@catp-protocol/cli 0.6.0 → 0.7.2

package/dist/adapters/codex.d.ts

@@ -0,0 +1,3 @@
+import type { RuntimeAdapter } from "../runtime/types.js";
+export declare const codexAdapter: RuntimeAdapter;
+//# sourceMappingURL=codex.d.ts.map

package/dist/adapters/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/adapters/codex.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAA4B,MAAM,qBAAqB,CAAC;AAcpF,eAAO,MAAM,YAAY,EAAE,cAQ1B,CAAC"}

package/dist/adapters/codex.js

@@ -0,0 +1,56 @@
+const EVENT_BY_PHASE = {
+    pre: "PreToolUse",
+    post: "PostToolUse",
+};
+export const codexAdapter = {
+    runtime: "codex",
+    fromPreToolUse(input) {
+        return toToolAction(input, "pre");
+    },
+    fromPostToolUse(input) {
+        return toToolAction(input, "post");
+    },
+};
+function toToolAction(input, phase) {
+    if (!isCodexHookInput(input, phase)) {
+        return null;
+    }
+    return {
+        runtime: codexAdapter.runtime,
+        phase,
+        sessionId: input.session_id,
+        toolName: input.tool_name,
+        toolInput: normalizeToolInput(input.tool_input),
+        raw: input,
+    };
+}
+// Validation mirrors the claude-code adapter: only the fields CATP core logic
+// depends on are required, so payloads from older Codex builds that predate
+// newer schema fields (model, turn_id, ...) still parse.
+function isCodexHookInput(input, phase) {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        return false;
+    }
+    const value = input;
+    if (value.hook_event_name !== undefined && value.hook_event_name !== EVENT_BY_PHASE[phase]) {
+        return false;
+    }
+    return (typeof value.tool_name === "string" &&
+        !!value.tool_name &&
+        isRecord(value.tool_input) &&
+        (value.session_id === undefined || typeof value.session_id === "string"));
+}
+// Codex shell-family tools may pass `command` as an argv array. Join it into a
+// single string so policy pattern matching sees the same command shape as on
+// other runtimes. Non-string argv elements are left untouched.
+function normalizeToolInput(toolInput) {
+    const command = toolInput.command;
+    if (!Array.isArray(command) || command.some((part) => typeof part !== "string")) {
+        return toolInput;
+    }
+    return { ...toolInput, command: command.join(" ") };
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=codex.js.map

package/dist/adapters/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/adapters/codex.ts"],"names":[],"mappings":"AASA,MAAM,cAAc,GAAiC;IACnD,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,aAAa;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,OAAO,EAAE,OAAO;IAChB,cAAc,CAAC,KAAc;QAC3B,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,eAAe,CAAC,KAAc;QAC5B,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEF,SAAS,YAAY,CAAC,KAAc,EAAE,KAAmB;IACvD,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK;QACL,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/C,GAAG,EAAE,KAAK;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,yDAAyD;AACzD,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAmB;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,CAAC,KAAK,CAAC,SAAS;QACjB,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAC1B,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,SAAkC;IAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC"}

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAExE;AAED,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED,wBAAgB,8BAA8B,IAAI,MAAM,CAKvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAExE;AAED,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED,wBAAgB,8BAA8B,IAAI,MAAM,CAKvD"}

package/dist/adapters/index.js

@@ -1,5 +1,6 @@
 import { claudeCodeAdapter } from "./claude-code.js";
-const ADAPTERS = [claudeCodeAdapter];
+import { codexAdapter } from "./codex.js";
+const ADAPTERS = [claudeCodeAdapter, codexAdapter];
 export function getRuntimeAdapter(runtime) {
     return ADAPTERS.find((adapter) => adapter.runtime === runtime) ?? null;
 }

package/dist/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,MAAM,QAAQ,GAAG,CAAC,iBAAiB,CAAU,CAAC;AAE9C,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,6BAA6B;QAC7B,GAAG,wBAAwB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;KAC/D,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1C,MAAM,QAAQ,GAAG,CAAC,iBAAiB,EAAE,YAAY,CAAU,CAAC;AAE5D,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,6BAA6B;QAC7B,GAAG,wBAAwB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;KAC/D,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC"}

