@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/commands/mcp/scan.js

@@ -0,0 +1,349 @@
+/**
+ * `vibedefend scan` — talk to every upstream once, with no agent in the loop.
+ *
+ * `initialize` plus `tools/list` against each server in `upstreams.json`, and
+ * a line per server. It is the command you run when something is wrong and
+ * you want to know which server it is, and it is what a CI job runs to find
+ * out whether the park changed under it.
+ *
+ * It is also the AUDIT. An agent session buys a judgement only for the tool
+ * it calls; `scan` buys one for every tool of every reachable server
+ * (`Verifier.judgeAll`), because the user who typed it asked exactly that
+ * question. The `verdict` column is the worst verdict on the server, the
+ * flagged tools are listed under it, and a `malicious` server exits
+ * non-zero. Without a credential the column reads `unverified`, which is
+ * honest: nobody could be asked. `VIBEDEFEND_MCP_NO_VERIFY=1` skips it.
+ */
+import { spawn } from 'node:child_process';
+import { probeMcpHttp } from '../../mcp/auth/probe.js';
+import { ensureMcpAccessToken } from '../../mcp/auth/store.js';
+import { createNullLogger } from '../../mcp/proxy/log.js';
+import { encodeMessage, LineFramer } from '../../mcp/proxy/jsonrpc.js';
+import { PROXY_ENV_PREFIX } from '../../mcp/proxy/paths.js';
+import { describeUpstream, upstreamEnvironment } from '../../mcp/proxy/spec.js';
+import { planSpawn } from '../../mcp/proxy/windowsCommand.js';
+import { expandedSpecOf, readUpstreams, specOf } from '../../mcp/proxy/upstreams.js';
+import { resolveBackendConfig } from '../../mcp/verify/backend.js';
+import { createJsonVerifyCache } from '../../mcp/verify/cache.js';
+import { buildVerifier } from '../../mcp/verify/factory.js';
+import { runPool } from '../../mcp/verify/pool.js';
+import { log } from '../../utils.js';
+export const EXIT_OK = 0;
+export const EXIT_PROBLEM = 1;
+export const EXIT_USAGE = 2;
+const DEFAULT_TIMEOUT_MS = 20_000;
+/** A judge takes about a second per tool; a catalogue of a hundred is a coffee. */
+const DEFAULT_VERIFY_TIMEOUT_MS = 180_000;
+/**
+ * Servers judged side by side. Probing stays sequential — a stdio server is
+ * a process, and spawning the whole park at once is the wrong kind of
+ * fast — but a judgement is a network call that waits on a backend, and
+ * four of them waiting together cost the backend nothing it does not cap.
+ */
+const JUDGE_CONCURRENCY = 4;
+export async function runMcpScanCommand(options, runtime) {
+    const stdout = runtime.stdout ?? process.stdout;
+    const stderr = runtime.stderr ?? process.stderr;
+    const upstreams = readUpstreams(runtime.env);
+    let entries = Object.values(upstreams.servers);
+    if (options.name) {
+        const one = upstreams.servers[options.name];
+        if (!one) {
+            stderr.write(`vibedefend scan: no upstream named "${options.name}". Known: ${Object.keys(upstreams.servers).join(', ') || '(none)'}.\n`);
+            return EXIT_USAGE;
+        }
+        entries = [one];
+    }
+    if (entries.length === 0) {
+        if (options.json)
+            stdout.write(`${JSON.stringify({ servers: [] }, null, 2)}\n`);
+        else
+            log.info('No MCP server is registered. Run `vibedefend sync` after configuring one.');
+        return EXIT_OK;
+    }
+    const prepared = await prepareRuntime(runtime, stderr);
+    // Two phases. Reach every server, one at a time; then judge the ones that
+    // answered, a few at a time. The rows stay in the order of the entries
+    // whatever finishes first.
