@aion0/bastion 0.1.7

package/dist/cli/commands/stats.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerStatsCommand = registerStatsCommand;
+const database_js_1 = require("../../storage/database.js");
+const requests_js_1 = require("../../storage/repositories/requests.js");
+const cache_js_1 = require("../../storage/repositories/cache.js");
+const dashboard_js_1 = require("../../metrics/dashboard.js");
+function registerStatsCommand(program) {
+    program
+        .command('stats')
+        .description('Show usage statistics')
+        .option('--hours <hours>', 'Show stats for last N hours')
+        .action((options) => {
+        try {
+            const db = (0, database_js_1.getDatabase)();
+            const requestsRepo = new requests_js_1.RequestsRepository(db);
+            const cacheRepo = new cache_js_1.CacheRepository(db);
+            const sinceHours = options.hours ? parseInt(options.hours, 10) : undefined;
+            const stats = requestsRepo.getStats({ sinceHours });
+            const cacheStats = cacheRepo.getStats();
+            console.log((0, dashboard_js_1.renderDashboard)(stats, cacheStats));
+        }
+        catch (err) {
+            console.error('Failed to load stats:', err.message);
+            console.error('Is Bastion initialized? Try running: bastion start');
+        }
+        finally {
+            (0, database_js_1.closeDatabase)();
+        }
+    });
+}
+//# sourceMappingURL=stats.js.map

package/dist/cli/commands/stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.js","sourceRoot":"","sources":["../../../src/cli/commands/stats.ts"],"names":[],"mappings":";;AAMA,oDAuBC;AA5BD,2DAAuE;AACvE,wEAA4E;AAC5E,kEAAsE;AACtE,6DAA6D;AAE7D,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,uBAAuB,CAAC;SACpC,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;SACxD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAA,yBAAW,GAAE,CAAC;YACzB,MAAM,YAAY,GAAG,IAAI,gCAAkB,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,0BAAe,CAAC,EAAE,CAAC,CAAC;YAE1C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;YAExC,OAAO,CAAC,GAAG,CAAC,IAAA,8BAAe,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;gBAAS,CAAC;YACT,IAAA,2BAAa,GAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/stop.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerStopCommand(program: Command): void;
+//# sourceMappingURL=stop.d.ts.map

package/dist/cli/commands/stop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stop.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/stop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsB1D"}

package/dist/cli/commands/stop.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerStopCommand = registerStopCommand;
+const daemon_js_1 = require("../daemon.js");
+const proxy_js_1 = require("./proxy.js");
+function registerStopCommand(program) {
+    program
+        .command('stop')
+        .description('Stop the Bastion AI Gateway')
+        .action(() => {
+        const status = (0, daemon_js_1.getDaemonStatus)();
+        if (!status.running) {
+            console.log('Bastion is not running');
+            return;
+        }
+        const stopped = (0, daemon_js_1.stopDaemon)();
+        if (stopped) {
+            // Clean up macOS system proxy if it points to Bastion
+            // (prevents all traffic from breaking after gateway stops)
+            (0, proxy_js_1.clearSystemProxyIfBastion)();
+            console.log(`Bastion stopped (was PID: ${status.pid})`);
+        }
+        else {
+            console.log('Failed to stop Bastion');
+        }
+    });
+}
+//# sourceMappingURL=stop.js.map

package/dist/cli/commands/stop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stop.js","sourceRoot":"","sources":["../../../src/cli/commands/stop.ts"],"names":[],"mappings":";;AAIA,kDAsBC;AAzBD,4CAA2D;AAC3D,yCAAuD;AAEvD,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,6BAA6B,CAAC;SAC1C,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,MAAM,GAAG,IAAA,2BAAe,GAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,sBAAU,GAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,CAAC;YACZ,sDAAsD;YACtD,2DAA2D;YAC3D,IAAA,oCAAyB,GAAE,CAAC;YAE5B,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/token.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerTokenCommand(program: Command): void;
+//# sourceMappingURL=token.d.ts.map

package/dist/cli/commands/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsB3D"}

