@agentwares/agentguard 0.1.9 → 0.1.10

package/dist/chunk-ZG4LGUJE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/connect.ts","../src/commands/control.ts","../src/commands/hook.ts","../src/hooks/transcript-file.ts","../src/commands/keys.ts","../src/commands/permission-diff.ts","../src/commands/report.ts","../src/cli.ts"],"sourcesContent":["/**\n * `okgate connect <key>` — point this machine's MCP client at a hosted okgate proxy.\n *\n * The OSS CLI enforces policy locally and needs no account. The hosted tiers move that\n * enforcement server-side, so \"connecting\" is not an install: it is resolving a key to the\n * customer's own proxy URL and writing one remote MCP server into the client config.\n *\n * Everything the command prints comes from the server, so the CLI never has to know the\n * shape of a proxy id, a band, or the URL scheme — it stays correct when those change.\n */\nimport { existsSync } from \"node:fs\";\nimport { relative } from \"node:path\";\nimport { flagBool, flagString, type ParsedArgs } from \"../args.js\";\nimport {\n  describeConfigPath,\n  detectClientConfigs,\n  isGeminiConfig,\n  LEGACY_PROXY_SERVER_NAME,\n  mergeServerIntoConfig,\n  PROXY_SERVER_NAME,\n  type ClientConfigFile,\n  type ServerEntry,\n} from \"../configs.js\";\nimport { homeFrom, type Io } from \"../context.js\";\nimport { envTwin } from \"@agentwares/agentguard-core\";\n\nexport const DEFAULT_PROXY_URL = \"https://agentwares-agentguard-proxy.vercel.app\";\n\n/** What POST /connect answers with. Optional fields are tolerated so an older CLI still works. */\ninterface ConnectResponse {\n  proxyId: string;\n  slug: string;\n  mode: string;\n  mcpUrl: string;\n  headers: Record<string, string>;\n  upstreams?: string[];\n  band?: { tier: string; quantity: number };\n  dashboardUrl?: string;\n  mcpServers: Record<string, ServerEntry>;\n  claudeCode?: string;\n}\n\ninterface StructuredError {\n  code: string;\n  cause: string;\n  fix?: string;\n  retryable?: boolean;\n}\n\nfunction fail(e: StructuredError): never {\n  throw e;\n}\n\nexport async function connectCommand(\n  args: ParsedArgs,\n  io: Io,\n  fetchImpl: typeof fetch = fetch,\n): Promise<number> {\n  const key = args.positionals[0] ?? envTwin(io.env, \"KEY\");\n  if (!key) {\n    io.err(\"usage: okgate connect <key> [--write] [--client <path>] [--url <proxy-url>]\");\n    io.err(\"  the key is on your dashboard; it starts with agk_\");\n    return 2;\n  }\n\n  const base = (\n    flagString(args, \"url\") ??\n    envTwin(io.env, \"PROXY_URL\") ??\n    DEFAULT_PROXY_URL\n  ).replace(/\\/+$/, \"\");\n\n  let res: Response;\n  try {\n    res = await fetchImpl(`${base}/connect`, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify({ key }),\n    });\n  } catch (err) {\n    // A network failure is the one retryable case here; everything else is a bad key or a bad URL.\n    fail({\n      code: \"PROXY_UNREACHABLE\",\n      cause: `could not reach ${base}: ${err instanceof Error ? err.message : String(err)}`,\n      fix: \"check the network, or pass --url if you run your own proxy\",\n      retryable: true,\n    });\n  }\n\n  const text = await res.text();\n  let body: unknown;\n  try {\n    body = JSON.parse(text);\n  } catch {\n    fail({\n      code: \"PROXY_BAD_RESPONSE\",\n      cause: `${base}/connect returned ${res.status} that was not JSON: ${text.slice(0, 200)}`,\n      fix: \"check --url points at an okgate proxy, not at the dashboard\",\n      retryable: false,\n    });\n  }\n  if (!res.ok) {\n    const e = body as Partial<StructuredError>;\n    fail({\n      code: e.code ?? \"CONNECT_REFUSED\",\n      cause: e.cause ?? `${base}/connect returned ${res.status}`,\n      fix: e.fix ?? \"check the key on your dashboard; revoked keys stop working immediately\",\n      retryable: e.retryable ?? false,\n    });\n  }\n  const conn = body as ConnectResponse;\n\n  if (flagBool(args, \"json\")) {\n    io.out(JSON.stringify(conn, null, 2));\n    return 0;\n  }\n\n  const rel = (p: string) => (p.startsWith(io.cwd + \"/\") ? relative(io.cwd, p) : p);\n  // a proxy deployed before the rename answers under the old key\n  const entry = conn.mcpServers[PROXY_SERVER_NAME] ??\n    conn.mcpServers[LEGACY_PROXY_SERVER_NAME] ?? {\n      type: \"http\",\n      url: conn.mcpUrl,\n      headers: conn.headers,\n    };\n\n  if (!flagBool(args, \"write\")) {\n    io.out(JSON.stringify({ mcpServers: { [PROXY_SERVER_NAME]: entry } }, null, 2));\n  } else {\n    const explicit = flagString(args, \"client\");\n    const configs = explicit\n      ? [describeConfigPath(explicit)]\n      : detectClientConfigs(io.cwd, homeFrom(io), io.env);\n    // Same rule as `init`: a user-level config affects every project on the machine, so it is\n    // only written when named explicitly.\n    const projectLevel = configs.filter((c) => c.path.startsWith(io.cwd + \"/\"));\n    let chosen: ClientConfigFile[];\n    if (explicit || flagBool(args, \"all\")) chosen = configs;\n    else chosen = projectLevel.slice(0, 1);\n\n    if (chosen.length === 0) {\n      io.err(\n        \"no MCP config found here (.mcp.json, .cursor/mcp.json, .vscode/mcp.json). Create one, or paste this into your client:\",\n      );\n      io.out(JSON.stringify({ mcpServers: { [PROXY_SERVER_NAME]: entry } }, null, 2));\n      return 1;\n    }\n    for (const c of chosen) {\n      if (!existsSync(c.path)) {\n        io.err(`no MCP config at ${c.path}`);\n        return 1;\n      }\n      // Gemini CLI takes Streamable HTTP as `httpUrl`; its `url` would be dialled as SSE.\n      const forClient: ServerEntry = isGeminiConfig(c)\n        ? { httpUrl: entry.url, ...(entry.headers ? { headers: entry.headers } : {}) }\n        : entry;\n      const { backup, replaced } = mergeServerIntoConfig(c, PROXY_SERVER_NAME, forClient, [\n        LEGACY_PROXY_SERVER_NAME,\n      ]);\n      io.out(\n        `${replaced ? \"updated\" : \"wrote  \"} ${rel(c.path)} (${c.label}) → ${PROXY_SERVER_NAME} = ${conn.mcpUrl}`,\n      );\n      io.out(`backup  ${rel(backup)}`);\n    }\n    for (const c of configs.filter((c) => !chosen.includes(c)))\n      io.out(\n        `found   ${c.path} (${c.label}, user-level) — not touched; pass --client ${JSON.stringify(c.path)} to write it too`,\n      );\n  }\n\n  const band = conn.band ? ` band=${conn.band.tier} (${conn.band.quantity} calls/mo)` : \"\";\n  io.out(`\\nproxy ${conn.slug} (${conn.proxyId}) mode=${conn.mode}${band}`);\n  if (conn.upstreams?.length) io.out(`upstreams: ${conn.upstreams.join(\", \")}`);\n  if (conn.dashboardUrl) io.out(`dashboard: ${conn.dashboardUrl}`);\n  if (conn.claudeCode) io.out(`claude code: ${conn.claudeCode}`);\n  if (!flagBool(args, \"write\"))\n    io.out(`\\nrun again with --write to add this to your MCP client config`);\n  return 0;\n}\n","/**\n * `okgate kill|resume|approve|deny|approvals` — the human side of the loop.\n */\nimport { KILL_ENV, LEGACY_KILL_ENV } from \"@agentwares/agentguard-core\";\nimport { flagBool, flagString, type ParsedArgs } from \"../args.js\";\nimport { createFileGuard, loadPolicyFor, readRegistration, type Io } from \"../context.js\";\n\nasync function pokeHttp(\n  io: Io,\n  reg: ReturnType<typeof readRegistration>,\n  path: string,\n  body?: unknown,\n): Promise<void> {\n  if (!reg) return;\n  try {\n    const res = await fetch(`${reg.baseUrl}${path}`, {\n      method: \"POST\",\n      headers: { Authorization: `Bearer ${reg.token}`, \"Content-Type\": \"application/json\" },\n      body: body === undefined ? undefined : JSON.stringify(body),\n      signal: AbortSignal.timeout(2000),\n    });\n    if (!res.ok)\n      io.err(\n        `running proxy at ${reg.baseUrl} answered ${res.status} (the file switch still applies)`,\n      );\n  } catch {\n    io.err(\n      `no proxy answering at ${reg.baseUrl} (stale ${reg.pid}?) — the file switch still applies`,\n    );\n  }\n}\n\nexport async function killCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });\n  const reason =\n    args.positionals.join(\" \") ||\n    flagString(args, \"reason\") ||\n    `okgate kill by ${io.env.USER ?? \"operator\"}`;\n  kill.kill(reason);\n  await pokeHttp(io, readRegistration(loaded), \"/kill\", { reason });\n  io.out(\n    `KILLED: ${kill.path} written — every tool call through this policy now returns KILLED. Clear with: okgate resume`,\n  );\n  return 0;\n}\n\nexport async function resumeCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });\n  kill.resume();\n  await pokeHttp(io, readRegistration(loaded), \"/resume\");\n  io.out(`resumed: ${kill.path} removed`);\n  for (const name of new Set([loaded.policy.kill.env, KILL_ENV, LEGACY_KILL_ENV]))\n    if (io.env[name] && io.env[name] !== \"0\" && io.env[name]!.toLowerCase() !== \"false\")\n      io.err(\n        `note: ${name} is set in this shell's environment; proxies started from it stay killed`,\n      );\n  return 0;\n}\n\nexport async function decideCommand(\n  decision: \"approved\" | \"denied\",\n  args: ParsedArgs,\n  io: Io,\n): Promise<number> {\n  const id = args.positionals[0];\n  if (!id) {\n    io.err(\n      `usage: okgate ${decision === \"approved\" ? \"approve\" : \"deny\"} <approval-id> [--by name] [--note text]`,\n    );\n    return 1;\n  }\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });\n  const record = await guard.decide(\n    id,\n    decision,\n    flagString(args, \"by\") ?? io.env.USER ?? \"cli\",\n    flagString(args, \"note\"),\n  );\n  if (!record) {\n    io.err(`no approval ${id} — pending ones: okgate approvals`);\n    return 1;\n  }\n  io.out(\n    `${record.status}: ${record.tool} (${record.id}, run ${record.run_id})${record.status === \"approved\" ? \" — the agent may now retry the identical call once\" : \"\"}`,\n  );\n  return 0;\n}\n\nexport async function approvalsCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });\n  const list = await guard.approvals.list(flagBool(args, \"all\") ? undefined : \"pending\");\n  if (flagBool(args, \"json\")) {\n    io.out(JSON.stringify(list, null, 2));\n    return 0;\n  }\n  if (list.length === 0) {\n    io.out(flagBool(args, \"all\") ? \"no approvals recorded\" : \"no pending approvals\");\n    return 0;\n  }\n  for (const r of list) {\n    io.out(\n      `${r.id}  ${r.status.padEnd(9)} ${r.tool}  run ${r.run_id}${r.agent ? ` agent ${r.agent}` : \"\"}  expires ${r.expires_at}`,\n    );\n    io.out(`  args: ${JSON.stringify(r.args).slice(0, 300)}`);\n    if (r.status === \"pending\") io.out(`  → okgate approve ${r.id}   |   okgate deny ${r.id}`);\n  }\n  return 0;\n}\n","/**\n * `okgate hook pre-tool-use` — what a coding agent's pre-execution hook runs for each shell\n * command, file edit and MCP tool call: Claude Code `PreToolUse`, Codex `PreToolUse`, Gemini CLI\n * `BeforeTool`. Reads the harness's JSON on stdin and answers in that harness's format on\n * stdout (nothing else may go to stdout).\n *\n * - allow: no output, exit 0. The harness's own permission flow still applies; okgate never\n *   answers \"allow\", so it can only take permissions away.\n * - deny: Claude Code / Codex `hookSpecificOutput.permissionDecision: \"deny\"`, Gemini CLI\n *   `decision: \"deny\"`, with the okgate error body (`code`, `cause`, `fix`, `retryable`) as\n *   the reason the model reads, and a one-line `systemMessage` for the person.\n * - dry-run would-have-stopped: a `systemMessage` only; the call runs.\n * - an error inside okgate: a `systemMessage` saying the call was NOT checked, exit 0. A\n *   broken policy file must not stop the agent; it must not pass silently either.\n */\nimport { existsSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport {\n  POLICY_FILES,\n  assessHookAction,\n  detectHookClient,\n  envTwin,\n  hookActionFromInput,\n  type HookClient,\n  type PreflightResult,\n} from \"@agentwares/agentguard-core\";\nimport { flagString, type ParsedArgs } from \"../args.js\";\nimport {\n  approvalUrlFor,\n  createFileGuard,\n  describeError,\n  homeFrom,\n  readRegistration,\n  type Io,\n} from \"../context.js\";\nimport { INSTALL } from \"../install.js\";\nimport { CLIENT_ALIASES, hookSettingsFiles } from \"../hooks/clients.js\";\nimport { humanTurnFromTranscript } from \"../hooks/transcript-file.js\";\nimport { loadPolicyFile } from \"@agentwares/agentguard-core/node\";\n\nconst RUN_PREFIX: Record<HookClient, string> = {\n  \"claude-code\": \"cc\",\n  codex: \"codex\",\n  \"gemini-cli\": \"gemini\",\n};\n\n/** Walk up from `start` to the filesystem root looking for okgate.yaml, or agentguard.yaml. */\nfunction findPolicyUpwards(start: string): string | undefined {\n  let dir = resolve(start);\n  for (let i = 0; i < 64; i += 1) {\n    for (const name of POLICY_FILES) {\n      const candidate = join(dir, name);\n      if (existsSync(candidate)) return candidate;\n    }\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n  return undefined;\n}\n\nfunction projectDir(io: Io, inputCwd: string | undefined): string | undefined {\n  return io.env.CLAUDE_PROJECT_DIR || io.env.GEMINI_PROJECT_DIR || inputCwd || undefined;\n}\n\n/**\n * --config → OKGATE_CONFIG / AGENTGUARD_CONFIG → okgate.yaml (or agentguard.yaml) at or above\n * the project → --fallback-config.\n */\nexport function resolveHookPolicy(\n  args: ParsedArgs,\n  io: Io,\n  inputCwd: string | undefined,\n): { path: string; found: \"flag\" | \"env\" | \"project\" | \"fallback\" } | undefined {\n  const flag = flagString(args, \"config\");\n  if (flag) return { path: resolve(io.cwd, flag), found: \"flag\" };\n  const fromEnv = envTwin(io.env, \"CONFIG\");\n  if (fromEnv) return { path: resolve(io.cwd, fromEnv), found: \"env\" };\n  const start = projectDir(io, inputCwd) ?? io.cwd;\n  const near = findPolicyUpwards(start);\n  if (near) return { path: near, found: \"project\" };\n  const fallback = flagString(args, \"fallback-config\");\n  if (fallback && existsSync(resolve(io.cwd, fallback)))\n    return { path: resolve(io.cwd, fallback), found: \"fallback\" };\n  return undefined;\n}\n\nfunction out(io: Io, value: unknown): void {\n  io.out(JSON.stringify(value));\n}\n\n/** A systemMessage reaches the person in all three harnesses and changes no decision. */\nfunction warn(io: Io, message: string): void {\n  out(io, { systemMessage: message });\n}\n\nfunction respond(\n  io: Io,\n  client: HookClient,\n  result: PreflightResult,\n  summary: string,\n  approveCommand: (id: string) => string,\n): void {\n  if (result.decision === \"deny\" && result.error) {\n    const e = result.error;\n    const reason = JSON.stringify(e);\n    const id = result.approvalId ? `, approval ${result.approvalId}` : \"\";\n    const approve =\n      e.code === \"APPROVAL_REQUIRED\" && result.approvalId\n        ? ` To let this exact command run once: ${approveCommand(result.approvalId)}`\n        : \"\";\n    const systemMessage = `okgate refused \"${summary.slice(0, 120)}\" (${e.code}${id}): ${e.cause}${approve}`;\n    if (client === \"gemini-cli\") out(io, { decision: \"deny\", reason, systemMessage });\n    else\n      out(io, {\n        hookSpecificOutput: {\n          hookEventName: \"PreToolUse\",\n          permissionDecision: \"deny\",\n          permissionDecisionReason: reason,\n        },\n        systemMessage,\n      });\n    return;\n  }\n  if (result.would) {\n    out(io, {\n      systemMessage: `okgate (hooks.mode: dry-run) would have stopped \"${summary.slice(0, 120)}\" with ${result.would.code}: ${result.would.cause} — it ran; nothing is blocked until hooks.mode is enforce`,\n    });\n  }\n}\n\nexport async function hookCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const event = args.positionals[0];\n  if (event !== \"pre-tool-use\") {\n    io.err(\n      \"usage: okgate hook pre-tool-use [--client claude|codex|gemini] [--config okgate.yaml] [--fallback-config path]\\n\" +\n        \"  run by a coding agent's pre-execution hook, with the hook's JSON on stdin; `okgate hooks install` sets it up\",\n    );\n    return 1;\n  }\n  const flagClient = flagString(args, \"client\");\n  let client: HookClient = (flagClient && CLIENT_ALIASES[flagClient]) || \"claude-code\";\n  try {\n    const raw = (await io.stdin?.()) ?? \"\";\n    const input = JSON.parse(raw) as Record<string, unknown>;\n    if (!flagClient) client = detectHookClient(input);\n    const inputCwd = typeof input.cwd === \"string\" ? input.cwd : undefined;\n    const policyRef = resolveHookPolicy(args, io, inputCwd);\n    if (!policyRef) return 0; // no okgate.yaml for this project: nothing to enforce\n    const loaded = loadPolicyFile(policyRef.path, { env: io.env, allowMissingEnv: true });\n    const action = hookActionFromInput(client, input, inputCwd ?? io.cwd);\n    if (!action) return 0;\n    const home = homeFrom(io);\n    const workspace =\n      projectDir(io, undefined) ??\n      (policyRef.found === \"project\" ? dirname(policyRef.path) : undefined) ??\n      action.cwd;\n    const tmpDirs = [\n      tmpdir(),\n      io.env.TMPDIR,\n      typeof input.scratchpad_dir === \"string\" ? input.scratchpad_dir : undefined,\n      \"/tmp\",\n      \"/private/tmp\",\n      \"/var/folders\",\n      \"/private/var/folders\",\n    ].filter((d): d is string => Boolean(d));\n    const ctx = {\n      workspace: resolve(workspace),\n      home,\n      tmpDirs,\n      stateDir: loaded.stateDir,\n      // both names: creating okgate.yaml beside agentguard.yaml would replace the policy read\n      guardFiles: [\n        loaded.path,\n        ...POLICY_FILES.map((name) => join(dirname(loaded.path), name)),\n        ...hookSettingsFiles({ cwd: resolve(workspace), home }),\n      ],\n      policyFile: basename(loaded.path),\n    };\n    const assessment = assessHookAction(loaded.policy, action, ctx);\n    const reg = readRegistration(loaded);\n    const { guard } = createFileGuard(loaded, {\n      env: io.env,\n      approvalUrl: approvalUrlFor(reg),\n      log: (line) => io.err(line),\n    });\n    const configHint =\n      policyRef.found === \"project\" && dirname(policyRef.path) === resolve(workspace)\n        ? \"\"\n        : ` --config ${JSON.stringify(policyRef.path)}`;\n    const approveCommand = (id: string): string => `${INSTALL} approve ${id}${configHint}`;\n    const result = await guard.preflight({\n      action,\n      assessment,\n      runId: `${RUN_PREFIX[client]}_${action.sessionId}`,\n      humanTurn: () =>\n        client === \"claude-code\"\n          ? humanTurnFromTranscript(action.transcriptPath, {\n              requireOrigin: loaded.policy.hooks.irreversible.require_origin,\n            })\n          : {\n              missing: `${client} transcripts are not a verified format for this check, so an irreversible command needs \\`okgate approve\\``,\n            },\n      approveCommand,\n    });\n    respond(io, client, result, assessment.summary, approveCommand);\n    return 0;\n  } catch (err) {\n    warn(\n      io,\n      `okgate hook error — this call was NOT checked: ${describeError(err).replace(/\\s+/g, \" \").slice(0, 400)}`,\n    );\n    return 0;\n  }\n}\n","/**\n * Read the end of a coding agent's transcript and find the latest turn a person typed. Long\n * sessions write tens of megabytes; the latest human turn is almost always near the end, so read\n * the last 1 MB first and widen only when it holds none.\n */\nimport { closeSync, existsSync, openSync, readSync, statSync } from \"node:fs\";\nimport { scanTranscript, type HumanTurn, type TranscriptScan } from \"@agentwares/agentguard-core\";\n\nconst STEPS = [1 << 20, 8 << 20, 64 << 20];\n\nexport interface TranscriptEvidence {\n  turn?: HumanTurn;\n  /** why there is no turn */\n  missing?: string;\n  scan?: TranscriptScan;\n}\n\nfunction readTail(path: string, bytes: number, size: number): string {\n  const length = Math.min(bytes, size);\n  const fd = openSync(path, \"r\");\n  try {\n    const buf = Buffer.alloc(length);\n    readSync(fd, buf, 0, length, size - length);\n    return buf.toString(\"utf8\");\n  } finally {\n    closeSync(fd);\n  }\n}\n\nexport function humanTurnFromTranscript(\n  path: string | undefined,\n  opts: { requireOrigin?: boolean } = {},\n): TranscriptEvidence {\n  if (!path) return { missing: \"the hook input carried no transcript_path\" };\n  if (!existsSync(path)) return { missing: `no transcript at ${path}` };\n  let size: number;\n  try {\n    size = statSync(path).size;\n  } catch (err) {\n    return {\n      missing: `transcript unreadable: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n  let scan: TranscriptScan | undefined;\n  for (const step of STEPS) {\n    try {\n      scan = scanTranscript(readTail(path, step, size), opts);\n    } catch (err) {\n      return {\n        missing: `transcript unreadable: ${err instanceof Error ? err.message : String(err)}`,\n      };\n    }\n    if (scan.turn || step >= size) break;\n  }\n  if (scan?.turn) return { turn: scan.turn, scan };\n  return {\n    missing:\n      size > STEPS[STEPS.length - 1]! ? \"none in the last 64 MB of the transcript\" : undefined,\n    scan,\n  };\n}\n","/**\n * `okgate key create|list|revoke` — scoped agent credentials. The proxy holds upstream tokens;\n * each agent gets its own `agk_…` key whose hash and scope live in okgate.yaml.