package/dist/audit/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAWxD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAY,EAClB,WAAW,GAAE,MAAM,GAAG,IAAW,EACjC,YAAY,GAAE,MAAW,EACzB,aAAa,CAAC,EAAE,mBAAmB,EACnC,iBAAiB,GAAE,CAAC,GAAG,CAAC,GAAG,CAAK,EAChC,KAAK,CAAC,EAAE,YAAY,GACnB,MAAM,CASR;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGxD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIzD;AAeD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAKzE;AAED,wBAAgB,uBAAuB,CAAC,CAAC,SAAS;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,EAC1E,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,CAAC,GACnC,CAAC,CAUH;AAkCD,wBAAgB,UAAU,CACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,GAAE,MAAY,GAC3B,UAAU,CA4BZ;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAsB7F"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAexD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAY,EAClB,WAAW,GAAE,MAAM,GAAG,IAAW,EACjC,YAAY,GAAE,MAAW,EACzB,aAAa,CAAC,EAAE,mBAAmB,EACnC,iBAAiB,GAAE,CAAC,GAAG,CAAC,GAAG,CAAK,EAChC,KAAK,CAAC,EAAE,YAAY,GACnB,MAAM,CASR;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGxD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIzD;AAsCD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAKzE;AAED,wBAAgB,uBAAuB,CAAC,CAAC,SAAS;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,EAC1E,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,CAAC,GACnC,CAAC,CAUH;AAkCD,wBAAgB,UAAU,CACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,GAAE,MAAY,GAC3B,UAAU,CA4BZ;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAsB7F"}

package/dist/audit/logger.js

@@ -1,11 +1,15 @@
 import { createHash } from "node:crypto";
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { lockSync } from "proper-lockfile";
 import { auditDirForDate } from "./paths.js";
 const AUDIT_LOCK_STALE_MS = 5_000;
 const AUDIT_LOCK_WAIT_MS = 2_000;
 const AUDIT_LOCK_RETRY_MS = 10;
+// Tail recovery reads only this suffix of the daily file: audit entries are
+// bounded (input summaries are capped), so the last line always fits, and
+// append cost stays constant as the daily log grows.
+const AUDIT_TAIL_READ_BYTES = 64 * 1024;
 const lockWaitBuffer = new Int32Array(new SharedArrayBuffer(4));
 // Phase 0: SHA-256 audit commitment.
 // Chains on fields stored in the log (tool, decision, ts, prev) so the chain
@@ -37,16 +41,40 @@ export function getLastCommitment(agentId) {
 function getLastCommitmentFromFile(file) {
     if (!existsSync(file))
         return "0";
-    const content = readFileSync(file, "utf8").trimEnd();
-    if (!content)
+    const lastLine = readLastAuditLine(file);
+    if (lastLine === null)
         return "0";
-    const lastLine = content.split("\n").pop() ?? "";
     const entry = JSON.parse(lastLine);
     if (typeof entry.commitment !== "string" || !/^[0-9a-f]{64}$/i.test(entry.commitment)) {
         throw new Error(`invalid audit log tail in ${file}`);
     }
     return entry.commitment;
 }
+function readLastAuditLine(file) {
+    const size = statSync(file).size;
+    if (size === 0)
+        return null;
+    const fd = openSync(file, "r");
+    try {
+        const chunkSize = Math.min(size, AUDIT_TAIL_READ_BYTES);
+        const buffer = Buffer.alloc(chunkSize);
+        readSync(fd, buffer, 0, chunkSize, size - chunkSize);
+        let text = buffer.toString("utf8");
+        // A valid file ends every entry with a newline, so the suffix must
+        // contain one unless the whole file is a single oversized line.
+        if (size > chunkSize && !text.includes("\n")) {
+            throw new Error(`invalid audit log tail in ${file}`);
+        }
+        text = text.trimEnd();
+        if (!text)
+            return null;
+        const cut = text.lastIndexOf("\n");
+        return cut === -1 ? text : text.slice(cut + 1);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 export function appendAuditEntry(agentId, entry) {
     const dir = auditDir(agentId);
     mkdirSync(dir, { recursive: true });

