl
+  redact: true
+  include_results: false
+`;
+}
+function cleanUpstream(u) {
+  const out = { name: u.name };
+  if (u.url) {
+    out.url = u.url;
+    if (Object.keys(u.headers).length) out.headers = u.headers;
+  } else {
+    out.command = u.command;
+    if (u.args.length) out.args = u.args;
+    if (Object.keys(u.env).length) out.env = u.env;
+    if (u.cwd) out.cwd = u.cwd;
+  }
+  return out;
+}
+async function initCommand(args, io) {
+  const policyPath = policyPathFrom(args, io);
+  const explicit = flagString(args, "client");
+  const configs = explicit ? [describeConfigPath(resolve(io.cwd, explicit))] : detectClientConfigs(io.cwd, homeFrom(io), io.env);
+  const rel = (p) => {
+    const r = relative(io.cwd, p);
+    return r.startsWith("..") ? p : r || ".";
+  };
+  if (flagBool(args, "undo")) {
+    let restored = 0;
+    for (const c of configs) {
+      if (restoreClientConfig(c)) {
+        io.out(`restored ${rel(c.path)} from backup`);
+        restored += 1;
+      }
+    }
+    if (restored === 0)
+      io.err(
+        "nothing to undo (no *.okgate-backup or *.agentguard-backup files next to your MCP configs)"
+      );
+    return 0;
+  }
+  const projectLevel = configs.filter((c) => c.path.startsWith(io.cwd + "/"));
+  const userLevel = configs.filter((c) => !projectLevel.includes(c));
+  let chosen;
+  if (explicit) chosen = configs;
+  else if (flagBool(args, "all")) chosen = configs;
+  else chosen = projectLevel.slice(0, 1);
+  if (!explicit && !flagBool(args, "all")) {
+    for (const c of userLevel)
+      io.out(
+        `found   ${c.path} (${c.label}, user-level) \u2014 not touched; pass --client ${JSON.stringify(c.path)} to route it through okgate`
+      );
+  }
+  if (!chosen.every((c) => existsSync(c.path))) {
+    io.err(`no MCP config at ${chosen.map((c) => c.path).join(", ")}`);
+    return 1;
+  }
+  const servers = {};
+  for (const c of chosen) {
+    const found = readServers(c);
+    io.out(
+      `found   ${rel(c.path)} (${c.label}) \u2192 ${Object.keys(found).length} server${Object.keys(found).length === 1 ? "" : "s"}: ${Object.keys(found).join(", ") || "none"}`
+    );
+    for (const [name, entry] of Object.entries(found))
+      if (!(name in servers)) servers[name] = entry;
+  }
+  if (chosen.length === 0)
+    io.out(
+      "found   no MCP config (Claude Code .mcp.json, Cursor, VS Code, Claude Desktop, Windsurf, Gemini CLI) \u2014 writing a policy with no upstreams"
+    );
+  const { upstreams, skipped } = serversToUpstreams(servers);
+  for (const s of skipped) io.err(`skipped ${s.name}: ${s.reason}`);
+  if (skipped.some((s) => s.reason.includes("already")) && upstreams.length === 0 && existsSync(policyPath)) {
+    io.out(
+      `already initialized: ${rel(policyPath)} exists and ${chosen.map((c) => rel(c.path)).join(", ")} already points at okgate`
+    );
+    return 0;
+  }
+  let probed = [];
+  const probeErrors = [];
+  if (flagBool(args, "probe") !== false && upstreams.length > 0) {
+    io.out(`probing ${upstreams.length} upstream${upstreams.length === 1 ? "" : "s"}\u2026`);
+    const result = await probeUpstreams(upstreams, {
+      log: () => void 0,
+      env: io.env,
+      timeoutMs: 2e4
+    });
+    probed = result.tools;
+    for (const u of result.upstreams) {
+      if (u.connected) io.out(`        ${u.name}: ${u.tools} tools`);
+      else {
+        io.err(
+          `        ${u.name}: could not connect (${u.error}) \u2014 the proxy will keep retrying at start; fix the entry in okgate.yaml`
+        );
+        probeErrors.push(`${u.name}: ${u.error}`);
+      }
+    }
+  }
+  const mode = flagString(args, "mode") ?? "dry-run";
+  if (existsSync(policyPath) && !flagBool(args, "force")) {
+    io.out(`kept    ${rel(policyPath)} (exists; pass --force to regenerate)`);
+  } else {
+    writeFileSync(policyPath, renderStarterPolicy({ upstreams, tools: probed, mode, probeErrors }));
+    const counts = probed.reduce(
+      (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),
+      {}
+    );
+    io.out(
+      `wrote   ${rel(policyPath)} (mode: ${mode}, ${upstreams.length} upstream${upstreams.length === 1 ? "" : "s"}${probed.length ? `, ${probed.length} tools: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")}` : ""})`
+    );
+  }
+  if (flagBool(args, "rewrite") !== false) {
+    for (const c of chosen) {
+      if (resolve(c.path) === resolve(policyPath)) {
+        throw new Error(
+          `refusing: ${rel(c.path)} is both the policy file (--config) and a client config. Rewriting it would replace the policy with the proxy entry and leave the proxy pointing at itself. Use --config for the policy path and --client for the client's config, or let --config default to okgate.yaml.`
+        );
+      }
+      const { backup, replaced } = rewriteClientConfig(c, policyPath, {
+        agent: flagString(args, "agent")
+      });
+      io.out(
+        `rewrote ${rel(c.path)} \u2192 ${replaced.length ? `${replaced.join(", ")} now go through` : "points at"} \`${RUN} proxy\` (backup: ${rel(backup)})`
+      );
+    }
+  }
+  io.out("");
+  io.out("Next:");
+  io.out(
+    `  1. restart your MCP client so it re-reads ${chosen.map((c) => rel(c.path)).join(", ") || "its config"}`
+  );
+  io.out(
+    `  2. run your agent once \u2014 ${mode === "dry-run" ? "writes are faked; nothing executes upstream" : "enforce mode: caps, loop breaker and approvals are live"}`
+  );
+  io.out("  3. okgate report    # what this run would have destroyed / spent");
+  io.out("     okgate diff      # the record-by-record mutation diff");
+  if (mode === "dry-run")
+    io.out(`  4. set \`mode: enforce\` in ${rel(policyPath)} when it looks right`);
+  io.out("  undo any time: okgate init --undo");
+  return 0;
+}
+
+export {
+  renderStarterPolicy,
+  initCommand
+};
+//# sourceMappingURL=chunk-IEJK7N3B.js.map