@cybedefend/vibedefend 1.5.0 → 1.6.0

package/dist/commands/mcp/sync.js

@@ -0,0 +1,215 @@
+import { isMcpClientId, MCP_CLIENT_ADAPTERS } from '../../mcp/config/clients.js';
+import { installSyncHook, removeSyncHook } from '../../mcp/config/hook.js';
+import { installProxy, installRefusalMessage, installRefusalSentence, uninstallProxy, } from '../../mcp/config/install.js';
+import { log } from '../../utils.js';
+export const EXIT_OK = 0;
+export const EXIT_PROBLEM = 1;
+export const EXIT_USAGE = 2;
+export async function runMcpSyncCommand(options, runtime, mode = 'sync') {
+    const stdout = runtime.stdout ?? process.stdout;
+    const stderr = runtime.stderr ?? process.stderr;
+    if (options.hook !== undefined) {
+        return runHook(options, runtime, stdout, stderr);
+    }
+    let clients;
+    if (options.client) {
+        if (!isMcpClientId(options.client)) {
+            stderr.write(`vibedefend ${mode}: unknown client "${options.client}". Known: ${MCP_CLIENT_ADAPTERS.map((adapter) => adapter.id).join(', ')}.\n`);
+            return EXIT_USAGE;
+        }
+        clients = [options.client];
+    }
+    // The original entry is recorded in `upstreams.json`, which is what
+    // `uninstall` restores from; the backup is for the user, not for us.
+    const shared = {
+        env: runtime.env,
+        clients,
+        dryRun: options.dryRun,
+        backup: !options.noBackup,
+        now: runtime.now,
+        platform: runtime.platform,
+    };
+    let plan;
+    let result;
+    if (mode === 'uninstall') {
+        ({ plan, result } = uninstallProxy(shared));
+    }
+    else {
+        const outcome = installProxy({
+            ...shared,
+            argv1: runtime.argv1 ?? process.argv[1],
+            execFileFn: runtime.execFileFn,
+        });
+        if (outcome.refused) {
+            writeRefusal(outcome.refused, options, stdout, stderr);
+            return EXIT_PROBLEM;
+        }
+        plan = outcome.plan;
+        result = outcome.result;
+    }
+    const report = buildReport(plan, result, options.dryRun === true);
+    if (options.json) {
+        stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    }
+    else if (options.quiet) {
+        writeQuiet(report, stdout);
+    }
+    else {
+        writeVerbose(report, mode, stdout);
+    }
+    return report.problems.length > 0 || report.failed.length > 0 ? EXIT_PROBLEM : EXIT_OK;
+}
+function runHook(options, runtime, stdout, stderr) {
+    if (options.hook !== 'claude-code') {
+        stderr.write(`vibedefend sync: --hook only knows claude-code for now (got "${String(options.hook)}").\n`);
+        return EXIT_USAGE;
+    }
+    const result = options.removeHook
+        ? removeSyncHook({ env: runtime.env })
+        : installSyncHook({ env: runtime.env });
+    if (result.outcome === 'unreadable') {
+        stderr.write(`vibedefend sync: cannot read ${result.file}. It may contain comments, which cannot be edited without dropping them; add the hook by hand.\n`);
+        return EXIT_PROBLEM;
+    }
+    if (options.json) {
+        stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    }
+    else if (!options.quiet) {
+        log.ok(options.removeHook
+            ? `SessionStart hook removed from ${result.file}`
+            : result.outcome === 'already-installed'
+                ? `SessionStart hook already in ${result.file}`
+                : `SessionStart hook added to ${result.file}`);
+    }
+    return EXIT_OK;
+}
+/**
+ * Sync did nothing, and says why in the mode's own voice: a JSON block for a
+ * program, one sentence on stdout for the hook (it lands in the agent's
+ * context, and the user has to hear about it from somewhere), the full
+ * explanation on stderr for a human.
+ */
+function writeRefusal(refusal, options, stdout, stderr) {
+    if (options.json) {
+        stdout.write(`${JSON.stringify({ refused: refusal }, null, 2)}\n`);
+        return;
+    }
+    if (options.quiet) {
+        stdout.write(`${installRefusalSentence(refusal)}\n`);
+        return;
+    }
+    stderr.write(`${installRefusalMessage(refusal)}\n`);
+}
+function buildReport(plan, result, dryRun) {
+    const failedChanges = new Set(result.failed.map((failure) => failure.change));
+    const applied = plan.changes.filter((change) => !failedChanges.has(change));
+    return {
+        wrapped: applied
+            .filter((change) => change.kind === 'wrap')
+            .map((change) => ({
+            name: change.upstreamName,
+            client: change.entry.location.client,
+            from: change.entry.kind,
+        })),
+        unwrapped: applied
+            .filter((change) => change.kind === 'unwrap')