package/dist/audit/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE,qCAAqC;AACrC,6EAA6E;AAC7E,wEAAwE;AACxE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG,EAClB,cAA6B,IAAI,EACjC,eAAuB,EAAE,EACzB,aAAmC,EACnC,oBAA+B,CAAC,EAChC,KAAoB;IAEpB,MAAM,OAAO,GAAG,iBAAiB,KAAK,CAAC;QACrC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;QACzH,CAAC,CAAC,iBAAiB,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;YAClH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAElC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAiB;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,KAAoC;IAEpC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAiB;IACxD,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAI,IAAY,EAAE,SAAkB;IACxD,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,EAAE;gBACpB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;gBAClD,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAChF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAiB,EACjB,QAA0B,EAC1B,WAA0B,EAC1B,iBAAyB,GAAG;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAe;QACxB,kBAAkB,EAAE,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,iBAAiB,CAC3B,KAAK,CAAC,QAAQ,EACd,QAAQ,EACR,EAAE,EACF,cAAc,EACd,WAAW,EACX,YAAY,EACZ,aAAa,EACb,CAAC,EACD,KAAK,CAAC,KAAK,CACZ;QACD,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,kBAAkB,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACtF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAK7C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,4EAA4E;AAC5E,0EAA0E;AAC1E,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE,qCAAqC;AACrC,6EAA6E;AAC7E,wEAAwE;AACxE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG,EAClB,cAA6B,IAAI,EACjC,eAAuB,EAAE,EACzB,aAAmC,EACnC,oBAA+B,CAAC,EAChC,KAAoB;IAEpB,MAAM,OAAO,GAAG,iBAAiB,KAAK,CAAC;QACrC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;QACzH,CAAC,CAAC,iBAAiB,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,IAAI,EAAE;YAClH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SAC/B,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,mEAAmE;QACnE,gEAAgE;QAChE,IAAI,IAAI,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAiB;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,KAAoC;IAEpC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAiB;IACxD,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAI,IAAY,EAAE,SAAkB;IACxD,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,EAAE;gBACpB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;gBAClD,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAChF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAiB,EACjB,QAA0B,EAC1B,WAA0B,EAC1B,iBAAyB,GAAG;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAe;QACxB,kBAAkB,EAAE,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,iBAAiB,CAC3B,KAAK,CAAC,QAAQ,EACd,QAAQ,EACR,EAAE,EACF,cAAc,EACd,WAAW,EACX,YAAY,EACZ,aAAa,EACb,CAAC,EACD,KAAK,CAAC,KAAK,CACZ;QACD,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,kBAAkB,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACtF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC"}

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA2CA,wBAAgB,cAAc,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAE7E;AAED,wBAAgB,OAAO,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAiBpE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA0DA,wBAAgB,cAAc,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAE7E;AAED,wBAAgB,OAAO,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAiBpE"}

package/dist/commands/init.js

@@ -6,6 +6,15 @@ version = "1"
 
 # Rules are evaluated top-to-bottom; first match wins.
 # Omit pattern/path fields to match any invocation of that tool.
+# Command patterns are matched against the raw command string; CATP does not
+# parse shell syntax. Keep the control-operator deny rule below ahead of any
+# Bash allow rule so allowlisted commands cannot be chained into others.
+
+[[rules]]
+tool = "Bash"
+allow = false
+pattern = ["&&", ";", "|", "\`", "$("]
+reason = "Compound shell commands are blocked; remove this rule only if you understand the bypass risk"
 
