@cybedefend/vibedefend 1.4.3 → 1.4.4

package/dist/auth/auth-store.js

@@ -12,11 +12,10 @@
  * password blob, so all PKCE / OIDC state travels with it. On macOS the OS
  * provides the encryption; on Linux the file permissions are the only control.
  *
- * Service name: "Codex MCP Credentials" — intentionally the same service that
- * `resolveTokenCodexMacOS` reads in resolve.ts, so a Codex-style lookup
- * (account = "<mcpName>|vibedefend") also picks up the new bundle and the
- * existing `resolveToken` path still works without modification during
- * the migration period.
+ * Service name: "Codex MCP Credentials", account "<mcpName>|vibedefend".
+ * `resolveToken` (resolve.ts) reads this bundle through `loadAuth`, by
+ * exact account — never through a service-wide lookup, which returns
+ * whichever entry of the service comes first (BACK-173).
  */
 import { execFileSync } from 'node:child_process';
 import { homedir } from 'node:os';
@@ -24,7 +23,7 @@ import { join } from 'node:path';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, } from 'node:fs';
 // ─── Constants ───────────────────────────────────────────────────────────────
 const KEYCHAIN_SERVICE = 'Codex MCP Credentials';
-/** Account shape: "<mcpName>|vibedefend" — matches resolveTokenCodexMacOS. */
+/** Account shape: "<mcpName>|vibedefend". */
 function accountFor(mcpName) {
     return `${mcpName}|vibedefend`;
 }

package/dist/auth/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../../src/auth/auth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC;AA0BjB,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAEjD,8EAA8E;AAC9E,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,GAAG,OAAO,aAAa,CAAC;AACjC,CAAC;AAED,iFAAiF;AAEjF,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAAgB;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAE/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,CAAC,IAAI;QAAE,IAAI,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;QACvD,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,+EAA+E;QAC/E,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EACxC,CAAC;YACD,OAAO,MAAoB,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV;gBACE,yBAAyB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;aAC1B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,SAAS,kBAAkB,CAAC,OAAe,EAAE,IAAY;IACvD,wEAAwE;IACxE,0BAA0B;IAC1B,IAAI,CAAC;QACH,YAAY,CACV,UAAU,EACV;YACE,yBAAyB;YACzB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;SAC1B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IAED,YAAY,CACV,UAAU,EACV;QACE,sBAAsB;QACtB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,IAAI;KACX,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV;YACE,uBAAuB;YACvB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;YACzB,IAAI;SACL,EACD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,wEAAwE;QACxE,4CAA4C;QAC5C,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../../src/auth/auth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC;AA0BjB,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAEjD,6CAA6C;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,GAAG,OAAO,aAAa,CAAC;AACjC,CAAC;AAED,iFAAiF;AAEjF,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAAgB;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAE/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,CAAC,IAAI;QAAE,IAAI,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;QACvD,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,+EAA+E;QAC/E,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EACxC,CAAC;YACD,OAAO,MAAoB,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV;gBACE,yBAAyB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;aAC1B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,SAAS,kBAAkB,CAAC,OAAe,EAAE,IAAY;IACvD,wEAAwE;IACxE,0BAA0B;IAC1B,IAAI,CAAC;QACH,YAAY,CACV,UAAU,EACV;YACE,yBAAyB;YACzB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;SAC1B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IAED,YAAY,CACV,UAAU,EACV;QACE,sBAAsB;QACtB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,IAAI;KACX,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV;YACE,uBAAuB;YACvB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;YACzB,IAAI;SACL,EACD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,wEAAwE;QACxE,4CAA4C;QAC5C,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/diagnostics.js