+    const probed = [];
+    for (const entry of entries) {
+        probed.push(await probeOne(entry, options, prepared));
+    }
+    const judge = prepared.judge ?? judgeWithBackend;
+    await runPool(probed.filter((server) => server.tools !== undefined), JUDGE_CONCURRENCY, async (server) => {
+        const started = Date.now();
+        const judged = await judge(server.spec, server.tools ?? [], options, prepared, server.row.name);
+        Object.assign(server.row, judged);
+        server.row.ms += elapsed(started);
+    });
+    const rows = probed.map((server) => server.row);
+    if (options.json) {
+        stdout.write(`${JSON.stringify({ servers: rows }, null, 2)}\n`);
+    }
+    else {
+        writeTable(rows);
+    }
+    // A server that wants a login is not a failure of the scan: it is
+    // information, and `vibedefend connect` is the answer. A malicious server
+    // is, and so is one that could not be reached.
+    return rows.some((row) => row.status === 'unreachable' ||
+        row.status === 'unusable' ||
+        row.verdict === 'malicious' ||
+        row.override === 'deny')
+        ? EXIT_PROBLEM
+        : EXIT_OK;
+}
+/**
+ * Resolves what every judgement of this scan shares — backend, cache — once.
+ *
+ * Only when the real judge will run: an injected judge never touches them,
+ * and `VIBEDEFEND_MCP_NO_VERIFY=1` means nobody is asked at all.
+ */
+async function prepareRuntime(runtime, stderr) {
+    if (runtime.judge || runtime.env[`${PROXY_ENV_PREFIX}NO_VERIFY`] === '1')
+        return runtime;
+    const backend = runtime.backend !== undefined
+        ? runtime.backend
+        : await (runtime.resolveBackendConfigFn ?? resolveBackendConfig)({
+            env: runtime.env,
+            // Typed by a human: the reason nothing is verified goes to them.
+            warn: (message) => stderr.write(`vibedefend scan: ${message}\n`),
+        });
+    return {
+        ...runtime,
+        backend,
+        cache: runtime.cache ?? createJsonVerifyCache({ env: runtime.env }),
+    };
+}
+async function probeOne(entry, options, runtime) {
+    const started = Date.now();
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const base = { name: entry.name, transport: entry.transport, verdict: 'unverified' };
+    // TWO specs, as in the proxy (`runMcpProxyCommand`). The expanded one is
+    // what the server is REACHED with — a `${VAR}` in a url, a header or an
+    // argument must resolve here too, or `scan` reports a server the proxy
+    // would reach as unreachable. The stored one is what the verdict is FILED
+    // under: `upstreamServerId` hashes `command` + `args` (or the url), and
+    // that hash keys the cache and the user's `allow`/`deny`, which the proxy
+    // and `vibedefend allow` compute from the stored entry. Judging under the
+    // expanded spec would open a second cache file per server (with the
+    // resolved value in its name), bill every tool twice, and hide the
+    // override from `scan`.
+    const identitySpec = specOf(entry);
+    const failed = (status) => ({
+        row: { ...base, status, ms: elapsed(started) },
+        spec: identitySpec,
+    });
+    try {
+        if (entry.transport === 'http') {
+            const spec = expandedSpecOf(entry, runtime.env).value;
+            if (spec.transport !== 'http')
+                return failed('unusable');
+            const common = {
+                timeoutMs,
+                headers: spec.headers,
+                clientInfo: { name: 'vibedefend', version: runtime.version },
+            };
+            // Bare first. Most servers want no token, and asking the credential
+            // store for one costs a keychain round trip — and, on a locked macOS
+            // keychain, a dialog — for a lookup that was never going to find
+            // anything.
+            let probe = await probeMcpHttp(spec.url, { ...common, token: null });
+            if (probe.verdict === 'refused') {
+                // Renewed if it expired, and persisted: a token that ran out in the
+                // last hour used to send the user to `vibedefend connect --all` with
+                // the refresh token that would have fixed it sitting in the store
+                // (2026-09-16, three servers at once). A dead refresh token is erased
+                // on the way, and the row honestly reads `needs-auth`.
