@axtary/cli 0.1.0 → 0.2.0

package/dist/shell-file-normalize.d.ts

@@ -0,0 +1,21 @@
+export type ShellFileOp = {
+    kind: "read" | "write";
+    path: string;
+};
+/**
+ * Deep classifier: every file read/write a shell command performs, so the
+ * content policy applies to each. Governs the SOURCE read of copy/move/`dd`/
+ * `tar`/redirection commands (not only the destination write), which closes the
+ * `cp secret dest` / `cat secret > public` exfiltration gap. Still conservative:
+ * unrecognized commands and piped readers contribute nothing (no false-positive
+ * file ops), and exotic invocations stay a documented best-effort limit.
+ */
+export declare function classifyShellFileOps(command: string): ShellFileOp[];
+/**
+ * Back-compat single-op view: the primary file op of a command — the
+ * destination write for a mover/redirection, otherwise the first read. Callers
+ * that must evaluate every op (the runtime hooks, fail-closed) should use
+ * {@link classifyShellFileOps} instead.
+ */
+export declare function classifyShellCommand(command: string): ShellFileOp | null;
+//# sourceMappingURL=shell-file-normalize.d.ts.map

package/dist/shell-file-normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-file-normalize.d.ts","sourceRoot":"","sources":["../src/shell-file-normalize.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAgPnE;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAYnE;AAcD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAKxE"}