\n */\nimport { readFileSync, writeFileSync } from \"node:fs\";\nimport YAML, { isMap, isSeq, YAMLSeq, type YAMLMap } from \"yaml\";\nimport { generateAgentKey, hashAgentKey } from \"@agentwares/agentguard-core\";\nimport { flagList, flagNumber, flagString, type ParsedArgs } from \"../args.js\";\nimport { policyPathFrom, type Io } from \"../context.js\";\n\nexport async function keyCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const [sub, name] = args.positionals;\n  const path = policyPathFrom(args, io);\n  const doc = YAML.parseDocument(readFileSync(path, \"utf8\"));\n  let agents = doc.get(\"agents\");\n  if (!isSeq(agents)) {\n    agents = new YAMLSeq();\n    doc.set(\"agents\", agents);\n  }\n  const seq = agents as YAMLSeq;\n  const items = seq.items.filter(isMap) as YAMLMap[];\n\n  if (sub === \"list\" || sub === undefined) {\n    if (items.length === 0)\n      io.out(\"no agents in okgate.yaml — create one: okgate key create <name> --allow 'crm_get_*'\");\n    for (const a of items) {\n      const allow = a.get(\"allow\");\n      io.out(\n        `${String(a.get(\"name\")).padEnd(20)} key: ${a.get(\"key_hash\") ? \"set\" : \"none (stdio --agent only)\"}  allow: ${isSeq(allow) ? allow.items.map(String).join(\", \") : \"all\"}`,\n      );\n    }\n    return 0;\n  }\n  if (!name) {\n    io.err(\n      \"usage: okgate key create <agent> [--allow pattern]... [--deny pattern]... [--writes n] [--spend n] [--deletes n] [--emails n] [--tool-calls n] [--mode dry-run|enforce] [--upstream name]...\",\n    );\n    return 1;\n  }\n  if (sub === \"revoke\") {\n    const idx = items.findIndex((a) => a.get(\"name\") === name);\n    if (idx < 0) {\n      io.err(`no agent \"${name}\"`);\n      return 1;\n    }\n    seq.items.splice(seq.items.indexOf(items[idx]!), 1);\n    writeFileSync(path, doc.toString());\n    io.out(`revoked ${name}: removed from okgate.yaml (running proxies pick it up on restart)`);\n    return 0;\n  }\n  if (sub !== \"create\") {\n    io.err(`unknown subcommand \"${sub}\" — use create, list or revoke`);\n    return 1;\n  }\n  const key = generateAgentKey();\n  const keyHash = await hashAgentKey(key);\n  const existing = items.find((a) => a.get(\"name\") === name);\n  const entry: Record<string, unknown> = { name, key_hash: keyHash };\n  const allow = flagList(args, \"allow\");\n  const deny = flagList(args, \"deny\");\n  if (allow.length) entry.allow = allow;\n  if (deny.length) entry.deny = deny;\n  const upstreams = flagList(args, \"upstream\");\n  if (upstreams.length) entry.upstreams = upstreams;\n  const mode = flagString(args, \"mode\");\n  if (mode) entry.mode = mode;\n  const perRun: Record<string, number> = {};\n  for (const [flag, counter] of [\n    [\"writes\", \"writes\"],\n    [\"spend\", \"spend_usd\"],\n    [\"deletes\", \"deletes\"],\n    [\"emails\", \"emails\"],\n    [\"tool-calls\", \"tool_calls\"],\n  ] as const) {\n    const n = flagNumber(args, flag);\n    if (n !== undefined) perRun[counter] = n;\n  }\n  if (Object.keys(perRun).length) entry.caps = { per_run: perRun };\n  if (existing) {\n    for (const [k, v] of Object.entries(entry)) existing.set(k, v);\n  } else {\n    seq.add(doc.createNode(entry));\n  }\n  writeFileSync(path, doc.toString());\n  io.err(\n    `${existing ? \"rotated\" : \"created\"} agent \"${name}\" in ${path}${allow.length ? ` (allow: ${allow.join(\", \")})` : \" (allow: all tools)\"}`,\n  );\n  io.err(\n    \"the key is shown once; give it to the agent as `Authorization: Bearer <key>` (HTTP) — over stdio use `okgate proxy --agent \" +\n      name +\n      \"`\",\n  );\n  io.out(key);\n  return 0;\n}\n","/**\n * `okgate permission-diff` — which changes between two git refs widen what an agent may do\n * (okgate.yaml, .claude/settings.json, mcp.json). The GitHub Action posts the markdown.\n */\nimport { execFileSync } from \"node:child_process\";\nimport {\n  diffPermissionFile,\n  renderPermissionDiffMarkdown,\n  type Finding,\n} from \"@agentwares/agentguard-core\";\nimport { flagBool, flagList, flagString, type ParsedArgs } from \"../args.js\";\nimport type { Io } from \"../context.js\";\n\nexport const DEFAULT_PERMISSION_PATHS = [\n  \"okgate.yaml\",\n  \"okgate.yml\",\n  // the policy's name before the rename, still read when there is no okgate.yaml\n  \"agentguard.yaml\",\n  \"agentguard.yml\",\n  \".claude/settings.json\",\n  \".claude/settings.local.json\",\n  \".mcp.json\",\n  \"mcp.json\",\n  \".cursor/mcp.json\",\n  \".vscode/mcp.json\",\n];\n\nconst PERMISSION_FILE =\n  /(^|\\/)((okgate|agentguard)[^/]*\\.ya?ml|\\.claude\\/settings(\\.local)?\\.json|[^/]*mcp[^/]*\\.json|claude_desktop_config\\.json)$/;\n\nfunction git(cwd: string, argv: string[]): string | undefined {\n  try {\n    return execFileSync(\"git\", argv, {\n      cwd,\n      encoding: \"utf8\",\n      stdio: [\"ignore\", \"pipe\", \"ignore\"],\n    });\n  } catch {\n    return undefined;\n  }\n}\n\nexport function showAt(cwd: string, ref: string, path: string): string | undefined {\n  return git(cwd, [\"show\", `${ref}:${path}`]);\n}\n\nexport function changedPermissionFiles(cwd: string, base: string, head: string): string[] {\n  const out = git(cwd, [\"diff\", \"--name-only\", base, head]) ?? \"\";\n  return out\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l && PERMISSION_FILE.test(l));\n}\n\nexport function resolveBase(cwd: string, explicit: string | undefined): string {\n  if (explicit) return explicit;\n  for (const candidate of [\"origin/main\", \"main\", \"origin/master\", \"master\"]) {\n    if (git(cwd, [\"rev-parse\", \"--verify\", \"--quiet\", candidate]) !== undefined) return candidate;\n  }\n  return \"HEAD~1\";\n}\n\nexport interface PermissionDiffResult {\n  base: string;\n  head: string;\n  files: string[];\n  findings: Finding[];\n  markdown: string;\n}\n\nexport function runPermissionDiff(\n  cwd: string,\n  opts: { base?: string; head?: string; paths?: string[]; title?: string },\n): PermissionDiffResult {\n  const base = resolveBase(cwd, opts.base);\n  const head = opts.head ?? \"HEAD\";\n  const files = [\n    ...new Set([\n      ...(opts.paths ?? DEFAULT_PERMISSION_PATHS),\n      ...changedPermissionFiles(cwd, base, head),\n    ]),\n  ];\n  const findings: Finding[] = [];\n  const touched: string[] = [];\n  for (const file of files) {\n    const before = showAt(cwd, base, file);\n    const after = showAt(cwd, head, file);\n    if (before === undefined && after === undefined) continue;\n    if (before === after) continue;\n    touched.push(file);\n    findings.push(...diffPermissionFile(file, before, after));\n  }\n  return {\n    base,\n    head,\n    files: touched,\n    findings,\n    markdown: renderPermissionDiffMarkdown(findings, { title: opts.title }),\n  };\n}\n\nexport async function permissionDiffCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const paths = flagList(args, \"paths\");\n  const result = runPermissionDiff(io.cwd, {\n    base: flagString(args, \"base\"),\n    head: flagString(args, \"head\"),\n    paths: paths.length ? paths : undefined,\n  });\n  const format = flagString(args, \"format\") ?? (flagBool(args, \"json\") ? \"json\" : \"markdown\");\n  if (format === \"json\") io.out(JSON.stringify(result, null, 2));\n  else io.out(result.markdown);\n  const widen = result.findings.filter((f) => f.severity === \"widen\").length;\n  if (flagBool(args, \"fail-on-widen\") && widen > 0) return 1;\n  return 0;\n}\n","/**\n * `okgate report` (the incident-shaped summary), `diff` (mutation diff), `verify` (audit\n * chain), `status` (counters and remaining budget).\n */\nimport { resolve } from \"node:path\";\nimport {\n  buildReport,\n  latestRunId,\n  listRuns,\n  renderMutationDiff,\n  renderReportMarkdown,\n} from \"@agentwares/agentguard-core\";\nimport { readAuditFile, verifyAuditFile } from \"@agentwares/agentguard-core/node\";\nimport { flagBool, flagString, type ParsedArgs } from \"../args.js\";\nimport { createFileGuard, loadPolicyFor, readRegistration, type Io } from \"../context.js\";\n\nfunction pickRun(args: ParsedArgs, entries: ReturnType<typeof readAuditFile>): string | undefined {\n  if (flagBool(args, \"all\")) return undefined;\n  return flagString(args, \"run\") ?? latestRunId(entries);\n}\n\nexport async function reportCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const entries = readAuditFile(loaded.auditPath);\n  const runId = pickRun(args, entries);\n  const report = buildReport(entries, { runId });\n  if (flagBool(args, \"json\")) {\n    io.out(\n      JSON.stringify(\n        {\n          ...report,\n          mutations: report.mutations.map((m) => ({\n            seq: m.seq,\n            ts: m.ts,\n            tool: m.tool,\n            mutation: m.mutation,\n          })),\n        },\n        null,\n        2,\n      ),\n    );\n    return 0;\n  }\n  io.out(renderReportMarkdown(report));\n  const chain = await verifyAuditFile(loaded.auditPath);\n  io.out(\n    chain.ok\n      ? `Audit chain: ${chain.entries} entries, verified (${loaded.auditPath}).`\n      : `Audit chain BROKEN at entry ${chain.brokenAt}: ${chain.reason}`,\n  );\n  if (runId && listRuns(entries).length > 1) io.out(`Other runs: okgate report --all`);\n  return 0;\n}\n\nexport async function diffCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const entries = readAuditFile(loaded.auditPath);\n  const runId = pickRun(args, entries);\n  io.out(renderMutationDiff(entries, { runId }).trimEnd());\n  return 0;\n}\n\nexport async function verifyCommand(args: ParsedArgs, io: Io): Promise<number> {\n  let path = args.positionals[0];\n  if (!path) path = loadPolicyFor(args, io, { allowMissingEnv: true }).auditPath;\n  path = resolve(io.cwd, path);\n  const result = await verifyAuditFile(path);\n  if (flagBool(args, \"json\")) io.out(JSON.stringify({ path, ...result }));\n  else if (result.ok)\n    io.out(\n      `ok: ${result.entries} entries, chain intact, head ${result.head?.slice(0, 16)}… (${path})`,\n    );\n  else io.out(`BROKEN at entry ${result.brokenAt}: ${result.reason} (${path})`);\n  return result.ok ? 0 : 1;\n}\n\nexport async function statusCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });\n  const entries = readAuditFile(loaded.auditPath);\n  const runId = flagString(args, \"run\") ?? latestRunId(entries) ?? \"(none yet)\";\n  const status = await guard.status(runId);\n  // every source a guard halts on: either KILL file, OKGATE_KILL, AGENTGUARD_KILL, kill.env\n  const killed = status.killed;\n  const reg = readRegistration(loaded);\n  const pending = await guard.approvals.list(\"pending\");\n  if (flagBool(args, \"json\")) {\n    io.out(\n      JSON.stringify(\n        {\n          policy: loaded.path,\n          mode: loaded.policy.mode,\n          runId,\n          ...status,\n          killed,\n          pendingApprovals: pending.length,\n          http: reg ? { url: reg.url, pid: reg.pid } : undefined,\n        },\n        null,\n        2,\n      ),\n    );\n    return 0;\n  }\n  io.out(\n    `policy   ${loaded.path} (mode: ${loaded.policy.mode}, ${loaded.policy.upstreams.length} upstreams)`,\n  );\n  io.out(`kill     ${killed.killed ? `ON — ${killed.reason} (okgate resume to clear)` : \"off\"}`);\n  io.out(`http     ${reg ? `${reg.url} (pid ${reg.pid})` : \"not running (okgate proxy --http)\"}`);\n  io.out(`audit    ${entries.length} entries in ${loaded.auditPath}`);\n  io.out(\n    `pending  ${pending.length} approval${pending.length === 1 ? \"\" : \"s\"}${pending.length ? ` — okgate approvals` : \"\"}`,\n  );\n  io.out(`run      ${runId}`);\n  const fmt = (scope: \"per_run\" | \"per_day\"): string =>\n    Object.entries(status.caps[scope])\n      .map(([k, limit]) => `${k} ${status.usage[scope][k] ?? 0}/${limit}`)\n      .join(\"  \") || \"no caps\";\n  io.out(`  per_run  ${fmt(\"per_run\")}`);\n  io.out(`  per_day  ${fmt(\"per_day\")}`);\n  return 0;\n}\n","#!/usr/bin/env node\n/**\n * `okgate` — MCP policy proxy: hard spend limits, destructive-action gating with approvals,\n * a kill switch, scoped credentials, dry-run writes, a loop breaker, blast-radius caps and a\n * hash-chained audit log. No LLM calls, no phone-home, no account.\n */\nimport { parseArgs, type ParsedArgs } from \"./args.js\";\nimport { version } from \"./version.js\";\nimport { INSTALL } from \"./install.js\";\n\nexport { version };\nimport { defaultIo, describeError, type Io } from \"./context.js\";\nimport { connectCommand } from \"./commands/connect.js\";\nimport { approvalsCommand, decideCommand, killCommand, resumeCommand } from \"./commands/control.js\";\nimport { hookCommand } from \"./commands/hook.js\";\nimport { hooksCommand } from \"./commands/hooks.js\";\nimport { keyCommand } from \"./commands/keys.js\";\nimport { permissionDiffCommand } from \"./commands/permission-diff.js\";\nimport { diffCommand, reportCommand, statusCommand, verifyCommand } from \"./commands/report.js\";\n\n// The MCP SDK costs ~110 ms to load. `okgate hook pre-tool-use` runs before every guarded\n// tool call of a coding agent and never needs it, so the commands that do load it on demand.\nconst proxyCommand = async (args: ParsedArgs, io: Io): Promise<number> =>\n  (await import(\"./commands/proxy.js\")).proxyCommand(args, io);\nconst initCommand = async (args: ParsedArgs, io: Io): Promise<number> =>\n  (await import(\"./commands/init.js\")).initCommand(args, io);\nconst toolsCommand = async (args: ParsedArgs, io: Io): Promise<number> =>\n  (await import(\"./commands/tools.js\")).toolsCommand(args, io);\nconst auditCommand = async (args: ParsedArgs, io: Io): Promise<number> =>\n  (await import(\"./commands/audit.js\")).auditCommand(args, io);\n\nexport const HELP = `okgate — MCP policy proxy for agents that touch production\n\n  ${INSTALL} init\n                                      read your MCP config, write okgate.yaml (dry-run), route every server through the proxy\n  okgate report [--run id|--all]      what this run did / would have destroyed / spent, where it was halted\n  okgate diff [--run id]              record-by-record mutation diff from a dry run\n  okgate verify [audit.jsonl]         prove the hash-chained audit log was not edited\n  okgate connect <key> [--write]      point this machine at your hosted proxy (paid tiers)\n\n  okgate hooks install [--project|--user] [--client claude|codex|gemini|all]\n                                      check a coding agent's own shell commands and file edits against okgate.yaml (dry-run first);\n                                      irreversible commands (push, merge, publish, send, rm outside the repo) only on a turn a person typed\n  okgate hooks uninstall | status\n  okgate hook pre-tool-use            what the installed hook runs (reads the harness's JSON on stdin)\n\n  okgate audit [--since 7d|30d|all] [--client claude|codex|all] [--json]\n                                      which rules in CLAUDE.md / AGENTS.md / GEMINI.md / .cursor/rules your coding agents broke,\n                                      from this machine's Claude Code and Codex sessions in this repo (nothing is sent anywhere)\n  okgate audit --enforce [--preview]\n                                      write the checkable rules into okgate.yaml as hook rules, in dry-run, and install the hook\n\n  okgate proxy [--http --port 8788] [--agent name] [--run-id id] [--mode dry-run|enforce]\n  okgate tools [--json]               the tools your agent will see, with class and why\n  okgate status [--run id]            counters vs caps, kill state, pending approvals\n\n  okgate kill [reason]                halt every run now (file + running HTTP proxy);  okgate resume\n  okgate approvals [--all]            pending approvals;  okgate approve <id> | deny <id> [--note text]\n  okgate key create <agent> [--allow 'crm_get_*']... [--deny p] [--writes n] [--spend n] [--mode m]\n  okgate key list | revoke <agent>\n  okgate permission-diff [--base ref] [--head ref] [--paths a,b] [--format markdown|json] [--fail-on-widen]\n\nOptions: --config <okgate.yaml> (or OKGATE_CONFIG), --json, --help, --version\nRenamed from agentguard: agentguard.yaml, .agentguard/, AGENTGUARD_* and the agentguard bin keep working.\nDocs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli`;\n\nexport async function main(argv: readonly string[], io: Io = defaultIo()): Promise<number> {\n  const args: ParsedArgs = parseArgs(argv);\n  if (args.flags.version) {\n    io.out(version());\n    return 0;\n  }\n  if (args.command === undefined && !args.flags.help && io.tty === false) {\n    // An MCP client spawned bare `npx @agentwares/agentguard` — that is what server.json registers — and is\n    // waiting for JSON-RPC on stdout. Serve the proxy instead of printing help into the stream.\n    try {\n      return await proxyCommand(args, io);\n    } catch (err) {\n      io.err(describeError(err));\n      return 1;\n    }\n  }\n  if (args.flags.help || args.command === undefined || args.command === \"help\") {\n    io.out(HELP);\n    return args.command === undefined && !args.flags.help ? 1 : 0;\n  }\n  try {\n    switch (args.command) {\n      case \"init\":\n        return await initCommand(args, io);\n      case \"proxy\":\n      case \"serve\":\n        return await proxyCommand(args, io);\n      case \"report\":\n        return await reportCommand(args, io);\n      case \"diff\":\n        return await diffCommand(args, io);\n      case \"verify\":\n        return await verifyCommand(args, io);\n      case \"connect\":\n        return await connectCommand(args, io);\n      case \"status\":\n        return await statusCommand(args, io);\n      case \"tools\":\n        return await toolsCommand(args, io);\n      case \"kill\":\n        return await killCommand(args, io);\n      case \"resume\":\n        return await resumeCommand(args, io);\n      case \"approve\":\n        return await decideCommand(\"approved\", args, io);\n      case \"deny\":\n        return await decideCommand(\"denied\", args, io);\n      case \"approvals\":\n        return await approvalsCommand(args, io);\n      case \"key\":\n      case \"keys\":\n        return await keyCommand(args, io);\n      case \"permission-diff\":\n        return await permissionDiffCommand(args, io);\n      case \"hook\":\n        return await hookCommand(args, io);\n      case \"hooks\":\n        return await hooksCommand(args, io);\n      case \"audit\":\n        return await auditCommand(args, io);\n      default:\n        io.err(`unknown command \"${args.command}\"\\n`);\n        io.err(HELP);\n        return 1;\n    }\n  } catch (err) {\n    io.err(describeError(err));\n    return 1;\n  }\n}\n\n// `okgate`, and `agentguard` (its name before the rename) for 90 days. A package that runs this\n// CLI by importing it (the @agentwares/agentguard shim) sets the flag and calls main() itself.\nconst embedded =\n  (globalThis as Record<symbol, unknown>)[Symbol.for(\"okgate.cli.embedded\")] === true;\nconst isMain =\n  !embedded &&\n  process.argv[1] !== undefined &&\n  /(^|[\\\\/])(cli\\.[cm]?[jt]s|okgate|agentguard)$/.test(process.argv[1]);\nif (isMain) {\n  main(process.argv.slice(2)).then(\n    (code) => {\n      if (code !