+                const token = await ensureMcpAccessToken(spec.url, { env: runtime.env });
+                if (token)
+                    probe = await probeMcpHttp(spec.url, { ...common, token });
+            }
+            if (probe.verdict === 'open') {
+                return {
+                    row: { ...base, status: 'ok', toolCount: probe.toolCount, ms: elapsed(started) },
+                    spec: identitySpec,
+                    tools: probe.tools ?? [],
+                };
+            }
+            if (probe.verdict === 'refused')
+                return failed('needs-auth');
+            if (probe.verdict === 'unreachable')
+                return failed('unreachable');
+            return failed('unusable');
+        }
+        const tools = await listStdioTools(entry, timeoutMs, runtime.env);
+        if (tools === null)
+            return failed('unreachable');
+        return {
+            row: { ...base, status: 'ok', toolCount: tools.length, ms: elapsed(started) },
+            spec: identitySpec,
+            tools,
+        };
+    }
+    catch {
+        return failed('unreachable');
+    }
+}
+function elapsed(started) {
+    return Date.now() - started;
+}
+/**
+ * Buys the judgement of every tool listed, and reads the verdicts back.
+ *
+ * Wired exactly like the proxy (`buildVerifier`): same cache, same identity,
+ * same name on the finding and same credential path, so what `scan` buys is
+ * what the next agent session finds, and vice versa. Without a credential
+ * nothing is asked and the row says `unverified`.
+ */
+export const judgeWithBackend = async (spec, listed, options, runtime, name) => {
+    if (runtime.env[`${PROXY_ENV_PREFIX}NO_VERIFY`] === '1')
+        return { verdict: 'unverified' };
+    const tools = listed.filter((tool) => typeof tool === 'object' && tool !== null && typeof tool.name === 'string');
+    // Resolved once by `runMcpScanCommand`; a direct caller gets it here.
+    const backend = runtime.backend !== undefined
+        ? runtime.backend
+        : await (runtime.resolveBackendConfigFn ?? resolveBackendConfig)({ env: runtime.env });
+    if (!backend)
+        return { verdict: 'unverified' };
+    const { verifier } = buildVerifier(spec, name ?? describeUpstream(spec), createNullLogger(), runtime.env, {
+        backend,
+        cache: runtime.cache,
+    });
+    try {
+        const outcome = await verifier.judgeAll(tools, {
+            timeoutMs: options.verifyTimeoutMs ?? DEFAULT_VERIFY_TIMEOUT_MS,
+        });
+        return rowFromOutcome(outcome);
+    }
+    catch {
+        return { verdict: 'unverified' };
+    }
+};
+/**
+ * The row, from the outcome — and from the DECISION, not the verdict alone.
+ *
+ * The flagged tools come from `outcome.tools`, which is scoped to the tools
+ * listed now; the cache file is never pruned and walking it would show a
+ * tool the server dropped last month. The user's override is read off the
+ * decision's rationale, the one place `vibedefend allow` / `deny` surfaces.
+ */
+export function rowFromOutcome(outcome) {
+    const flagged = [];
+    for (const tool of outcome.tools ?? []) {
+        if (tool.verdict === 'malicious' || tool.verdict === 'suspicious') {
+            flagged.push({ name: tool.name, verdict: tool.verdict, ...(tool.reason ? { reason: tool.reason } : {}) });
+        }
+    }
+    const judged = outcome.verdict === 'malicious' || outcome.verdict === 'suspicious' || outcome.verdict === 'ok'
+        ? outcome.verdict
+        : 'unverified';
+    const override = outcome.decision.rationale === 'allowed-by-user'
+        ? 'allow'
+        : outcome.decision.rationale === 'denied-by-user'
+            ? 'deny'
+            : undefined;
+    return {
+        verdict: override === 'allow' ? 'ok' : judged,
+        ...(flagged.length > 0 ? { flagged } : {}),
+        ...(override ? { override } : {}),
+    };
+}
+/**
+ * Spawns a stdio server, does the handshake, counts its tools and stops it.
+ *
+ * The proxy's own transport is not reused here: it exists to forward, and
+ * what this needs is a two-message conversation with a hard deadline and no
+ * session to keep. `null` means the server never got that far.
