@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/diagnostics.js

@@ -10,7 +10,30 @@ import { join } from 'node:path';
 import { ALL_ADAPTERS } from './clients/registry.js';
 import { pkg } from './version.js';
 import { pingGateway } from './hooks/runtime/api.js';
-import { resolveProjectId, resolveToken } from './hooks/runtime/resolve.js';
+import { resolveActivationMode, resolveProjectId, } from './hooks/runtime/resolve.js';
+import { readUnmappedTools, } from './hooks/runtime/unmapped-tools.js';
+import { getOrgPolicy } from './mcp/verify/api.js';
+import { resolveVerifyToken, TOKEN_ENV_VARS } from './mcp/verify/token.js';
+/**
+ * The token `status` / `doctor` report on: `CYBEDEFEND_TOKEN` /
+ * `VIBEDEFEND_TOKEN`, then the bundle `vibedefend login` wrote. The SAME two
+ * places the proxy and `mcp scan` read (`resolveVerifyToken`), so what these
+ * commands print is what those will experience — and nothing else: the
+ * agent's own keychain (Claude Code / Codex MCP OAuth) is not ours to probe,
+ * the proxy refuses it by design, and a `status` that answered
+ * "authenticated" on its strength would contradict the very next `mcp scan`.
+ * The hooks alone keep that fallback (BACK-124), through their own resolver.
+ */
+export function lookupStoreToken(mcpName, deps = {}) {
+    const env = deps.env ?? process.env;
+    for (const name of TOKEN_ENV_VARS) {
+        const value = env[name];
+        if (value && value.trim() !== '')
+            return { token: value.trim(), source: 'environment' };
+    }
+    const token = resolveVerifyToken(mcpName, { ...deps, env: {} });
+    return { token, source: token ? 'vibedefend store' : null };
+}
 /** `~/.cybedefend`, overridable via CYBEDEFEND_HOME for tests. */
 function cybeHome() {
     return join(process.env.CYBEDEFEND_HOME ?? homedir(), '.cybedefend');
@@ -36,16 +59,28 @@ function readTextSafe(path) {
         return null;
     }
 }
-export async function gatherInstallState(opts = {}) {
+export async function gatherInstallState(opts = {}, deps = {}) {
+    const adapters = deps.adapters ?? ALL_ADAPTERS;
+    const resolveTokenImpl = deps.resolveTokenFn ?? lookupStoreToken;
+    const pingImpl = deps.pingFn ?? pingGateway;
+    const policyImpl = deps.policyFn ?? getOrgPolicy;
     const dir = cybeHome();
     const runtimeConfig = readJsonSafe(join(dir, 'runtime-config.json'));
     const region = runtimeConfig?.region ?? null;
+    const organization = organizationOf(runtimeConfig);
     const runnerSource = typeof runtimeConfig?.runnerSource === 'string'
         ? runtimeConfig.runnerSource
         : null;
     const runnerSourceValid = runnerSource === null || existsSync(runnerSource);
+    const runnerPresent = existsSync(join(dir, 'hook-runner.js'));
+    const re2WasmPresent = runnerSource !== null || !runnerPresent || existsSync(join(dir, 're2.wasm'));
     const versionStamped = readTextSafe(join(dir, 'version'));
-    const clients = ALL_ADAPTERS.map((a) => {
+    const activation = runtimeConfig ? resolveActivationMode(runtimeConfig) : null;
+    // Read from where the HOOK writes (its own dir convention), not from this
+    // CLI-side dir — otherwise an override in one env var and not the other
+    // would make `status` report an empty list while the file fills up.
+    const unmappedTools = readUnmappedTools();
+    const clients = adapters.map((a) => {
         const detected = (() => {
             try {
                 return a.detect().installed;
@@ -83,17 +118,20 @@ export async function gatherInstallState(opts = {}) {
     catch {
         projectId = null;
     }
-    let live = null;
-    if (opts.live) {
-        let token = null;
+    // Looked up whenever there is a region, live check or not: the source is
+    // part of the report, and a lookup is a file read.
+    let lookup = { token: null, source: null };
+    if (region) {
         try {
-            token = region
-                ? resolveToken(region.mcpName, { mcpUrl: region.mcpUrl })
-                : null;
+            lookup = await resolveTokenImpl(region.mcpName);
         }
         catch {
-            token = null;
+            lookup = { token: null, source: null };
         }
+    }
+    const token = lookup.token;
+    let live = null;
+    if (opts.live) {
         if (!region) {
             live = { status: 'skipped', reason: 'not installed' };
         }
@@ -105,7 +143,7 @@ export async function gatherInstallState(opts = {}) {
         }
         else {
             try {
-                live = await pingGateway({
+                live = await pingImpl({
                     apiBase: region.apiBase,
                     projectId,
                     token,
@@ -116,16 +154,44 @@ export async function gatherInstallState(opts = {}) {
             }
         }
     }
+    // The policy is displayed, never applied from here: the verifier learns
+    // it from every response. Read only when there is something to read it
+    // with, and said to be unavailable when the read fails.
+    let policy = null;
+    if (opts.live && region && organization && token) {
+        try {
+            policy = await policyImpl({ apiBase: region.apiBase, token, mcpName: region.mcpName, organizationId: organization.id });
+        }
+        catch {
+            policy = 'unavailable';
+        }
+    }
     return {
         installed: runtimeConfig !== null,
         region,
-        runnerPresent: existsSync(join(dir, 'hook-runner.js')),
+        organization,
+        policy,
+        runnerPresent,
         runnerSourceValid,
         versionStamped,
         versionCurrent: pkg.version,
         clients,
         projectId,
+        tokenSource: token ? lookup.source : null,
         live,
+        activation,
+        unmappedTools,
+        re2WasmPresent,
     };
 }
+/** The selected organization of a runtime config, or `null` for none or a malformed entry. */
+function organizationOf(runtimeConfig) {
+    const raw = runtimeConfig?.organization;
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const { id, name } = raw;
+    if (typeof id !== 'string' || id === '')
+        return null;
+    return { id, name: typeof name === 'string' ? name : '' };
+}
 //# sourceMappingURL=diagnostics.js.map