package/dist/cli/commands/token.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerTokenCommand = registerTokenCommand;
+const index_js_1 = require("../../config/index.js");
+function mask(token) {
+    if (token.length <= 8)
+        return '****';
+    return token.slice(0, 4) + '...' + token.slice(-4);
+}
+function registerTokenCommand(program) {
+    program
+        .command('token')
+        .description('Show the dashboard auth token')
+        .option('--reveal', 'Show the full token (default: masked)')
+        .action((opts) => {
+        const config = (0, index_js_1.loadConfig)();
+        const token = config.server.auth?.token;
+        if (!token) {
+            console.log('No token configured. A random token is generated on each start.');
+            console.log('Check the startup log output for the generated token.');
+            return;
+        }
+        if (opts.reveal) {
+            console.log(token);
+        }
+        else {
+            console.log(mask(token));
+            console.log('  (use --reveal to show full token)');
+        }
+    });
+}
+//# sourceMappingURL=token.js.map

package/dist/cli/commands/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/cli/commands/token.ts"],"names":[],"mappings":";;AAQA,oDAsBC;AA7BD,oDAAmD;AAEnD,SAAS,IAAI,CAAC,KAAa;IACzB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,UAAU,EAAE,uCAAuC,CAAC;SAC3D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,MAAM,GAAG,IAAA,qBAAU,GAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QAExC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/trust-ca.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerTrustCaCommand(program: Command): void;
+//# sourceMappingURL=trust-ca.d.ts.map

package/dist/cli/commands/trust-ca.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-ca.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/trust-ca.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqC7D"}

package/dist/cli/commands/trust-ca.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerTrustCaCommand = registerTrustCaCommand;
+const node_os_1 = require("node:os");
+const certs_js_1 = require("../../proxy/certs.js");
+function registerTrustCaCommand(program) {
+    program
+        .command('trust-ca')
+        .description('Generate and display the Bastion CA certificate for trust configuration')
+        .action(() => {
+        // This will generate the CA if it doesn't exist
+        (0, certs_js_1.ensureCA)();
+        const certPath = (0, certs_js_1.getCACertPath)();
+        const plat = (0, node_os_1.platform)();
+        console.log('Bastion CA certificate generated.');
+        console.log('');
+        console.log(`  Certificate: ${certPath}`);
+        console.log('');
+        console.log('For Node.js tools (Claude Code, etc.):');
+        console.log(`  export NODE_EXTRA_CA_CERTS="${certPath}"`);
+        console.log('');
+        console.log('Or use "bastion wrap" which sets this automatically:');
+        console.log('  bastion wrap claude');
+        console.log('');
+        if (plat === 'darwin') {
+            console.log('To add to macOS system trust (optional):');
+            console.log(`  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`);
+        }
+        else if (plat === 'linux') {
+            console.log('To add to Linux system trust (optional):');
+            console.log(`  sudo cp "${certPath}" /usr/local/share/ca-certificates/bastion-ca.crt`);
+            console.log('  sudo update-ca-certificates');
+            console.log('');
+            console.log('For Python (requests/httpx):');
+            console.log(`  export SSL_CERT_FILE="${certPath}"`);
+            console.log(`  export REQUESTS_CA_BUNDLE="${certPath}"`);
+        }
+        else if (plat === 'win32') {
+            console.log('To add to Windows certificate store (optional):');
+            console.log(`  certutil -addstore -user Root "${certPath}"`);
+        }
+    });
+}
+//# sourceMappingURL=trust-ca.js.map

package/dist/cli/commands/trust-ca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-ca.js","sourceRoot":"","sources":["../../../src/cli/commands/trust-ca.ts"],"names":[],"mappings":";;AAIA,wDAqCC;AAxCD,qCAAmC;AACnC,mDAA+D;AAE/D,SAAgB,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,GAAG,EAAE;QACX,gDAAgD;QAChD,IAAA,mBAAQ,GAAE,CAAC;QACX,MAAM,QAAQ,GAAG,IAAA,wBAAa,GAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAA,kBAAQ,GAAE,CAAC;QAExB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,iCAAiC,QAAQ,GAAG,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,2FAA2F,QAAQ,GAAG,CAAC,CAAC;QACtH,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,cAAc,QAAQ,mDAAmD,CAAC,CAAC;YACvF,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,GAAG,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,oCAAoC,QAAQ,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/wrap.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerWrapCommand(program: Command): void;
+//# sourceMappingURL=wrap.d.ts.map

package/dist/cli/commands/wrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/wrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiE1D"}