@@ -85,7 +85,9 @@ export async function gatherInstallState(opts = {}) {
     if (opts.live) {
         let token = null;
         try {
-            token = region ? resolveToken(region.mcpName) : null;
+            token = region
+                ? resolveToken(region.mcpName, { mcpUrl: region.mcpUrl })
+                : null;
         }
         catch {
             token = null;

package/dist/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AA2B5E,kEAAkE;AAClE,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAI,aAAa,EAAE,MAAmC,IAAI,IAAI,CAAC;IAE3E,MAAM,YAAY,GAChB,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ;QAC7C,CAAC,CAAC,aAAa,CAAC,YAAY;QAC5B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,iBAAiB,GAAG,YAAY,KAAK,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAE5E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAE1D,MAAM,OAAO,GAAmB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,GAAG,GAAG,MAAM;YAChB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,IAAI,CAAC;oBACH,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACjF,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,aAAa,KAAK,IAAI;QACjC,MAAM;QACN,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtD,iBAAiB;QACjB,cAAc;QACd,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,OAAO;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AA2B5E,kEAAkE;AAClE,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAI,aAAa,EAAE,MAAmC,IAAI,IAAI,CAAC;IAE3E,MAAM,YAAY,GAChB,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ;QAC7C,CAAC,CAAC,aAAa,CAAC,YAAY;QAC5B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,iBAAiB,GAAG,YAAY,KAAK,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAE5E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAE1D,MAAM,OAAO,GAAmB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,GAAG,GAAG,MAAM;YAChB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,IAAI,CAAC;oBACH,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM;gBACZ,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACjF,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,aAAa,KAAK,IAAI;QACjC,MAAM;QACN,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtD,iBAAiB;QACjB,cAAc;QACd,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,OAAO;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/hook-runner.js

@@ -4896,6 +4896,7 @@ function extractToolInputShape(input, client) {
 
 // src/hooks/runtime/resolve.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
+import { createHash } from "node:crypto";
 import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
 