+ */
+async function listStdioTools(entry, timeoutMs, env) {
+    const spec = expandedSpecOf(entry, env).value;
+    if (spec.transport !== 'stdio')
+        return null;
+    void createNullLogger();
+    const plan = planSpawn(spec.command, spec.args, process.platform, env);
+    const child = spawn(plan.command, plan.args, {
+        env: upstreamEnvironment(env, spec.env),
+        cwd: spec.cwd,
+        stdio: ['pipe', 'pipe', 'ignore'],
+        windowsVerbatimArguments: plan.windowsVerbatimArguments,
+        shell: false,
+    });
+    return new Promise((resolve) => {
+        const framer = new LineFramer();
+        let settled = false;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                child.stdin.end();
+                child.kill();
+            }
+            catch {
+                /* already gone */
+            }
+            resolve(value);
+        };
+        const timer = setTimeout(() => finish(null), timeoutMs);
+        if (typeof timer.unref === 'function')
+            timer.unref();
+        child.once('error', () => finish(null));
+        child.once('exit', () => finish(null));
+        child.stdout?.on('data', (chunk) => {
+            for (const message of framer.push(chunk).messages) {
+                const typed = message;
+                if (typed.id === 1) {
+                    child.stdin.write(encodeMessage({ jsonrpc: '2.0', method: 'notifications/initialized' }));
+                    child.stdin.write(encodeMessage({ jsonrpc: '2.0', id: 2, method: 'tools/list' }));
+                    continue;
+                }
+                if (typed.id === 2) {
+                    const result = typed.result;
+                    finish(Array.isArray(result?.tools) ? result.tools : []);
+                }
+            }
+        });
+        child.stdin.write(encodeMessage({
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2025-06-18',
+                capabilities: {},
+                clientInfo: { name: 'vibedefend-scan', version: '1.0.0' },
+            },
+        }));
+    });
+}
+function writeTable(rows) {
+    const width = Math.max(6, ...rows.map((row) => row.name.length));
+    log.step('MCP servers');
+    for (const row of rows) {
+        const name = row.name.padEnd(width);
+        const tools = row.toolCount === undefined ? '' : `${row.toolCount} tools`;
+        const verdict = row.status === 'ok' ? row.verdict : '';
+        const said = row.override === 'allow' ? '  [allowed by you]' : row.override === 'deny' ? '  [denied by you]' : '';
+        const line = `${name}  ${row.transport.padEnd(5)}  ${row.status.padEnd(11)}  ${tools.padEnd(9)}  ${verdict.padEnd(10)}  ${row.ms} ms${said}`;
+        if (row.verdict === 'malicious' || row.override === 'deny')
+            log.err(line);
+        else if (row.verdict === 'suspicious')
+            log.warn(line);
+        else if (row.status === 'ok')
+            log.ok(line);
+        else if (row.status === 'needs-auth')
+            log.warn(`${line}  → vibedefend connect ${row.name}`);
+        else
+            log.err(line);
+        for (const tool of row.flagged ?? []) {
+            const reason = tool.reason ? ` — ${tool.reason}` : '';
+            const detail = `    ${tool.verdict.padEnd(10)}  ${tool.name}${reason}`;
+            if (tool.verdict === 'malicious')
+                log.err(detail);
+            else
+                log.warn(detail);
+        }
+    }
+}
+//# sourceMappingURL=scan.js.map

package/dist/commands/mcp/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/commands/mcp/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,UAAU,EAAuB,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAqB,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAsB,MAAM,8BAA8B,CAAC;AACzG,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,2BAA2B,CAAC;AAEpF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEnD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AA4FrC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,mFAAmF;AACnF,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAC1C;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,OAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,KAAK,CACV,uCAAuC,OAAO,CAAC,IAAI,aAAa,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,CAC3H,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;;YAC3E,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvD,0EAA0E;IAC1E,uEAAuE;IACvE,2BAA2B;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,gBAAgB,CAAC;IACjD,MAAM,OAAO,CACX,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,EACrD,iBAAiB,EACjB,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,kEAAkE;IAClE,0EAA0E;IAC1E,+CAA+C;IAC/C,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,MAAM,KAAK,aAAa;QAC5B,GAAG,CAAC,MAAM,KAAK,UAAU;QACzB,GAAG,CAAC,OAAO,KAAK,WAAW;QAC3B,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1B;QACC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE,MAA6B;IAClF,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,WAAW,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IACzF,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC;YAC7D,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,iEAAiE;YACjE