package/dist/cli/commands/wrap.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWrapCommand = registerWrapCommand;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const index_js_1 = require("../../config/index.js");
+const certs_js_1 = require("../../proxy/certs.js");
+const daemon_js_1 = require("../daemon.js");
+function registerWrapCommand(program) {
+    program
+        .command('wrap')
+        .description('Run a command with AI traffic routed through Bastion')
+        .option('--base-url', 'Use BASE_URL mode instead of HTTPS_PROXY (breaks OAuth)')
+        .option('--label <label>', 'Human-readable session label')
+        .argument('<command...>', 'Command to run (e.g. "claude", "python app.py")')
+        .passThroughOptions()
+        .allowUnknownOption()
+        .action((args, options) => {
+        // Check if Bastion is running
+        const status = (0, daemon_js_1.getDaemonStatus)();
+        if (!status.running) {
+            console.error('Bastion is not running. Start it first: bastion start');
+            process.exitCode = 1;
+            return;
+        }
+        const config = (0, index_js_1.loadConfig)();
+        const sessionId = (0, node_crypto_1.randomUUID)();
+        const [cmd, ...cmdArgs] = args;
+        const label = options.label ?? cmd;
+        console.log(`Bastion session: ${sessionId} (${label})`);
+        const baseUrl = `http://${config.server.host}:${config.server.port}`;
+        const caCertPath = (0, certs_js_1.getCACertPath)();
+        // Build environment
+        const env = { ...process.env };
+        if (options.baseUrl) {
+            // Legacy BASE_URL mode
+            env.ANTHROPIC_BASE_URL = baseUrl;
+            env.OPENAI_BASE_URL = baseUrl;
+            env.GOOGLE_AI_BASE_URL = baseUrl;
+        }
+        else {
+            // HTTPS_PROXY mode (default, OAuth-compatible)
+            // Only proxy HTTPS — do NOT set HTTP_PROXY to avoid interfering with OAuth callbacks
+            env.HTTPS_PROXY = `http://${sessionId}@${config.server.host}:${config.server.port}`;
+            // Exclude proxy itself, auth/UI domains from proxying
+            env.NO_PROXY = [
+                config.server.host,
+                'localhost',
+                'console.anthropic.com',
+                'platform.claude.com',
+                'auth.anthropic.com',
+            ].join(',');
+            env.NODE_EXTRA_CA_CERTS = caCertPath;
+        }
+        const child = (0, node_child_process_1.spawn)(cmd, cmdArgs, {
+            stdio: 'inherit',
+            env,
+            // Windows needs shell:true to find .cmd/.bat/.ps1 commands (e.g. "claude", "node")
+            ...(process.platform === 'win32' ? { shell: true } : {}),
+        });
+        child.on('close', (code) => {
+            process.exitCode = code ?? 0;
+        });
+        child.on('error', (err) => {
+            console.error(`Failed to start: ${err.message}`);
+            process.exitCode = 1;
+        });
+    });
+}
+//# sourceMappingURL=wrap.js.map

package/dist/cli/commands/wrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap.js","sourceRoot":"","sources":["../../../src/cli/commands/wrap.ts"],"names":[],"mappings":";;AAOA,kDAiEC;AAvED,2DAA2C;AAC3C,6CAAyC;AACzC,oDAAmD;AACnD,mDAAqD;AACrD,4CAA+C;AAE/C,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,YAAY,EAAE,yDAAyD,CAAC;SAC/E,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC;SACzD,QAAQ,CAAC,cAAc,EAAE,iDAAiD,CAAC;SAC3E,kBAAkB,EAAE;SACpB,kBAAkB,EAAE;SACpB,MAAM,CAAC,CAAC,IAAc,EAAE,OAAO,EAAE,EAAE;QAClC,8BAA8B;QAC9B,MAAM,MAAM,GAAG,IAAA,2BAAe,GAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,qBAAU,GAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oBAAoB,SAAS,KAAK,KAAK,GAAG,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,UAAU,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,IAAA,wBAAa,GAAE,CAAC;QAEnC,oBAAoB;QACpB,MAAM,GAAG,GAAuC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAEnE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,uBAAuB;YACvB,GAAG,CAAC,kBAAkB,GAAG,OAAO,CAAC;YACjC,GAAG,CAAC,eAAe,GAAG,OAAO,CAAC;YAC9B,GAAG,CAAC,kBAAkB,GAAG,OAAO,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,qFAAqF;YACrF,GAAG,CAAC,WAAW,GAAG,UAAU,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpF,sDAAsD;YACtD,GAAG,CAAC,QAAQ,GAAG;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI;gBAClB,WAAW;gBACX,uBAAuB;gBACvB,qBAAqB;gBACrB,oBAAoB;aACrB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,GAAG,CAAC,mBAAmB,GAAG,UAAU,CAAC;QACvC,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,OAAO,EAAE;YAChC,KAAK,EAAE,SAAS;YAChB,GAAG;YACH,mFAAmF;YACnF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/daemon.d.ts

