@executioncontrolprotocol/cli 0.4.0 → 0.5.0

package/README.md

@@ -1,6 +1,10 @@
 # `@executioncontrolprotocol/cli`
 
-Command-line interface for **Execution Control Protocol (ECP)**.
+**Execution Control Protocol (ECP)** specifies portable **Context** manifests for agent orchestration: structured inputs and outputs, tool boundaries, per-executor policies, and host-level enforcement via system config—so runs stay least-privilege and auditable.
+
+**Learn more:** [executioncontrolprotocol.io](https://executioncontrolprotocol.io)
+
+This package is the **command-line interface** for validating and running Contexts.
 
 ## Install
 
@@ -13,10 +17,61 @@ npm install -g @executioncontrolprotocol/cli
 ```bash
 ecp --help
 ecp validate path/to/context.yaml
-ecp run path/to/context.yaml --enable openai -i topic="Hello"
+ecp run path/to/context.yaml -i topic="Hello"
+```
+
+### System config (`ecp.config.yaml` / `~/.ecp/config.yaml`)
+
+**v0.5 layout:** use top-level **`security`** for allow-lists and defaults (mirrors `models`, `tools`, `loggers`, …). Wiring lives under **`models.providers`**, **`tools.servers`**, **`loggers.config`**, **`agents.endpoints`**, **`plugins.installs`**, **`secrets`**. Set **`version: "0.5"`**.
+
+```bash
+ecp config --help
+ecp config init                    # best-practices starter in current directory
+ecp config init --global          # ~/.ecp/config.yaml
+ecp config path                    # resolved file path (use --for-write for mutation target)
+ecp config get --format json
+ecp config security get
+ecp config plugins get             # plugins.installs + security.plugins summary
+ecp config models get
+ecp config tools get
+ecp config loggers get
+ecp config secrets yaml get
+```
+
+`ecp run` accepts `--logger` / `-l` (e.g. `file`) to enable logger **plugins** (`kind: logger`); defaults and allow-lists are under **`security.loggers`**, per-logger options under **`loggers.config`**.
+
+YAML and JSON are supported; defaults are searched in order: `./ecp.config.yaml`, `./ecp.config.json`, then `~/.ecp/`.
+
+## Secrets and environment files
+
+ECP separates **where** a secret is loaded from using **provider ids** in `tools.servers.<name>.credentials.bindings[].source`:
+
+| Provider id   | Meaning                                                                                                                                                                                                      |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `process.env` | Read from the current process environment (`process.env[<key>]`).                                                                                                                                            |
+| `dot.env`     | Read from a `.env`-style file on disk (path from config or `--environment`).                                                                                                                                 |
+| `os.secrets`  | Read from the OS credential manager / keychain; stored under an `ecp://<key>` target (same as default `SecretRef.id`; provider is only in `source.provider`, e.g. `os.secrets.MY_KEY` as shorthand in docs). |
+
+Bindings use **plain keys** (e.g. `GITHUB_PAT`, `server/fetch.token`) in `source.key`. Values are never stored in Context YAML—only references.
+
+### `ecp config secrets`
+
+Use **`os.secrets`** for durable storage (e.g. `ecp config secrets add --provider os.secrets --key myapp/token --prompt`). The `ecp config` commands do **not** support `--environment`; they resolve `dot.env` only from `ecp.config.*` (`secrets.providers.dot.env.path`).
+
+### `--environment` (runtime commands only)
+
+On **`ecp run`**, **`ecp validate`**, **`ecp trace`**, **`ecp trace list`**, and **`ecp graph`**, you can pass:
+
+```bash
+ecp run context.yaml --environment ./.env.local
 ```
 
+This sets the **file** used by the **`dot.env`** provider for that process. It **does not** merge variables into `process.env`; use `source.provider: process.env` only for variables already in the shell/CI environment, and `source.provider: dot.env` for file-backed values.
+
+If both `--environment` and `secrets.providers.dot.env.path` are set, **`--environment` wins** for that command. If the path does not exist, the CLI exits with an error.
+
 ## Links
 