+            .map((change) => ({ name: change.upstreamName, client: change.location.client })),
+        forgotten: applied
+            .filter((change) => change.kind === 'forget')
+            .map((change) => change.upstreamName),
+        skipped: plan.skipped.map((entry) => ({
+            name: entry.entry.name,
+            client: entry.entry.location.client,
+            reason: entry.reason,
+        })),
+        problems: plan.problems.map((problem) => ({
+            file: problem.location.file,
+            problem: problem.problem,
+        })),
+        failed: result.failed.map((failure) => ({ reason: failure.reason })),
+        files: result.written,
+        backups: result.backups,
+        dryRun,
+    };
+}
+/**
+ * The hook's output, which lands in the agent's context.
+ *
+ * Silence when nothing happened. One sentence when something did — naming the
+ * servers, because "1 server was wrapped" tells the agent nothing it can act
+ * on.
+ */
+function writeQuiet(report, stdout) {
+    const lines = [];
+    if (report.wrapped.length > 0) {
+        lines.push(`VibeDefend is now proxying ${report.wrapped.length === 1 ? 'a new MCP server' : `${report.wrapped.length} new MCP servers`}: ${report.wrapped.map((entry) => entry.name).join(', ')}.`);
+    }
+    if (report.problems.length > 0) {
+        lines.push(`VibeDefend could not read ${report.problems.length === 1 ? 'an MCP config file' : `${report.problems.length} MCP config files`}: ${report.problems.map((problem) => problem.file).join(', ')}.`);
+    }
+    // Loud even in quiet mode: this one is not "nothing happened", it is a
+    // server deliberately left alone, and the user has to know which.
+    const interactive = report.skipped.filter((entry) => entry.reason === 'needs-interactive-input');
+    if (interactive.length > 0) {
+        lines.push(`VibeDefend left ${interactive.map((entry) => entry.name).join(', ')} untouched: ${interactive.length === 1 ? 'it uses' : 'they use'} a \${input:…} placeholder, which only the client can resolve by asking you.`);
+    }
+    if (lines.length > 0)
+        stdout.write(`${lines.join(' ')}\n`);
+}
+function writeVerbose(report, mode, stdout) {
+    void stdout;
+    const prefix = report.dryRun ? '[dry-run] ' : '';
+    for (const entry of report.wrapped) {
+        log.ok(`${prefix}${entry.client}: ${entry.name} is now behind the proxy`);
+    }
+    for (const entry of report.unwrapped) {
+        log.ok(`${prefix}${entry.client}: ${entry.name} restored to its original entry`);
+    }
+    for (const name of report.forgotten) {
+        log.info(`${prefix}forgot ${name}, which no client lists any more`);
+    }
+    for (const entry of report.skipped) {
+        const explanation = explainSkip(entry.reason);
+        if (explanation)
+            log.warn(`${entry.client}: ${entry.name} ${explanation}`);
+    }
+    for (const problem of report.problems) {
+        log.warn(`${problem.file}: ${explainProblem(problem.problem)}`);
+    }
+    for (const failure of report.failed) {
+        log.err(failure.reason);
+    }
+    if (report.wrapped.length === 0 && report.unwrapped.length === 0 && report.forgotten.length === 0) {
+        log.info(mode === 'uninstall' ? 'Nothing was behind the proxy.' : 'Everything is already in order.');
+    }
+    if (report.backups.length > 0) {
+        log.hint(`Backups: ${report.backups.join(', ')}`);
+    }
+}
+/**
+ * Why an entry was left alone, when that is worth a line. `null` for the
+ * reasons that are business as usual — an already-wrapped server is not news.
+ */
+function explainSkip(reason) {
+    if (reason === 'needs-interactive-input') {
+        return ('was left untouched: it references a ${input:…} placeholder, whose value ' +
+            'the client obtains by asking you. The proxy has no way to ask, so ' +
+            'wrapping it would break a server that works today. Replace the ' +
+            'placeholder with an environment variable to put it behind the proxy.');
+    }
+    if (reason === 'unreadable-transport') {
+        return 'was left untouched: its transport could not be read';
+    }
+    return null;
+}
+function explainProblem(problem) {
+    if (problem === 'jsonc') {
+        return 'contains comments or trailing commas, which cannot be rewritten without dropping them — wrap its servers by hand, or remove the comments';
+    }
+    if (problem === 'unparseable')
+        return 'is not valid JSON; left untouched';
+    if (problem === 'not-an-object')
+        return 'is valid JSON but not an object; left untouched';
+    return 'could not be read; left untouched';
+}
+//# sourceMappingURL=sync.js.map