@@ -0,0 +1,11 @@
+export declare function writePidFile(pid: number): void;
+export declare function readPidFile(): number | null;
+export declare function removePidFile(): void;
+export declare function isProcessRunning(pid: number): boolean;
+export declare function getDaemonStatus(): {
+    running: boolean;
+    pid: number | null;
+};
+export declare function spawnDaemon(): number;
+export declare function stopDaemon(): boolean;
+//# sourceMappingURL=daemon.d.ts.map

package/dist/cli/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../src/cli/daemon.ts"],"names":[],"mappings":"AAKA,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG9C;AAED,wBAAgB,WAAW,IAAI,MAAM,GAAG,IAAI,CAK3C;AAED,wBAAgB,aAAa,IAAI,IAAI,CAIpC;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOrD;AAED,wBAAgB,eAAe,IAAI;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAO1E;AAED,wBAAgB,WAAW,IAAI,MAAM,CAsBpC;AAED,wBAAgB,UAAU,IAAI,OAAO,CAYpC"}

package/dist/cli/daemon.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writePidFile = writePidFile;
+exports.readPidFile = readPidFile;
+exports.removePidFile = removePidFile;
+exports.isProcessRunning = isProcessRunning;
+exports.getDaemonStatus = getDaemonStatus;
+exports.spawnDaemon = spawnDaemon;
+exports.stopDaemon = stopDaemon;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const paths_js_1 = require("../config/paths.js");
+function writePidFile(pid) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(paths_js_1.paths.pidFile), { recursive: true });
+    (0, node_fs_1.writeFileSync)(paths_js_1.paths.pidFile, pid.toString(), 'utf-8');
+}
+function readPidFile() {
+    if (!(0, node_fs_1.existsSync)(paths_js_1.paths.pidFile))
+        return null;
+    const content = (0, node_fs_1.readFileSync)(paths_js_1.paths.pidFile, 'utf-8').trim();
+    const pid = parseInt(content, 10);
+    return isNaN(pid) ? null : pid;
+}
+function removePidFile() {
+    if ((0, node_fs_1.existsSync)(paths_js_1.paths.pidFile)) {
+        (0, node_fs_1.unlinkSync)(paths_js_1.paths.pidFile);
+    }
+}
+function isProcessRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function getDaemonStatus() {
+    const pid = readPidFile();
+    if (pid === null)
+        return { running: false, pid: null };
+    if (isProcessRunning(pid))
+        return { running: true, pid };
+    // Stale PID file
+    removePidFile();
+    return { running: false, pid: null };
+}
+function spawnDaemon() {
+    const entryPoint = (0, node_path_1.resolve)((0, node_path_1.join)(__dirname, '..', 'index.js'));
+    // Use tsx for development, node for production
+    const isTs = entryPoint.endsWith('.ts');
+    const command = isTs ? 'npx' : 'node';
+    const args = isTs ? ['tsx', entryPoint] : [entryPoint];
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(paths_js_1.paths.logFile), { recursive: true });
+    const child = (0, node_child_process_1.spawn)(command, args, {
+        detached: true,
+        stdio: 'ignore',
+        env: { ...process.env, BASTION_DAEMON: '1' },
+        // Prevent a console window from popping up on Windows
+        ...(process.platform === 'win32' ? { windowsHide: true } : {}),
+    });
+    child.unref();
+    const pid = child.pid;
+    writePidFile(pid);
+    return pid;
+}
+function stopDaemon() {
+    const { running, pid } = getDaemonStatus();
+    if (!running || pid === null)
+        return false;
+    try {
+        process.kill(pid, 'SIGTERM');
+        removePidFile();
+        return true;
+    }
+    catch {
+        removePidFile();
+        return false;
+    }
+}
+//# sourceMappingURL=daemon.js.map