package/dist/shell-file-normalize.js

@@ -0,0 +1,269 @@
+// Shell programs that read a file's contents (the file is the last operand).
+// These read their operand in ANY pipeline position (`… | cat secret` still
+// reads the file), so they are not gated by stage.
+const READ_CMDS = new Set([
+    "cat",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "bat",
+    "nl",
+    "od",
+    "xxd",
+    "strings",
+    "hexdump",
+    "tac",
+    "view",
+]);
+// Readers whose FIRST operand is a pattern/script, not a file; the file reads
+// are the operands AFTER it. This is what lets `… | grep PATTERN` (reads stdin,
+// PATTERN is not a file) stay a no-op while `grep PATTERN file` / `sed -n 1p f`
+// correctly read `file` in any pipeline position.
+const PATTERN_FIRST_READ_CMDS = new Set([
+    "grep",
+    "egrep",
+    "fgrep",
+    "sed",
+    "awk",
+]);
+// Single-operand writers: the path operand is created/modified/removed.
+const WRITE_CMDS = new Set([
+    "rm",
+    "touch",
+    "truncate",
+    "tee",
+    "unlink",
+    "shred",
+    "ln",
+]);
+// Two-operand movers: every operand except the last is a SOURCE read, the last
+// is the DESTINATION write. This is what closes the `cp secret dest` exfil gap —
+// the source read is governed, not just the destination write.
+const COPY_CMDS = new Set(["cp", "mv", "install", "rsync"]);
+// Wrappers to skip so we classify the real command after them.
+const PREFIX_CMDS = new Set(["sudo", "env", "command", "nohup", "time", "exec"]);
+// tar single-letter flags (used to tell a bare `czf` cluster from a path operand).
+const TAR_FLAG_RE = /^[cxtrujzvfCJkpPOWK]+$/;
+// Statement separators (`;`, newlines, `&&`, `||`) — NOT a single `|`, which is
+// a pipeline and is handled stage-by-stage so a piped reader (`… | grep KEY`)
+// does not mistake its pattern argument for a file.
+function splitStatements(command) {
+    return command.split(/&&|\|\||[;\n]/g);
+}
+function tokenizeSegment(segment) {
+    const tokens = [];
+    const re = /'[^']*'|"[^"]*"|>>|>|\||[^\s>|]+/g;
+    let match;
+    while ((match = re.exec(segment))) {
+        let token = match[0];
+        if ((token.startsWith("'") && token.endsWith("'")) ||
+            (token.startsWith('"') && token.endsWith('"'))) {
+            token = token.slice(1, -1);
+        }
+        tokens.push(token);
+    }
+    return tokens;
+}
+function basename(program) {
+    const parts = program.split("/");
+    return parts[parts.length - 1] ?? program;
+}
+function isPathLike(token) {
+    return token.length > 0 && !token.startsWith("-") && !token.startsWith("&");
+}
+// `dd if=SRC of=DEST` — key=value operands, not positional.
+function classifyDd(args) {
+    const ops = [];
+    for (const arg of args) {
+        if (arg.startsWith("if=")) {
+            const path = arg.slice(3);
+            if (path)
+                ops.push({ kind: "read", path });
+        }
+        else if (arg.startsWith("of=")) {
+            const path = arg.slice(3);
+            if (path)
+                ops.push({ kind: "write", path });
+        }
+    }
+    return ops;
+}
+// `tar` (conservative). Create (`c`) reads the named inputs and writes the
+// archive from `-f`; extract (`x`) reads the archive. Exotic invocations
+// (stdin/stdout archives, `--options`) stay best-effort and are a documented
+// limit — the classifier never guesses a write it cannot see.
+function classifyTar(args) {
+    let create = false;
+    let extract = false;
+    let archive = null;
+    let expectArchive = false;
+    const inputs = [];
+    args.forEach((arg, index) => {
+        const isFlag = arg.startsWith("-") || (index === 0 && TAR_FLAG_RE.test(arg));
+        if (isFlag) {
+            const flags = arg.replace(/^-+/, "");
+            if (flags.includes("c"))
+                create = true;
+            if (flags.includes("x"))
+                extract = true;
+            // A clustered `f` (e.g. `czf`) takes the next token as the archive path.
+            if (flags.endsWith("f"))
+                expectArchive = true;
+            return;
+        }
+        if (expectArchive) {
+            archive = arg;
+            expectArchive = false;
+            return;
+        }
+        if (isPathLike(arg))
+            inputs.push(arg);
+    });
+    const ops = [];
+    if (create) {
+        if (archive)
+            ops.push({ kind: "write", path: archive });
+        for (const path of inputs)
+            ops.push({ kind: "read", path });
+    }
+    else if (extract && archive) {
+        ops.push({ kind: "read", path: archive });
+    }
+    return ops;
+}
+function classifyCommand(command, args) {
+    if (command === "dd")
+        return classifyDd(args);
+    if (command === "tar")
+        return classifyTar(args);
+    const operands = args.filter(isPathLike);
+    // grep/sed/awk: the first operand is the pattern/script and any operands after
+    // it are files read in ANY pipeline position. With no trailing operand the
+    // program reads stdin, so there is no governed file — this is what keeps
+    // `… | grep PATTERN` a no-op without dropping `… | grep PATTERN secret`.
+    if (PATTERN_FIRST_READ_CMDS.has(command)) {
+        return operands.slice(1).map((path) => ({ kind: "read", path }));
+    }
+    if (operands.length === 0)
+        return [];
+    const last = operands[operands.length - 1];
+    if (COPY_CMDS.has(command)) {
+        const ops = operands
+            .slice(0, -1)
+            .map((path) => ({ kind: "read", path }));
+        ops.push({ kind: "write", path: last });
+        return ops;
+    }
+    if (WRITE_CMDS.has(command)) {
+        return [{ kind: "write", path: last }];
+    }
+    if (READ_CMDS.has(command)) {
+        // A plain reader reads its file operand wherever it sits in a pipeline
+        // (`echo x | cat secret` still reads the file); it is never stage-gated.
+        return [{ kind: "read", path: last }];
+    }
+    return [];
+}
+// Drop a trailing `#` comment (unquoted, at a word boundary) so it is not
+// mistaken for a file operand — `cat .env # note` reads `.env`, not `note`.
+function stripComment(statement) {
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < statement.length; i += 1) {
+        const char = statement[i];
+        if (char === "'" && !inDouble)
+            inSingle = !inSingle;
+        else if (char === '"' && !inSingle)
+            inDouble = !inDouble;
+        else if (char === "#" &&
+            !inSingle &&
+            !inDouble &&
+            (i === 0 || /\s/.test(statement[i - 1]))) {
+            return statement.slice(0, i);
+        }
+    }
+    return statement;
+}
+function classifyStatement(statement) {
+    const ops = [];
+    const stages = stripComment(statement).split(/\|/g);
+    for (const stage of stages) {
+        const tokens = tokenizeSegment(stage);
+        // Redirection (`> file` / `>> file`) is the clearest write signal, on any stage.
+        for (let i = 0; i < tokens.length; i += 1) {
+            if (tokens[i] === ">" || tokens[i] === ">>") {
+                const target = tokens[i + 1];
+                if (target && isPathLike(target)) {
+                    ops.push({ kind: "write", path: target });
+                }
+            }
+        }
+        // Command words: strip redirection tokens + their targets, skip wrappers.
+        const words = [];
+        for (let i = 0; i < tokens.length; i += 1) {
+            if (tokens[i] === ">" || tokens[i] === ">>") {
+                i += 1;
+                continue;
+            }
+            words.push(tokens[i]);
+        }
+        let index = 0;
+        while (index < words.length && PREFIX_CMDS.has(basename(words[index]))) {
+            index += 1;
+        }
+        if (index >= words.length)
+            continue;
+        const command = basename(words[index]);
+        const args = words.slice(index + 1);
+        ops.push(...classifyCommand(command, args));
+    }
+    return ops;
+}
+/**
+ * Deep classifier: every file read/write a shell command performs, so the
+ * content policy applies to each. Governs the SOURCE read of copy/move/`dd`/
+ * `tar`/redirection commands (not only the destination write), which closes the
+ * `cp secret dest` / `cat secret > public` exfiltration gap. Still conservative:
+ * unrecognized commands and piped readers contribute nothing (no false-positive
+ * file ops), and exotic invocations stay a documented best-effort limit.
+ */
+export function classifyShellFileOps(command) {
+    const ops = [];
+    for (const statement of splitStatements(command)) {
+        ops.push(...classifyStatement(statement));
+    }
+    // Reads first (stable): a protected source read is evaluated — and can block —
+    // before a benign destination write is even authorized/ledgered.
+    const deduped = dedupeOps(ops);
+    return [
+        ...deduped.filter((op) => op.kind === "read"),
+        ...deduped.filter((op) => op.kind === "write"),
+    ];
+}
+function dedupeOps(ops) {
+    const seen = new Set();
+    const result = [];
+    for (const op of ops) {
+        const key = `${op.kind}:${op.path}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(op);
+    }
+    return result;
+}
+/**
+ * Back-compat single-op view: the primary file op of a command — the
+ * destination write for a mover/redirection, otherwise the first read. Callers
+ * that must evaluate every op (the runtime hooks, fail-closed) should use
+ * {@link classifyShellFileOps} instead.
+ */
+export function classifyShellCommand(command) {
+    const ops = classifyShellFileOps(command);
+    if (ops.length === 0)
+        return null;
+    const lastWrite = [...ops].reverse().find((op) => op.kind === "write");
+    return lastWrite ?? ops[0];
+}
+//# sourceMappingURL=shell-file-normalize.js.map