package/dist/commands/mcp/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../src/commands/mcp/sync.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,cAAc,GAEf,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AA+BrC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAc5B,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,OAAuB,EACvB,OAA6B,MAAM;IAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAEhD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAkC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,cAAc,IAAI,qBAAqB,OAAO,CAAC,MAAM,aAAa,mBAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CACnI,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ;QACzB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IAEF,IAAI,IAAc,CAAC;IACnB,IAAI,MAAmB,CAAC;IACxB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,GAAG,MAAM;YACT,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,OAAO,CAAC,IAAgB,CAAC;QAChC,MAAM,GAAG,OAAO,CAAC,MAAqB,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAElE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AACzF,CAAC;AAED,SAAS,OAAO,CACd,OAAuB,EACvB,OAAuB,EACvB,MAA6B,EAC7B,MAA6B;IAE7B,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CACV,gEAAgE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAC5F,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU;QAC/B,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,CACV,gCAAgC,MAAM,CAAC,IAAI,kGAAkG,CAC9I,CAAC;QACF,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,GAAG,CAAC,EAAE,CACJ,OAAO,CAAC,UAAU;YAChB,CAAC,CAAC,kCAAkC,MAAM,CAAC,IAAI,EAAE;YACjD,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,mBAAmB;gBACtC,CAAC,CAAC,gCAAgC,MAAM,CAAC,IAAI,EAAE;gBAC/C,CAAC,CAAC,8BAA8B,MAAM,CAAC,IAAI,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,OAAuB,EACvB,OAAuB,EACvB,MAA6B,EAC7B,MAA6B;IAE7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,MAAmB,EAAE,MAAe;IACvE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5E,OAAO;QACL,OAAO,EAAE,OAAO;aACb,MAAM,CAAC,CAAC,MAAM,EAAsD,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC;aAC9F,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM;YACpC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;SACxB,CAAC,CAAC;QACL,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,MAAM,EAAwD,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;aAClG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,MAAM,EAAwD,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;aAClG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YACtB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,KAAK,EAAE,MAAM,CAAC,OAAO;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,MAAkB,EAAE,MAA6B;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,8BAA8B,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,kBAAkB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxL,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,6BAA6B,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,mBAAmB,KAAK,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjM,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC;IACjG,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,mBAAmB,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,8EAA8E,CACnN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CACnB,MAAkB,EAClB,IAA0B,EAC1B,MAA6B;IAE7B,KAAK,MAAM,CAAC;IACZ,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,iCAAiC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,UAAU,IAAI,kCAAkC,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,OAAO,CACL,0EAA0E;YAC1E,oEAAoE;YACpE,iEAAiE;YACjE,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;QACtC,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,0IAA0I,CAAC;IACpJ,CAAC;IACD,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,mCAAmC,CAAC;IAC1E,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,iDAAiD,CAAC;IAC1F,OAAO,mCAAmC,CAAC;AAC7C,CAAC"}