+- **Docs**: [executioncontrolprotocol.io](https://executioncontrolprotocol.io)
 - **Repo**: `https://github.com/executioncontrolprotocol/executioncontrolprotocol`
 - **Issues**: `https://github.com/executioncontrolprotocol/executioncontrolprotocol/issues`

package/dist/commands/config/endpoints/add.d.ts

@@ -0,0 +1,14 @@
+import { Command } from "@oclif/core";
+export default class ConfigEndpointsAdd extends Command {
+    static summary: string;
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        url: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=add.d.ts.map

package/dist/commands/config/endpoints/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/endpoints/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,MAAM,aAAa,CAAC;AAK5C,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,OAAO;IACrD,MAAM,CAAC,OAAO,SAAmD;IAEjE,MAAM,CAAC,IAAI;;;MAGT;IAEF,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAsB3B"}

package/dist/commands/config/endpoints/add.js

@@ -0,0 +1,29 @@
+import { Args, Command } from "@oclif/core";
+import { configScopeFlags } from "../../../lib/config-flags.js";
+import { persistConfig, readForMutation } from "../../../lib/system-config-cli.js";
+export default class ConfigEndpointsAdd extends Command {
+    static summary = "Set agents.endpoints.<executorName>.url (A2A)";
+    static args = {
+        name: Args.string({ required: true, description: "Executor / specialist name" }),
+        url: Args.string({ required: true, description: "A2A endpoint URL" }),
+    };
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { args, flags } = await this.parse(ConfigEndpointsAdd);
+        const cwd = process.cwd();
+        const { path, config } = readForMutation({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        config.agents ??= {};
+        config.agents.endpoints ??= {};
+        if (config.agents.endpoints[args.name] !== undefined) {
+            this.error(`Endpoint "${args.name}" already exists. Use "ecp config endpoints update" to change the URL.`, { exit: 1 });
+        }
+        config.agents.endpoints[args.name] = { url: args.url };
+        persistConfig(path, config);
+        this.log(`Added agents.endpoints.${args.name}.url = ${args.url} (${path})`);
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/commands/config/endpoints/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../../src/commands/config/endpoints/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEnF,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,OAAO;IACrD,MAAM,CAAC,OAAO,GAAG,+CAA+C,CAAC;IAEjE,MAAM,CAAC,IAAI,GAAG;QACZ,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;QAChF,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;KACtE,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,CACR,aAAa,IAAI,CAAC,IAAI,wEAAwE,EAC9F,EAAE,IAAI,EAAE,CAAC,EAAE,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvD,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC,CAAC;IAC9E,CAAC"}

package/dist/commands/config/endpoints/get.d.ts

@@ -0,0 +1,10 @@
+import { Command } from "@oclif/core";
+export default class ConfigEndpointsGet extends Command {
+    static summary: string;
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=get.d.ts.map

package/dist/commands/config/endpoints/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/endpoints/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAMtC,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,OAAO;IACrD,MAAM,CAAC,OAAO,SAAgD;IAE9D,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B3B"}

package/dist/commands/config/endpoints/get.js

@@ -0,0 +1,35 @@
+import { Command } from "@oclif/core";
+import { formatConfigFileHeaderLine, runWithCommandError } from "../../../lib/command-helpers.js";
+import { configScopeFlags } from "../../../lib/config-flags.js";
+import { loadConfigForDisplay } from "../../../lib/system-config-cli.js";
+export default class ConfigEndpointsGet extends Command {
+    static summary = "Get A2A agent endpoints (agents.endpoints)";
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { flags } = await this.parse(ConfigEndpointsGet);
+        const cwd = process.cwd();
+        await runWithCommandError(this, async () => {
+            const { path, exists, config } = loadConfigForDisplay({
+                global: flags.global,
+                cwd,
+                explicit: flags.config,
+            });
+            this.log(formatConfigFileHeaderLine(path, exists));
+            const ae = config.agents?.endpoints;
+            if (!ae || Object.keys(ae).length === 0) {
+                this.log("(no agent endpoints configured)");
+                return;
+            }
+            for (const k of Object.keys(ae).sort()) {
+                const v = ae[k];
+                const url = typeof v === "string"
+                    ? v
+                    : v && typeof v === "object" && typeof v.url === "string"
+                        ? v.url
+                        : "(invalid entry)";
+                this.log(`${k}: ${url}`);
+            }
+        });
+    }
+}
+//# sourceMappingURL=get.js.map