 // src/auth/auth-store.ts
@@ -5585,30 +5586,50 @@ function resolveProjectId(cwd = process.cwd(), deps = {}) {
   }
   return { projectId: null, apiBase: null };
 }
-function resolveToken(mcpName) {
+function resolveToken(mcpName, opts = {}) {
   const envToken = process.env.CYBEDEFEND_TOKEN;
   if (envToken && envToken.length > 0) return envToken;
-  if (process.platform === "darwin") {
-    return resolveTokenMacOS(mcpName) ?? resolveTokenCodexMacOS(mcpName);
+  const stored = (opts.loadStoredAuth ?? loadAuth)(mcpName);
+  if (stored && (opts.now ?? Date.now)() < stored.expiresAt) {
+    return stored.accessToken;
   }
-  if (process.platform === "linux") return resolveTokenLinux(mcpName);
+  const platform2 = opts.platform ?? process.platform;
+  const readKeychain = opts.readKeychain ?? readMacOSKeychain2;
+  if (platform2 === "darwin") {
+    return resolveTokenMacOS(mcpName, readKeychain) ?? resolveTokenCodexMacOS(mcpName, opts.mcpUrl, readKeychain);
+  }
+  if (platform2 === "linux") return resolveTokenLinux(mcpName);
   return null;
 }
-function resolveTokenMacOS(mcpName) {
-  let blob;
+function codexCredentialAccount(mcpName, mcpUrl) {
+  const digest = createHash("sha256").update(JSON.stringify({ type: "http", url: mcpUrl, headers: {} })).digest("hex");
+  return `${mcpName}|${digest.slice(0, 16)}`;
+}
+function readMacOSKeychain2(service, account) {
   try {
-    blob = execFileSync2(
+    const blob = execFileSync2(
       "security",
-      ["find-generic-password", "-s", "Claude Code-credentials", "-w"],
+      [
+        "find-generic-password",
+        "-s",
+        service,
+        ...account === void 0 ? [] : ["-a", account],
+        "-w"
+      ],
       {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
         timeout: 2e3
       }
     ).trim();
+    return blob.length > 0 ? blob : null;
   } catch {
     return null;
   }
+}
+function resolveTokenMacOS(mcpName, readKeychain) {
+  const blob = readKeychain("Claude Code-credentials");
+  if (!blob) return null;
   try {
     const data = JSON.parse(blob);
     const oauth = data.mcpOAuth ?? {};
@@ -5622,37 +5643,20 @@ function resolveTokenMacOS(mcpName) {
   }
   return null;
 }
-function resolveTokenCodexMacOS(mcpName) {
-  let blob;
-  try {
-    blob = execFileSync2(
-      "security",
-      ["find-generic-password", "-s", "Codex MCP Credentials", "-a", mcpName, "-w"],
-      {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 2e3
-      }
-    ).trim();
-  } catch {
-    try {
-      blob = execFileSync2(
-        "security",
-        ["find-generic-password", "-s", "Codex MCP Credentials", "-w"],
-        {
-          encoding: "utf8",
-          stdio: ["ignore", "pipe", "ignore"],
-          timeout: 2e3
-        }
-      ).trim();
-    } catch {
-      return null;
-    }
+function resolveTokenCodexMacOS(mcpName, mcpUrl, readKeychain) {
+  const accounts = mcpUrl ? [codexCredentialAccount(mcpName, mcpUrl), mcpName] : [mcpName];
+  for (const account of accounts) {
+    const blob = readKeychain("Codex MCP Credentials", account);
+    if (!blob) continue;
+    const token = parseCodexCredential(blob);
+    if (token) return token;
   }
-  if (!blob) return null;
+  return null;
+}
+function parseCodexCredential(blob) {
   try {
     const data = JSON.parse(blob);
-    return data.access_token ?? data.accessToken ?? data.token ?? null;
+    return data.token_response?.access_token ?? data.access_token ?? data.accessToken ?? data.token ?? null;
   } catch {
     return blob || null;
   }
@@ -5673,7 +5677,7 @@ function resolveTokenLinux(mcpName) {
     return null;
   }
 }
-async function resolveTokenWithRefresh(mcpName, deps = {}) {
+async function resolveTokenWithRefresh(mcpName, deps = {}, opts = {}) {
   const getValidAccessTokenFn = deps.getValidAccessToken ?? getValidAccessToken;
   const resolveTokenFn = deps.resolveTokenFn ?? resolveToken;
   const envToken = process.env.CYBEDEFEND_TOKEN;
@@ -5683,10 +5687,10 @@ async function resolveTokenWithRefresh(mcpName, deps = {}) {
     if (token) return token;
   } catch (e) {
     if (e instanceof LoginRequiredError) {
-      return resolveTokenFn(mcpName);
+      return resolveTokenFn(mcpName, opts);
     }
   }
-  return resolveTokenFn(mcpName);
+  return resolveTokenFn(mcpName, opts);
 }
 var RESOLVE_API_TIMEOUT_MS = 4e3;
 async function resolveProjectIdWithApi(cwd = process.cwd(), deps = {}) {
@@ -5909,7 +5913,9 @@ async function fetchRulesHook(deps = {}) {
   const { projectId, apiBase: configApiBase } = await resolveProject();
   if (!projectId) return;
   const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
-  const token = resolveTok(config.region.mcpName);
+  const token = resolveTok(config.region.mcpName, {
+    mcpUrl: config.region.mcpUrl
+  });
   if (!token) return;
   const intent = buildIntent(event);
   const files = event.filePaths.length > 0 ? event.filePaths : [event.filePath];
@@ -6209,19 +6215,66 @@ function pmCommand(mode, spec) {
   }
 }
 