package/dist/cli/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../src/cli/daemon.ts"],"names":[],"mappings":";;AAKA,oCAGC;AAED,kCAKC;AAED,sCAIC;AAED,4CAOC;AAED,0CAOC;AAED,kCAsBC;AAED,gCAYC;AA7ED,2DAA2C;AAC3C,qCAAyF;AACzF,yCAAmD;AACnD,iDAA2C;AAE3C,SAAgB,YAAY,CAAC,GAAW;IACtC,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,gBAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,IAAA,uBAAa,EAAC,gBAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,WAAW;IACzB,IAAI,CAAC,IAAA,oBAAU,EAAC,gBAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,gBAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACjC,CAAC;AAED,SAAgB,aAAa;IAC3B,IAAI,IAAA,oBAAU,EAAC,gBAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,IAAA,oBAAU,EAAC,gBAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,eAAe;IAC7B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACzD,iBAAiB;IACjB,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAgB,WAAW;IACzB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAE9D,+CAA+C;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAEvD,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,gBAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,OAAO,EAAE,IAAI,EAAE;QACjC,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE;QAC5C,sDAAsD;QACtD,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IAEH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,GAAG,GAAG,KAAK,CAAC,GAAI,CAAC;IACvB,YAAY,CAAC,GAAG,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAE3C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,aAAa,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":""}

package/dist/cli/index.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const start_js_1 = require("./commands/start.js");
+const stop_js_1 = require("./commands/stop.js");
+const stats_js_1 = require("./commands/stats.js");
+const health_js_1 = require("./commands/health.js");
+const config_js_1 = require("./commands/config.js");
+const env_js_1 = require("./commands/env.js");
+const wrap_js_1 = require("./commands/wrap.js");
+const trust_ca_js_1 = require("./commands/trust-ca.js");
+const proxy_js_1 = require("./commands/proxy.js");
+const openclaw_js_1 = require("./commands/openclaw.js");
+const token_js_1 = require("./commands/token.js");
+const version_js_1 = require("../version.js");
+const program = new commander_1.Command();
+program
+    .name('bastion')
+    .description('Bastion AI Gateway — Local-first proxy for LLM providers')
+    .version((0, version_js_1.getVersion)())
+    .enablePositionalOptions();
+(0, start_js_1.registerStartCommand)(program);
+(0, stop_js_1.registerStopCommand)(program);
+(0, stats_js_1.registerStatsCommand)(program);
+(0, health_js_1.registerHealthCommand)(program);
+(0, config_js_1.registerConfigCommand)(program);
+(0, env_js_1.registerEnvCommand)(program);
+(0, wrap_js_1.registerWrapCommand)(program);
+(0, trust_ca_js_1.registerTrustCaCommand)(program);
+(0, proxy_js_1.registerProxyCommand)(program);
+(0, openclaw_js_1.registerOpenclawCommand)(program);
+(0, token_js_1.registerTokenCommand)(program);
+program.parse();
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;;AAEA,yCAAoC;AACpC,kDAA2D;AAC3D,gDAAyD;AACzD,kDAA2D;AAC3D,oDAA6D;AAC7D,oDAA6D;AAC7D,8CAAuD;AACvD,gDAAyD;AACzD,wDAAgE;AAChE,kDAA2D;AAC3D,wDAAiE;AACjE,kDAA2D;AAC3D,8CAA2C;AAE3C,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,IAAA,uBAAU,GAAE,CAAC;KACrB,uBAAuB,EAAE,CAAC;AAE7B,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,6BAAmB,EAAC,OAAO,CAAC,CAAC;AAC7B,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,iCAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,iCAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,2BAAkB,EAAC,OAAO,CAAC,CAAC;AAC5B,IAAA,6BAAmB,EAAC,OAAO,CAAC,CAAC;AAC7B,IAAA,oCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,qCAAuB,EAAC,OAAO,CAAC,CAAC;AACjC,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,3 @@
+import type { BastionConfig } from './schema.js';
+export declare function loadConfig(overridePath?: string): BastionConfig;
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAwBjD,wBAAgB,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,aAAa,CAiC/D"}