package/dist/commands/config/endpoints/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/commands/config/endpoints/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,OAAO;IACrD,MAAM,CAAC,OAAO,GAAG,4CAA4C,CAAC;IAE9D,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1B,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;gBACpD,MAAM,EAAE,KAAK,CAAC,MAAiB;gBAC/B,GAAG;gBACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;YACpC,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChB,MAAM,GAAG,GACP,OAAO,CAAC,KAAK,QAAQ;oBACnB,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAsB,CAAC,GAAG,KAAK,QAAQ;wBAC7E,CAAC,CAAE,CAAqB,CAAC,GAAG;wBAC5B,CAAC,CAAC,iBAAiB,CAAC;gBAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC"}

package/dist/commands/config/endpoints/remove.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "@oclif/core";
+export default class ConfigEndpointsRemove extends Command {
+    static summary: string;
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=remove.d.ts.map

package/dist/commands/config/endpoints/remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/endpoints/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,MAAM,aAAa,CAAC;AAK5C,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,OAAO;IACxD,MAAM,CAAC,OAAO,SAAsC;IAEpD,MAAM,CAAC,IAAI;;MAET;IAEF,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB3B"}

package/dist/commands/config/endpoints/remove.js

@@ -0,0 +1,25 @@
+import { Args, Command } from "@oclif/core";
+import { configScopeFlags } from "../../../lib/config-flags.js";
+import { persistConfig, readForMutation } from "../../../lib/system-config-cli.js";
+export default class ConfigEndpointsRemove extends Command {
+    static summary = "Remove an agents.endpoints entry";
+    static args = {
+        name: Args.string({ required: true, description: "Executor / specialist name" }),
+    };
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { args, flags } = await this.parse(ConfigEndpointsRemove);
+        const cwd = process.cwd();
+        const { path, config } = readForMutation({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        if (config.agents?.endpoints && args.name in config.agents.endpoints) {
+            delete config.agents.endpoints[args.name];
+        }
+        persistConfig(path, config);
+        this.log(`Removed agents.endpoints.${args.name} (${path})`);
+    }
+}
+//# sourceMappingURL=remove.js.map

package/dist/commands/config/endpoints/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../../src/commands/config/endpoints/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEnF,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,OAAO;IACxD,MAAM,CAAC,OAAO,GAAG,kCAAkC,CAAC;IAEpD,MAAM,CAAC,IAAI,GAAG;QACZ,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;KACjF,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC"}

package/dist/commands/config/endpoints/update.d.ts

@@ -0,0 +1,15 @@
+import { Command } from "@oclif/core";
+export default class ConfigEndpointsUpdate extends Command {
+    static summary: string;
+    static description: string;
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        url: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=update.d.ts.map

package/dist/commands/config/endpoints/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/commands/config/endpoints/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,MAAM,aAAa,CAAC;AAK5C,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,OAAO;IACxD,MAAM,CAAC,OAAO,SAAgD;IAE9D,MAAM,CAAC,WAAW,SAA6E;IAE/F,MAAM,CAAC,IAAI;;;MAGT;IAEF,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA2B3B"}