== 0) process.exitCode = code;\n    },\n    (err: unknown) => {\n      process.stderr.write(`${describeError(err)}\\n`);\n      process.exitCode = 1;\n    },\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AAazB,SAAS,eAAe;AAEjB,IAAM,oBAAoB;AAuBjC,SAAS,KAAK,GAA2B;AACvC,QAAM;AACR;AAEA,eAAsB,eACpB,MACA,IACA,YAA0B,OACT;AACjB,QAAM,MAAM,KAAK,YAAY,CAAC,KAAK,QAAQ,GAAG,KAAK,KAAK;AACxD,MAAI,CAAC,KAAK;AACR,OAAG,IAAI,6EAA6E;AACpF,OAAG,IAAI,qDAAqD;AAC5D,WAAO;AAAA,EACT;AAEA,QAAM,QACJ,WAAW,MAAM,KAAK,KACtB,QAAQ,GAAG,KAAK,WAAW,KAC3B,mBACA,QAAQ,QAAQ,EAAE;AAEpB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,UAAU,GAAG,IAAI,YAAY;AAAA,MACvC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,IAAI,CAAC;AAAA,IAC9B,CAAC;AAAA,EACH,SAAS,KAAK;AAEZ,SAAK;AAAA,MACH,MAAM;AAAA,MACN,OAAO,mBAAmB,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACnF,KAAK;AAAA,MACL,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,SAAK;AAAA,MACH,MAAM;AAAA,MACN,OAAO,GAAG,IAAI,qBAAqB,IAAI,MAAM,uBAAuB,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,MACtF,KAAK;AAAA,MACL,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AACV,SAAK;AAAA,MACH,MAAM,EAAE,QAAQ;AAAA,MAChB,OAAO,EAAE,SAAS,GAAG,IAAI,qBAAqB,IAAI,MAAM;AAAA,MACxD,KAAK,EAAE,OAAO;AAAA,MACd,WAAW,EAAE,aAAa;AAAA,IAC5B,CAAC;AAAA,EACH;AACA,QAAM,OAAO;AAEb,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,CAAC,MAAe,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,SAAS,GAAG,KAAK,CAAC,IAAI;AAE/E,QAAM,QAAQ,KAAK,WAAW,iBAAiB,KAC7C,KAAK,WAAW,wBAAwB,KAAK;AAAA,IAC3C,MAAM;AAAA,IACN,KAAK,KAAK;AAAA,IACV,SAAS,KAAK;AAAA,EAChB;AAEF,MAAI,CAAC,SAAS,MAAM,OAAO,GAAG;AAC5B,OAAG,IAAI,KAAK,UAAU,EAAE,YAAY,EAAE,CAAC,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AAAA,EAChF,OAAO;AACL,UAAM,WAAW,WAAW,MAAM,QAAQ;AAC1C,UAAM,UAAU,WACZ,CAAC,mBAAmB,QAAQ,CAAC,IAC7B,oBAAoB,GAAG,KAAK,SAAS,EAAE,GAAG,GAAG,GAAG;AAGpD,UAAM,eAAe,QAAQ,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC;AAC1E,QAAI;AACJ,QAAI,YAAY,SAAS,MAAM,KAAK,EAAG,UAAS;AAAA,QAC3C,UAAS,aAAa,MAAM,GAAG,CAAC;AAErC,QAAI,OAAO,WAAW,GAAG;AACvB,SAAG;AAAA,QACD;AAAA,MACF;AACA,SAAG,IAAI,KAAK,UAAU,EAAE,YAAY,EAAE,CAAC,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AAC9E,aAAO;AAAA,IACT;AACA,eAAW,KAAK,QAAQ;AACtB,UAAI,CAAC,WAAW,EAAE,IAAI,GAAG;AACvB,WAAG,IAAI,oBAAoB,EAAE,IAAI,EAAE;AACnC,eAAO;AAAA,MACT;AAEA,YAAM,YAAyB,eAAe,CAAC,IAC3C,EAAE,SAAS,MAAM,KAAK,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC,EAAG,IAC3E;AACJ,YAAM,EAAE,QAAQ,SAAS,IAAI,sBAAsB,GAAG,mBAAmB,WAAW;AAAA,QAClF;AAAA,MACF,CAAC;AACD,SAAG;AAAA,QACD,GAAG,WAAW,YAAY,SAAS,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,YAAO,iBAAiB,MAAM,KAAK,MAAM;AAAA,MACzG;AACA,SAAG,IAAI,WAAW,IAAI,MAAM,CAAC,EAAE;AAAA,IACjC;AACA,eAAW,KAAK,QAAQ,OAAO,CAACA,OAAM,CAAC,OAAO,SAASA,EAAC,CAAC;AACvD,SAAG;AAAA,QACD,WAAW,EAAE,IAAI,KAAK,EAAE,KAAK,mDAA8C,KAAK,UAAU,EAAE,IAAI,CAAC;AAAA,MACnG;AAAA,EACJ;AAEA,QAAM,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,QAAQ,eAAe;AACtF,KAAG,IAAI;AAAA,QAAW,KAAK,IAAI,KAAK,KAAK,OAAO,UAAU,KAAK,IAAI,GAAG,IAAI,EAAE;AACxE,MAAI,KAAK,WAAW,OAAQ,IAAG,IAAI,cAAc,KAAK,UAAU,KAAK,IAAI,CAAC,EAAE;AAC5E,MAAI,KAAK,aAAc,IAAG,IAAI,cAAc,KAAK,YAAY,EAAE;AAC/D,MAAI,KAAK,WAAY,IAAG,IAAI,gBAAgB,KAAK,UAAU,EAAE;AAC7D,MAAI,CAAC,SAAS,MAAM,OAAO;AACzB,OAAG,IAAI;AAAA,6DAAgE;AACzE,SAAO;AACT;;;AC9KA,SAAS,UAAU,uBAAuB;AAI1C,eAAe,SACb,IACA,KACA,MACA,MACe;AACf,MAAI,CAAC,IAAK;AACV,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,IAAI;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,IAAI,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,MACpF,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC1D,QAAQ,YAAY,QAAQ,GAAI;AAAA,IAClC,CAAC;AACD,QAAI,CAAC,IAAI;AACP,SAAG;AAAA,QACD,oBAAoB,IAAI,OAAO,aAAa,IAAI,MAAM;AAAA,MACxD;AAAA,EACJ,QAAQ;AACN,OAAG;AAAA,MACD,yBAAyB,IAAI,OAAO,WAAW,IAAI,GAAG;AAAA,IACxD;AAAA,EACF;AACF;AAEA,eAAsB,YAAY,MAAkB,IAAyB;AAC3E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,KAAK,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACvE,QAAM,SACJ,KAAK,YAAY,KAAK,GAAG,KACzB,WAAW,MAAM,QAAQ,KACzB,kBAAkB,GAAG,IAAI,QAAQ,UAAU;AAC7C,OAAK,KAAK,MAAM;AAChB,QAAM,SAAS,IAAI,iBAAiB,MAAM,GAAG,SAAS,EAAE,OAAO,CAAC;AAChE,KAAG;AAAA,IACD,WAAW,KAAK,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAEA,eAAsB,cAAc,MAAkB,IAAyB;AAC7E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,KAAK,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACvE,OAAK,OAAO;AACZ,QAAM,SAAS,IAAI,iBAAiB,MAAM,GAAG,SAAS;AACtD,KAAG,IAAI,YAAY,KAAK,IAAI,UAAU;AACtC,aAAW,QAAQ,oBAAI,IAAI,CAAC,OAAO,OAAO,KAAK,KAAK,UAAU,eAAe,CAAC;AAC5E,QAAI,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,MAAM,OAAO,GAAG,IAAI,IAAI,EAAG,YAAY,MAAM;AAC1E,SAAG;AAAA,QACD,SAAS,IAAI;AAAA,MACf;AACJ,SAAO;AACT;AAEA,eAAsB,cACpB,UACA,MACA,IACiB;AACjB,QAAM,KAAK,KAAK,YAAY,CAAC;AAC7B,MAAI,CAAC,IAAI;AACP,OAAG;AAAA,MACD,iBAAiB,aAAa,aAAa,YAAY,MAAM;AAAA,IAC/D;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,MAAM,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACxE,QAAM,SAAS,MAAM,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,WAAW,MAAM,IAAI,KAAK,GAAG,IAAI,QAAQ;AAAA,IACzC,WAAW,MAAM,MAAM;AAAA,EACzB;AACA,MAAI,CAAC,QAAQ;AACX,OAAG,IAAI,eAAe,EAAE,wCAAmC;AAC3D,WAAO;AAAA,EACT;AACA,KAAG;AAAA,IACD,GAAG,OAAO,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,EAAE,SAAS,OAAO,MAAM,IAAI,OAAO,WAAW,aAAa,4DAAuD,EAAE;AAAA,EAClK;AACA,SAAO;AACT;AAEA,eAAsB,iBAAiB,MAAkB,IAAyB;AAChF,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,MAAM,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACxE,QAAM,OAAO,MAAM,MAAM,UAAU,KAAK,SAAS,MAAM,KAAK,IAAI,SAAY,SAAS;AACrF,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACpC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,WAAW,GAAG;AACrB,OAAG,IAAI,SAAS,MAAM,KAAK,IAAI,0BAA0B,sBAAsB;AAC/E,WAAO;AAAA,EACT;AACA,aAAW,KAAK,MAAM;AACpB,OAAG;AAAA,MACD,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,QAAQ,UAAU,EAAE,KAAK,KAAK,EAAE,aAAa,EAAE,UAAU;AAAA,IACzH;AACA,OAAG,IAAI,WAAW,KAAK,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,EAAE;AACxD,QAAI,EAAE,WAAW,UAAW,IAAG,IAAI,2BAAsB,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE;AAAA,EAC3F;AACA,SAAO;AACT;;;AChGA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,UAAU,SAAS,MAAM,eAAe;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAAC;AAAA,EACA;AAAA,OAGK;;;ACrBP,SAAS,WAAW,cAAAC,aAAY,UAAU,UAAU,gBAAgB;AACpE,SAAS,sBAA2D;AAEpE,IAAM,QAAQ,CAAC,KAAK,IAAI,KAAK,IAAI,MAAM,EAAE;AASzC,SAAS,SAAS,MAAc,OAAe,MAAsB;AACnE,QAAM,SAAS,KAAK,IAAI,OAAO,IAAI;AACnC,QAAM,KAAK,SAAS,MAAM,GAAG;AAC7B,MAAI;AACF,UAAM,MAAM,OAAO,MAAM,MAAM;AAC/B,aAAS,IAAI,KAAK,GAAG,QAAQ,OAAO,MAAM;AAC1C,WAAO,IAAI,SAAS,MAAM;AAAA,EAC5B,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACF;AAEO,SAAS,wBACd,MACA,OAAoC,CAAC,GACjB;AACpB,MAAI,CAAC,KAAM,QAAO,EAAE,SAAS,4CAA4C;AACzE,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO,EAAE,SAAS,oBAAoB,IAAI,GAAG;AACpE,MAAI;AACJ,MAAI;AACF,WAAO,SAAS,IAAI,EAAE;AAAA,EACxB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACrF;AAAA,EACF;AACA,MAAI;AACJ,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,aAAO,eAAe,SAAS,MAAM,MAAM,IAAI,GAAG,IAAI;AAAA,IACxD,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,SAAS,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACrF;AAAA,IACF;AACA,QAAI,KAAK,QAAQ,QAAQ,KAAM;AAAA,EACjC;AACA,MAAI,MAAM,KAAM,QAAO,EAAE,MAAM,KAAK,MAAM,KAAK;AAC/C,SAAO;AAAA,IACL,SACE,OAAO,MAAM,MAAM,SAAS,CAAC,IAAK,6CAA6C;AAAA,IACjF;AAAA,EACF;AACF;;;ADrBA,SAAS,sBAAsB;AAE/B,IAAM,aAAyC;AAAA,EAC7C,eAAe;AAAA,EACf,OAAO;AAAA,EACP,cAAc;AAChB;AAGA,SAAS,kBAAkB,OAAmC;AAC5D,MAAI,MAAM,QAAQ,KAAK;AACvB,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG;AAC9B,eAAW,QAAQ,cAAc;AAC/B,YAAM,YAAY,KAAK,KAAK,IAAI;AAChC,UAAIC,YAAW,SAAS,EAAG,QAAO;AAAA,IACpC;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,SAAS,WAAW,IAAQ,UAAkD;AAC5E,SAAO,GAAG,IAAI,sBAAsB,GAAG,IAAI,sBAAsB,YAAY;AAC/E;AAMO,SAAS,kBACd,MACA,IACA,UAC8E;AAC9E,QAAM,OAAO,WAAW,MAAM,QAAQ;AACtC,MAAI,KAAM,QAAO,EAAE,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,OAAO,OAAO;AAC9D,QAAM,UAAUC,SAAQ,GAAG,KAAK,QAAQ;AACxC,MAAI,QAAS,QAAO,EAAE,MAAM,QAAQ,GAAG,KAAK,OAAO,GAAG,OAAO,MAAM;AACnE,QAAM,QAAQ,WAAW,IAAI,QAAQ,KAAK,GAAG;AAC7C,QAAM,OAAO,kBAAkB,KAAK;AACpC,MAAI,KAAM,QAAO,EAAE,MAAM,MAAM,OAAO,UAAU;AAChD,QAAM,WAAW,WAAW,MAAM,iBAAiB;AACnD,MAAI,YAAYD,YAAW,QAAQ,GAAG,KAAK,QAAQ,CAAC;AAClD,WAAO,EAAE,MAAM,QAAQ,GAAG,KAAK,QAAQ,GAAG,OAAO,WAAW;AAC9D,SAAO;AACT;AAEA,SAAS,IAAI,IAAQ,OAAsB;AACzC,KAAG,IAAI,KAAK,UAAU,KAAK,CAAC;AAC9B;AAGA,SAAS,KAAK,IAAQ,SAAuB;AAC3C,MAAI,IAAI,EAAE,eAAe,QAAQ,CAAC;AACpC;AAEA,SAAS,QACP,IACA,QACA,QACA,SACA,gBACM;AACN,MAAI,OAAO,aAAa,UAAU,OAAO,OAAO;AAC9C,UAAM,IAAI,OAAO;AACjB,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,UAAM,KAAK,OAAO,aAAa,cAAc,OAAO,UAAU,KAAK;AACnE,UAAM,UACJ,EAAE,SAAS,uBAAuB,OAAO,aACrC,wCAAwC,eAAe,OAAO,UAAU,CAAC,KACzE;AACN,UAAM,gBAAgB,mBAAmB,QAAQ,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,GAAG,OAAO;AACtG,QAAI,WAAW,aAAc,KAAI,IAAI,EAAE,UAAU,QAAQ,QAAQ,cAAc,CAAC;AAAA;AAE9E,UAAI,IAAI;AAAA,QACN,oBAAoB;AAAA,UAClB,eAAe;AAAA,UACf,oBAAoB;AAAA,UACpB,0BAA0B;AAAA,QAC5B;AAAA,QACA;AAAA,MACF,CAAC;AACH;AAAA,EACF;AACA,MAAI,OAAO,OAAO;AAChB,QAAI,IAAI;AAAA,MACN,eAAe,oDAAoD,QAAQ,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO,MAAM,IAAI,KAAK,OAAO,MAAM,KAAK;AAAA,IAC5I,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,YAAY,MAAkB,IAAyB;AAC3E,QAAM,QAAQ,KAAK,YAAY,CAAC;AAChC,MAAI,UAAU,gBAAgB;AAC5B,OAAG;AAAA,MACD;AAAA,IAEF;AACA,WAAO;AAAA,EACT;AACA,QAAM,aAAa,WAAW,MAAM,QAAQ;AAC5C,MAAI,SAAsB,cAAc,eAAe,UAAU,KAAM;AACvE,MAAI;AACF,UAAM,MAAO,MAAM,GAAG,QAAQ,KAAM;AACpC,UAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAI,CAAC,WAAY,UAAS,iBAAiB,KAAK;AAChD,UAAM,WAAW,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM;AAC7D,UAAM,YAAY,kBAAkB,MAAM,IAAI,QAAQ;AACtD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,SAAS,eAAe,UAAU,MAAM,EAAE,KAAK,GAAG,KAAK,iBAAiB,KAAK,CAAC;AACpF,UAAM,SAAS,oBAAoB,QAAQ,OAAO,YAAY,GAAG,GAAG;AACpE,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,OAAO,SAAS,EAAE;AACxB,UAAM,YACJ,WAAW,IAAI,MAAS,MACvB,UAAU,UAAU,YAAY,QAAQ,UAAU,IAAI,IAAI,WAC3D,OAAO;AACT,UAAM,UAAU;AAAA,MACd,OAAO;AAAA,MACP,GAAG,IAAI;AAAA,MACP,OAAO,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAClE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,OAAO,CAAC,MAAmB,QAAQ,CAAC,CAAC;AACvC,UAAM,MAAM;AAAA,MACV,WAAW,QAAQ,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,UAAU,OAAO;AAAA;AAAA,MAEjB,YAAY;AAAA,QACV,OAAO;AAAA,QACP,GAAG,aAAa,IAAI,CAAC,SAAS,KAAK,QAAQ,OAAO,IAAI,GAAG,IAAI,CAAC;AAAA,QAC9D,GAAG,kBAAkB,EAAE,KAAK,QAAQ,SAAS,GAAG,KAAK,CAAC;AAAA,MACxD;AAAA,MACA,YAAY,SAAS,OAAO,IAAI;AAAA,IAClC;AACA,UAAM,aAAa,iBAAiB,OAAO,QAAQ,QAAQ,GAAG;AAC9D,UAAM,MAAM,iBAAiB,MAAM;AACnC,UAAM,EAAE,MAAM,IAAI,gBAAgB,QAAQ;AAAA,MACxC,KAAK,GAAG;AAAA,MACR,aAAa,eAAe,GAAG;AAAA,MAC/B,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI;AAAA,IAC5B,CAAC;AACD,UAAM,aACJ,UAAU,UAAU,aAAa,QAAQ,UAAU,IAAI,MAAM,QAAQ,SAAS,IAC1E,KACA,aAAa,KAAK,UAAU,UAAU,IAAI,CAAC;AACjD,UAAM,iBAAiB,CAAC,OAAuB,GAAG,OAAO,YAAY,EAAE,GAAG,UAAU;AACpF,UAAM,SAAS,MAAM,MAAM,UAAU;AAAA,MACnC;AAAA,MACA;AAAA,MACA,OAAO,GAAG,WAAW,MAAM,CAAC,IAAI,OAAO,SAAS;AAAA,MAChD,WAAW,MACT,WAAW,gBACP,wBAAwB,OAAO,gBAAgB;AAAA,QAC7C,eAAe,OAAO,OAAO,MAAM,aAAa;AAAA,MAClD,CAAC,IACD;AAAA,QACE,SAAS,GAAG,MAAM;AAAA,MACpB;AAAA,MACN;AAAA,IACF,CAAC;AACD,YAAQ,IAAI,QAAQ,QAAQ,WAAW,SAAS,cAAc;AAC9D,WAAO;AAAA,EACT,SAAS,KAAK;AACZ;AAAA,MACE;AAAA,MACA,uDAAkD,cAAc,GAAG,EAAE,QAAQ,QAAQ,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;AAAA,IACzG;AACA,WAAO;AAAA,EACT;AACF;;;AEnNA,SAAS,cAAc,qBAAqB;AAC5C,OAAO,QAAQ,OAAO,OAAO,eAA6B;AAC1D,SAAS,kBAAkB,oBAAoB;AAI/C,eAAsB,WAAW,MAAkB,IAAyB;AAC1E,QAAM,CAAC,KAAK,IAAI,IAAI,KAAK;AACzB,QAAM,OAAO,eAAe,MAAM,EAAE;AACpC,QAAM,MAAM,KAAK,cAAc,aAAa,MAAM,MAAM,CAAC;AACzD,MAAI,SAAS,IAAI,IAAI,QAAQ;AAC7B,MAAI,CAAC,MAAM,MAAM,GAAG;AAClB,aAAS,IAAI,QAAQ;AACrB,QAAI,IAAI,UAAU,MAAM;AAAA,EAC1B;AACA,QAAM,MAAM;AACZ,QAAM,QAAQ,IAAI,MAAM,OAAO,KAAK;AAEpC,MAAI,QAAQ,UAAU,QAAQ,QAAW;AACvC,QAAI,MAAM,WAAW;AACnB,SAAG,IAAI,0FAAqF;AAC9F,eAAW,KAAK,OAAO;AACrB,YAAME,SAAQ,EAAE,IAAI,OAAO;AAC3B,SAAG;AAAA,QACD,GAAG,OAAO,EAAE,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,UAAU,IAAI,QAAQ,2BAA2B,YAAY,MAAMA,MAAK,IAAIA,OAAM,MAAM,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI,KAAK;AAAA,MAC1K;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM;AACT,OAAG;AAAA,MACD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,MAAM,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,MAAM,MAAM,IAAI;AACzD,QAAI,MAAM,GAAG;AACX,SAAG,IAAI,aAAa,IAAI,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,QAAI,MAAM,OAAO,IAAI,MAAM,QAAQ,MAAM,GAAG,CAAE,GAAG,CAAC;AAClD,kBAAc,MAAM,IAAI,SAAS,CAAC;AAClC,OAAG,IAAI,WAAW,IAAI,oEAAoE;AAC1F,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,UAAU;AACpB,OAAG,IAAI,uBAAuB,GAAG,qCAAgC;AACjE,WAAO;AAAA,EACT;AACA,QAAM,MAAM,iBAAiB;AAC7B,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,WAAW,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,MAAM,IAAI;AACzD,QAAM,QAAiC,EAAE,MAAM,UAAU,QAAQ;AACjE,QAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,QAAM,OAAO,SAAS,MAAM,MAAM;AAClC,MAAI,MAAM,OAAQ,OAAM,QAAQ;AAChC,MAAI,KAAK,OAAQ,OAAM,OAAO;AAC9B,QAAM,YAAY,SAAS,MAAM,UAAU;AAC3C,MAAI,UAAU,OAAQ,OAAM,YAAY;AACxC,QAAM,OAAO,WAAW,MAAM,MAAM;AACpC,MAAI,KAAM,OAAM,OAAO;AACvB,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,MAAM,OAAO,KAAK;AAAA,IAC5B,CAAC,UAAU,QAAQ;AAAA,IACnB,CAAC,SAAS,WAAW;AAAA,IACrB,CAAC,WAAW,SAAS;AAAA,IACrB,CAAC,UAAU,QAAQ;AAAA,IACnB,CAAC,cAAc,YAAY;AAAA,EAC7B,GAAY;AACV,UAAM,IAAI,WAAW,MAAM,IAAI;AAC/B,QAAI,MAAM,OAAW,QAAO,OAAO,IAAI;AAAA,EACzC;AACA,MAAI,OAAO,KAAK,MAAM,EAAE,OAAQ,OAAM,OAAO,EAAE,SAAS,OAAO;AAC/D,MAAI,UAAU;AACZ,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,EAAG,UAAS,IAAI,GAAG,CAAC;AAAA,EAC/D,OAAO;AACL,QAAI,IAAI,IAAI,WAAW,KAAK,CAAC;AAAA,EAC/B;AACA,gBAAc,MAAM,IAAI,SAAS,CAAC;AAClC,KAAG;AAAA,IACD,GAAG,WAAW,YAAY,SAAS,WAAW,IAAI,QAAQ,IAAI,GAAG,MAAM,SAAS,YAAY,MAAM,KAAK,IAAI,CAAC,MAAM,qBAAqB;AAAA,EACzI;AACA,KAAG;AAAA,IACD,qIACE,OACA;AAAA,EACJ;AACA,KAAG,IAAI,GAAG;AACV,SAAO;AACT;;;AC1FA,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAIA,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,kBACJ;AAEF,SAAS,IAAI,KAAa,MAAoC;AAC5D,MAAI;AACF,WAAO,aAAa,OAAO,MAAM;AAAA,MAC/B;AAAA,MACA,UAAU;AAAA,MACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACpC,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,OAAO,KAAa,KAAa,MAAkC;AACjF,SAAO,IAAI,KAAK,CAAC,QAAQ,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;AAC5C;AAEO,SAAS,uBAAuB,KAAa,MAAc,MAAwB;AACxF,QAAMC,OAAM,IAAI,KAAK,CAAC,QAAQ,eAAe,MAAM,IAAI,CAAC,KAAK;AAC7D,SAAOA,KACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,KAAK,gBAAgB,KAAK,CAAC,CAAC;AAC/C;AAEO,SAAS,YAAY,KAAa,UAAsC;AAC7E,MAAI,SAAU,QAAO;AACrB,aAAW,aAAa,CAAC,eAAe,QAAQ,iBAAiB,QAAQ,GAAG;AAC1E,QAAI,IAAI,KAAK,CAAC,aAAa,YAAY,WAAW,SAAS,CAAC,MAAM,OAAW,QAAO;AAAA,EACtF;AACA,SAAO;AACT;AAUO,SAAS,kBACd,KACA,MACsB;AACtB,QAAM,OAAO,YAAY,KAAK,KAAK,IAAI;AACvC,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,QAAQ;AAAA,IACZ,GAAG,oBAAI,IAAI;AAAA,MACT,GAAI,KAAK,SAAS;AAAA,MAClB,GAAG,uBAAuB,KAAK,MAAM,IAAI;AAAA,IAC3C,CAAC;AAAA,EACH;AACA,QAAM,WAAsB,CAAC;AAC7B,QAAM,UAAoB,CAAC;AAC3B,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,OAAO,KAAK,MAAM,IAAI;AACrC,UAAM,QAAQ,OAAO,KAAK,MAAM,IAAI;AACpC,QAAI,WAAW,UAAa,UAAU,OAAW;AACjD,QAAI,WAAW,MAAO;AACtB,YAAQ,KAAK,IAAI;AACjB,aAAS,KAAK,GAAG,mBAAmB,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC1D;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,UAAU,6BAA6B,UAAU,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,EACxE;AACF;AAEA,eAAsB,sBAAsB,MAAkB,IAAyB;AACrF,QAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,QAAM,SAAS,kBAAkB,GAAG,KAAK;AAAA,IACvC,MAAM,WAAW,MAAM,MAAM;AAAA,IAC7B,MAAM,WAAW,MAAM,MAAM;AAAA,IAC7B,OAAO,MAAM,SAAS,QAAQ;AAAA,EAChC,CAAC;AACD,QAAM,SAAS,WAAW,MAAM,QAAQ,MAAM,SAAS,MAAM,MAAM,IAAI,SAAS;AAChF,MAAI,WAAW,OAAQ,IAAG,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,MACxD,IAAG,IAAI,OAAO,QAAQ;AAC3B,QAAM,QAAQ,OAAO,SAAS,OAAO,CAAC,MAAM,EAAE,aAAa,OAAO,EAAE;AACpE,MAAI,SAAS,MAAM,eAAe,KAAK,QAAQ,EAAG,QAAO;AACzD,SAAO;AACT;;;AC9GA,SAAS,WAAAC,gBAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe,uBAAuB;AAI/C,SAAS,QAAQ,MAAkB,SAA+D;AAChG,MAAI,SAAS,MAAM,KAAK,EAAG,QAAO;AAClC,SAAO,WAAW,MAAM,KAAK,KAAK,YAAY,OAAO;AACvD;AAEA,eAAsB,cAAc,MAAkB,IAAyB;AAC7E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,UAAU,cAAc,OAAO,SAAS;AAC9C,QAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,QAAM,SAAS,YAAY,SAAS,EAAE,MAAM,CAAC;AAC7C,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG;AAAA,MACD,KAAK;AAAA,QACH;AAAA,UACE,GAAG;AAAA,UACH,WAAW,OAAO,UAAU,IAAI,CAAC,OAAO;AAAA,YACtC,KAAK,EAAE;AAAA,YACP,IAAI,EAAE;AAAA,YACN,MAAM,EAAE;AAAA,YACR,UAAU,EAAE;AAAA,UACd,EAAE;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,KAAG,IAAI,qBAAqB,MAAM,CAAC;AACnC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,SAAS;AACpD,KAAG;AAAA,IACD,MAAM,KACF,gBAAgB,MAAM,OAAO,uBAAuB,OAAO,SAAS,OACpE,+BAA+B,MAAM,QAAQ,KAAK,MAAM,MAAM;AAAA,EACpE;AACA,MAAI,SAAS,SAAS,OAAO,EAAE,SAAS,EAAG,IAAG,IAAI,iCAAiC;AACnF,SAAO;AACT;AAEA,eAAsB,YAAY,MAAkB,IAAyB;AAC3E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,UAAU,cAAc,OAAO,SAAS;AAC9C,QAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,KAAG,IAAI,mBAAmB,SAAS,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;AACvD,SAAO;AACT;AAEA,eAAsB,cAAc,MAAkB,IAAyB;AAC7E,MAAI,OAAO,KAAK,YAAY,CAAC;AAC7B,MAAI,CAAC,KAAM,QAAO,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC,EAAE;AACrE,SAAOC,SAAQ,GAAG,KAAK,IAAI;AAC3B,QAAM,SAAS,MAAM,gBAAgB,IAAI;AACzC,MAAI,SAAS,MAAM,MAAM,EAAG,IAAG,IAAI,KAAK,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;AAAA,WAC7D,OAAO;AACd,OAAG;AAAA,MACD,OAAO,OAAO,OAAO,gCAAgC,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC,WAAM,IAAI;AAAA,IAC1F;AAAA,MACG,IAAG,IAAI,mBAAmB,OAAO,QAAQ,KAAK,OAAO,MAAM,KAAK,IAAI,GAAG;AAC5E,SAAO,OAAO,KAAK,IAAI;AACzB;AAEA,eAAsB,cAAc,MAAkB,IAAyB;AAC7E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,MAAM,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACxE,QAAM,UAAU,cAAc,OAAO,SAAS;AAC9C,QAAM,QAAQ,WAAW,MAAM,KAAK,KAAK,YAAY,OAAO,KAAK;AACjE,QAAM,SAAS,MAAM,MAAM,OAAO,KAAK;AAEvC,QAAM,SAAS,OAAO;AACtB,QAAM,MAAM,iBAAiB,MAAM;AACnC,QAAM,UAAU,MAAM,MAAM,UAAU,KAAK,SAAS;AACpD,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG;AAAA,MACD,KAAK;AAAA,QACH;AAAA,UACE,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO,OAAO;AAAA,UACpB;AAAA,UACA,GAAG;AAAA,UACH;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,MAAM,MAAM,EAAE,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI;AAAA,QAC/C;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,KAAG;AAAA,IACD,YAAY,OAAO,IAAI,WAAW,OAAO,OAAO,IAAI,KAAK,OAAO,OAAO,UAAU,MAAM;AAAA,EACzF;AACA,KAAG,IAAI,YAAY,OAAO,SAAS,aAAQ,OAAO,MAAM,8BAA8B,KAAK,EAAE;AAC7F,KAAG,IAAI,YAAY,MAAM,GAAG,IAAI,GAAG,SAAS,IAAI,GAAG,MAAM,mCAAmC,EAAE;AAC9F,KAAG,IAAI,YAAY,QAAQ,MAAM,eAAe,OAAO,SAAS,EAAE;AAClE,KAAG;AAAA,IACD,YAAY,QAAQ,MAAM,YAAY,QAAQ,WAAW,IAAI,KAAK,GAAG,GAAG,QAAQ,SAAS,6BAAwB,EAAE;AAAA,EACrH;AACA,KAAG,IAAI,YAAY,KAAK,EAAE;AAC1B,QAAM,MAAM,CAAC,UACX,OAAO,QAAQ,OAAO,KAAK,KAAK,CAAC,EAC9B,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,EAClE,KAAK,IAAI,KAAK;AACnB,KAAG,IAAI,cAAc,IAAI,SAAS,CAAC,EAAE;AACrC,KAAG,IAAI,cAAc,IAAI,SAAS,CAAC,EAAE;AACrC,SAAO;AACT;;;ACpGA,IAAM,eAAe,OAAO,MAAkB,QAC3C,MAAM,OAAO,qBAAqB,GAAG,aAAa,MAAM,EAAE;AAC7D,IAAM,cAAc,OAAO,MAAkB,QAC1C,MAAM,OAAO,oBAAoB,GAAG,YAAY,MAAM,EAAE;AAC3D,IAAM,eAAe,OAAO,MAAkB,QAC3C,MAAM,OAAO,qBAAqB,GAAG,aAAa,MAAM,EAAE;AAC7D,IAAM,eAAe,OAAO,MAAkB,QAC3C,MAAM,OAAO,qBAAqB,GAAG,aAAa,MAAM,EAAE;AAEtD,IAAM,OAAO;AAAA;AAAA,IAEhB,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiCX,eAAsB,KAAK,MAAyB,KAAS,UAAU,GAAoB;AACzF,QAAM,OAAmB,UAAU,IAAI;AACvC,MAAI,KAAK,MAAM,SAAS;AACtB,OAAG,IAAI,QAAQ,CAAC;AAChB,WAAO;AAAA,EACT;AACA,MAAI,KAAK,YAAY,UAAa,CAAC,KAAK,MAAM,QAAQ,GAAG,QAAQ,OAAO;AAGtE,QAAI;AACF,aAAO,MAAM,aAAa,MAAM,EAAE;AAAA,IACpC,SAAS,KAAK;AACZ,SAAG,IAAI,cAAc,GAAG,CAAC;AACzB,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,KAAK,MAAM,QAAQ,KAAK,YAAY,UAAa,KAAK,YAAY,QAAQ;AAC5E,OAAG,IAAI,IAAI;AACX,WAAO,KAAK,YAAY,UAAa,CAAC,KAAK,MAAM,OAAO,IAAI;AAAA,EAC9D;AACA,MAAI;AACF,YAAQ,KAAK,SAAS;AAAA,MACpB,KAAK;AACH,eAAO,MAAM,YAAY,MAAM,EAAE;AAAA,MACnC,KAAK;AAAA,MACL,KAAK;AACH,eAAO,MAAM,aAAa,MAAM,EAAE;AAAA,MACpC,KAAK;AACH,eAAO,MAAM,cAAc,MAAM,EAAE;AAAA,MACrC,KAAK;AACH,eAAO,MAAM,YAAY,MAAM,EAAE;AAAA,MACnC,KAAK;AACH,eAAO,MAAM,cAAc,MAAM,EAAE;AAAA,MACrC,KAAK;AACH,eAAO,MAAM,eAAe,MAAM,EAAE;AAAA,MACtC,KAAK;AACH,eAAO,MAAM,cAAc,MAAM,EAAE;AAAA,MACrC,KAAK;AACH,eAAO,MAAM,aAAa,MAAM,EAAE;AAAA,MACpC,KAAK;AACH,eAAO,MAAM,YAAY,MAAM,EAAE;AAAA,MACnC,KAAK;AACH,eAAO,MAAM,cAAc,MAAM,EAAE;AAAA,MACrC,KAAK;AACH,eAAO,MAAM,cAAc,YAAY,MAAM,EAAE;AAAA,MACjD,KAAK;AACH,eAAO,MAAM,cAAc,UAAU,MAAM,EAAE;AAAA,MAC/C,KAAK;AACH,eAAO,MAAM,iBAAiB,MAAM,EAAE;AAAA,MACxC,KAAK;AAAA,MACL,KAAK;AACH,eAAO,MAAM,WAAW,MAAM,EAAE;AAAA,MAClC,KAAK;AACH,eAAO,MAAM,sBAAsB,MAAM,EAAE;AAAA,MAC7C,KAAK;AACH,eAAO,MAAM,YAAY,MAAM,EAAE;AAAA,MACnC,KAAK;AACH,eAAO,MAAM,aAAa,MAAM,EAAE;AAAA,MACpC,KAAK;AACH,eAAO,MAAM,aAAa,MAAM,EAAE;AAAA,MACpC;AACE,WAAG,IAAI,oBAAoB,KAAK,OAAO;AAAA,CAAK;AAC5C,WAAG,IAAI,IAAI;AACX,eAAO;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,OAAG,IAAI,cAAc,GAAG,CAAC;AACzB,WAAO;AAAA,EACT;AACF;AAIA,IAAM,WACH,WAAuC,uBAAO,IAAI,qBAAqB,CAAC,MAAM;AACjF,IAAM,SACJ,CAAC,YACD,QAAQ,KAAK,CAAC,MAAM,UACpB,gDAAgD,KAAK,QAAQ,KAAK,CAAC,CAAC;AACtE,IAAI,QAAQ;AACV,OAAK,QAAQ,KAAK,MAAM,CAAC,CAAC,EAAE;AAAA,IAC1B,CAAC,SAAS;AACR,UAAI,SAAS,EAAG,SAAQ,WAAW;AAAA,IACrC;AAAA,IACA,CAAC,QAAiB;AAChB,cAAQ,OAAO,MAAM,GAAG,cAAc,GAAG,CAAC;AAAA,CAAI;AAC9C,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF;AACF;","names":["c","existsSync","envTwin","existsSync","existsSync","envTwin","allow","out","resolve","resolve"]}