package/dist/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAkC5E,kEAAkE;AAClE,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAI,aAAa,EAAE,MAAmC,IAAI,IAAI,CAAC;IAE3E,MAAM,YAAY,GAChB,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ;QAC7C,CAAC,CAAC,aAAa,CAAC,YAAY;QAC5B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,iBAAiB,GAAG,YAAY,KAAK,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAE5E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAE1D,MAAM,OAAO,GAAmB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM;YAChB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,IAAI,CAAC;oBACH,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,CAAC;QACX,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM;gBACZ,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACjF,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,aAAa,KAAK,IAAI;QACjC,MAAM;QACN,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtD,iBAAiB;QACjB,cAAc;QACd,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,OAAO;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,GAElB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AA0BjG;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAwB,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAwCD,kEAAkE;AAClE,SAAS,QAAQ;IACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAoCD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA2B,EAAE,EAC7B,OAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IACjD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAI,aAAa,EAAE,MAAmC,IAAI,IAAI,CAAC;IAC3E,MAAM,YAAY,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,YAAY,GAChB,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ;QAC7C,CAAC,CAAC,aAAa,CAAC,YAAY;QAC5B,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,iBAAiB,GAAG,YAAY,KAAK,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC9D,MAAM,cAAc,GAClB,YAAY,KAAK,IAAI,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IAE/E,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;IAE1C,MAAM,OAAO,GAAmB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM;YAChB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,IAAI,CAAC;oBACH,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,CAAC;QACX,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,EAAE,CAAC,SAAS,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,mDAAmD;IACnD,IAAI,MAAM,GAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAE3B,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACjF,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC;oBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,wDAAwD;IACxD,IAAI,MAAM,GAA2B,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,aAAa,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,aAAa,KAAK,IAAI;QACjC,MAAM;QACN,YAAY;QACZ,MAAM;QACN,aAAa;QACb,iBAAiB;QACjB,cAAc;QACd,cAAc,EAAE,GAAG,CAAC,OAAO;QAC3B,OAAO;QACP,SAAS;QACT,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACzC,IAAI;QACJ,UAAU;QACV,aAAa;QACb,cAAc;KACf,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,aAA6C;IACnE,MAAM,GAAG,GAAG,aAAa,EAAE,YAAY,CAAC;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,GAAuC,CAAC;IAC7D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5D,CAAC"}

package/dist/doctor.js

@@ -45,6 +45,9 @@ export function resolveHookConfigFrom(hooks) {
         ...hooks,
         enableDiffScan: hooks.enableDiffScan ?? HOOK_DEFAULTS.enableDiffScan,
         nonBlockingMode: hooks.nonBlockingMode ?? HOOK_DEFAULTS.nonBlockingMode,
+        // BACK-174 — same backfill for the activation mode; an explicit `opt-in`
+        // survives a repair.
+        activation: hooks.activation ?? HOOK_DEFAULTS.activation,
     };
 }
 /** A built-in region's label + URL for its MCP URL, else the URL alone. */
@@ -89,6 +92,22 @@ export function deriveRepairs(state) {
             },
         });
     }
+    if (state.runnerPresent && !state.re2WasmPresent) {
+        // BACK-174 — a full-copy runner whose `re2.wasm` is gone runs every rule
+        // on native RegExp and says so on each hook. Re-rendering the runtime
+        // copies the wasm back next to it.
+        repairs.push({
+            id: 'runner-wasm-missing',
+            description: 'RE2 engine binary ~/.cybedefend/re2.wasm is missing — rules run on native RegExp; re-render the runner.',
+            fix: () => {
+                installHookRuntime({
+                    region,
+                    hooks: resolveHookConfig(),
+                    installedVersion: pkg.version,
+                });
+            },
+        });
+    }
     for (const c of state.clients) {
         if (c.detected && !c.hooksWired) {
             repairs.push({