package/dist/commands/config/endpoints/update.js

@@ -0,0 +1,36 @@
+import { Args, Command } from "@oclif/core";
+import { configScopeFlags } from "../../../lib/config-flags.js";
+import { persistConfig, readForMutation } from "../../../lib/system-config-cli.js";
+export default class ConfigEndpointsUpdate extends Command {
+    static summary = "Update agents.endpoints.<executorName>.url";
+    static description = "Same as add: sets the URL for an executor name (creates or overwrites).";
+    static args = {
+        name: Args.string({ required: true, description: "Executor / specialist name" }),
+        url: Args.string({ required: true, description: "A2A endpoint URL" }),
+    };
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { args, flags } = await this.parse(ConfigEndpointsUpdate);
+        const cwd = process.cwd();
+        const { path, config } = readForMutation({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        config.agents ??= {};
+        config.agents.endpoints ??= {};
+        if (config.agents.endpoints[args.name] === undefined) {
+            this.error(`No endpoint "${args.name}". Use "ecp config endpoints add" first.`, { exit: 1 });
+        }
+        const cur = config.agents.endpoints[args.name];
+        if (typeof cur === "string") {
+            config.agents.endpoints[args.name] = { url: args.url };
+        }
+        else if (cur && typeof cur === "object") {
+            cur.url = args.url;
+        }
+        persistConfig(path, config);
+        this.log(`Updated agents.endpoints.${args.name}.url = ${args.url} (${path})`);
+    }
+}
+//# sourceMappingURL=update.js.map

package/dist/commands/config/endpoints/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../../src/commands/config/endpoints/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEnF,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,OAAO;IACxD,MAAM,CAAC,OAAO,GAAG,4CAA4C,CAAC;IAE9D,MAAM,CAAC,WAAW,GAAG,yEAAyE,CAAC;IAE/F,MAAM,CAAC,IAAI,GAAG;QACZ,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;QAChF,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;KACtE,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,CACR,gBAAgB,IAAI,CAAC,IAAI,0CAA0C,EACnE,EAAE,IAAI,EAAE,CAAC,EAAE,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACzD,CAAC;aAAM,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1C,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,CAAC;QAED,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC,CAAC;IAChF,CAAC"}

package/dist/commands/config/get.d.ts

@@ -0,0 +1,11 @@
+import { Command } from "@oclif/core";
+export default class ConfigGet extends Command {
+    static summary: string;
+    static flags: {
+        format: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=get.d.ts.map

package/dist/commands/config/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../src/commands/config/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAY7C,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,OAAO;IAC5C,MAAM,CAAC,OAAO,SAAmD;IAEjE,MAAM,CAAC,KAAK;;;;MAOV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB3B"}

package/dist/commands/config/get.js

@@ -0,0 +1,31 @@
+import { Command, Flags } from "@oclif/core";
+import { stringifySystemConfig } from "@executioncontrolprotocol/runtime";
+import { CONFIG_DUMP_HEADER_WHEN_MISSING, formatConfigFileHeaderLine, runWithCommandError, } from "../../lib/command-helpers.js";
+import { configScopeFlags } from "../../lib/config-flags.js";
+import { loadConfigForDisplay } from "../../lib/system-config-cli.js";
+export default class ConfigGet extends Command {
+    static summary = "Get the resolved system config (YAML or JSON)";
+    static flags = {
+        ...configScopeFlags,
+        format: Flags.string({
+            description: "Serialization format",
+            options: ["yaml", "json"],
+            default: "yaml",
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ConfigGet);
+        const cwd = process.cwd();
+        await runWithCommandError(this, async () => {
+            const { path, exists, config } = loadConfigForDisplay({
+                global: flags.global,
+                cwd,
+                explicit: flags.config,
+            });
+            const fmt = flags.format;
+            this.log(formatConfigFileHeaderLine(path, exists, CONFIG_DUMP_HEADER_WHEN_MISSING));
+            this.log(stringifySystemConfig(config, fmt));
+        });
+    }
+}
+//# sourceMappingURL=get.js.map