package/dist/config.js

@@ -48,5 +48,11 @@ export const HOOK_DEFAULTS = {
     // the files it changed (cybe_scan_diff) before the user commits. Opt-out at
     // install. Rides on session-review, so it only fires when that hook is on.
     enableDiffScan: true,
+    // BACK-174 — `auto` keeps git-origin auto-discovery (VibeDefend lights up on
+    // every repo of the machine that is a CybeDefend project). `opt-in` limits
+    // the hooks to repos that carry `.cybedefend/config.json` (or
+    // CYBEDEFEND_PROJECT_ID). Default stays `auto` so existing installs keep
+    // their behaviour; the installer asks.
+    activation: 'auto',
 };
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAwCA,MAAM,CAAC,MAAM,OAAO,GAA4B;IAC9C;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,kFAAkF;QACpF,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,2BAA2B;KAC1C;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,0EAA0E;QAC5E,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,2BAA2B;KAC1C;CACO,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,KAAK;IACtB,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;IAChB,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,cAAc,EAAE,IAAI;CACZ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA0CA,MAAM,CAAC,MAAM,OAAO,GAA4B;IAC9C;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,kFAAkF;QACpF,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,2BAA2B;KAC1C;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,0EAA0E;QAC5E,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,2BAA2B;KAC1C;CACO,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,KAAK;IACtB,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;IAChB,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,cAAc,EAAE,IAAI;IACpB,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,yEAAyE;IACzE,uCAAuC;IACvC,UAAU,EAAE,MAAwB;CAC5B,CAAC"}