+// src/hooks/runtime/hook-refresh-trigger.ts
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { dirname as dirname3, join as join6 } from "node:path";
+function maybeRefreshStaleWiring(deps) {
+  try {
+    const { config, runnerVersion } = deps;
+    if (!config.runnerSource || config.installedVersion === runnerVersion) {
+      return false;
+    }
+    const cliEntry = join6(dirname3(dirname3(config.runnerSource)), "bin", "vibedefend.js");
+    if (!(deps.exists ?? existsSync9)(cliEntry)) return false;
+    const markerPath = deps.markerPath ?? join6(process.env.CYBEDEFEND_HOME ?? homedir7(), ".cybedefend", "hook-refresh.json");
+    if (readMarkerVersion(markerPath) === runnerVersion) return false;
+    (deps.spawnRefresh ?? defaultSpawnRefresh)(cliEntry);
+    writeMarker(markerPath, runnerVersion);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readMarkerVersion(path) {
+  try {
+    if (!existsSync9(path)) return null;
+    const data = JSON.parse(readFileSync8(path, "utf8"));
+    return typeof data.version === "string" ? data.version : null;
+  } catch {
+    return null;
+  }
+}
+function writeMarker(path, version) {
+  try {
+    ensureDirFor(path);
+    writeFileSync5(path, JSON.stringify({ version, spawnedAt: Date.now() }) + "\n");
+  } catch {
+  }
+}
+function defaultSpawnRefresh(cliEntry) {
+  const child = spawn2(process.execPath, [cliEntry, "update", "--refresh-hooks"], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true
+  });
+  child.unref();
+}
+
 // src/version.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname4, join as join7 } from "node:path";
 var PKG_NAME = "@cybedefend/vibedefend";
 function defaultPkgPath() {
-  return join6(dirname3(fileURLToPath2(import.meta.url)), "..", "package.json");
+  return join7(dirname4(fileURLToPath2(import.meta.url)), "..", "package.json");
 }
 function readPackageMeta(opts = {}) {
   if (typeof opts.bakedVersion === "string" && opts.bakedVersion.length > 0) {
     return { name: PKG_NAME, version: opts.bakedVersion };
   }
-  const readFile = opts.readFile ?? ((p) => readFileSync8(p, "utf8"));
+  const readFile = opts.readFile ?? ((p) => readFileSync9(p, "utf8"));
   const pkgPath = opts.pkgPath ?? defaultPkgPath();
   try {
     return JSON.parse(readFile(pkgPath));
@@ -6230,7 +6283,7 @@ function readPackageMeta(opts = {}) {
   }
 }
 var pkg = readPackageMeta({
-  bakedVersion: true ? "1.4.3" : void 0
+  bakedVersion: true ? "1.4.4" : void 0
 });
 
 // src/hooks/runtime/session-start.ts
@@ -6249,6 +6302,10 @@ async function sessionStartHook(deps = {}) {
   const event = sniff(stdin);
   const config = loadConfig();
   if (!config) return;
+  (deps.refreshStaleWiringFn ?? maybeRefreshStaleWiring)({
+    config,
+    runnerVersion: pkg.version
+  });
   const { projectId, apiBase: configApiBase } = await resolveProject();
   if (!projectId) return;
   const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
@@ -6261,7 +6318,9 @@ async function sessionStartHook(deps = {}) {
     );
     return;
   }
-  const token = resolveTok(config.region.mcpName);
+  const token = resolveTok(config.region.mcpName, {
+    mcpUrl: config.region.mcpUrl
+  });
   let total = null;
   if (token) {
     const result = await fetchProposals({ apiBase, projectId, token });
@@ -6335,7 +6394,7 @@ async function sessionStartHook(deps = {}) {
 }
 
 // src/hooks/runtime/session-review.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
 var COUNTED_TOOLS = /* @__PURE__ */ new Set([
   "Edit",
   "Write",
@@ -6413,9 +6472,9 @@ function loadTranscript(stdin, readFile) {
   return out;
 }
 function defaultReadTranscript(path) {
-  if (!existsSync9(path)) return null;
+  if (!existsSync10(path)) return null;
   try {
-    return readFileSync9(path, "utf8");
+    return readFileSync10(path, "utf8");
   } catch {
     return null;
   }
@@ -6673,19 +6732,19 @@ async function preCompactHook(deps = {}) {
 }
 