package/dist/commands/config/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../src/commands/config/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,OAAO;IAC5C,MAAM,CAAC,OAAO,GAAG,+CAA+C,CAAC;IAEjE,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,sBAAsB;YACnC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAU;YAClC,OAAO,EAAE,MAAM;SAChB,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1B,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;gBACpD,MAAM,EAAE,KAAK,CAAC,MAAiB;gBAC/B,GAAG;gBACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;aAC7C,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,KAAK,CAAC,MAAyB,CAAC;YAC5C,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,+BAA+B,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC"}

package/dist/commands/config/init.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "@oclif/core";
+export default class ConfigInit extends Command {
+    static summary: string;
+    static description: string;
+    static flags: {
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        format: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/config/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/commands/config/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAS7C,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,MAAM,CAAC,OAAO,SAAoD;IAElE,MAAM,CAAC,WAAW,SAEqB;IAEvC,MAAM,CAAC,KAAK;;;;;MAYV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B3B"}

package/dist/commands/config/init.js

@@ -0,0 +1,49 @@
+import { Command, Flags } from "@oclif/core";
+import { resolve } from "node:path";
+import { parseSystemConfigString, saveSystemConfig } from "@executioncontrolprotocol/runtime";
+import { DEFAULT_ECP_SYSTEM_CONFIG_YAML } from "../../lib/default-ecp-config.js";
+import { configScopeFlags } from "../../lib/config-flags.js";
+import { globalConfigJsonPath, globalConfigYamlPath, loadConfigAtPath } from "../../lib/system-config-cli.js";
+export default class ConfigInit extends Command {
+    static summary = "Write best-practices default config if missing";
+    static description = "Creates a new config file with a conservative allow-list (OpenAI + Ollama), model defaults, and extension security. " +
+        "Does not overwrite unless --force.";
+    static flags = {
+        ...configScopeFlags,
+        force: Flags.boolean({
+            char: "f",
+            description: "Overwrite existing config at the target path",
+            default: false,
+        }),
+        format: Flags.string({
+            description: "Output format for the new file",
+            options: ["yaml", "json"],
+            default: "yaml",
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ConfigInit);
+        const global = flags.global;
+        const explicit = flags.config;
+        const cwd = process.cwd();
+        let target;
+        if (explicit) {
+            target = resolve(explicit);
+        }
+        else if (global) {
+            target = flags.format === "json" ? globalConfigJsonPath() : globalConfigYamlPath();
+        }
+        else {
+            target =
+                flags.format === "json" ? resolve(cwd, "ecp.config.json") : resolve(cwd, "ecp.config.yaml");
+        }
+        const parsed = parseSystemConfigString(DEFAULT_ECP_SYSTEM_CONFIG_YAML, "yaml");
+        const { exists } = loadConfigAtPath(target);
+        if (exists && !flags.force) {
+            this.error(`Config already exists: ${target}\nUse --force to overwrite, or edit the file directly.`, { exit: 1 });
+        }
+        saveSystemConfig(target, parsed);
+        this.log(exists ? `Overwrote ${target}` : `Wrote ${target}`);
+    }
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/config/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/commands/config/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAE9G,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,MAAM,CAAC,OAAO,GAAG,gDAAgD,CAAC;IAElE,MAAM,CAAC,WAAW,GAChB,sHAAsH;QACtH,oCAAoC,CAAC;IAEvC,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,gBAAgB;QACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACnB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,8CAA8C;YAC3D,OAAO,EAAE,KAAK;SACf,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,gCAAgC;YAC7C,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAU;YAClC,OAAO,EAAE,MAAM;SAChB,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAiB,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAA4B,CAAC;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1B,IAAI,MAAc,CAAC;QACnB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,MAAM;gBACJ,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE5C,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CACR,0BAA0B,MAAM,wDAAwD,EACxF,EAAE,IAAI,EAAE,CAAC,EAAE,CACZ,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC"}