package/dist/config/index.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadConfig = loadConfig;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const paths_js_1 = require("./paths.js");
+const DEFAULT_CONFIG_PATH = (0, node_path_1.resolve)((0, node_path_1.join)(__dirname, '..', '..', 'config', 'default.yaml'));
+function deepMerge(target, source) {
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+        if (source[key] !== null &&
+            typeof source[key] === 'object' &&
+            !Array.isArray(source[key]) &&
+            typeof target[key] === 'object' &&
+            target[key] !== null &&
+            !Array.isArray(target[key])) {
+            result[key] = deepMerge(target[key], source[key]);
+        }
+        else {
+            result[key] = source[key];
+        }
+    }
+    return result;
+}
+function loadConfig(overridePath) {
+    // Load default config
+    const defaultRaw = (0, node_fs_1.readFileSync)(DEFAULT_CONFIG_PATH, 'utf-8');
+    let config = js_yaml_1.default.load(defaultRaw);
+    // Merge user config if it exists
+    const userConfigPath = overridePath ?? paths_js_1.paths.configFile;
+    if ((0, node_fs_1.existsSync)(userConfigPath)) {
+        const userRaw = (0, node_fs_1.readFileSync)(userConfigPath, 'utf-8');
+        const userConfig = js_yaml_1.default.load(userRaw);
+        if (userConfig) {
+            config = deepMerge(config, userConfig);
+        }
+    }
+    // Apply environment variable overrides
+    if (process.env.BASTION_PORT) {
+        config.server.port = parseInt(process.env.BASTION_PORT, 10);
+    }
+    if (process.env.BASTION_HOST) {
+        config.server.host = process.env.BASTION_HOST;
+    }
+    if (process.env.BASTION_LOG_LEVEL) {
+        config.logging.level = process.env.BASTION_LOG_LEVEL;
+    }
+    if (process.env.BASTION_AUTH_TOKEN) {
+        const serverObj = config.server;
+        const serverAuth = serverObj.auth ?? {};
+        serverAuth.token = process.env.BASTION_AUTH_TOKEN;
+        serverObj.auth = serverAuth;
+    }
+    return config;
+}
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":";;;;;AA2BA,gCAiCC;AA5DD,qCAAmD;AACnD,yCAA0C;AAC1C,sDAA2B;AAE3B,yCAAmC;AAEnC,MAAM,mBAAmB,GAAG,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAE3F,SAAS,SAAS,CAAC,MAA+B,EAAE,MAA+B;IACjF,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IACE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YACpB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAA4B,EAAE,MAAM,CAAC,GAAG,CAA4B,CAAC,CAAC;QAC1G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,UAAU,CAAC,YAAqB;IAC9C,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAA,sBAAY,EAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,MAAM,GAAG,iBAAI,CAAC,IAAI,CAAC,UAAU,CAA4B,CAAC;IAE9D,iCAAiC;IACjC,MAAM,cAAc,GAAG,YAAY,IAAI,gBAAK,CAAC,UAAU,CAAC;IACxD,IAAI,IAAA,oBAAU,EAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,iBAAI,CAAC,IAAI,CAAC,OAAO,CAA4B,CAAC;QACjE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAkC,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAkC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACjC,MAAM,CAAC,OAAmC,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAiC,CAAC;QAC3D,MAAM,UAAU,GAAI,SAAS,CAAC,IAAgC,IAAI,EAAE,CAAC;QACrE,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAClD,SAAS,CAAC,IAAI,GAAG,UAAU,CAAC;IAC9B,CAAC;IAED,OAAO,MAAkC,CAAC;AAC5C,CAAC"}

package/dist/config/manager.d.ts

@@ -0,0 +1,12 @@
+import type { BastionConfig } from './schema.js';
+type ConfigChangeListener = (config: BastionConfig) => void;
+export declare class ConfigManager {
+    private config;
+    private listeners;
+    constructor(initialConfig: BastionConfig);
+    get(): BastionConfig;
+    update(partial: Record<string, unknown>): BastionConfig;
+    onChange(callback: ConfigChangeListener): void;
+}
+export {};
+//# sourceMappingURL=manager.d.ts.map

package/dist/config/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/config/manager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAMjD,KAAK,oBAAoB,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAqB5D,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,SAAS,CAA8B;gBAEnC,aAAa,EAAE,aAAa;IAIxC,GAAG,IAAI,aAAa;IAIpB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa;IAmCvD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI;CAG/C"}