package/dist/shell-file-normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-file-normalize.js","sourceRoot":"","sources":["../src/shell-file-normalize.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AACnD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,SAAS;IACT,SAAS;IACT,KAAK;IACL,MAAM;CACP,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,kDAAkD;AAClD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,IAAI;IACJ,OAAO;IACP,UAAU;IACV,KAAK;IACL,QAAQ;IACR,OAAO;IACP,IAAI;CACL,CAAC,CAAC;AAEH,+EAA+E;AAC/E,iFAAiF;AACjF,+DAA+D;AAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5D,+DAA+D;AAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjF,mFAAmF;AACnF,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,gFAAgF;AAChF,8EAA8E;AAC9E,oDAAoD;AACpD,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,mCAAmC,CAAC;IAC/C,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,4DAA4D;AAC5D,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,8DAA8D;AAC9D,SAAS,WAAW,CAAC,IAAc;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,MAAM,GACV,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,IAAI,CAAC;YACvC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;YACxC,yEAAyE;YACzE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,aAAa,GAAG,IAAI,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,GAAG,GAAG,CAAC;YACd,aAAa,GAAG,KAAK,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,IAAc;IACtD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEzC,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAE5C,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAkB,QAAQ;aAChC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACZ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,uEAAuE;QACvE,yEAAyE;QACzE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aAC/C,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aACpD,IACH,IAAI,KAAK,GAAG;YACZ,CAAC,QAAQ;YACT,CAAC,QAAQ;YACT,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,EACzC,CAAC;YACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAEtC,iFAAiF;QACjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC,EAAE,CAAC;YACxE,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAEpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO;QACL,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC;QAC7C,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAkB;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACvE,OAAO,SAAS,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC;AAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axtary/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
   "description": "Axtary local CLI for deterministic proxy demos.",
   "type": "module",
@@ -24,7 +24,7 @@
     "axtary": "dist/bin.js"
   },
   "scripts": {
-    "prebuild": "npm run build -w @axtary/config && npm run build -w @axtary/adapters && npm run build -w @axtary/proxy && npm run build -w @axtary/mcp",
+    "prebuild": "npm run build -w @axtary/config && npm run build -w @axtary/adapters && npm run build -w @axtary/proxy && npm run build -w @axtary/mcp && npm run build -w @axtary/approvals",
     "build": "npm run clean && tsc -p tsconfig.json",
     "clean": "rm -rf dist",
     "prepack": "npm run build"
@@ -39,16 +39,21 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./claude-code-hook": {
+      "types": "./dist/claude-code-hook.d.ts",
+      "import": "./dist/claude-code-hook.js"
     }
   },
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@axtary/actionpass": "^0.1.0",
-    "@axtary/adapters": "^0.1.0",
-    "@axtary/config": "^0.1.0",
-    "@axtary/ledger": "^0.1.0",
-    "@axtary/mcp": "^0.1.0",
-    "@axtary/policy": "^0.1.0",
-    "@axtary/proxy": "^0.1.0"
+    "@axtary/actionpass": "^0.2.0",
+    "@axtary/adapters": "^0.2.0",
+    "@axtary/approvals": "^0.2.0",
+    "@axtary/config": "^0.2.0",
+    "@axtary/ledger": "^0.2.0",
+    "@axtary/mcp": "^0.2.0",
+    "@axtary/policy": "^0.2.0",
+    "@axtary/proxy": "^0.2.0"
   }
 }