 // src/hooks/runtime/user-prompt-submit.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join8 } from "node:path";
 var SESSIONS_CAP = 100;
 function defaultSessionsFile() {
-  const dir = process.env.CYBEDEFEND_BASELINE_DIR ?? join7(homedir7(), ".cybedefend");
-  return join7(dir, "user-prompt-seen-sessions.json");
+  const dir = process.env.CYBEDEFEND_BASELINE_DIR ?? join8(homedir8(), ".cybedefend");
+  return join8(dir, "user-prompt-seen-sessions.json");
 }
 function defaultSessionTracker(file = defaultSessionsFile()) {
   function load() {
-    if (!existsSync10(file)) return [];
+    if (!existsSync11(file)) return [];
     try {
-      const raw = readFileSync10(file, "utf8");
+      const raw = readFileSync11(file, "utf8");
       const data = JSON.parse(raw);
       if (!Array.isArray(data.sessions)) return [];
       return data.sessions.filter((s) => typeof s === "string");
@@ -6702,8 +6761,8 @@ function defaultSessionTracker(file = defaultSessionsFile()) {
       if (existing.includes(sessionId)) return;
       const next = [...existing, sessionId].slice(-SESSIONS_CAP);
       try {
-        mkdirSync4(join7(file, ".."), { recursive: true });
-        writeFileSync5(file, JSON.stringify({ sessions: next }), "utf8");
+        mkdirSync4(join8(file, ".."), { recursive: true });
+        writeFileSync6(file, JSON.stringify({ sessions: next }), "utf8");
       } catch {
       }
     }
@@ -6728,7 +6787,9 @@ async function userPromptSubmitHook(deps = {}) {
   const { projectId, apiBase: configApiBase } = await resolveProject();
   if (!projectId) return;
   const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
-  const token = resolveTok(config.region.mcpName);
+  const token = resolveTok(config.region.mcpName, {
+    mcpUrl: config.region.mcpUrl
+  });
   let total = null;
   if (token) {
     const result = await fetchProposals({ apiBase, projectId, token });
@@ -7386,7 +7447,7 @@ function validateRule(rule) {
 }
 
 // src/guards-evaluator/redact.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 var REDACTED = "[REDACTED]";
 var PATTERNS = [
   // 1. JWT — three base64url segments separated by dots
@@ -7488,7 +7549,7 @@ function redactTarget(text, maxLen = 256) {
   return result;
 }
 function hashTarget(text) {
-  return createHash("sha256").update(text, "utf8").digest("hex");
+  return createHash2("sha256").update(text, "utf8").digest("hex");
 }
 
 // src/hooks/runtime/near-miss.ts
@@ -7766,10 +7827,10 @@ function nearMiss(req, rule) {
 }
 
 // src/hooks/runtime/guard-rules-cache.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync6, existsSync as existsSync11, mkdirSync as mkdirSync5 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
-import { homedir as homedir8 } from "node:os";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, existsSync as existsSync12, mkdirSync as mkdirSync5 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join9 } from "node:path";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -11881,8 +11942,8 @@ function parseRuleFields(raw) {
 }
 
 // src/hooks/runtime/guard-rules-cache.ts
-var DEFAULT_CACHE_FILE = join8(
-  homedir8(),
+var DEFAULT_CACHE_FILE = join9(
+  homedir9(),
   ".cybedefend",
   "guards-cache.json"
 );
@@ -12006,9 +12067,9 @@ function makeGuardRulesCache(opts) {
     }
   }
   function readCache(projectId) {
-    if (!existsSync11(cacheFile)) return null;
+    if (!existsSync12(cacheFile)) return null;
     try {
-      const raw = readFileSync11(cacheFile, "utf8");
+      const raw = readFileSync12(cacheFile, "utf8");
       const data = JSON.parse(raw);
       if (data.projectId !== projectId) return null;
       return data;
@@ -12019,15 +12080,15 @@ function makeGuardRulesCache(opts) {
   function writeCache(entry) {
     try {
       ensureDirFor2(cacheFile);
-      writeFileSync6(cacheFile, JSON.stringify(entry), "utf8");
+      writeFileSync7(cacheFile, JSON.stringify(entry), "utf8");
     } catch {
     }
   }
   return { refreshIfStale };
 }
 function ensureDirFor2(filePath) {
-  const dir = dirname4(filePath);
-  if (!existsSync11(dir)) {
+  const dir = dirname5(filePath);
+  if (!existsSync12(dir)) {
     mkdirSync5(dir, { recursive: true });
   }
 }
@@ -12149,11 +12210,11 @@ function detectPromptInjection(text) {
 }
 