 [[rules]]
 tool = "Bash"
@@ -27,6 +36,12 @@ reason = "Writes outside the project allowlist are blocked"
 tool = "WebFetch"
 allow = false
 reason = "External network calls require explicit approval"
+
+# On OpenAI Codex CLI (catp hook pre/post --runtime codex), tool rules match
+# the names Codex reports: v0.155.1 uses "Bash" for shell commands and
+# "apply_patch" for file edits (patch text arrives in tool_input.command;
+# argv-array commands are normalized to a single string). Run "catp log show"
+# after a tool call to confirm the names your runtime reports.
 `;
 const AUTHORIZATION_TEMPLATE = `
 [authorization]
@@ -50,8 +65,8 @@ export function cmdInit(opts = {}) {
     writeFileSync(dest, policyTemplate(opts), "utf8");
     const authorizationStep = opts.authorization
         ? "  3. Run: catp witness --action <action.json> --out <witness.json>\n" +
-            "  4. Add CATP hooks to ~/.claude/settings.json (see README)\n"
-        : "  3. Add CATP hooks to ~/.claude/settings.json (see README)\n";
+            "  4. Add CATP hooks to ~/.claude/settings.json, or ~/.codex/hooks.json for Codex CLI (see README)\n"
+        : "  3. Add CATP hooks to ~/.claude/settings.json, or ~/.codex/hooks.json for Codex CLI (see README)\n";
     process.stdout.write("Created catp-policy.toml\n\nNext steps:\n" +
         "  1. Edit catp-policy.toml to match your agent's requirements\n" +
         "  2. Run: catp validate\n" +

package/dist/commands/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BhB,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;;;;;;;CAS9B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,OAAoC,EAAE;IACnE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,sBAAsB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAoC,EAAE;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa;QAC1C,CAAC,CAAC,sEAAsE;YACtE,+DAA+D;QACjE,CAAC,CAAC,+DAA+D,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C;QAC3C,iEAAiE;QACjE,2BAA2B;QAC3B,iBAAiB,CAClB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ChB,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;;;;;;;CAS9B,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,OAAoC,EAAE;IACnE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,sBAAsB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAoC,EAAE;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa;QAC1C,CAAC,CAAC,sEAAsE;YACtE,qGAAqG;QACvG,CAAC,CAAC,qGAAqG,CAAC;IAC1G,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C;QAC3C,iEAAiE;QACjE,2BAA2B;QAC3B,iBAAiB,CAClB,CAAC;AACJ,CAAC"}

package/dist/hook/pre.d.ts

@@ -10,5 +10,9 @@ export interface PreHookOutcome {
     reason: string;
 }
 export declare function evaluatePreHookInput(raw: string, opts?: HookOptions): PreHookOutcome;
+export declare function preHookBlockOutput(reason: string): {
+    stdout: string;
+    stderr: string;
+};
 export declare function runPreHook(opts?: HookOptions): Promise<void>;
 //# sourceMappingURL=pre.d.ts.map

package/dist/hook/pre.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pre.d.ts","sourceRoot":"","sources":["../../src/hook/pre.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,cAAc,CAqDxF;AAED,wBAAsB,UAAU,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYtE"}
+{"version":3,"file":"pre.d.ts","sourceRoot":"","sources":["../../src/hook/pre.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,cAAc,CAqDxF;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAQrF;AAED,wBAAsB,UAAU,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYtE"}

package/dist/hook/pre.js

@@ -53,11 +53,22 @@ export function evaluatePreHookInput(raw, opts = {}) {
         };
     }
 }
+export function preHookBlockOutput(reason) {
+    return {
+        stdout: JSON.stringify({ decision: "block", reason }) + "\n",
+        // Codex CLI ignores stdout JSON when the hook exits non-zero and treats a
+        // missing stderr reason as a hook failure (fail-open); Claude Code also
+        // surfaces stderr on exit code 2. Write the reason to both streams.
+        stderr: reason + "\n",
+    };
+}
 export async function runPreHook(opts = {}) {
     const raw = await readStdin();
     const outcome = evaluatePreHookInput(raw, opts);
     if (outcome.exitCode === 2) {
-        process.stdout.write(JSON.stringify({ decision: "block", reason: outcome.reason }) + "\n");
+        const block = preHookBlockOutput(outcome.reason);
+        process.stdout.write(block.stdout);
+        process.stderr.write(block.stderr);
         process.exit(2);
     }
     process.exit(0);