package/dist/diagnostics.js

@@ -10,7 +10,30 @@ import { join } from 'node:path';
 import { ALL_ADAPTERS } from './clients/registry.js';
 import { pkg } from './version.js';
 import { pingGateway } from './hooks/runtime/api.js';
-import { resolveProjectId, resolveToken } from './hooks/runtime/resolve.js';
+import { resolveActivationMode, resolveProjectId, } from './hooks/runtime/resolve.js';
+import { readUnmappedTools, } from './hooks/runtime/unmapped-tools.js';
+import { getOrgPolicy } from './mcp/verify/api.js';
+import { resolveVerifyToken, TOKEN_ENV_VARS } from './mcp/verify/token.js';
+/**
+ * The token `status` / `doctor` report on: `CYBEDEFEND_TOKEN` /
+ * `VIBEDEFEND_TOKEN`, then the bundle `vibedefend login` wrote. The SAME two
+ * places the proxy and `mcp scan` read (`resolveVerifyToken`), so what these
+ * commands print is what those will experience — and nothing else: the
+ * agent's own keychain (Claude Code / Codex MCP OAuth) is not ours to probe,
+ * the proxy refuses it by design, and a `status` that answered
+ * "authenticated" on its strength would contradict the very next `mcp scan`.
+ * The hooks alone keep that fallback (BACK-124), through their own resolver.
+ */
+export function lookupStoreToken(mcpName, deps = {}) {
+    const env = deps.env ?? process.env;
+    for (const name of TOKEN_ENV_VARS) {
+        const value = env[name];
+        if (value && value.trim() !== '')
+            return { token: value.trim(), source: 'environment' };
+    }
+    const token = resolveVerifyToken(mcpName, { ...deps, env: {} });
+    return { token, source: token ? 'vibedefend store' : null };
+}
 /** `~/.cybedefend`, overridable via CYBEDEFEND_HOME for tests. */
 function cybeHome() {
     return join(process.env.CYBEDEFEND_HOME ?? homedir(), '.cybedefend');
@@ -36,16 +59,28 @@ function readTextSafe(path) {
         return null;
     }
 }
-export async function gatherInstallState(opts = {}) {
+export async function gatherInstallState(opts = {}, deps = {}) {
+    const adapters = deps.adapters ?? ALL_ADAPTERS;
+    const resolveTokenImpl = deps.resolveTokenFn ?? lookupStoreToken;
+    const pingImpl = deps.pingFn ?? pingGateway;
+    const policyImpl = deps.policyFn ?? getOrgPolicy;
     const dir = cybeHome();
     const runtimeConfig = readJsonSafe(join(dir, 'runtime-config.json'));
     const region = runtimeConfig?.region ?? null;
+    const organization = organizationOf(runtimeConfig);
     const runnerSource = typeof runtimeConfig?.runnerSource === 'string'
         ? runtimeConfig.runnerSource
         : null;
     const runnerSourceValid = runnerSource === null || existsSync(runnerSource);
+    const runnerPresent = existsSync(join(dir, 'hook-runner.js'));
+    const re2WasmPresent = runnerSource !== null || !runnerPresent || existsSync(join(dir, 're2.wasm'));
     const versionStamped = readTextSafe(join(dir, 'version'));
-    const clients = ALL_ADAPTERS.map((a) => {
+    const activation = runtimeConfig ? resolveActivationMode(runtimeConfig) : null;
+    // Read from where the HOOK writes (its own dir convention), not from this
+    // CLI-side dir — otherwise an override in one env var and not the other
+    // would make `status` report an empty list while the file fills up.
+    const unmappedTools = readUnmappedTools();
+    const clients = adapters.map((a) => {
         const detected = (() => {
             try {
                 return a.detect().installed;
@@ -83,17 +118,20 @@ export async function gatherInstallState(opts = {}) {
     catch {
         projectId = null;
     }
-    let live = null;
-    if (opts.live) {
-        let token = null;
+    // Looked up whenever there is a region, live check or not: the source is
+    // part of the report, and a lookup is a file read.
+    let lookup = { token: null, source: null };
+    if (region) {
         try {
-            token = region
-                ? resolveToken(region.mcpName, { mcpUrl: region.mcpUrl })
-                : null;
+            lookup = await resolveTokenImpl(region.mcpName);
         }
         catch {
-            token = null;
+            lookup = { token: null, source: null };
         }
+    }
+    const token = lookup.token;
+    let live = null;
+    if (opts.live) {
         if (!region) {
             live = { status: 'skipped', reason: 'not installed' };
         }
@@ -105,7 +143,7 @@ export async function gatherInstallState(opts = {}) {
         }
         else {
             try {
-                live = await pingGateway({
+                live = await pingImpl({
                     apiBase: region.apiBase,
                     projectId,
                     token,
@@ -116,16 +154,44 @@ export async function gatherInstallState(opts = {}) {
             }
         }
     }
+    // The policy is displayed, never applied from here: the verifier learns
+    // it from every response. Read only when there is something to read it
+    // with, and said to be unavailable when the read fails.
+    let policy = null;
+    if (opts.live && region && organization && token) {
+        try {
+            policy = await policyImpl({ apiBase: region.apiBase, token, mcpName: region.mcpName, organizationId: organization.id });
+        }
+        catch {
+            policy = 'unavailable';
+        }
+    }
     return {
         installed: runtimeConfig !== null,
         region,
-        runnerPresent: existsSync(join(dir, 'hook-runner.js')),
+        organization,
+        policy,
+        runnerPresent,
         runnerSourceValid,
         versionStamped,
         versionCurrent: pkg.version,
         clients,
         projectId,
+        tokenSource: token ? lookup.source : null,
         live,
+        activation,
+        unmappedTools,
+        re2WasmPresent,
     };
 }
+/** The selected organization of a runtime config, or `null` for none or a malformed entry. */
+function organizationOf(runtimeConfig) {
+    const raw = runtimeConfig?.organization;
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const { id, name } = raw;
+    if (typeof id !== 'string' || id === '')
+        return null;
+    return { id, name: typeof name === 'string' ? name : '' };
+}
 //# sourceMappingURL=diagnostics.js.map