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC;SACjE,CAAC,CAAC;IACT,OAAO;QACL,GAAG,OAAO;QACV,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAWD,KAAK,UAAU,QAAQ,CACrB,KAAoB,EACpB,OAAuB,EACvB,OAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,YAAqB,EAAE,CAAC;IAE9F,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,mEAAmE;IACnE,wBAAwB;IACxB,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAU,EAAE,CAAC,CAAC;QAC9C,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;QAC9C,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YACtD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG;gBACb,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;aAC7D,CAAC;YAEF,oEAAoE;YACpE,qEAAqE;YACrE,iEAAiE;YACjE,YAAY;YACZ,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,oEAAoE;gBACpE,qEAAqE;gBACrE,kEAAkE;gBAClE,sEAAsE;gBACtE,uDAAuD;gBACvD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACzE,IAAI,KAAK;oBAAE,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7B,OAAO;oBACL,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAChF,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa;gBAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO;YACL,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7E,IAAI,EAAE,YAAY;YAClB,KAAK;SACN,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAY,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtF,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,WAAW,CAAC,KAAK,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CACzB,CAAC,IAAI,EAAsB,EAAE,CAC3B,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,CACrG,CAAC;IACF,sEAAsE;IACtE,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAE/C,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE;QACxG,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE;YAC7C,SAAS,EAAE,OAAO,CAAC,eAAe,IAAI,yBAAyB;SAChE,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACnC,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAA4B;IACzD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAC7F,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,YAAY,CAAC;IACnB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,iBAAiB;QAC9C,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,gBAAgB;YAC/C,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC7C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,KAAoB,EACpB,SAAiB,EACjB,GAAsB;IAEtB,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,gBAAgB,EAAE,CAAC;IAExB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;QAC3C,GAAG,EAAE,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACjC,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;QACvD,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAuB,EAAQ,EAAE;YAC/C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAErD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,OAAyB,CAAC;gBACxC,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACnB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBAC1F,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;oBAClF,SAAS;gBACX,CAAC;gBACD,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAA2C,CAAC;oBACjE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,aAAa,CAAC;YACZ,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE;gBACN,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE;aAC1D;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAe;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,SAAS,QAAQ,CAAC;QAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,MAAM,IAAI,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;QAC7I,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACrE,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACjD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;aACtC,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,0BAA0B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;;YACvF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YACvE,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;;gBAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/mcp/sync.js

@@ -0,0 +1,215 @@
+import { isMcpClientId, MCP_CLIENT_ADAPTERS } from '../../mcp/config/clients.js';
+import { installSyncHook, removeSyncHook } from '../../mcp/config/hook.js';
+import { installProxy, installRefusalMessage, installRefusalSentence, uninstallProxy, } from '../../mcp/config/install.js';
+import { log } from '../../utils.js';
+export const EXIT_OK = 0;
+export const EXIT_PROBLEM = 1;
+export const EXIT_USAGE = 2;
+export async function runMcpSyncCommand(options, runtime, mode = 'sync') {
+    const stdout = runtime.stdout ?? process.stdout;
+    const stderr = runtime.stderr ?? process.stderr;
+    if (options.hook !== undefined) {
+        return runHook(options, runtime, stdout, stderr);
+    }
+    let clients;
+    if (options.client) {
+        if (!isMcpClientId(options.client)) {
+            stderr.write(`vibedefend ${mode}: unknown client "${options.client}". Known: ${MCP_CLIENT_ADAPTERS.map((adapter) => adapter.id).join(', ')}.\n`);
+            return EXIT_USAGE;
+        }
+        clients = [options.client];
+    }
+    // The original entry is recorded in `upstreams.json`, which is what
+    // `uninstall` restores from; the backup is for the user, not for us.