package/dist/commands/config/loggers/allow/add.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "@oclif/core";
+export default class ConfigLoggersAllowAdd extends Command {
+    static summary: string;
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=add.d.ts.map

package/dist/commands/config/loggers/allow/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/loggers/allow/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,MAAM,aAAa,CAAC;AAU5C,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,OAAO;IACxD,MAAM,CAAC,OAAO,SAAqD;IAEnE,MAAM,CAAC,IAAI;;MAET;IAEF,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAgB3B"}

package/dist/commands/config/loggers/allow/add.js

@@ -0,0 +1,25 @@
+import { Args, Command } from "@oclif/core";
+import { configScopeFlags } from "../../../../lib/config-flags.js";
+import { addUnique, persistConfig, readForMutation, touchSecurity, } from "../../../../lib/system-config-cli.js";
+export default class ConfigLoggersAllowAdd extends Command {
+    static summary = "Add a logger ID to security.loggers.allowEnable";
+    static args = {
+        id: Args.string({ required: true, description: "Logger ID" }),
+    };
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { args, flags } = await this.parse(ConfigLoggersAllowAdd);
+        const cwd = process.cwd();
+        const { path, config } = readForMutation({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const sec = touchSecurity(config);
+        sec.loggers ??= {};
+        sec.loggers.allowEnable = addUnique(sec.loggers.allowEnable, args.id);
+        persistConfig(path, config);
+        this.log(`Updated security.loggers.allowEnable (${path}): ${sec.loggers.allowEnable?.join(", ")}`);
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/commands/config/loggers/allow/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../../../src/commands/config/loggers/allow/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,SAAS,EACT,aAAa,EACb,eAAe,EACf,aAAa,GACd,MAAM,sCAAsC,CAAC;AAE9C,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,OAAO;IACxD,MAAM,CAAC,OAAO,GAAG,iDAAiD,CAAC;IAEnE,MAAM,CAAC,IAAI,GAAG;QACZ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;KAC9D,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC;QACnB,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,yCAAyC,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC"}

package/dist/commands/config/loggers/allow/remove.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "@oclif/core";
+export default class ConfigLoggersAllowRemove extends Command {
+    static summary: string;
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=remove.d.ts.map

package/dist/commands/config/loggers/allow/remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/loggers/allow/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,MAAM,aAAa,CAAC;AAU5C,MAAM,CAAC,OAAO,OAAO,wBAAyB,SAAQ,OAAO;IAC3D,MAAM,CAAC,OAAO,SAA0D;IAExE,MAAM,CAAC,IAAI;;MAET;IAEF,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAiB3B"}

package/dist/commands/config/loggers/allow/remove.js

@@ -0,0 +1,26 @@
+import { Args, Command } from "@oclif/core";
+import { configScopeFlags } from "../../../../lib/config-flags.js";
+import { persistConfig, readForMutation, removeId, touchSecurity, } from "../../../../lib/system-config-cli.js";
+export default class ConfigLoggersAllowRemove extends Command {
+    static summary = "Remove a logger ID from security.loggers.allowEnable";
+    static args = {
+        id: Args.string({ required: true, description: "Logger ID" }),
+    };
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { args, flags } = await this.parse(ConfigLoggersAllowRemove);
+        const cwd = process.cwd();
+        const { path, config } = readForMutation({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const sec = touchSecurity(config);
+        sec.loggers ??= {};
+        sec.loggers.allowEnable = removeId(sec.loggers.allowEnable, args.id);
+        sec.loggers.defaultEnable = removeId(sec.loggers.defaultEnable, args.id);
+        persistConfig(path, config);
+        this.log(`Removed "${args.id}" from logger allow/default lists. ${path}`);
+    }
+}
+//# sourceMappingURL=remove.js.map