package/dist/cli.js

@@ -2,12 +2,14 @@
 import {
   HELP,
   main
-} from "./chunk-6TUQD666.js";
-import "./chunk-3O6KWT3E.js";
-import "./chunk-TW5KJREH.js";
+} from "./chunk-ZG4LGUJE.js";
+import "./chunk-OM5L7A32.js";
+import "./chunk-F73VDY3W.js";
+import "./chunk-2QDPPTPY.js";
+import "./chunk-XPNBYSIN.js";
 import {
   version
-} from "./chunk-SUXQTT3X.js";
+} from "./chunk-4WTFMFRY.js";
 import "./chunk-5WRI5ZAA.js";
 export {
   HELP,

package/dist/fixtures/crm-server.js

@@ -3,8 +3,8 @@ import {
   createCrmMcpServer,
   crmTools,
   seedState
-} from "../chunk-HPYZ3JDX.js";
-import "../chunk-ZSLWPKXI.js";
+} from "../chunk-SWZQMPDG.js";
+import "../chunk-IS3DAHZI.js";
 import "../chunk-5WRI5ZAA.js";
 export {
   createCrmMcpServer,

package/dist/fixtures/demo-agent.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDemoAgent
-} from "../chunk-BKXXTWIS.js";
+} from "../chunk-XOBFANL4.js";
 import "../chunk-5WRI5ZAA.js";
 export {
   runDemoAgent

package/dist/index.d.ts

@@ -415,11 +415,11 @@ declare function rewriteClientConfig(file: ClientConfigFile, policyPath: string,
     backup: string;
     replaced: string[];
 };
-/** `agentguard init --undo`: restore the backup. */
+/** `okgate init --undo`: restore the backup. */
 declare function restoreClientConfig(file: ClientConfigFile): boolean;
 
 /**
- * `agentguard tools` — connect to every upstream and print the tools the agent will see,
+ * `okgate tools` — connect to every upstream and print the tools the agent will see,
  * with their class and why. Also the probe `init` uses to seed the policy.
  */
 
@@ -507,9 +507,9 @@ declare function createCrmMcpServer(state?: CrmState): McpServer;
 /**
  * A scripted "agent" that misbehaves on purpose: reads, then writes, then loops, then bursts
  * writes past the cap. Run it against the proxy to see dry-run diffs, LOOP_DETECTED and
- * CAP_EXCEEDED in `agentguard report`.
+ * CAP_EXCEEDED in `okgate report`.
  *
- *   node dist/fixtures/demo-agent.js --config agentguard.yaml   # spawns `agentguard proxy` over stdio
+ *   node dist/fixtures/demo-agent.js --config okgate.yaml   # spawns `okgate proxy` over stdio
  */
 
 interface DemoStep {
@@ -556,7 +556,7 @@ declare const TEAM_HISTORY_URL = "https://agentwares-agentguard.vercel.app/team-
 declare function parseSince(value: string | undefined, now: Date): number | undefined;
 declare function auditCommand(args: ParsedArgs, io: Io): Promise<number>;
 
-declare const HELP = "agentguard \u2014 MCP policy proxy for agents that touch production\n\n  npx @agentwares/agentguard init                 read your MCP config, write agentguard.yaml (dry-run), route every server through the proxy\n  agentguard report [--run id|--all]  what this run did / would have destroyed / spent, where it was halted\n  agentguard diff [--run id]          record-by-record mutation diff from a dry run\n  agentguard verify [audit.jsonl]     prove the hash-chained audit log was not edited\n  agentguard connect <key> [--write]  point this machine at your hosted proxy (paid tiers)\n\n  agentguard hooks install [--project|--user] [--client claude|codex|gemini|all]\n                                      check a coding agent's own shell commands and file edits against agentguard.yaml (dry-run first);\n                                      irreversible commands (push, merge, publish, send, rm outside the repo) only on a turn a person typed\n  agentguard hooks uninstall | status\n  agentguard hook pre-tool-use        what the installed hook runs (reads the harness's JSON on stdin)\n\n  agentguard audit [--since 7d|30d|all] [--client claude|codex|all] [--json]\n                                      which rules in CLAUDE.md / AGENTS.md / GEMINI.md / .cursor/rules your coding agents broke,\n                                      from this machine's Claude Code and Codex sessions in this repo (nothing is sent anywhere)\n  agentguard audit --enforce [--preview]\n                                      write the checkable rules into agentguard.yaml as hook rules, in dry-run, and install the hook\n\n  agentguard proxy [--http --port 8788] [--agent name] [--run-id id] [--mode dry-run|enforce]\n  agentguard tools [--json]           the tools your agent will see, with class and why\n  agentguard status [--run id]        counters vs caps, kill state, pending approvals\n\n  agentguard kill [reason]            halt every run now (file + running HTTP proxy);  agentguard resume\n  agentguard approvals [--all]        pending approvals;  agentguard approve <id> | deny <id> [--note text]\n  agentguard key create <agent> [--allow 'crm_get_*']... [--deny p] [--writes n] [--spend n] [--mode m]\n  agentguard key list | revoke <agent>\n  agentguard permission-diff [--base ref] [--head ref] [--paths a,b] [--format markdown|json] [--fail-on-widen]\n\nOptions: --config <agentguard.yaml> (or AGENTGUARD_CONFIG), --json, --help, --version\nDocs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli";
+declare const HELP: string;
 declare function main(argv: readonly string[], io?: Io): Promise<number>;
 
 export { AUDIT_CANARIES, type CallContext, type ClientConfigFile, type CrmState, DEFAULT_PERMISSION_PATHS, type DemoOptions, type DemoStep, type DownstreamOptions, type DownstreamSession, type ExposedTool, type FileGuard, HELP, type HttpProxy, type HttpProxyOptions, type HttpRegistration, type Io, type PermissionDiffResult, type ProbeResult, type ProbedTool, ProxyRuntime, type RuntimeOptions, type ServerEntry, type SyntheticAuditHistory, type SyntheticAuditOptions, TEAM_HISTORY_URL, type UpstreamStatus, approvalSlackMessage, auditCommand, candidateConfigs, createAlerter, createCrmMcpServer, createDownstreamServer, createFileGuard, crmTools, detectClientConfigs, haltSlackMessage, loadPolicyFor, main, parseSince, probeUpstreams, proxyEntry, readRegistration, readServers, registrationPath, renderStarterPolicy, restoreClientConfig, rewriteClientConfig, runDemoAgent, runIdFor, runPermissionDiff, seedState, serversToUpstreams, startHttpProxy, toCallToolResult, writeSyntheticAuditHistory };

package/dist/index.js

@@ -3,37 +3,24 @@ import {
   HELP,
   main,
   runPermissionDiff
-} from "./chunk-6TUQD666.js";
+} from "./chunk-ZG4LGUJE.js";
 import {
   createCrmMcpServer,
   crmTools,
   seedState
-} from "./chunk-HPYZ3JDX.js";
+} from "./chunk-SWZQMPDG.js";
 import {
   runDemoAgent
-} from "./chunk-BKXXTWIS.js";
+} from "./chunk-XOBFANL4.js";
 import {
   createDownstreamServer,
   runIdFor,
   startHttpProxy,
   toCallToolResult
-} from "./chunk-KRKZGAJ3.js";
+} from "./chunk-JSELR4SG.js";
 import {
   renderStarterPolicy
-} from "./chunk-X4M7YWQA.js";
-import {
-  probeUpstreams
-} from "./chunk-VQWQ5TOM.js";
-import {
-  ProxyRuntime
-} from "./chunk-D66U3PVB.js";
-import "./chunk-ZSLWPKXI.js";
-import {
-  TEAM_HISTORY_URL,
-  auditCommand,
-  parseSince
-} from "./chunk-6S7LYVOC.js";
-import "./chunk-3O6KWT3E.js";
+} from "./chunk-IEJK7N3B.js";
 import {
   candidateConfigs,
   detectClientConfigs,
@@ -42,7 +29,22 @@ import {
   restoreClientConfig,
   rewriteClientConfig,
   serversToUpstreams
-} from "./chunk-TW5KJREH.js";
+} from "./chunk-OM5L7A32.js";
+import {
+  probeUpstreams
+} from "./chunk-DEVXG3IB.js";
+import {
+  ProxyRuntime
+} from "./chunk-TJXZBOHL.js";
+import "./chunk-IS3DAHZI.js";
+import {
+  TEAM_HISTORY_URL,
+  auditCommand,
+  parseSince
+} from "./chunk-YBVD6HTT.js";
+import "./chunk-F73VDY3W.js";
+import "./chunk-2QDPPTPY.js";
+import "./chunk-XPNBYSIN.js";
 import {
   approvalSlackMessage,
   createAlerter,
@@ -51,7 +53,7 @@ import {
   loadPolicyFor,
   readRegistration,
   registrationPath
-} from "./chunk-SUXQTT3X.js";
+} from "./chunk-4WTFMFRY.js";
 import "./chunk-5WRI5ZAA.js";
 