package/dist/hook/pre.js.map

@@ -1 +1 @@
-{"version":3,"file":"pre.js","sourceRoot":"","sources":["../../src/hook/pre.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAc1D,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,OAAoB,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC;IAClD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,uBAAuB;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,wBAAwB;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE;SAClD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAC/D,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CACxC,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,gBAAiB,GAAa,CAAC,OAAO,EAAE;SACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE;IACrD,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CACrE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"pre.js","sourceRoot":"","sources":["../../src/hook/pre.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAc1D,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,OAAoB,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC;IAClD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,uBAAuB;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,wBAAwB;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE;SAClD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAC/D,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CACxC,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,gBAAiB,GAAa,CAAC,OAAO,EAAE;SACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI;QAC5D,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,EAAE,MAAM,GAAG,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE;IACrD,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/hook/runtime.d.ts

@@ -1,4 +1,11 @@
 import type { RuntimeAdapter, RuntimePhase, ToolAction } from "../runtime/types.js";
+export declare const HOOK_STDIN_MAX_BYTES: number;
+export declare const HOOK_STDIN_DEADLINE_MS = 10000;
+export interface ReadStreamOptions {
+    maxBytes?: number;
+    deadlineMs?: number;
+}
 export declare function parseHookAction(raw: string, adapter: RuntimeAdapter, phase: RuntimePhase): ToolAction | null;
-export declare function readStdin(): Promise<string>;
+export declare function readStdin(opts?: ReadStreamOptions): Promise<string>;
+export declare function readStream(stream: NodeJS.ReadableStream, opts?: ReadStreamOptions): Promise<string>;
 //# sourceMappingURL=runtime.d.ts.map

package/dist/hook/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/hook/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEpF,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,UAAU,GAAG,IAAI,CAWnB;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAQjD"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/hook/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKpF,eAAO,MAAM,oBAAoB,QAAc,CAAC;AAChD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,UAAU,GAAG,IAAI,CAWnB;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7E;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,CAAC,cAAc,EAC7B,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAgDjB"}

package/dist/hook/runtime.js

@@ -1,3 +1,8 @@
+// Hook payloads are small tool-event JSON documents. Cap and deadline keep a
+// hostile or stuck runtime pipe from exhausting enforcement-process memory or
+// hanging the hook; violations reject, and the CLI fail-closed path blocks.
+export const HOOK_STDIN_MAX_BYTES = 1024 * 1024;
+export const HOOK_STDIN_DEADLINE_MS = 10_000;
 export function parseHookAction(raw, adapter, phase) {
     let parsed;
     try {
@@ -10,13 +15,50 @@ export function parseHookAction(raw, adapter, phase) {
         ? adapter.fromPreToolUse(parsed)
         : adapter.fromPostToolUse(parsed);
 }
-export async function readStdin() {
-    return new Promise((resolve) => {
+export async function readStdin(opts = {}) {
+    return readStream(process.stdin, opts);
+}
+export function readStream(stream, opts = {}) {
+    const maxBytes = opts.maxBytes ?? HOOK_STDIN_MAX_BYTES;
+    const deadlineMs = opts.deadlineMs ?? HOOK_STDIN_DEADLINE_MS;
+    return new Promise((resolve, reject) => {
         let data = "";
-        process.stdin.setEncoding("utf8");
-        process.stdin.on("data", (chunk) => { data += chunk; });
-        process.stdin.on("end", () => resolve(data));
-        process.stdin.on("error", () => resolve(""));
+        let bytes = 0;
+        let settled = false;
+        const timer = setTimeout(() => {
+            finish(() => reject(new Error(`hook stdin deadline exceeded (${deadlineMs}ms)`)));
+        }, deadlineMs);
+        function finish(settle) {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            stream.removeListener("data", onData);
+            stream.removeListener("end", onEnd);
+            stream.removeListener("error", onError);
+            if (typeof stream.destroy === "function") {
+                stream.destroy();
+            }
+            settle();
+        }
+        function onData(chunk) {
+            const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+            bytes += Buffer.byteLength(text, "utf8");
+            if (bytes > maxBytes) {
+                finish(() => reject(new Error(`hook stdin exceeded ${maxBytes} byte limit`)));
+                return;
+            }
+            data += text;
+        }
+        function onEnd() {
+            finish(() => resolve(data));
+        }
+        function onError() {
+            finish(() => resolve(""));
+        }
+        stream.on("data", onData);
+        stream.on("end", onEnd);
+        stream.on("error", onError);
     });
 }
 //# sourceMappingURL=runtime.js.map