 // src/hooks/runtime/judge-cache.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, existsSync as existsSync12, mkdirSync as mkdirSync6 } from "node:fs";
-import { dirname as dirname5, join as join9 } from "node:path";
-import { homedir as homedir9 } from "node:os";
-var DEFAULT_JUDGE_CACHE_FILE = join9(
-  homedir9(),
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync8, existsSync as existsSync13, mkdirSync as mkdirSync6 } from "node:fs";
+import { dirname as dirname6, join as join10 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+var DEFAULT_JUDGE_CACHE_FILE = join10(
+  homedir10(),
   ".cybedefend",
   "guards-judge-cache.json"
 );
@@ -12163,9 +12224,9 @@ function makeJudgeCache(opts = {}) {
   const ttlMs = opts.ttlMs ?? DEFAULT_JUDGE_TTL_MS;
   const now = opts.now ?? (() => Date.now());
   function readAll() {
-    if (!existsSync12(cacheFile)) return {};
+    if (!existsSync13(cacheFile)) return {};
     try {
-      return JSON.parse(readFileSync12(cacheFile, "utf8"));
+      return JSON.parse(readFileSync13(cacheFile, "utf8"));
     } catch {
       return {};
     }
@@ -12185,36 +12246,36 @@ function makeJudgeCache(opts = {}) {
       }
       all[key] = { res, at: t };
       ensureDirFor3(cacheFile);
-      writeFileSync7(cacheFile, JSON.stringify(all), "utf8");
+      writeFileSync8(cacheFile, JSON.stringify(all), "utf8");
     } catch {
     }
   }
   return { get, set };
 }
 function ensureDirFor3(filePath) {
-  const dir = dirname5(filePath);
-  if (!existsSync12(dir)) {
+  const dir = dirname6(filePath);
+  if (!existsSync13(dir)) {
     mkdirSync6(dir, { recursive: true });
   }
 }
 
 // src/hooks/runtime/guard-check.ts
-import { homedir as homedir11 } from "node:os";
-import { join as join11 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+import { join as join12 } from "node:path";
 