+    const shared = {
+        env: runtime.env,
+        clients,
+        dryRun: options.dryRun,
+        backup: !options.noBackup,
+        now: runtime.now,
+        platform: runtime.platform,
+    };
+    let plan;
+    let result;
+    if (mode === 'uninstall') {
+        ({ plan, result } = uninstallProxy(shared));
+    }
+    else {
+        const outcome = installProxy({
+            ...shared,
+            argv1: runtime.argv1 ?? process.argv[1],
+            execFileFn: runtime.execFileFn,
+        });
+        if (outcome.refused) {
+            writeRefusal(outcome.refused, options, stdout, stderr);
+            return EXIT_PROBLEM;
+        }
+        plan = outcome.plan;
+        result = outcome.result;
+    }
+    const report = buildReport(plan, result, options.dryRun === true);
+    if (options.json) {
+        stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    }
+    else if (options.quiet) {
+        writeQuiet(report, stdout);
+    }
+    else {
+        writeVerbose(report, mode, stdout);
+    }
+    return report.problems.length > 0 || report.failed.length > 0 ? EXIT_PROBLEM : EXIT_OK;
+}
+function runHook(options, runtime, stdout, stderr) {
+    if (options.hook !== 'claude-code') {
+        stderr.write(`vibedefend sync: --hook only knows claude-code for now (got "${String(options.hook)}").\n`);
+        return EXIT_USAGE;
+    }
+    const result = options.removeHook
+        ? removeSyncHook({ env: runtime.env })
+        : installSyncHook({ env: runtime.env });
+    if (result.outcome === 'unreadable') {
+        stderr.write(`vibedefend sync: cannot read ${result.file}. It may contain comments, which cannot be edited without dropping them; add the hook by hand.\n`);
+        return EXIT_PROBLEM;
+    }
+    if (options.json) {
+        stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    }
+    else if (!options.quiet) {
+        log.ok(options.removeHook
+            ? `SessionStart hook removed from ${result.file}`
+            : result.outcome === 'already-installed'
+                ? `SessionStart hook already in ${result.file}`
+                : `SessionStart hook added to ${result.file}`);
+    }
+    return EXIT_OK;
+}
+/**
+ * Sync did nothing, and says why in the mode's own voice: a JSON block for a
+ * program, one sentence on stdout for the hook (it lands in the agent's
+ * context, and the user has to hear about it from somewhere), the full
+ * explanation on stderr for a human.
+ */
+function writeRefusal(refusal, options, stdout, stderr) {
+    if (options.json) {
+        stdout.write(`${JSON.stringify({ refused: refusal }, null, 2)}\n`);
+        return;
+    }
+    if (options.quiet) {
+        stdout.write(`${installRefusalSentence(refusal)}\n`);
+        return;
+    }
+    stderr.write(`${installRefusalMessage(refusal)}\n`);
+}
+function buildReport(plan, result, dryRun) {
+    const failedChanges = new Set(result.failed.map((failure) => failure.change));
+    const applied = plan.changes.filter((change) => !failedChanges.has(change));
+    return {
+        wrapped: applied
+            .filter((change) => change.kind === 'wrap')
+            .map((change) => ({
+            name: change.upstreamName,
+            client: change.entry.location.client,
+            from: change.entry.kind,
+        })),
+        unwrapped: applied
+            .filter((change) => change.kind === 'unwrap')
+            .map((change) => ({ name: change.upstreamName, client: change.location.client })),
+        forgotten: applied
+            .filter((change) => change.kind === 'forget')
+            .map((change) => change.upstreamName),
+        skipped: plan.skipped.map((entry) => ({
+            name: entry.entry.name,
+            client: entry.entry.location.client,
+            reason: entry.reason,
+        })),
+        problems: plan.problems.map((problem) => ({
+            file: problem.location.file,
+            problem: problem.problem,
+        })),
+        failed: result.failed.map((failure) => ({ reason: failure.reason })),
+        files: result.written,
+        backups: result.backups,
+        dryRun,
+    };
+}
+/**
+ * The hook's output, which lands in the agent's context.
+ *
+ * Silence when nothing happened. One sentence when something did — naming the
+ * servers, because "1 server was wrapped" tells the agent nothing it can act
+ * on.