 // src/fixtures/audit-sessions.ts
@@ -113,7 +115,7 @@ function writeSyntheticAuditHistory(opts) {
   writeFileSync(join(repo, "AGENTS.md"), AGENTS_MD);
   writeFileSync(join(repo, "GEMINI.md"), GEMINI_MD);
   writeFileSync(join(repo, ".cursor", "rules", "release.mdc"), CURSOR_RULE);
-  writeFileSync(join(repo, "agentguard.yaml"), POLICY);
+  writeFileSync(join(repo, "okgate.yaml"), POLICY);
   const project = join(opts.claudeDir, repo.replace(/[^a-zA-Z0-9]/g, "-"));
   mkdirSync(project, { recursive: true });
   let n = 0;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/fixtures/audit-sessions.ts"],"sourcesContent":["/**\n * A synthetic history for `agentguard audit`: rule files in every format it reads, and Claude\n * Code and Codex transcripts in the shapes those clients write (verified on 7 Oct 2026, structure\n * only), with known kept and broken rules. Every prompt, command and path here is made up; the\n * CANARY strings let a test prove none of them reaches the cache or the JSON.\n *\n * Used by the tests and by `scripts/audit-recorded-run.mjs`.\n */\nimport { mkdirSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nexport const AUDIT_CANARIES = [\n  \"CANARY-PROMPT-7d1e\",\n  \"CANARY-ASSISTANT-3b9a\",\n  \"CANARY-COMMIT-MESSAGE-5c2f\",\n  \"CANARY-OUTPUT-8e4d\",\n  \"CANARY-PATH-2a6b\",\n  \"CANARY-CONTENT-9f0c\",\n] as const;\n\nconst [PROMPT, ASSISTANT, COMMIT, OUTPUT, PATH, CONTENT] = AUDIT_CANARIES;\n\nconst CLAUDE_MD = `# Working in this repo\n\n## Git\n\n- Never push to \\`main\\`.\n- Never force-push.\n- Never use \\`--no-verify\\`.\n- Run \\`pnpm check\\` before pushing.\n\n## Tooling\n\n- Use pnpm, not npm.\n- Write tests for new code.\n`;\n\nconst AGENTS_MD = `# AGENTS.md\n\n- Do not add dependencies without asking.\n- Never rm -rf anything outside the repo.\n- Keep functions small. <!-- agentguard: none -->\n`;\n\nconst GEMINI_MD = `# GEMINI.md\n\nDo not edit \\`pnpm-lock.yaml\\` by hand.\n`;\n\nconst CURSOR_RULE = `---\ndescription: releases\nalwaysApply: true\n---\n\n- Do not deploy.\n- Do not use \\`vercel env pull\\`.\n`;\n\nconst POLICY = `version: 1\naudit:\n  rules:\n    - id: publish\n      text: Only CI publishes packages\n      check: no-publish\n`;\n\nexport interface SyntheticAuditOptions {\n  /** the repository: rule files are written here */\n  repo: string;\n  /** stands in for ~/.claude/projects */\n  claudeDir: string;\n  /** stands in for ~/.codex/sessions */\n  codexDir: string;\n  now?: Date;\n}\n\nexport interface SyntheticAuditHistory {\n  /** sessions in the repository in the last 7 days (5 Claude Code, 1 Codex) */\n  sessionsLast7d: number;\n  /** and with the one 20 days old */\n  sessionsAll: number;\n}\n\ntype Entry = Record<string, unknown>;\n\n/** Write the rule files and the transcripts. */\nexport function writeSyntheticAuditHistory(opts: SyntheticAuditOptions): SyntheticAuditHistory {\n  const now = (opts.now ?? new Date()).getTime();\n  const repo = opts.repo;\n  mkdirSync(join(repo, \".cursor\", \"rules\"), { recursive: true });\n  writeFileSync(join(repo, \"CLAUDE.md\"), CLAUDE_MD);\n  writeFileSync(join(repo, \"AGENTS.md\"), AGENTS_MD);\n  writeFileSync(join(repo, \"GEMINI.md\"), GEMINI_MD);\n  writeFileSync(join(repo, \".cursor\", \"rules\", \"release.mdc\"), CURSOR_RULE);\n  writeFileSync(join(repo, \"agentguard.yaml\"), POLICY);\n\n  const project = join(opts.claudeDir, repo.replace(/[^a-zA-Z0-9]/g, \"-\"));\n  mkdirSync(project, { recursive: true });\n  let n = 0;\n\n  const session = (id: string, daysAgo: number, cwd = repo) => {\n    let t = now - daysAgo * 86_400_000;\n    const lines: Entry[] = [];\n    let branch = \"fix/work\";\n    const base = (type: string, sidechain = false): Entry => {\n      t += 45_000;\n      n += 1;\n      return {\n        parentUuid: null,\n        isSidechain: sidechain,\n        type,\n        uuid: `u-${id}-${n}`,\n        timestamp: new Date(t).toISOString(),\n        userType: \"external\",\n        entrypoint: \"cli\",\n        cwd,\n        sessionId: id,\n        version: \"2.1.286\",\n        gitBranch: branch,\n      };\n    };\n    const api = {\n      lines,\n      branch(b: string) {\n        branch = b;\n        return api;\n      },\n      human(text: string) {\n        lines.push({\n          ...base(\"user\"),\n          origin: { kind: \"human\" },\n          message: { role: \"user\", content: text },\n        });\n        return api;\n      },\n      say(text: string) {\n        lines.push({\n          ...base(\"assistant\"),\n          message: { role: \"assistant\", content: [{ type: \"text\", text }] },\n        });\n        return api;\n      },\n      tool(name: string, input: Entry, result: Entry = {}, sidechain = false) {\n        const toolId = `toolu_${id}_${n + 1}`;\n        lines.push({\n          ...base(\"assistant\", sidechain),\n          message: { role: \"assistant\", content: [{ type: \"tool_use\", id: toolId, name, input }] },\n        });\n        lines.push({\n          ...base(\"user\", sidechain),\n          message: {\n            role: \"user\",\n            content: [\n              {\n                type: \"tool_result\",\n                tool_use_id: toolId,\n                content: `done ${OUTPUT}`,\n                is_error: Boolean(result.toolDenialKind),\n              },\n            ],\n          },\n          toolUseResult: { stdout: `ok ${OUTPUT}`, stderr: \"\" },\n          ...result,\n        });\n        return api;\n      },\n      bash(command: string, result: Entry = {}, sidechain = false) {\n        return api.tool(\"Bash\", { command, description: \"synthetic\" }, result, sidechain);\n      },\n      write(dir: string, file: string) {\n        writeFileSync(\n          join(dir, `${id}.jsonl`),\n          lines.map((l) => JSON.stringify(l)).join(\"\\n\") + \"\\n\",\n        );\n        return file;\n      },\n    };\n    return api;\n  };\n\n  // S1: kept everything — edited, checked, pushed a branch\n  session(\"s1-kept\", 6)\n    .human(`fix the login bug ${PROMPT}`)\n    .say(`Looking at it. ${ASSISTANT}`)\n    .tool(\"Edit\", {\n      file_path: join(repo, \"src\", `${PATH}.ts`),\n      old_string: \"a\",\n      new_string: CONTENT,\n    })\n    .bash(\"pnpm check 2>&1 | tail -20\")\n    .bash(`git commit -am \"fix login ${COMMIT}\"`)\n    .bash(\"git push origin fix/login\")\n    .write(project, \"s1\");\n\n  // S2: pushed main without the check, and skipped the hooks\n  session(\"s2-main\", 5)\n    .human(\"update the readme\")\n    .tool(\"Write\", { file_path: join(repo, \"README.md\"), content: CONTENT })\n    .bash(`git commit --no-verify -m \"${COMMIT}\"`)\n    .bash(\"git push origin main\")\n    .write(project, \"s2\");\n\n  // S3: npm instead of pnpm; one package asked for, one not (in a subagent)\n  const s3 = session(\"s3-deps\", 4)\n    .human(\"add zod for the form validation\")\n    .bash(\"pnpm add zod\")\n    .bash(\"npm install\");\n  s3.write(project, \"s3\");\n  // a subagent of the same session, a few minutes later: its sidechain lines carry the parent's id\n  const sub = session(\"s3-deps\", 3.99).bash(\"pnpm add left-pad\", {}, true);\n  mkdirSync(join(project, \"s3-deps\", \"subagents\"), { recursive: true });\n  writeFileSync(\n    join(project, \"s3-deps\", \"subagents\", \"agent-a1.jsonl\"),\n    sub.lines.map((l) => JSON.stringify({ ...l, agentId: \"a1\" })).join(\"\\n\") + \"\\n\",\n  );\n\n  // S4: force-push, rm outside the repo, a hand-edited lockfile, a refused push to main\n  session(\"s4-cleanup\", 3)\n    .human(\"clean up the branch\")\n    .bash(\"git push --force origin fix/work\")\n    .bash(\"rm -rf /srv/old-builds\")\n    .tool(\"Edit\", { file_path: join(repo, \"pnpm-lock.yaml\"), old_string: \"a\", new_string: \"b\" })\n    .bash(\"git push origin main\", { toolDenialKind: \"user-rejected\" })\n    .write(project, \"s4\");\n\n  // S5: secrets pulled, a deploy the person asked for, a publish\n  session(\"s5-release\", 2)\n    .human(\"deploy the release to production\")\n    .bash(\"vercel env pull .env.local --token sk_live_synthetic000000\")\n    .bash(\"vercel --prod\")\n    .bash(\"npm publish --access public\")\n    .write(project, \"s5\");\n\n  // S6: twenty days ago — only in a 30-day audit\n  session(\"s6-old\", 20).human(\"ship it\").bash(\"git push origin main\").write(project, \"s6\");\n\n  // another repository on the same machine: never counted\n  const other = join(opts.claudeDir, `${repo.replace(/[^a-zA-Z0-9]/g, \"-\")}-other`);\n  mkdirSync(other, { recursive: true });\n  session(\"s7-elsewhere\", 1, `${repo}-other`).bash(\"git push origin main\").write(other, \"s7\");\n\n  // Codex: one rollout in the repository, one elsewhere\n  const day = new Date(now - 86_400_000);\n  const codexDay = join(\n    opts.codexDir,\n    String(day.getUTCFullYear()),\n    String(day.getUTCMonth() + 1).padStart(2, \"0\"),\n    String(day.getUTCDate()).padStart(2, \"0\"),\n  );\n  mkdirSync(codexDay, { recursive: true });\n  const rollout = (thread: string, cwd: string): string => {\n    let t = now - 86_400_000;\n    const line = (type: string, payload: Entry): Entry => {\n      t += 30_000;\n      return { timestamp: new Date(t).toISOString(), type, payload };\n    };\n    const call = (cmd: string, k: number): Entry =>\n      line(\"response_item\", {\n        type: \"function_call\",\n        name: \"exec_command\",\n        call_id: `call_${thread}_${k}`,\n        arguments: JSON.stringify({ cmd, workdir: cwd, yield_time_ms: 1000 }),\n      });\n    return (\n      [\n        line(\"session_meta\", {\n          id: thread,\n          cwd,\n          cli_version: \"0.159.0\",\n          originator: \"codex_cli_rs\",\n          source: \"cli\",\n        }),\n        line(\"turn_context\", { turn_id: \"t1\", cwd, model: \"synthetic-model\" }),\n        line(\"response_item\", {\n          type: \"message\",\n          role: \"user\",\n          content: [{ type: \"input_text\", text: PROMPT }],\n        }),\n        call(\"npm run build\", 1),\n        call(\"git push origin main\", 2),\n        line(\"response_item\", {\n          type: \"custom_tool_call\",\n          name: \"exec\",\n          call_id: `call_${thread}_3`,\n          input: `await run(${JSON.stringify(CONTENT)})`,\n        }),\n      ]\n        .map((l) => JSON.stringify(l))\n        .join(\"\\n\") + \"\\n\"\n    );\n  };\n  writeFileSync(\n    join(codexDay, \"rollout-2026-10-06T10-00-00-thread-in-repo.jsonl\"),\n    rollout(\"thread-in-repo\", repo),\n  );\n  writeFileSync(\n    join(codexDay, \"rollout-2026-10-06T11-00-00-thread-other.jsonl\"),\n    rollout(\"thread-other\", \"/elsewhere/project\"),\n  );\n\n  return { sessionsLast7d: 6, sessionsAll: 7 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,SAAS,WAAW,qBAAqB;AACzC,SAAS,YAAY;AAEd,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,CAAC,QAAQ,WAAW,QAAQ,QAAQ,MAAM,OAAO,IAAI;AAE3D,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAelB,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAOlB,IAAM,YAAY;AAAA;AAAA;AAAA;AAKlB,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASpB,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BR,SAAS,2BAA2B,MAAoD;AAC7F,QAAM,OAAO,KAAK,OAAO,oBAAI,KAAK,GAAG,QAAQ;AAC7C,QAAM,OAAO,KAAK;AAClB,YAAU,KAAK,MAAM,WAAW,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,gBAAc,KAAK,MAAM,WAAW,GAAG,SAAS;AAChD,gBAAc,KAAK,MAAM,WAAW,GAAG,SAAS;AAChD,gBAAc,KAAK,MAAM,WAAW,GAAG,SAAS;AAChD,gBAAc,KAAK,MAAM,WAAW,SAAS,aAAa,GAAG,WAAW;AACxE,gBAAc,KAAK,MAAM,iBAAiB,GAAG,MAAM;AAEnD,QAAM,UAAU,KAAK,KAAK,WAAW,KAAK,QAAQ,iBAAiB,GAAG,CAAC;AACvE,YAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,MAAI,IAAI;AAER,QAAM,UAAU,CAAC,IAAY,SAAiB,MAAM,SAAS;AAC3D,QAAI,IAAI,MAAM,UAAU;AACxB,UAAM,QAAiB,CAAC;AACxB,QAAI,SAAS;AACb,UAAM,OAAO,CAAC,MAAc,YAAY,UAAiB;AACvD,WAAK;AACL,WAAK;AACL,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,aAAa;AAAA,QACb;AAAA,QACA,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,QAClB,WAAW,IAAI,KAAK,CAAC,EAAE,YAAY;AAAA,QACnC,UAAU;AAAA,QACV,YAAY;AAAA,QACZ;AAAA,QACA,WAAW;AAAA,QACX,SAAS;AAAA,QACT,WAAW;AAAA,MACb;AAAA,IACF;AACA,UAAM,MAAM;AAAA,MACV;AAAA,MACA,OAAO,GAAW;AAChB,iBAAS;AACT,eAAO;AAAA,MACT;AAAA,MACA,MAAM,MAAc;AAClB,cAAM,KAAK;AAAA,UACT,GAAG,KAAK,MAAM;AAAA,UACd,QAAQ,EAAE,MAAM,QAAQ;AAAA,UACxB,SAAS,EAAE,MAAM,QAAQ,SAAS,KAAK;AAAA,QACzC,CAAC;AACD,eAAO;AAAA,MACT;AAAA,MACA,IAAI,MAAc;AAChB,cAAM,KAAK;AAAA,UACT,GAAG,KAAK,WAAW;AAAA,UACnB,SAAS,EAAE,MAAM,aAAa,SAAS,CAAC,EAAE,MAAM,QAAQ,KAAK,CAAC,EAAE;AAAA,QAClE,CAAC;AACD,eAAO;AAAA,MACT;AAAA,MACA,KAAK,MAAc,OAAc,SAAgB,CAAC,GAAG,YAAY,OAAO;AACtE,cAAM,SAAS,SAAS,EAAE,IAAI,IAAI,CAAC;AACnC,cAAM,KAAK;AAAA,UACT,GAAG,KAAK,aAAa,SAAS;AAAA,UAC9B,SAAS,EAAE,MAAM,aAAa,SAAS,CAAC,EAAE,MAAM,YAAY,IAAI,QAAQ,MAAM,MAAM,CAAC,EAAE;AAAA,QACzF,CAAC;AACD,cAAM,KAAK;AAAA,UACT,GAAG,KAAK,QAAQ,SAAS;AAAA,UACzB,SAAS;AAAA,YACP,MAAM;AAAA,YACN,SAAS;AAAA,cACP;AAAA,gBACE,MAAM;AAAA,gBACN,aAAa;AAAA,gBACb,SAAS,QAAQ,MAAM;AAAA,gBACvB,UAAU,QAAQ,OAAO,cAAc;AAAA,cACzC;AAAA,YACF;AAAA,UACF;AAAA,UACA,eAAe,EAAE,QAAQ,MAAM,MAAM,IAAI,QAAQ,GAAG;AAAA,UACpD,GAAG;AAAA,QACL,CAAC;AACD,eAAO;AAAA,MACT;AAAA,MACA,KAAK,SAAiB,SAAgB,CAAC,GAAG,YAAY,OAAO;AAC3D,eAAO,IAAI,KAAK,QAAQ,EAAE,SAAS,aAAa,YAAY,GAAG,QAAQ,SAAS;AAAA,MAClF;AAAA,MACA,MAAM,KAAa,MAAc;AAC/B;AAAA,UACE,KAAK,KAAK,GAAG,EAAE,QAAQ;AAAA,UACvB,MAAM,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI;AAAA,QACnD;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,UAAQ,WAAW,CAAC,EACjB,MAAM,qBAAqB,MAAM,EAAE,EACnC,IAAI,kBAAkB,SAAS,EAAE,EACjC,KAAK,QAAQ;AAAA,IACZ,WAAW,KAAK,MAAM,OAAO,GAAG,IAAI,KAAK;AAAA,IACzC,YAAY;AAAA,IACZ,YAAY;AAAA,EACd,CAAC,EACA,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,MAAM,GAAG,EAC3C,KAAK,2BAA2B,EAChC,MAAM,SAAS,IAAI;AAGtB,UAAQ,WAAW,CAAC,EACjB,MAAM,mBAAmB,EACzB,KAAK,SAAS,EAAE,WAAW,KAAK,MAAM,WAAW,GAAG,SAAS,QAAQ,CAAC,EACtE,KAAK,8BAA8B,MAAM,GAAG,EAC5C,KAAK,sBAAsB,EAC3B,MAAM,SAAS,IAAI;AAGtB,QAAM,KAAK,QAAQ,WAAW,CAAC,EAC5B,MAAM,iCAAiC,EACvC,KAAK,cAAc,EACnB,KAAK,aAAa;AACrB,KAAG,MAAM,SAAS,IAAI;AAEtB,QAAM,MAAM,QAAQ,WAAW,IAAI,EAAE,KAAK,qBAAqB,CAAC,GAAG,IAAI;AACvE,YAAU,KAAK,SAAS,WAAW,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;AACpE;AAAA,IACE,KAAK,SAAS,WAAW,aAAa,gBAAgB;AAAA,IACtD,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI;AAAA,EAC7E;AAGA,UAAQ,cAAc,CAAC,EACpB,MAAM,qBAAqB,EAC3B,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,QAAQ,EAAE,WAAW,KAAK,MAAM,gBAAgB,GAAG,YAAY,KAAK,YAAY,IAAI,CAAC,EAC1F,KAAK,wBAAwB,EAAE,gBAAgB,gBAAgB,CAAC,EAChE,MAAM,SAAS,IAAI;AAGtB,UAAQ,cAAc,CAAC,EACpB,MAAM,kCAAkC,EACxC,KAAK,4DAA4D,EACjE,KAAK,eAAe,EACpB,KAAK,6BAA6B,EAClC,MAAM,SAAS,IAAI;AAGtB,UAAQ,UAAU,EAAE,EAAE,MAAM,SAAS,EAAE,KAAK,sBAAsB,EAAE,MAAM,SAAS,IAAI;AAGvF,QAAM,QAAQ,KAAK,KAAK,WAAW,GAAG,KAAK,QAAQ,iBAAiB,GAAG,CAAC,QAAQ;AAChF,YAAU,OAAO,EAAE,WAAW,KAAK,CAAC;AACpC,UAAQ,gBAAgB,GAAG,GAAG,IAAI,QAAQ,EAAE,KAAK,sBAAsB,EAAE,MAAM,OAAO,IAAI;AAG1F,QAAM,MAAM,IAAI,KAAK,MAAM,KAAU;AACrC,QAAM,WAAW;AAAA,IACf,KAAK;AAAA,IACL,OAAO,IAAI,eAAe,CAAC;AAAA,IAC3B,OAAO,IAAI,YAAY,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AAAA,IAC7C,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,GAAG,GAAG;AAAA,EAC1C;AACA,YAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,UAAU,CAAC,QAAgB,QAAwB;AACvD,QAAI,IAAI,MAAM;AACd,UAAM,OAAO,CAAC,MAAc,YAA0B;AACpD,WAAK;AACL,aAAO,EAAE,WAAW,IAAI,KAAK,CAAC,EAAE,YAAY,GAAG,MAAM,QAAQ;AAAA,IAC/D;AACA,UAAM,OAAO,CAAC,KAAa,MACzB,KAAK,iBAAiB;AAAA,MACpB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,QAAQ,MAAM,IAAI,CAAC;AAAA,MAC5B,WAAW,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,eAAe,IAAK,CAAC;AAAA,IACtE,CAAC;AACH,WACE;AAAA,MACE,KAAK,gBAAgB;AAAA,QACnB,IAAI;AAAA,QACJ;AAAA,QACA,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,QAAQ;AAAA,MACV,CAAC;AAAA,MACD,KAAK,gBAAgB,EAAE,SAAS,MAAM,KAAK,OAAO,kBAAkB,CAAC;AAAA,MACrE,KAAK,iBAAiB;AAAA,QACpB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,CAAC,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,MAChD,CAAC;AAAA,MACD,KAAK,iBAAiB,CAAC;AAAA,MACvB,KAAK,wBAAwB,CAAC;AAAA,MAC9B,KAAK,iBAAiB;AAAA,QACpB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,QAAQ,MAAM;AAAA,QACvB,OAAO,aAAa,KAAK,UAAU,OAAO,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH,EACG,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAC5B,KAAK,IAAI,IAAI;AAAA,EAEpB;AACA;AAAA,IACE,KAAK,UAAU,kDAAkD;AAAA,IACjE,QAAQ,kBAAkB,IAAI;AAAA,EAChC;AACA;AAAA,IACE,KAAK,UAAU,gDAAgD;AAAA,IAC/D,QAAQ,gBAAgB,oBAAoB;AAAA,EAC9C;AAEA,SAAO,EAAE,gBAAgB,GAAG,aAAa,EAAE;AAC7C;","names":[]}