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AASnC;;;;;;;;GAQG;AACH,SAAS,iBAAiB;IACxB,OAAO,qBAAqB,CAAC,iBAAiB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyC;IAEzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACxC,OAAO;QACL,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc;QACpE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,aAAa,CAAC,eAAe;KACxE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,eAAe;YACnB,WAAW,EAAE,yDAAyD;SACvE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,gBAAgB;YACpB,WAAW,EACT,qEAAqE;YACvE,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,0EAA0E;YAC5E,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE;gBACnB,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,2DAA2D;gBAClF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;oBAClC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;wBAC7B,OAAO,EAAE,EAAE;wBACX,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;wBAC9C,MAAM;wBACN,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACnC,uEAAuE;YACvE,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE;gBACjB,WAAW,EACT,CAAC,CAAC,MAAM,KAAK,IAAI;oBACf,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,2CAA2C,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,KAAK,iBAAiB;oBACtH,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,mEAAmE;gBACnF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACjC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrC,CAAC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,+CAA+C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,WAAW;YAC3C,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,OAAO;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,GAAI,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,EAAE,MACpB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AASnC;;;;;;;;GAQG;AACH,SAAS,iBAAiB;IACxB,OAAO,qBAAqB,CAAC,iBAAiB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyC;IAEzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;IACxC,OAAO;QACL,GAAG,KAAK;QACR,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc;QACpE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,aAAa,CAAC,eAAe;QACvE,yEAAyE;QACzE,qBAAqB;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;KACzD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,eAAe;YACnB,WAAW,EAAE,yDAAyD;SACvE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAE5B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,gBAAgB;YACpB,WAAW,EACT,qEAAqE;YACvE,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,0EAA0E;YAC5E,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACjD,yEAAyE;QACzE,sEAAsE;QACtE,mCAAmC;QACnC,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,yGAAyG;YAC3G,GAAG,EAAE,GAAG,EAAE;gBACR,kBAAkB,CAAC;oBACjB,MAAM;oBACN,KAAK,EAAE,iBAAiB,EAAE;oBAC1B,gBAAgB,EAAE,GAAG,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE;gBACnB,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,2DAA2D;gBAClF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;oBAClC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC;wBAC7B,OAAO,EAAE,EAAE;wBACX,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;wBAC9C,MAAM;wBACN,KAAK;qBACN,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACnC,uEAAuE;YACvE,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE;gBACjB,WAAW,EACT,CAAC,CAAC,MAAM,KAAK,IAAI;oBACf,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,2CAA2C,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,MAAM,CAAC,KAAK,iBAAiB;oBACtH,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,mEAAmE;gBACnF,GAAG,EAAE,GAAG,EAAE;oBACR,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACjC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrC,CAAC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAA2C,EAAE;IAE7C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,+CAA+C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,WAAW;YAC3C,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,OAAO;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxB,MAAM,CAAC,CAAC,GAAI,EAAE,CAAC;YACf,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,EAAE,MACpB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACxD,CAAC"}

package/dist/guards-evaluator/analysis-types.js

@@ -0,0 +1,27 @@
+/**
+ * Shared analysis contract for the Action Guards hardening work (Level 0–2).
+ *
+ * The current evaluator matches regexes against the RAW command string, which
+ * is blind to trivial rewrites (`/bin/rm`, `--recursive --force`, `.e""nv`,
+ * `bash -c "<here>"`, `$( … )`). This module defines the shape that lets a
+ * de-obfuscation pass and a triage pass be built and tested independently of
+ * the evaluator:
+ *
+ *   normalizeCommand(raw)  ->  NormalizeResult   (normalize.ts)
+ *   triageCommand(result)  ->  TriageVerdict     (triage.ts)
+ *
+ * Nothing here is consumed by `evaluate()` directly; the PreToolUse hook
+ * (guard-check.ts) wires these in. Keeping the contract in one small, stable
+ * file means `normalize.ts`, `triage.ts` and `judge-triage.ts` never have to
+ * import each other's implementation to agree on a shape.
+ *
+ * Design rules every consumer relies on:
+ *   - PURE: no I/O, no network, no clock. Disk resolution lives elsewhere
+ *     (target-resolve.ts / script-resolve.ts).
+ *   - NEVER THROWS: a parse failure sets `incomplete: true` and returns what
+ *     was recovered. Blindness must fail toward "look closer", never toward a
+ *     silent allow.
+ *   - ALLOCATION-LIGHT: runs on every Bash tool call on the hot path.
+ */
+export {};
+//# sourceMappingURL=analysis-types.js.map

package/dist/guards-evaluator/analysis-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-types.js","sourceRoot":"","sources":["../../src/guards-evaluator/analysis-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}