package/dist/hook/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/hook/runtime.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,OAAuB,EACvB,KAAmB;IAEnB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,KAAK,KAAK;QACpB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;QAChC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/hook/runtime.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAO7C,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,OAAuB,EACvB,KAAmB;IAEnB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,KAAK,KAAK;QACpB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;QAChC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B,EAAE;IAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAA6B,EAC7B,OAA0B,EAAE;IAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,oBAAoB,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC;IAE7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC,EAAE,UAAU,CAAC,CAAC;QAEf,SAAS,MAAM,CAAC,MAAkB;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,OAAQ,MAA4B,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC/D,MAA4B,CAAC,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,MAAM,EAAE,CAAC;QACX,CAAC;QAED,SAAS,MAAM,CAAC,KAAsB;YACpC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,QAAQ,aAAa,CAAC,CAAC,CAAC,CAAC;gBAC9E,OAAO;YACT,CAAC;YACD,IAAI,IAAI,IAAI,CAAC;QACf,CAAC;QAED,SAAS,KAAK;YACZ,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,SAAS,OAAO;YACd,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/policy/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,QAAQ,CAiBxE"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,QAAQ,CAiBxE"}

package/dist/policy/engine.js

@@ -1,4 +1,5 @@
 import micromatch from "micromatch";
+import { posix as posixPath } from "node:path";
 export function evaluate(policy, input) {
     const toolRules = policy.rules.filter((r) => r.tool === "*" || r.tool === input.toolName);
     for (const rule of toolRules) {
@@ -21,15 +22,19 @@ function matchesRule(rule, input) {
         return rule.pattern.some((p) => micromatch.isMatch(command, p) || command.includes(p));
     }
     if (rule.path_allowlist || rule.path_denylist) {
-        const filePath = extractPath(input);
-        if (filePath === null)
+        const rawPath = extractPath(input);
+        if (rawPath === null)
             return false;
+        // Lexical normalization collapses dot segments and redundant separators on
+        // both sides so "src/../secrets/x" cannot slip past an allowlist label.
+        // Symlink and runtime-CWD resolution remain host-side residual risk.
+        const filePath = normalizePathLabel(rawPath);
         if (rule.path_denylist && rule.path_denylist.length > 0) {
-            if (micromatch.isMatch(filePath, rule.path_denylist))
+            if (micromatch.isMatch(filePath, rule.path_denylist.map(normalizePathLabel)))
                 return true;
         }
         if (rule.path_allowlist && rule.path_allowlist.length > 0) {
-            return !micromatch.isMatch(filePath, rule.path_allowlist);
+            return !micromatch.isMatch(filePath, rule.path_allowlist.map(normalizePathLabel));
         }
         // path condition present but file didn't match denylist and no allowlist — no match
         return false;
@@ -49,4 +54,7 @@ function extractPath(input) {
     }
     return null;
 }
+function normalizePathLabel(value) {
+    return posixPath.normalize(value);
+}
 //# sourceMappingURL=engine.js.map

package/dist/policy/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,YAAY,CAAC;AAUpC,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,KAAiB;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CACnD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,KAAiB;IAChD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEpC,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5D,CAAC;QACD,oFAAoF;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mEAAmE;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAU/C,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,KAAiB;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CACnD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,KAAiB;IAChD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACnC,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5F,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,oFAAoF;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mEAAmE;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@catp-protocol/cli",
-  "version": "0.6.0",
-  "description": "Cryptographic Agent Trust Protocol — local enforcement plugin for Claude Code with TOML policy and tamper-evident audit log",
+  "version": "0.7.2",
+  "description": "Cryptographic Agent Trust Protocol — local enforcement plugin for Claude Code and OpenAI Codex CLI with TOML policy and tamper-evident audit log",
   "keywords": [
     "claude-code",
+    "codex",
     "ai-agents",
     "policy",
     "audit",