package/dist/config/manager.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigManager = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const paths_js_1 = require("./paths.js");
+const logger_js_1 = require("../utils/logger.js");
+const log = (0, logger_js_1.createLogger)('config-manager');
+function deepMerge(target, source) {
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+        if (source[key] !== null &&
+            typeof source[key] === 'object' &&
+            !Array.isArray(source[key]) &&
+            typeof target[key] === 'object' &&
+            target[key] !== null &&
+            !Array.isArray(target[key])) {
+            result[key] = deepMerge(target[key], source[key]);
+        }
+        else {
+            result[key] = source[key];
+        }
+    }
+    return result;
+}
+class ConfigManager {
+    config;
+    listeners = [];
+    constructor(initialConfig) {
+        this.config = initialConfig;
+    }
+    get() {
+        return this.config;
+    }
+    update(partial) {
+        log.info('Config update received', { partial: JSON.stringify(partial) });
+        this.config = deepMerge(this.config, partial);
+        // Log the effective toolGuard config after merge
+        const tg = this.config.plugins;
+        const toolGuard = tg?.toolGuard;
+        if (toolGuard) {
+            log.info('Effective toolGuard config', { action: toolGuard.action, blockMinSeverity: toolGuard.blockMinSeverity });
+        }
+        // Persist to user config file
+        try {
+            (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(paths_js_1.paths.configFile), { recursive: true });
+            (0, node_fs_1.writeFileSync)(paths_js_1.paths.configFile, js_yaml_1.default.dump(this.config), 'utf-8');
+            log.info('Config persisted', { path: paths_js_1.paths.configFile });
+        }
+        catch (err) {
+            log.warn('Failed to persist config', { error: err.message });
+        }
+        // Notify listeners
+        for (const listener of this.listeners) {
+            try {
+                listener(this.config);
+            }
+            catch (err) {
+                log.warn('Config change listener error', { error: err.message });
+            }
+        }
+        return this.config;
+    }
+    onChange(callback) {
+        this.listeners.push(callback);
+    }
+}
+exports.ConfigManager = ConfigManager;
+//# sourceMappingURL=manager.js.map

package/dist/config/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/config/manager.ts"],"names":[],"mappings":";;;;;;AAAA,qCAAmD;AACnD,yCAAoC;AACpC,sDAA2B;AAE3B,yCAAmC;AACnC,kDAAkD;AAElD,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,gBAAgB,CAAC,CAAC;AAI3C,SAAS,SAAS,CAAC,MAA+B,EAAE,MAA+B;IACjF,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IACE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YACpB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAA4B,EAAE,MAAM,CAAC,GAAG,CAA4B,CAAC,CAAC;QAC1G,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAa,aAAa;IAChB,MAAM,CAAgB;IACtB,SAAS,GAA2B,EAAE,CAAC;IAE/C,YAAY,aAA4B;QACtC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;IAC9B,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,OAAgC;QACrC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,SAAS,CACrB,IAAI,CAAC,MAA4C,EACjD,OAAO,CACoB,CAAC;QAE9B,iDAAiD;QACjD,MAAM,EAAE,GAAI,IAAI,CAAC,MAA6C,CAAC,OAA8C,CAAC;QAC9G,MAAM,SAAS,GAAG,EAAE,EAAE,SAAgD,CAAC;QACvE,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,gBAAK,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAA,uBAAa,EAAC,gBAAK,CAAC,UAAU,EAAE,iBAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,gBAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,mBAAmB;QACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,QAAQ,CAAC,QAA8B;QACrC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACF;AAlDD,sCAkDC"}

package/dist/config/paths.d.ts

@@ -0,0 +1,10 @@
+export declare const paths: {
+    bastionDir: string;
+    configFile: string;
+    databaseFile: string;
+    encryptionKeyFile: string;
+    pidFile: string;
+    logFile: string;
+    signaturesDir: string;
+};
+//# sourceMappingURL=paths.d.ts.map

package/dist/config/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,KAAK;;;;;;;;CAQjB,CAAC"}

package/dist/config/paths.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.paths = void 0;
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const BASTION_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), '.bastion');
+exports.paths = {
+    bastionDir: BASTION_DIR,
+    configFile: (0, node_path_1.join)(BASTION_DIR, 'config.yaml'),
+    databaseFile: (0, node_path_1.join)(BASTION_DIR, 'bastion.db'),
+    encryptionKeyFile: (0, node_path_1.join)(BASTION_DIR, '.key'),
+    pidFile: (0, node_path_1.join)(BASTION_DIR, 'bastion.pid'),
+    logFile: (0, node_path_1.join)(BASTION_DIR, 'bastion.log'),
+    signaturesDir: (0, node_path_1.join)(BASTION_DIR, 'signatures'),
+};
+//# sourceMappingURL=paths.js.map