package/dist/commands/config/loggers/allow/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../../../src/commands/config/loggers/allow/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,aAAa,EACb,eAAe,EACf,QAAQ,EACR,aAAa,GACd,MAAM,sCAAsC,CAAC;AAE9C,MAAM,CAAC,OAAO,OAAO,wBAAyB,SAAQ,OAAO;IAC3D,MAAM,CAAC,OAAO,GAAG,sDAAsD,CAAC;IAExE,MAAM,CAAC,IAAI,GAAG;QACZ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;KAC9D,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC;QACnB,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEzE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,EAAE,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC"}

package/dist/commands/config/loggers/default/add.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "@oclif/core";
+export default class ConfigLoggersDefaultAdd extends Command {
+    static summary: string;
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=add.d.ts.map

package/dist/commands/config/loggers/default/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/loggers/default/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,MAAM,aAAa,CAAC;AAU5C,MAAM,CAAC,OAAO,OAAO,uBAAwB,SAAQ,OAAO;IAC1D,MAAM,CAAC,OAAO,SAAuD;IAErE,MAAM,CAAC,IAAI;;MAET;IAEF,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAmB3B"}

package/dist/commands/config/loggers/default/add.js

@@ -0,0 +1,28 @@
+import { Args, Command } from "@oclif/core";
+import { configScopeFlags } from "../../../../lib/config-flags.js";
+import { addUnique, persistConfig, readForMutation, touchSecurity, } from "../../../../lib/system-config-cli.js";
+export default class ConfigLoggersDefaultAdd extends Command {
+    static summary = "Add a logger ID to security.loggers.defaultEnable";
+    static args = {
+        id: Args.string({ required: true, description: "Logger ID" }),
+    };
+    static flags = { ...configScopeFlags };
+    async run() {
+        const { args, flags } = await this.parse(ConfigLoggersDefaultAdd);
+        const cwd = process.cwd();
+        const { path, config } = readForMutation({
+            global: flags.global,
+            cwd,
+            explicit: flags.config,
+        });
+        const sec = touchSecurity(config);
+        sec.loggers ??= {};
+        sec.loggers.defaultEnable = addUnique(sec.loggers.defaultEnable, args.id);
+        if (sec.loggers.allowEnable && sec.loggers.allowEnable.length > 0) {
+            sec.loggers.allowEnable = addUnique(sec.loggers.allowEnable, args.id);
+        }
+        persistConfig(path, config);
+        this.log(`Updated security.loggers.defaultEnable (${path}): ${sec.loggers.defaultEnable?.join(", ")}`);
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/commands/config/loggers/default/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../../../src/commands/config/loggers/default/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EACL,SAAS,EACT,aAAa,EACb,eAAe,EACf,aAAa,GACd,MAAM,sCAAsC,CAAC;AAE9C,MAAM,CAAC,OAAO,OAAO,uBAAwB,SAAQ,OAAO;IAC1D,MAAM,CAAC,OAAO,GAAG,mDAAmD,CAAC;IAErE,MAAM,CAAC,IAAI,GAAG;QACZ,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;KAC9D,CAAC;IAEF,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACvC,MAAM,EAAE,KAAK,CAAC,MAAiB;YAC/B,GAAG;YACH,QAAQ,EAAE,KAAK,CAAC,MAA4B;SAC7C,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC;QACnB,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,2CAA2C,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC"}

package/dist/commands/config/loggers/default/remove.d.ts

@@ -0,0 +1,13 @@
+import { Command } from "@oclif/core";
+export default class ConfigLoggersDefaultRemove extends Command {
+    static summary: string;
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=remove.d.ts.map

package/dist/commands/config/loggers/default/remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.d.ts","sourceRoot":"","sources":["../../../../../src/commands/config/loggers/default/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,OAAO,EAAE,MAAM,aAAa,CAAC;AAU5C,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,OAAO;IAC7D,MAAM,CAAC,OAAO,SAA4D;IAE1E,MAAM,CAAC,IAAI;;MAET;IAEF,MAAM,CAAC,KAAK;;;MAA2B;IAEjC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAkB3B"}