package/dist/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAkC5E,kEAAkE;AAClE,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAI,aAAa,EAAE,MAAmC,IAAI,IAAI,CAAC;IAE3E,MAAM,YAAY,GAChB,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ;QAC7C,CAAC,CAAC,aAAa,CAAC,YAAY;QAC5B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,iBAAiB,GAAG,YAAY,KAAK,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAE5E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAE1D,MAAM,OAAO,GAAmB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM;YAChB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,IAAI,CAAC;oBACH,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,CAAC;QACX,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM;gBACZ,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACjF,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,aAAa,KAAK,IAAI;QACjC,MAAM;QACN,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtD,iBAAiB;QACjB,cAAc;QACd,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,OAAO;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,GAElB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AA0BjG;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAwB,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAwCD,kEAAkE;AAClE,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAoCD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAAE,EAC7B,OAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IACjD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAI,aAAa,EAAE,MAAmC,IAAI,IAAI,CAAC;IAC3E,MAAM,YAAY,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,YAAY,GAChB,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ;QAC7C,CAAC,CAAC,aAAa,CAAC,YAAY;QAC5B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,iBAAiB,GAAG,YAAY,KAAK,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC9D,MAAM,cAAc,GAClB,YAAY,KAAK,IAAI,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IAE/E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAmB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM;YAChB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,IAAI,CAAC;oBACH,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,CAAC;QACX,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,mDAAmD;IACnD,IAAI,MAAM,GAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAE3B,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACjF,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC;oBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,wDAAwD;IACxD,IAAI,MAAM,GAA2B,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,aAAa,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,aAAa,KAAK,IAAI;QACjC,MAAM;QACN,YAAY;QACZ,MAAM;QACN,aAAa;QACb,iBAAiB;QACjB,cAAc;QACd,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,OAAO;QACP,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,IAAI;QACJ,UAAU;QACV,aAAa;QACb,cAAc;KACf,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,aAA6C;IACnE,MAAM,GAAG,GAAG,aAAa,EAAE,YAAY,CAAC;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,GAAuC,CAAC;IAC7D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5D,CAAC"}

package/dist/doctor.js

@@ -45,6 +45,9 @@ export function resolveHookConfigFrom(hooks) {
         ...hooks,
         enableDiffScan: hooks.enableDiffScan ?? HOOK_DEFAULTS.enableDiffScan,
         nonBlockingMode: hooks.nonBlockingMode ?? HOOK_DEFAULTS.nonBlockingMode,
+        // BACK-174 — same backfill for the activation mode; an explicit `opt-in`
+        // survives a repair.
+        activation: hooks.activation ?? HOOK_DEFAULTS.activation,
     };
 }
 /** A built-in region's label + URL for its MCP URL, else the URL alone. */
@@ -89,6 +92,22 @@ export function deriveRepairs(state) {
             },
         });
     }
+    if (state.runnerPresent && !state.re2WasmPresent) {
+        // BACK-174 — a full-copy runner whose `re2.wasm` is gone runs every rule
+        // on native RegExp and says so on each hook. Re-rendering the runtime
+        // copies the wasm back next to it.
+        repairs.push({
+            id: 'runner-wasm-missing',
+            description: 'RE2 engine binary ~/.cybedefend/re2.wasm is missing — rules run on native RegExp; re-render the runner.',
+            fix: () => {
+                installHookRuntime({
+                    region,
+                    hooks: resolveHookConfig(),
+                    installedVersion: pkg.version,
+                });
+            },
+        });
+    }
     for (const c of state.clients) {
         if (c.detected && !c.hooksWired) {
             repairs.push({