+{"version":3,"sources":["../src/fixtures/audit-sessions.ts"],"sourcesContent":["/**\n * A synthetic history for `okgate audit`: rule files in every format it reads, and Claude\n * Code and Codex transcripts in the shapes those clients write (verified on 7 Oct 2026, structure\n * only), with known kept and broken rules. Every prompt, command and path here is made up; the\n * CANARY strings let a test prove none of them reaches the cache or the JSON.\n *\n * Used by the tests and by `scripts/audit-recorded-run.mjs`.\n */\nimport { mkdirSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nexport const AUDIT_CANARIES = [\n  \"CANARY-PROMPT-7d1e\",\n  \"CANARY-ASSISTANT-3b9a\",\n  \"CANARY-COMMIT-MESSAGE-5c2f\",\n  \"CANARY-OUTPUT-8e4d\",\n  \"CANARY-PATH-2a6b\",\n  \"CANARY-CONTENT-9f0c\",\n] as const;\n\nconst [PROMPT, ASSISTANT, COMMIT, OUTPUT, PATH, CONTENT] = AUDIT_CANARIES;\n\nconst CLAUDE_MD = `# Working in this repo\n\n## Git\n\n- Never push to \\`main\\`.\n- Never force-push.\n- Never use \\`--no-verify\\`.\n- Run \\`pnpm check\\` before pushing.\n\n## Tooling\n\n- Use pnpm, not npm.\n- Write tests for new code.\n`;\n\nconst AGENTS_MD = `# AGENTS.md\n\n- Do not add dependencies without asking.\n- Never rm -rf anything outside the repo.\n- Keep functions small. <!-- agentguard: none -->\n`;\n\nconst GEMINI_MD = `# GEMINI.md\n\nDo not edit \\`pnpm-lock.yaml\\` by hand.\n`;\n\nconst CURSOR_RULE = `---\ndescription: releases\nalwaysApply: true\n---\n\n- Do not deploy.\n- Do not use \\`vercel env pull\\`.\n`;\n\nconst POLICY = `version: 1\naudit:\n  rules:\n    - id: publish\n      text: Only CI publishes packages\n      check: no-publish\n`;\n\nexport interface SyntheticAuditOptions {\n  /** the repository: rule files are written here */\n  repo: string;\n  /** stands in for ~/.claude/projects */\n  claudeDir: string;\n  /** stands in for ~/.codex/sessions */\n  codexDir: string;\n  now?: Date;\n}\n\nexport interface SyntheticAuditHistory {\n  /** sessions in the repository in the last 7 days (5 Claude Code, 1 Codex) */\n  sessionsLast7d: number;\n  /** and with the one 20 days old */\n  sessionsAll: number;\n}\n\ntype Entry = Record<string, unknown>;\n\n/** Write the rule files and the transcripts. */\nexport function writeSyntheticAuditHistory(opts: SyntheticAuditOptions): SyntheticAuditHistory {\n  const now = (opts.now ?? new Date()).getTime();\n  const repo = opts.repo;\n  mkdirSync(join(repo, \".cursor\", \"rules\"), { recursive: true });\n  writeFileSync(join(repo, \"CLAUDE.md\"), CLAUDE_MD);\n  writeFileSync(join(repo, \"AGENTS.md\"), AGENTS_MD);\n  writeFileSync(join(repo, \"GEMINI.md\"), GEMINI_MD);\n  writeFileSync(join(repo, \".cursor\", \"rules\", \"release.mdc\"), CURSOR_RULE);\n  writeFileSync(join(repo, \"okgate.yaml\"), POLICY);\n\n  const project = join(opts.claudeDir, repo.replace(/[^a-zA-Z0-9]/g, \"-\"));\n  mkdirSync(project, { recursive: true });\n  let n = 0;\n\n  const session = (id: string, daysAgo: number, cwd = repo) => {\n    let t = now - daysAgo * 86_400_000;\n    const lines: Entry[] = [];\n    let branch = \"fix/work\";\n    const base = (type: string, sidechain = false): Entry => {\n      t += 45_000;\n      n += 1;\n      return {\n        parentUuid: null,\n        isSidechain: sidechain,\n        type,\n        uuid: `u-${id}-${n}`,\n        timestamp: new Date(t).toISOString(),\n        userType: \"external\",\n        entrypoint: \"cli\",\n        cwd,\n        sessionId: id,\n        version: \"2.1.286\",\n        gitBranch: branch,\n      };\n    };\n    const api = {\n      lines,\n      branch(b: string) {\n        branch = b;\n        return api;\n      },\n      human(text: string) {\n        lines.push({\n          ...base(\"user\"),\n          origin: { kind: \"human\" },\n          message: { role: \"user\", content: text },\n        });\n        return api;\n      },\n      say(text: string) {\n        lines.push({\n          ...base(\"assistant\"),\n          message: { role: \"assistant\", content: [{ type: \"text\", text }] },\n        });\n        return api;\n      },\n      tool(name: string, input: Entry, result: Entry = {}, sidechain = false) {\n        const toolId = `toolu_${id}_${n + 1}`;\n        lines.push({\n          ...base(\"assistant\", sidechain),\n          message: { role: \"assistant\", content: [{ type: \"tool_use\", id: toolId, name, input }] },\n        });\n        lines.push({\n          ...base(\"user\", sidechain),\n          message: {\n            role: \"user\",\n            content: [\n              {\n                type: \"tool_result\",\n                tool_use_id: toolId,\n                content: `done ${OUTPUT}`,\n                is_error: Boolean(result.toolDenialKind),\n              },\n            ],\n          },\n          toolUseResult: { stdout: `ok ${OUTPUT}`, stderr: \"\" },\n          ...result,\n        });\n        return api;\n      },\n      bash(command: string, result: Entry = {}, sidechain = false) {\n        return api.tool(\"Bash\", { command, description: \"synthetic\" }, result, sidechain);\n      },\n      write(dir: string, file: string) {\n        writeFileSync(\n          join(dir, `${id}.jsonl`),\n          lines.map((l) => JSON.stringify(l)).join(\"\\n\") + \"\\n\",\n        );\n        return file;\n      },\n    };\n    return api;\n  };\n\n  // S1: kept everything — edited, checked, pushed a branch\n  session(\"s1-kept\", 6)\n    .human(`fix the login bug ${PROMPT}`)\n    .say(`Looking at it. ${ASSISTANT}`)\n    .tool(\"Edit\", {\n      file_path: join(repo, \"src\", `${PATH}.ts`),\n      old_string: \"a\",\n      new_string: CONTENT,\n    })\n    .bash(\"pnpm check 2>&1 | tail -20\")\n    .bash(`git commit -am \"fix login ${COMMIT}\"`)\n    .bash(\"git push origin fix/login\")\n    .write(project, \"s1\");\n\n  // S2: pushed main without the check, and skipped the hooks\n  session(\"s2-main\", 5)\n    .human(\"update the readme\")\n    .tool(\"Write\", { file_path: join(repo, \"README.md\"), content: CONTENT })\n    .bash(`git commit --no-verify -m \"${COMMIT}\"`)\n    .bash(\"git push origin main\")\n    .write(project, \"s2\");\n\n  // S3: npm instead of pnpm; one package asked for, one not (in a subagent)\n  const s3 = session(\"s3-deps\", 4)\n    .human(\"add zod for the form validation\")\n    .bash(\"pnpm add zod\")\n    .bash(\"npm install\");\n  s3.write(project, \"s3\");\n  // a subagent of the same session, a few minutes later: its sidechain lines carry the parent's id\n  const sub = session(\"s3-deps\", 3.99).bash(\"pnpm add left-pad\", {}, true);\n  mkdirSync(join(project, \"s3-deps\", \"subagents\"), { recursive: true });\n  writeFileSync(\n    join(project, \"s3-deps\", \"subagents\", \"agent-a1.jsonl\"),\n    sub.lines.map((l) => JSON.stringify({ ...l, agentId: \"a1\" })).join(\"\\n\") + \"\\n\",\n  );\n\n  // S4: force-push, rm outside the repo, a hand-edited lockfile, a refused push to main\n  session(\"s4-cleanup\", 3)\n    .human(\"clean up the branch\")\n    .bash(\"git push --force origin fix/work\")\n    .bash(\"rm -rf /srv/old-builds\")\n    .tool(\"Edit\", { file_path: join(repo, \"pnpm-lock.yaml\"), old_string: \"a\", new_string: \"b\" })\n    .bash(\"git push origin main\", { toolDenialKind: \"user-rejected\" })\n    .write(project, \"s4\");\n\n  // S5: secrets pulled, a deploy the person asked for, a publish\n  session(\"s5-release\", 2)\n    .human(\"deploy the release to production\")\n    .bash(\"vercel env pull .env.local --token sk_live_synthetic000000\")\n    .bash(\"vercel --prod\")\n    .bash(\"npm publish --access public\")\n    .write(project, \"s5\");\n\n  // S6: twenty days ago — only in a 30-day audit\n  session(\"s6-old\", 20).human(\"ship it\").bash(\"git push origin main\").write(project, \"s6\");\n\n  // another repository on the same machine: never counted\n  const other = join(opts.claudeDir, `${repo.replace(/[^a-zA-Z0-9]/g, \"-\")}-other`);\n  mkdirSync(other, { recursive: true });\n  session(\"s7-elsewhere\", 1, `${repo}-other`).bash(\"git push origin main\").write(other, \"s7\");\n\n  // Codex: one rollout in the repository, one elsewhere\n  const day = new Date(now - 86_400_000);\n  const codexDay = join(\n    opts.codexDir,\n    String(day.getUTCFullYear()),\n    String(day.getUTCMonth() + 1).padStart(2, \"0\"),\n    String(day.getUTCDate()).padStart(2, \"0\"),\n  );\n  mkdirSync(codexDay, { recursive: true });\n  const rollout = (thread: string, cwd: string): string => {\n    let t = now - 86_400_000;\n    const line = (type: string, payload: Entry): Entry => {\n      t += 30_000;\n      return { timestamp: new Date(t).toISOString(), type, payload };\n    };\n    const call = (cmd: string, k: number): Entry =>\n      line(\"response_item\", {\n        type: \"function_call\",\n        name: \"exec_command\",\n        call_id: `call_${thread}_${k}`,\n        arguments: JSON.stringify({ cmd, workdir: cwd, yield_time_ms: 1000 }),\n      });\n    return (\n      [\n        line(\"session_meta\", {\n          id: thread,\n          cwd,\n          cli_version: \"0.159.0\",\n          originator: \"codex_cli_rs\",\n          source: \"cli\",\n        }),\n        line(\"turn_context\", { turn_id: \"t1\", cwd, model: \"synthetic-model\" }),\n        line(\"response_item\", {\n          type: \"message\",\n          role: \"user\",\n          content: [{ type: \"input_text\", text: PROMPT }],\n        }),\n        call(\"npm run build\", 1),\n        call(\"git push origin main\", 2),\n        line(\"response_item\", {\n          type: \"custom_tool_call\",\n          name: \"exec\",\n          call_id: `call_${thread}_3`,\n          input: `await run(${JSON.stringify(CONTENT)})`,\n        }),\n      ]\n        .map((l) => JSON.stringify(l))\n        .join(\"\\n\") + \"\\n\"\n    );\n  };\n  writeFileSync(\n    join(codexDay, \"rollout-2026-10-06T10-00-00-thread-in-repo.jsonl\"),\n    rollout(\"thread-in-repo\", repo),\n  );\n  writeFileSync(\n    join(codexDay, \"rollout-2026-10-06T11-00-00-thread-other.jsonl\"),\n    rollout(\"thread-other\", \"/elsewhere/project\"),\n  );\n\n  return { sessionsLast7d: 6, sessionsAll: 7 };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,SAAS,WAAW,qBAAqB;AACzC,SAAS,YAAY;AAEd,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,CAAC,QAAQ,WAAW,QAAQ,QAAQ,MAAM,OAAO,IAAI;AAE3D,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAelB,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAOlB,IAAM,YAAY;AAAA;AAAA;AAAA;AAKlB,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASpB,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BR,SAAS,2BAA2B,MAAoD;AAC7F,QAAM,OAAO,KAAK,OAAO,oBAAI,KAAK,GAAG,QAAQ;AAC7C,QAAM,OAAO,KAAK;AAClB,YAAU,KAAK,MAAM,WAAW,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,gBAAc,KAAK,MAAM,WAAW,GAAG,SAAS;AAChD,gBAAc,KAAK,MAAM,WAAW,GAAG,SAAS;AAChD,gBAAc,KAAK,MAAM,WAAW,GAAG,SAAS;AAChD,gBAAc,KAAK,MAAM,WAAW,SAAS,aAAa,GAAG,WAAW;AACxE,gBAAc,KAAK,MAAM,aAAa,GAAG,MAAM;AAE/C,QAAM,UAAU,KAAK,KAAK,WAAW,KAAK,QAAQ,iBAAiB,GAAG,CAAC;AACvE,YAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,MAAI,IAAI;AAER,QAAM,UAAU,CAAC,IAAY,SAAiB,MAAM,SAAS;AAC3D,QAAI,IAAI,MAAM,UAAU;AACxB,UAAM,QAAiB,CAAC;AACxB,QAAI,SAAS;AACb,UAAM,OAAO,CAAC,MAAc,YAAY,UAAiB;AACvD,WAAK;AACL,WAAK;AACL,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,aAAa;AAAA,QACb;AAAA,QACA,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,QAClB,WAAW,IAAI,KAAK,CAAC,EAAE,YAAY;AAAA,QACnC,UAAU;AAAA,QACV,YAAY;AAAA,QACZ;AAAA,QACA,WAAW;AAAA,QACX,SAAS;AAAA,QACT,WAAW;AAAA,MACb;AAAA,IACF;AACA,UAAM,MAAM;AAAA,MACV;AAAA,MACA,OAAO,GAAW;AAChB,iBAAS;AACT,eAAO;AAAA,MACT;AAAA,MACA,MAAM,MAAc;AAClB,cAAM,KAAK;AAAA,UACT,GAAG,KAAK,MAAM;AAAA,UACd,QAAQ,EAAE,MAAM,QAAQ;AAAA,UACxB,SAAS,EAAE,MAAM,QAAQ,SAAS,KAAK;AAAA,QACzC,CAAC;AACD,eAAO;AAAA,MACT;AAAA,MACA,IAAI,MAAc;AAChB,cAAM,KAAK;AAAA,UACT,GAAG,KAAK,WAAW;AAAA,UACnB,SAAS,EAAE,MAAM,aAAa,SAAS,CAAC,EAAE,MAAM,QAAQ,KAAK,CAAC,EAAE;AAAA,QAClE,CAAC;AACD,eAAO;AAAA,MACT;AAAA,MACA,KAAK,MAAc,OAAc,SAAgB,CAAC,GAAG,YAAY,OAAO;AACtE,cAAM,SAAS,SAAS,EAAE,IAAI,IAAI,CAAC;AACnC,cAAM,KAAK;AAAA,UACT,GAAG,KAAK,aAAa,SAAS;AAAA,UAC9B,SAAS,EAAE,MAAM,aAAa,SAAS,CAAC,EAAE,MAAM,YAAY,IAAI,QAAQ,MAAM,MAAM,CAAC,EAAE;AAAA,QACzF,CAAC;AACD,cAAM,KAAK;AAAA,UACT,GAAG,KAAK,QAAQ,SAAS;AAAA,UACzB,SAAS;AAAA,YACP,MAAM;AAAA,YACN,SAAS;AAAA,cACP;AAAA,gBACE,MAAM;AAAA,gBACN,aAAa;AAAA,gBACb,SAAS,QAAQ,MAAM;AAAA,gBACvB,UAAU,QAAQ,OAAO,cAAc;AAAA,cACzC;AAAA,YACF;AAAA,UACF;AAAA,UACA,eAAe,EAAE,QAAQ,MAAM,MAAM,IAAI,QAAQ,GAAG;AAAA,UACpD,GAAG;AAAA,QACL,CAAC;AACD,eAAO;AAAA,MACT;AAAA,MACA,KAAK,SAAiB,SAAgB,CAAC,GAAG,YAAY,OAAO;AAC3D,eAAO,IAAI,KAAK,QAAQ,EAAE,SAAS,aAAa,YAAY,GAAG,QAAQ,SAAS;AAAA,MAClF;AAAA,MACA,MAAM,KAAa,MAAc;AAC/B;AAAA,UACE,KAAK,KAAK,GAAG,EAAE,QAAQ;AAAA,UACvB,MAAM,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI;AAAA,QACnD;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,UAAQ,WAAW,CAAC,EACjB,MAAM,qBAAqB,MAAM,EAAE,EACnC,IAAI,kBAAkB,SAAS,EAAE,EACjC,KAAK,QAAQ;AAAA,IACZ,WAAW,KAAK,MAAM,OAAO,GAAG,IAAI,KAAK;AAAA,IACzC,YAAY;AAAA,IACZ,YAAY;AAAA,EACd,CAAC,EACA,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,MAAM,GAAG,EAC3C,KAAK,2BAA2B,EAChC,MAAM,SAAS,IAAI;AAGtB,UAAQ,WAAW,CAAC,EACjB,MAAM,mBAAmB,EACzB,KAAK,SAAS,EAAE,WAAW,KAAK,MAAM,WAAW,GAAG,SAAS,QAAQ,CAAC,EACtE,KAAK,8BAA8B,MAAM,GAAG,EAC5C,KAAK,sBAAsB,EAC3B,MAAM,SAAS,IAAI;AAGtB,QAAM,KAAK,QAAQ,WAAW,CAAC,EAC5B,MAAM,iCAAiC,EACvC,KAAK,cAAc,EACnB,KAAK,aAAa;AACrB,KAAG,MAAM,SAAS,IAAI;AAEtB,QAAM,MAAM,QAAQ,WAAW,IAAI,EAAE,KAAK,qBAAqB,CAAC,GAAG,IAAI;AACvE,YAAU,KAAK,SAAS,WAAW,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;AACpE;AAAA,IACE,KAAK,SAAS,WAAW,aAAa,gBAAgB;AAAA,IACtD,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI;AAAA,EAC7E;AAGA,UAAQ,cAAc,CAAC,EACpB,MAAM,qBAAqB,EAC3B,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,QAAQ,EAAE,WAAW,KAAK,MAAM,gBAAgB,GAAG,YAAY,KAAK,YAAY,IAAI,CAAC,EAC1F,KAAK,wBAAwB,EAAE,gBAAgB,gBAAgB,CAAC,EAChE,MAAM,SAAS,IAAI;AAGtB,UAAQ,cAAc,CAAC,EACpB,MAAM,kCAAkC,EACxC,KAAK,4DAA4D,EACjE,KAAK,eAAe,EACpB,KAAK,6BAA6B,EAClC,MAAM,SAAS,IAAI;AAGtB,UAAQ,UAAU,EAAE,EAAE,MAAM,SAAS,EAAE,KAAK,sBAAsB,EAAE,MAAM,SAAS,IAAI;AAGvF,QAAM,QAAQ,KAAK,KAAK,WAAW,GAAG,KAAK,QAAQ,iBAAiB,GAAG,CAAC,QAAQ;AAChF,YAAU,OAAO,EAAE,WAAW,KAAK,CAAC;AACpC,UAAQ,gBAAgB,GAAG,GAAG,IAAI,QAAQ,EAAE,KAAK,sBAAsB,EAAE,MAAM,OAAO,IAAI;AAG1F,QAAM,MAAM,IAAI,KAAK,MAAM,KAAU;AACrC,QAAM,WAAW;AAAA,IACf,KAAK;AAAA,IACL,OAAO,IAAI,eAAe,CAAC;AAAA,IAC3B,OAAO,IAAI,YAAY,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AAAA,IAC7C,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,GAAG,GAAG;AAAA,EAC1C;AACA,YAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,UAAU,CAAC,QAAgB,QAAwB;AACvD,QAAI,IAAI,MAAM;AACd,UAAM,OAAO,CAAC,MAAc,YAA0B;AACpD,WAAK;AACL,aAAO,EAAE,WAAW,IAAI,KAAK,CAAC,EAAE,YAAY,GAAG,MAAM,QAAQ;AAAA,IAC/D;AACA,UAAM,OAAO,CAAC,KAAa,MACzB,KAAK,iBAAiB;AAAA,MACpB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,QAAQ,MAAM,IAAI,CAAC;AAAA,MAC5B,WAAW,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,eAAe,IAAK,CAAC;AAAA,IACtE,CAAC;AACH,WACE;AAAA,MACE,KAAK,gBAAgB;AAAA,QACnB,IAAI;AAAA,QACJ;AAAA,QACA,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,QAAQ;AAAA,MACV,CAAC;AAAA,MACD,KAAK,gBAAgB,EAAE,SAAS,MAAM,KAAK,OAAO,kBAAkB,CAAC;AAAA,MACrE,KAAK,iBAAiB;AAAA,QACpB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,CAAC,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,MAChD,CAAC;AAAA,MACD,KAAK,iBAAiB,CAAC;AAAA,MACvB,KAAK,wBAAwB,CAAC;AAAA,MAC9B,KAAK,iBAAiB;AAAA,QACpB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,QAAQ,MAAM;AAAA,QACvB,OAAO,aAAa,KAAK,UAAU,OAAO,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH,EACG,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAC5B,KAAK,IAAI,IAAI;AAAA,EAEpB;AACA;AAAA,IACE,KAAK,UAAU,kDAAkD;AAAA,IACjE,QAAQ,kBAAkB,IAAI;AAAA,EAChC;AACA;AAAA,IACE,KAAK,UAAU,gDAAgD;AAAA,IAC/D,QAAQ,gBAAgB,oBAAoB;AAAA,EAC9C;AAEA,SAAO,EAAE,gBAAgB,GAAG,aAAa,EAAE;AAC7C;","names":[]}