+ */
+function writeQuiet(report, stdout) {
+    const lines = [];
+    if (report.wrapped.length > 0) {
+        lines.push(`VibeDefend is now proxying ${report.wrapped.length === 1 ? 'a new MCP server' : `${report.wrapped.length} new MCP servers`}: ${report.wrapped.map((entry) => entry.name).join(', ')}.`);
+    }
+    if (report.problems.length > 0) {
+        lines.push(`VibeDefend could not read ${report.problems.length === 1 ? 'an MCP config file' : `${report.problems.length} MCP config files`}: ${report.problems.map((problem) => problem.file).join(', ')}.`);
+    }
+    // Loud even in quiet mode: this one is not "nothing happened", it is a
+    // server deliberately left alone, and the user has to know which.
+    const interactive = report.skipped.filter((entry) => entry.reason === 'needs-interactive-input');
+    if (interactive.length > 0) {
+        lines.push(`VibeDefend left ${interactive.map((entry) => entry.name).join(', ')} untouched: ${interactive.length === 1 ? 'it uses' : 'they use'} a \${input:…} placeholder, which only the client can resolve by asking you.`);
+    }
+    if (lines.length > 0)
+        stdout.write(`${lines.join(' ')}\n`);
+}
+function writeVerbose(report, mode, stdout) {
+    void stdout;
+    const prefix = report.dryRun ? '[dry-run] ' : '';
+    for (const entry of report.wrapped) {
+        log.ok(`${prefix}${entry.client}: ${entry.name} is now behind the proxy`);
+    }
+    for (const entry of report.unwrapped) {
+        log.ok(`${prefix}${entry.client}: ${entry.name} restored to its original entry`);
+    }
+    for (const name of report.forgotten) {
+        log.info(`${prefix}forgot ${name}, which no client lists any more`);
+    }
+    for (const entry of report.skipped) {
+        const explanation = explainSkip(entry.reason);
+        if (explanation)
+            log.warn(`${entry.client}: ${entry.name} ${explanation}`);
+    }
+    for (const problem of report.problems) {
+        log.warn(`${problem.file}: ${explainProblem(problem.problem)}`);
+    }
+    for (const failure of report.failed) {
+        log.err(failure.reason);
+    }
+    if (report.wrapped.length === 0 && report.unwrapped.length === 0 && report.forgotten.length === 0) {
+        log.info(mode === 'uninstall' ? 'Nothing was behind the proxy.' : 'Everything is already in order.');
+    }
+    if (report.backups.length > 0) {
+        log.hint(`Backups: ${report.backups.join(', ')}`);
+    }
+}
+/**
+ * Why an entry was left alone, when that is worth a line. `null` for the
+ * reasons that are business as usual — an already-wrapped server is not news.
+ */
+function explainSkip(reason) {
+    if (reason === 'needs-interactive-input') {
+        return ('was left untouched: it references a ${input:…} placeholder, whose value ' +
+            'the client obtains by asking you. The proxy has no way to ask, so ' +
+            'wrapping it would break a server that works today. Replace the ' +
+            'placeholder with an environment variable to put it behind the proxy.');
+    }
+    if (reason === 'unreadable-transport') {
+        return 'was left untouched: its transport could not be read';
+    }
+    return null;
+}
+function explainProblem(problem) {
+    if (problem === 'jsonc') {
+        return 'contains comments or trailing commas, which cannot be rewritten without dropping them — wrap its servers by hand, or remove the comments';
+    }
+    if (problem === 'unparseable')
+        return 'is not valid JSON; left untouched';
+    if (problem === 'not-an-object')
+        return 'is valid JSON but not an object; left untouched';
+    return 'could not be read; left untouched';
+}
+//# sourceMappingURL=sync.js.map

package/dist/commands/mcp/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../src/commands/mcp/sync.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,cAAc,GAEf,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AA+BrC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAc5B,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,OAAuB,EACvB,OAA6B,MAAM;IAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAEhD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAkC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,cAAc,IAAI,qBAAqB,OAAO,CAAC,MAAM,aAAa,mBAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CACnI,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ;QACzB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IAEF,IAAI,IAAc,CAAC;IACnB,IAAI,MAAmB,CAAC;IACxB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,GAAG,MAAM;YACT,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,OAAO,CAAC,IAAgB,CAAC;QAChC,MAAM,GAAG,OAAO,CAAC,MAAqB,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAElE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;AACzF,CAAC;AAED,SAAS,OAAO,CACd,OAAuB,EACvB,OAAuB,EACvB,MAA6B,EAC7B,MAA6B;IAE7B,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CACV,gEAAgE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAC5F,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU;QAC/B,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,CACV,gCAAgC,MAAM,CAAC,IAAI,kGAAkG,CAC9I,CAAC;QACF,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;SAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,GAAG,CAAC,EAAE,CACJ,OAAO,CAAC,UAAU;YAChB,CAAC,CAAC,kCAAkC,MAAM,CAAC,IAAI,EAAE;YACjD,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,mBAAmB;gBACtC,CAAC,CAAC,gCAAgC,MAAM,CAAC,IAAI,EAAE;gBAC/C,CAAC,CAAC,8BAA8B,MAAM,CAAC,IAAI,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,OAAuB,EACvB,OAAuB,EACvB,MAA6B,EAC7B,MAA6B;IAE7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,MAAmB,EAAE,MAAe;IACvE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5E,OAAO;QACL,OAAO,EAAE,OAAO;aACb,MAAM,CAAC,CAAC,MAAM,EAAsD,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC;aAC9F,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM;YACpC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;SACxB,CAAC,CAAC;QACL,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,MAAM,EAAwD,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;aAClG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,SAAS,EAAE,OAAO;aACf,MAAM,CAAC,CAAC,MAAM,EAAwD,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;aAClG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YACtB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,KAAK,EAAE,MAAM,CAAC,OAAO;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,MAAkB,EAAE,MAA6B;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,8BAA8B,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,kBAAkB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxL,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,6BAA6B,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,mBAAmB,KAAK,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjM,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC;IACjG,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,mBAAmB,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,8EAA8E,CACnN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CACnB,MAAkB,EAClB,IAA0B,EAC1B,MAA6B;IAE7B,KAAK,MAAM,CAAC;IACZ,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,iCAAiC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,UAAU,IAAI,kCAAkC,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,OAAO,CACL,0EAA0E;YAC1E,oEAAoE;YACpE,iEAAiE;YACjE,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;QACtC,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,0IAA0I,CAAC;IACpJ,CAAC;IACD,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,mCAAmC,CAAC;IAC1E,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,iDAAiD,CAAC;IAC1F,OAAO,mCAAmC,CAAC;AAC7C,CAAC"}

package/dist/config.js

@@ -48,5 +48,11 @@ export const HOOK_DEFAULTS = {
     // the files it changed (cybe_scan_diff) before the user commits. Opt-out at
     // install. Rides on session-review, so it only fires when that hook is on.
     enableDiffScan: true,
+    // BACK-174 — `auto` keeps git-origin auto-discovery (VibeDefend lights up on
+    // every repo of the machine that is a CybeDefend project). `opt-in` limits
+    // the hooks to repos that carry `.cybedefend/config.json` (or
+    // CYBEDEFEND_PROJECT_ID). Default stays `auto` so existing installs keep
+    // their behaviour; the installer asks.
+    activation: 'auto',
 };
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAwCA,MAAM,CAAC,MAAM,OAAO,GAA4B;IAC9C;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,kFAAkF;QACpF,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,2BAA2B;KAC1C;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,0EAA0E;QAC5E,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,2BAA2B;KAC1C;CACO,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,KAAK;IACtB,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;IAChB,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,cAAc,EAAE,IAAI;CACZ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA0CA,MAAM,CAAC,MAAM,OAAO,GAA4B;IAC9C;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,kFAAkF;QACpF,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,2BAA2B;KAC1C;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,0EAA0E;QAC5E,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,KAAK;QACV,YAAY,EAAE,2BAA2B;KAC1C;CACO,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,KAAK;IACtB,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;IAChB,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,cAAc,EAAE,IAAI;IACpB,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,yEAAyE;IACzE,uCAAuC;IACvC,UAAU,EAAE,MAAwB;CAC5B,CAAC"}