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AASnC;;;;;;;;GAQG;AACH,SAAS,iBAAiB;IACxB,OAAO,qBAAqB,CAAC,iBAAiB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyC;IAEzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACxC,OAAO;QACL,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc;QACpE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,aAAa,CAAC,eAAe;KACxE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,eAAe;YACnB,WAAW,EAAE,yDAAyD;SACvE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,gBAAgB;YACpB,WAAW,EACT,qEAAqE;YACvE,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,0EAA0E;YAC5E,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE;gBACnB,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,2DAA2D;gBAClF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;oBAClC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;wBAC7B,OAAO,EAAE,EAAE;wBACX,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;wBAC9C,MAAM;wBACN,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACnC,uEAAuE;YACvE,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE;gBACjB,WAAW,EACT,CAAC,CAAC,MAAM,KAAK,IAAI;oBACf,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,2CAA2C,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,KAAK,iBAAiB;oBACtH,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,mEAAmE;gBACnF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACjC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrC,CAAC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,+CAA+C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,WAAW;YAC3C,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,OAAO;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,GAAI,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,EAAE,MACpB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AASnC;;;;;;;;GAQG;AACH,SAAS,iBAAiB;IACxB,OAAO,qBAAqB,CAAC,iBAAiB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyC;IAEzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACxC,OAAO;QACL,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc;QACpE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,aAAa,CAAC,eAAe;QACvE,yEAAyE;QACzE,qBAAqB;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;KACzD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,eAAe;YACnB,WAAW,EAAE,yDAAyD;SACvE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,gBAAgB;YACpB,WAAW,EACT,qEAAqE;YACvE,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,0EAA0E;YAC5E,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACjD,yEAAyE;QACzE,sEAAsE;QACtE,mCAAmC;QACnC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,yGAAyG;YAC3G,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE;gBACnB,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,2DAA2D;gBAClF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;oBAClC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;wBAC7B,OAAO,EAAE,EAAE;wBACX,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;wBAC9C,MAAM;wBACN,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACnC,uEAAuE;YACvE,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE;gBACjB,WAAW,EACT,CAAC,CAAC,MAAM,KAAK,IAAI;oBACf,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,2CAA2C,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,KAAK,iBAAiB;oBACtH,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,mEAAmE;gBACnF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACjC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrC,CAAC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,+CAA+C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,WAAW;YAC3C,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,OAAO;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,GAAI,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,EAAE,MACpB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACxD,CAAC"}

package/dist/guards-evaluator/analysis-types.js

@@ -0,0 +1,27 @@
+/**
+ * Shared analysis contract for the Action Guards hardening work (Level 0–2).
+ *
+ * The current evaluator matches regexes against the RAW command string, which
+ * is blind to trivial rewrites (`/bin/rm`, `--recursive --force`, `.e""nv`,
+ * `bash -c "<here>"`, `$( … )`). This module defines the shape that lets a
+ * de-obfuscation pass and a triage pass be built and tested independently of
+ * the evaluator:
+ *
+ *   normalizeCommand(raw)  ->  NormalizeResult   (normalize.ts)
+ *   triageCommand(result)  ->  TriageVerdict     (triage.ts)
+ *
+ * Nothing here is consumed by `evaluate()` directly; the PreToolUse hook
+ * (guard-check.ts) wires these in. Keeping the contract in one small, stable
+ * file means `normalize.ts`, `triage.ts` and `judge-triage.ts` never have to
+ * import each other's implementation to agree on a shape.
+ *
+ * Design rules every consumer relies on:
+ *   - PURE: no I/O, no network, no clock. Disk resolution lives elsewhere
+ *     (target-resolve.ts / script-resolve.ts).
+ *   - NEVER THROWS: a parse failure sets `incomplete: true` and returns what
+ *     was recovered. Blindness must fail toward "look closer", never toward a
+ *     silent allow.
+ *   - ALLOCATION-LIGHT: runs on every Bash tool call on the hot path.
+ */
+export {};
+//# sourceMappingURL=analysis-types.js.map

package/dist/guards-evaluator/analysis-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-types.js","sourceRoot":"","sources":["../../src/guards-evaluator/analysis-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}