package/dist/init-MKPQU2JG.js

@@ -0,0 +1,17 @@
+import {
+  initCommand,
+  renderStarterPolicy
+} from "./chunk-IEJK7N3B.js";
+import "./chunk-OM5L7A32.js";
+import "./chunk-DEVXG3IB.js";
+import "./chunk-TJXZBOHL.js";
+import "./chunk-IS3DAHZI.js";
+import "./chunk-2QDPPTPY.js";
+import "./chunk-XPNBYSIN.js";
+import "./chunk-4WTFMFRY.js";
+import "./chunk-5WRI5ZAA.js";
+export {
+  initCommand,
+  renderStarterPolicy
+};
+//# sourceMappingURL=init-MKPQU2JG.js.map

package/dist/{proxy-3Z5YEZ4R.js → proxy-6GP63TLD.js}

@@ -2,13 +2,14 @@ import {
   INIT_COMMAND,
   createDownstreamServer,
   startHttpProxy
-} from "./chunk-KRKZGAJ3.js";
+} from "./chunk-JSELR4SG.js";
 import {
   ProxyRuntime
-} from "./chunk-D66U3PVB.js";
+} from "./chunk-TJXZBOHL.js";
 import {
   serveStdio
-} from "./chunk-ZSLWPKXI.js";
+} from "./chunk-IS3DAHZI.js";
+import "./chunk-XPNBYSIN.js";
 import {
   createFileGuard,
   flagBool,
@@ -16,31 +17,24 @@ import {
   flagString,
   loadPolicyFor,
   policyPathFrom
-} from "./chunk-SUXQTT3X.js";
+} from "./chunk-4WTFMFRY.js";
 import "./chunk-5WRI5ZAA.js";
 