 // src/hooks/runtime/guard-violations-buffer.ts
 import {
   appendFileSync,
-  existsSync as existsSync13,
-  readFileSync as readFileSync13,
-  writeFileSync as writeFileSync8,
+  existsSync as existsSync14,
+  readFileSync as readFileSync14,
+  writeFileSync as writeFileSync9,
   mkdirSync as mkdirSync7
 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
-import { homedir as homedir10 } from "node:os";
-import { join as join10 } from "node:path";
-var DEFAULT_BUFFER_FILE = join10(
-  homedir10(),
+import { dirname as dirname7 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { join as join11 } from "node:path";
+var DEFAULT_BUFFER_FILE = join11(
+  homedir11(),
   ".cybedefend",
   "guards-violations-buffer.jsonl"
 );
@@ -12233,10 +12294,10 @@ function makeViolationsBuffer(opts = {}) {
     }
   }
   async function flushViolations2(ctx, postFn) {
-    if (!existsSync13(bufferFile)) return;
+    if (!existsSync14(bufferFile)) return;
     let content;
     try {
-      content = readFileSync13(bufferFile, "utf8").trim();
+      content = readFileSync14(bufferFile, "utf8").trim();
     } catch {
       return;
     }
@@ -12255,7 +12316,7 @@ function makeViolationsBuffer(opts = {}) {
     }
     if (records.length === 0) {
       try {
-        writeFileSync8(bufferFile, "", "utf8");
+        writeFileSync9(bufferFile, "", "utf8");
       } catch {
       }
       return;
@@ -12285,10 +12346,10 @@ function makeViolationsBuffer(opts = {}) {
     }
     try {
       if (failed.length === 0) {
-        writeFileSync8(bufferFile, "", "utf8");
+        writeFileSync9(bufferFile, "", "utf8");
       } else {
         const serialised = failed.map((r) => JSON.stringify(r)).join("\n") + "\n";
-        writeFileSync8(bufferFile, serialised, "utf8");
+        writeFileSync9(bufferFile, serialised, "utf8");
       }
     } catch {
     }
@@ -12296,8 +12357,8 @@ function makeViolationsBuffer(opts = {}) {
   return { bufferViolation: bufferViolation2, flushViolations: flushViolations2 };
 }
 function ensureDirFor4(filePath) {
-  const dir = dirname6(filePath);
-  if (!existsSync13(dir)) {
+  const dir = dirname7(filePath);
+  if (!existsSync14(dir)) {
     mkdirSync7(dir, { recursive: true });
   }
 }
@@ -12325,10 +12386,10 @@ function appendDebugLog(entry) {
     const homeDir = process.env.HOME ?? process.env.USERPROFILE ?? "";
     if (!homeDir) return;
     const { mkdirSync: mkdirSync8, appendFileSync: appendFileSync2 } = __require("node:fs");
-    const { join: join12 } = __require("node:path");
-    const dir = join12(homeDir, ".cybedefend");
+    const { join: join13 } = __require("node:path");
+    const dir = join13(homeDir, ".cybedefend");
     mkdirSync8(dir, { recursive: true });
-    appendFileSync2(join12(dir, "hook-debug.log"), entry + "\n", "utf8");
+    appendFileSync2(join13(dir, "hook-debug.log"), entry + "\n", "utf8");
   } catch {
   }
 }
@@ -12814,8 +12875,6 @@ function emitAgentMessage(verdict, message) {
       // Claude Code legacy
       decision: "block",
       reason: fullMessage,
-      continue: false,
-      stopReason: fullMessage,
       // Claude Code modern
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
@@ -12844,9 +12903,9 @@ function emitAgentMessage(verdict, message) {
 }
 function makeProductionJudgeDeps() {
   const cache = makeJudgeCache();
-  const warnDir = process.env.CYBEDEFEND_BASELINE_DIR ?? join11(homedir11(), ".cybedefend");
+  const warnDir = process.env.CYBEDEFEND_BASELINE_DIR ?? join12(homedir12(), ".cybedefend");
   const warnTracker = defaultSessionTracker(
-    join11(warnDir, "guards-judge-warned-sessions.json")
+    join12(warnDir, "guards-judge-warned-sessions.json")
   );
   return {
     callJudge,
@@ -12871,7 +12930,11 @@ async function runPreToolUseGuard() {
     const { projectId, apiBase: configApiBase } = await resolveProjectIdWithApi();
     if (!projectId) return 0;
     const apiBaseResolved = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
-    const token = await resolveTokenWithRefresh(config.region.mcpName);
+    const token = await resolveTokenWithRefresh(
+      config.region.mcpName,
+      {},
+      { mcpUrl: config.region.mcpUrl }
+    );
     if (!token) {
       emitUnverifiedBanner(
         "Not authenticated \u2014 run `vibedefend login` to restore Action Guards."

package/dist/hooks/runtime/fetch-rules.js

@@ -60,7 +60,9 @@ export async function fetchRulesHook(deps = {}) {
     if (!projectId)
         return;
     const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
-    const token = resolveTok(config.region.mcpName);
+    const token = resolveTok(config.region.mcpName, {
+        mcpUrl: config.region.mcpUrl,
+    });
     if (!token)
         return;
     const intent = buildIntent(event);