 // src/commands/proxy.ts
 import { existsSync } from "fs";
-import { dirname } from "path";
-import { Guard, defaultPolicy, resolveAgent } from "@agentwares/agentguard-core";
-import { FileKillSwitch, resolvePath } from "@agentwares/agentguard-core/node";
+import { Guard, defaultPolicy, envTwin, resolveAgent } from "@agentwares/agentguard-core";
+import {
+  killSwitchFor,
+  resolveLoadedPolicy
+} from "@agentwares/agentguard-core/node";
 function newRunId(now = /* @__PURE__ */ new Date()) {
   return `run_${now.toISOString().replace(/[-:.TZ]/g, "").slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;
 }
 function unconfiguredPolicy(args, io) {
-  if (flagString(args, "config") !== void 0 || io.env.AGENTGUARD_CONFIG) return void 0;
+  if (flagString(args, "config") !== void 0 || envTwin(io.env, "CONFIG")) return void 0;
   const path = policyPathFrom(args, io);
   if (existsSync(path)) return void 0;
-  const policy = defaultPolicy();
-  const baseDir = dirname(path);
-  return {
-    policy,
-    path,
-    baseDir,
-    stateDir: resolvePath(policy.state.dir, baseDir),
-    auditPath: resolvePath(policy.audit.path, baseDir),
-    killPath: resolvePath(policy.kill.file, baseDir)
-  };
+  return resolveLoadedPolicy(defaultPolicy(), path, {});
 }
 async function serveOverStdio(runtime) {
   const server = createDownstreamServer(runtime);
@@ -54,7 +48,7 @@ async function serveOverStdio(runtime) {
   return 0;
 }
 async function proxyCommand(args, io) {
-  const log = (line) => io.err(`[agentguard] ${line}`);
+  const log = (line) => io.err(`[okgate] ${line}`);
   const modeOverride = flagString(args, "mode");
   const http = flagBool(args, "http") === true;
   const unconfigured = http ? void 0 : unconfiguredPolicy(args, io);
@@ -66,7 +60,7 @@ async function proxyCommand(args, io) {
       guard: new Guard({
         policy: unconfigured.policy,
         env: io.env,
-        kill: new FileKillSwitch(unconfigured.killPath)
+        kill: killSwitchFor(unconfigured)
       }),
       configured: false,
       defaultRunId: flagString(args, "run-id") ?? newRunId(),
@@ -74,7 +68,7 @@ async function proxyCommand(args, io) {
     });
     await runtime2.start();
     log(
-      `no policy file at ${unconfigured.path}: serving agentguard's own read-only tools only. To guard your MCP servers, run \`${INIT_COMMAND}\` in the project directory.`
+      `no policy file at ${unconfigured.path}: serving okgate's own read-only tools only. To guard your MCP servers, run \`${INIT_COMMAND}\` in the project directory.`
     );
     return serveOverStdio(runtime2);
   }
@@ -86,7 +80,7 @@ async function proxyCommand(args, io) {
     const resolved = await resolveAgent(loaded.policy, { name: agentName });
     if (resolved.error) {
       io.err(
-        `unknown agent "${agentName}" \u2014 agents in agentguard.yaml: ${loaded.policy.agents.map((a) => a.name).join(", ") || "none"}`
+        `unknown agent "${agentName}" \u2014 agents in okgate.yaml: ${loaded.policy.agents.map((a) => a.name).join(", ") || "none"}`
       );
       return 1;
     }
@@ -101,7 +95,7 @@ async function proxyCommand(args, io) {
       if (e.type === "APPROVAL_DECIDED") return;
       log(`${e.type} ${e.tool} (run ${e.runId})${e.error ? `: ${e.error.cause}` : ""}`);
       if (e.type === "APPROVAL_REQUIRED" && e.approval)
-        log(`approve with: agentguard approve ${e.approval.id}`);
+        log(`approve with: okgate approve ${e.approval.id}`);
     }
   });
   const runtime = new ProxyRuntime({
@@ -114,19 +108,17 @@ async function proxyCommand(args, io) {
   await runtime.start();
   const killed = await fileGuard.kill.check();
   if (killed.killed)
-    log(
-      `kill switch is ON (${killed.reason}); every call returns KILLED until \`agentguard resume\``
-    );
+    log(`kill switch is ON (${killed.reason}); every call returns KILLED until \`okgate resume\``);
   if (runtime.upstreamStatus().length === 0)
     log(
-      `${loaded.path} lists no upstreams: serving agentguard's own read-only tools only. Add servers under \`upstreams:\` to guard them.`
+      `${loaded.path} lists no upstreams: serving okgate's own read-only tools only. Add servers under \`upstreams:\` to guard them.`
     );
   if (http) {
     const server = await startHttpProxy({
       runtime,
       port: flagNumber(args, "port") ?? 8788,
       host: flagString(args, "host") ?? "127.0.0.1",
-      token: io.env.AGENTGUARD_HTTP_TOKEN
+      token: envTwin(io.env, "HTTP_TOKEN")
     });
     approvalBase = { baseUrl: server.url.replace(/\/mcp$/, ""), token: server.token };
     log(
@@ -151,4 +143,4 @@ export {
   proxyCommand,
   unconfiguredPolicy
 };
-//# sourceMappingURL=proxy-3Z5YEZ4R.js.map
+//# sourceMappingURL=proxy-6GP63TLD.js.map

package/dist/proxy-6GP63TLD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/proxy.ts"],"sourcesContent":["/**\n * `okgate proxy` — stdio by default (what MCP clients spawn), `--http` for Streamable HTTP\n * with the control endpoints. Logs go to stderr only; stdout is the MCP channel.\n */\nimport { existsSync } from \"node:fs\";\nimport { serveStdio } from \"@agentwares/mcp-kit\";\nimport { Guard, defaultPolicy, envTwin, resolveAgent } from \"@agentwares/agentguard-core\";\nimport {\n  killSwitchFor,\n  resolveLoadedPolicy,\n  type LoadedPolicy,\n} from \"@agentwares/agentguard-core/node\";\nimport { flagBool, flagNumber, flagString, type ParsedArgs } from \"../args.js\";\nimport { createFileGuard, loadPolicyFor, policyPathFrom, type Io } from \"../context.js\";\nimport { startHttpProxy } from \"../proxy/http.js\";\nimport { INIT_COMMAND } from \"../proxy/own-tools.js\";\nimport { ProxyRuntime } from \"../proxy/runtime.js\";\nimport { createDownstreamServer } from \"../proxy/server.js\";\n\nexport function newRunId(now: Date = new Date()): string {\n  return `run_${now\n    .toISOString()\n    .replace(/[-:.TZ]/g, \"\")\n    .slice(0, 14)}_${Math.random().toString(36).slice(2, 6)}`;\n}\n\n/**\n * The policy okgate runs on when no `okgate.yaml` exists and none was named: the\n * defaults, no upstreams, paths resolved where the file would be. It is what an install button\n * or a registry install starts before `init` has run. Nothing is written for it: the guard built\n * on it keeps counters, audit and approvals in memory, so the proxy leaves no `.okgate/` in\n * whatever directory the client spawned it in.\n *\n * `undefined` when a policy file exists, or when one was named with `--config` or\n * `OKGATE_CONFIG` / `AGENTGUARD_CONFIG` — a named file that is missing is still an error.\n */\nexport function unconfiguredPolicy(args: ParsedArgs, io: Io): LoadedPolicy | undefined {\n  if (flagString(args, \"config\") !== undefined || envTwin(io.env, \"CONFIG\")) return undefined;\n  const path = policyPathFrom(args, io);\n  if (existsSync(path)) return undefined;\n  return resolveLoadedPolicy(defaultPolicy(), path, {});\n}\n\nasync function serveOverStdio(runtime: ProxyRuntime): Promise<number> {\n  const server = createDownstreamServer(runtime);\n  const stop = async (): Promise<void> => {\n    await runtime.close();\n  };\n  process.once(\"SIGINT\", () => void stop().then(() => process.exit(0)));\n  process.once(\"SIGTERM\", () => void stop().then(() => process.exit(0)));\n  await serveStdio(server);\n  await stop();\n  return 0;\n}\n\nexport async function proxyCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const log = (line: string): void => io.err(`[okgate] ${line}`);\n  const modeOverride = flagString(args, \"mode\");\n  const http = flagBool(args, \"http\") === true;\n\n  // No policy file and none named: serve okgate's own read-only tools over stdio rather than\n  // exit, so a client that installed it from a button or a registry gets a working server that\n  // says how to set it up. `--http` still needs a policy (it writes its control token beside it).\n  const unconfigured = http ? undefined : unconfiguredPolicy(args, io);\n  if (unconfigured) {\n    if (modeOverride === \"dry-run\" || modeOverride === \"enforce\")\n      unconfigured.policy.mode = modeOverride;\n    const runtime = new ProxyRuntime({\n      loaded: unconfigured,\n      guard: new Guard({\n        policy: unconfigured.policy,\n        env: io.env,\n        kill: killSwitchFor(unconfigured),\n      }),\n      configured: false,\n      defaultRunId: flagString(args, \"run-id\") ?? newRunId(),\n      log,\n    });\n    await runtime.start();\n    log(\n      `no policy file at ${unconfigured.path}: serving okgate's own read-only tools only. To guard your MCP servers, run \\`${INIT_COMMAND}\\` in the project directory.`,\n    );\n    return serveOverStdio(runtime);\n  }\n\n  const loaded = loadPolicyFor(args, io);\n  if (modeOverride === \"dry-run\" || modeOverride === \"enforce\") loaded.policy.mode = modeOverride;\n\n  const agentName = flagString(args, \"agent\");\n  let agent = undefined;\n  if (agentName) {\n    const resolved = await resolveAgent(loaded.policy, { name: agentName });\n    if (resolved.error) {\n      io.err(\n        `unknown agent \"${agentName}\" — agents in okgate.yaml: ${loaded.policy.agents.map((a) => a.name).join(\", \") || \"none\"}`,\n      );\n      return 1;\n    }\n    agent = resolved.agent;\n  }\n\n  let approvalBase: { baseUrl: string; token: string } | undefined;\n  const fileGuard = createFileGuard(loaded, {\n    log,\n    env: io.env,\n    approvalUrl: (r) =>\n      approvalBase\n        ? `${approvalBase.baseUrl}/approve/${r.id}?token=${approvalBase.token}`\n        : undefined,\n    onEvent: (e) => {\n      if (e.type === \"APPROVAL_DECIDED\") return;\n      log(`${e.type} ${e.tool} (run ${e.runId})${e.error ? `: ${e.error.cause}` : \"\"}`);\n      if (e.type === \"APPROVAL_REQUIRED\" && e.approval)\n        log(`approve with: okgate approve ${e.approval.id}`);\n    },\n  });\n  const runtime = new ProxyRuntime({\n    loaded,\n    guard: fileGuard.guard,\n    agent,\n    defaultRunId: flagString(args, \"run-id\") ?? newRunId(),\n    log,\n  });\n  await runtime.start();\n  const killed = await fileGuard.kill.check();\n  if (killed.killed)\n    log(`kill switch is ON (${killed.reason}); every call returns KILLED until \\`okgate resume\\``);\n  if (runtime.upstreamStatus().length === 0)\n    log(\n      `${loaded.path} lists no upstreams: serving okgate's own read-only tools only. Add servers under \\`upstreams:\\` to guard them.`,\n    );\n\n  if (http) {\n    const server = await startHttpProxy({\n      runtime,\n      port: flagNumber(args, \"port\") ?? 8788,\n      host: flagString(args, \"host\") ?? \"127.0.0.1\",\n      token: envTwin(io.env, \"HTTP_TOKEN\"),\n    });\n    approvalBase = { baseUrl: server.url.replace(/\\/mcp$/, \"\"), token: server.token };\n    log(\n      `Streamable HTTP at ${server.url} · GET ${approvalBase.baseUrl}/health · control token in ${loaded.stateDir}/http.json`,\n    );\n    log(\n      `point your agent at ${server.url} (send X-Run-Id per run; Authorization: Bearer <agent key> for scoped agents)`,\n    );\n    const stop = async (): Promise<void> => {\n      await server.close();\n      await runtime.close();\n      process.exit(0);\n    };\n    process.once(\"SIGINT\", () => void stop());\n    process.once(\"SIGTERM\", () => void stop());\n    await new Promise<never>(() => undefined);\n  }\n\n  return serveOverStdio(runtime);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,kBAAkB;AAE3B,SAAS,OAAO,eAAe,SAAS,oBAAoB;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAQA,SAAS,SAAS,MAAY,oBAAI,KAAK,GAAW;AACvD,SAAO,OAAO,IACX,YAAY,EACZ,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAC3D;AAYO,SAAS,mBAAmB,MAAkB,IAAkC;AACrF,MAAI,WAAW,MAAM,QAAQ,MAAM,UAAa,QAAQ,GAAG,KAAK,QAAQ,EAAG,QAAO;AAClF,QAAM,OAAO,eAAe,MAAM,EAAE;AACpC,MAAI,WAAW,IAAI,EAAG,QAAO;AAC7B,SAAO,oBAAoB,cAAc,GAAG,MAAM,CAAC,CAAC;AACtD;AAEA,eAAe,eAAe,SAAwC;AACpE,QAAM,SAAS,uBAAuB,OAAO;AAC7C,QAAM,OAAO,YAA2B;AACtC,UAAM,QAAQ,MAAM;AAAA,EACtB;AACA,UAAQ,KAAK,UAAU,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AACpE,UAAQ,KAAK,WAAW,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AACrE,QAAM,WAAW,MAAM;AACvB,QAAM,KAAK;AACX,SAAO;AACT;AAEA,eAAsB,aAAa,MAAkB,IAAyB;AAC5E,QAAM,MAAM,CAAC,SAAuB,GAAG,IAAI,YAAY,IAAI,EAAE;AAC7D,QAAM,eAAe,WAAW,MAAM,MAAM;AAC5C,QAAM,OAAO,SAAS,MAAM,MAAM,MAAM;AAKxC,QAAM,eAAe,OAAO,SAAY,mBAAmB,MAAM,EAAE;AACnE,MAAI,cAAc;AAChB,QAAI,iBAAiB,aAAa,iBAAiB;AACjD,mBAAa,OAAO,OAAO;AAC7B,UAAMA,WAAU,IAAI,aAAa;AAAA,MAC/B,QAAQ;AAAA,MACR,OAAO,IAAI,MAAM;AAAA,QACf,QAAQ,aAAa;AAAA,QACrB,KAAK,GAAG;AAAA,QACR,MAAM,cAAc,YAAY;AAAA,MAClC,CAAC;AAAA,MACD,YAAY;AAAA,MACZ,cAAc,WAAW,MAAM,QAAQ,KAAK,SAAS;AAAA,MACrD;AAAA,IACF,CAAC;AACD,UAAMA,SAAQ,MAAM;AACpB;AAAA,MACE,qBAAqB,aAAa,IAAI,iFAAiF,YAAY;AAAA,IACrI;AACA,WAAO,eAAeA,QAAO;AAAA,EAC/B;AAEA,QAAM,SAAS,cAAc,MAAM,EAAE;AACrC,MAAI,iBAAiB,aAAa,iBAAiB,UAAW,QAAO,OAAO,OAAO;AAEnF,QAAM,YAAY,WAAW,MAAM,OAAO;AAC1C,MAAI,QAAQ;AACZ,MAAI,WAAW;AACb,UAAM,WAAW,MAAM,aAAa,OAAO,QAAQ,EAAE,MAAM,UAAU,CAAC;AACtE,QAAI,SAAS,OAAO;AAClB,SAAG;AAAA,QACD,kBAAkB,SAAS,mCAA8B,OAAO,OAAO,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,MAAM;AAAA,MACvH;AACA,aAAO;AAAA,IACT;AACA,YAAQ,SAAS;AAAA,EACnB;AAEA,MAAI;AACJ,QAAM,YAAY,gBAAgB,QAAQ;AAAA,IACxC;AAAA,IACA,KAAK,GAAG;AAAA,IACR,aAAa,CAAC,MACZ,eACI,GAAG,aAAa,OAAO,YAAY,EAAE,EAAE,UAAU,aAAa,KAAK,KACnE;AAAA,IACN,SAAS,CAAC,MAAM;AACd,UAAI,EAAE,SAAS,mBAAoB;AACnC,UAAI,GAAG,EAAE,IAAI,IAAI,EAAE,IAAI,SAAS,EAAE,KAAK,IAAI,EAAE,QAAQ,KAAK,EAAE,MAAM,KAAK,KAAK,EAAE,EAAE;AAChF,UAAI,EAAE,SAAS,uBAAuB,EAAE;AACtC,YAAI,gCAAgC,EAAE,SAAS,EAAE,EAAE;AAAA,IACvD;AAAA,EACF,CAAC;AACD,QAAM,UAAU,IAAI,aAAa;AAAA,IAC/B;AAAA,IACA,OAAO,UAAU;AAAA,IACjB;AAAA,IACA,cAAc,WAAW,MAAM,QAAQ,KAAK,SAAS;AAAA,IACrD;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,MAAM;AACpB,QAAM,SAAS,MAAM,UAAU,KAAK,MAAM;AAC1C,MAAI,OAAO;AACT,QAAI,sBAAsB,OAAO,MAAM,sDAAsD;AAC/F,MAAI,QAAQ,eAAe,EAAE,WAAW;AACtC;AAAA,MACE,GAAG,OAAO,IAAI;AAAA,IAChB;AAEF,MAAI,MAAM;AACR,UAAM,SAAS,MAAM,eAAe;AAAA,MAClC;AAAA,MACA,MAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAClC,MAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAClC,OAAO,QAAQ,GAAG,KAAK,YAAY;AAAA,IACrC,CAAC;AACD,mBAAe,EAAE,SAAS,OAAO,IAAI,QAAQ,UAAU,EAAE,GAAG,OAAO,OAAO,MAAM;AAChF;AAAA,MACE,sBAAsB,OAAO,GAAG,aAAU,aAAa,OAAO,iCAA8B,OAAO,QAAQ;AAAA,IAC7G;AACA;AAAA,MACE,uBAAuB,OAAO,GAAG;AAAA,IACnC;AACA,UAAM,OAAO,YAA2B;AACtC,YAAM,OAAO,MAAM;AACnB,YAAM,QAAQ,MAAM;AACpB,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,KAAK,UAAU,MAAM,KAAK,KAAK,CAAC;AACxC,YAAQ,KAAK,WAAW,MAAM,KAAK,KAAK,CAAC;AACzC,UAAM,IAAI,QAAe,MAAM,MAAS;AAAA,EAC1C;AAEA,SAAO,eAAe,OAAO;AAC/B;","names":["runtime"]}

package/dist/tools-XS7PMTLT.js

@@ -0,0 +1,15 @@
+import {
+  formatToolTable,
+  probeUpstreams,
+  toolsCommand
+} from "./chunk-DEVXG3IB.js";
+import "./chunk-TJXZBOHL.js";
+import "./chunk-IS3DAHZI.js";
+import "./chunk-4WTFMFRY.js";
+import "./chunk-5WRI5ZAA.js";
+export {
+  formatToolTable,
+  probeUpstreams,
+  toolsCommand
+};
+//# sourceMappingURL=tools-XS7PMTLT.js.map