@fml-inc/panopticon 0.1.0

package/dist/cli.js

@@ -0,0 +1,1084 @@
+#!/usr/bin/env node
+import {
+  permissionsApply,
+  permissionsShow
+} from "./chunk-TGXFVAID.js";
+import {
+  activitySummary,
+  costBreakdown,
+  dbStats,
+  listPlans,
+  listSessions,
+  print,
+  pruneEstimate,
+  pruneExecute,
+  rawQuery,
+  refreshPricing,
+  search,
+  sessionTimeline,
+  syncPending,
+  syncReset,
+  syncTargetAdd,
+  syncTargetList,
+  syncTargetRemove,
+  syncWatermarkGet,
+  syncWatermarkSet
+} from "./chunk-4SM2H22C.js";
+import {
+  DAEMON_NAMES,
+  LOG_DIR,
+  logPaths,
+  openLogFd
+} from "./chunk-7Q3BJMLG.js";
+import {
+  refreshPricing as refreshPricing2
+} from "./chunk-3TZAKV3M.js";
+import {
+  loadUnifiedConfig
+} from "./chunk-QK5442ZP.js";
+import "./chunk-ZEC4LRKS.js";
+import {
+  allTargets,
+  getTarget,
+  targetIds
+} from "./chunk-QVK6VGCV.js";
+import {
+  closeDb,
+  getDb
+} from "./chunk-DZ5HJFB4.js";
+import {
+  config,
+  ensureDataDir
+} from "./chunk-K7YUPLES.js";
+
+// src/cli.ts
+import { execFileSync, spawn } from "child_process";
+import fs2 from "fs";
+import os from "os";
+import path2 from "path";
+import readline from "readline";
+import { fileURLToPath } from "url";
+import { Command } from "commander";
+
+// src/toml.ts
+import fs from "fs";
+import path from "path";
+import { parse, stringify } from "smol-toml";
+function readTomlFile(filePath) {
+  try {
+    return parse(fs.readFileSync(filePath, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeTomlFile(filePath, data) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${stringify(data)}
+`);
+}
+
+// src/cli.ts
+function output(data) {
+  console.log(JSON.stringify(data, null, 2));
+}
+function getPluginRoot() {
+  let dir = path2.dirname(fileURLToPath(import.meta.url));
+  dir = path2.resolve(dir, "..");
+  return dir;
+}
+function stopExistingDaemons() {
+  const pidsKilled = /* @__PURE__ */ new Set();
+  for (const pidFile of [config.serverPidFile, config.pidFile]) {
+    try {
+      const pid = parseInt(fs2.readFileSync(pidFile, "utf-8").trim(), 10);
+      process.kill(pid, "SIGTERM");
+      pidsKilled.add(pid);
+    } catch {
+    }
+    try {
+      fs2.unlinkSync(pidFile);
+    } catch {
+    }
+  }
+  try {
+    const out = execFileSync("lsof", ["-ti", `tcp:${config.port}`], {
+      encoding: "utf-8",
+      timeout: 3e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    for (const line of out.split("\n")) {
+      const pid = parseInt(line, 10);
+      if (pid && !pidsKilled.has(pid)) {
+        try {
+          process.kill(pid, "SIGTERM");
+          pidsKilled.add(pid);
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  if (pidsKilled.size > 0) {
+    const deadline = Date.now() + 3e3;
+    while (Date.now() < deadline) {
+      try {
+        execFileSync("lsof", ["-ti", `tcp:${config.port}`], {
+          encoding: "utf-8",
+          timeout: 1e3,
+          stdio: ["ignore", "pipe", "ignore"]
+        });
+      } catch {
+        break;
+      }
+      const waitMs = Math.min(200, deadline - Date.now());
+      if (waitMs > 0)
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, waitMs);
+    }
+  }
+}
+function readJsonFile(filePath) {
+  try {
+    return JSON.parse(fs2.readFileSync(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeJsonFile(filePath, data) {
+  fs2.mkdirSync(path2.dirname(filePath), { recursive: true });
+  fs2.writeFileSync(filePath, `${JSON.stringify(data, null, 2)}
+`);
+}
+function isProcessRunning(pidFile) {
+  if (!fs2.existsSync(pidFile)) return { running: false, pid: null };
+  const pid = parseInt(fs2.readFileSync(pidFile, "utf-8").trim(), 10);
+  try {
+    process.kill(pid, 0);
+    return { running: true, pid };
+  } catch {
+    return { running: false, pid };
+  }
+}
+function parseAge(value) {
+  const match = value.match(/^(\d+)\s*(d|h|m)$/);
+  if (!match) {
+    console.error(
+      `Invalid --older-than value: ${value} (use e.g. 30d, 24h, 60m)`
+    );
+    process.exit(1);
+  }
+  const n = parseInt(match[1], 10);
+  const unit = match[2];
+  const multipliers = {
+    d: 864e5,
+    h: 36e5,
+    m: 6e4
+  };
+  return n * multipliers[unit];
+}
+function promptUser(question) {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+function tailLines(filePath, n) {
+  const CHUNK_SIZE = 64 * 1024;
+  const fd = fs2.openSync(filePath, "r");
+  try {
+    const { size } = fs2.fstatSync(fd);
+    if (size === 0) return [];
+    const readStart = Math.max(0, size - CHUNK_SIZE);
+    const buf = Buffer.alloc(size - readStart);
+    fs2.readSync(fd, buf, 0, buf.length, readStart);
+    const chunk = buf.toString("utf-8");
+    const lines = chunk.split("\n");
+    if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+    if (readStart > 0 && lines.length > 0) lines.shift();
+    return lines.slice(-n);
+  } finally {
+    fs2.closeSync(fd);
+  }
+}
+function readStdin() {
+  const chunks = [];
+  return new Promise((resolve, reject) => {
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on(
+      "end",
+      () => resolve(Buffer.concat(chunks).toString("utf-8"))
+    );
+    process.stdin.on("error", reject);
+  });
+}
+function configureShellEnv(force, target = "claude", proxy = false) {
+  const shellRc = path2.join(
+    os.homedir(),
+    process.env.SHELL?.includes("zsh") ? ".zshrc" : ".bashrc"
+  );
+  const rcContent = fs2.existsSync(shellRc) ? fs2.readFileSync(shellRc, "utf-8") : "";
+  const allTargetVarNames = /* @__PURE__ */ new Set();
+  for (const v of allTargets()) {
+    for (const [varName] of v.shellEnv.envVars(config.port, true)) {
+      allTargetVarNames.add(varName);
+    }
+  }
+  const PANOPTICON_VARS = [
+    "OTEL_EXPORTER_OTLP_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_PROTOCOL",
+    "OTEL_METRICS_EXPORTER",
+    "OTEL_LOGS_EXPORTER",
+    "OTEL_LOG_TOOL_DETAILS",
+    "OTEL_LOG_USER_PROMPTS",
+    "OTEL_METRIC_EXPORT_INTERVAL",
+    ...allTargetVarNames
+  ];
+  const PANOPTICON_COMMENTS = ["# >>> panopticon", "# <<< panopticon"];
+  const isPanopticonLine = (line) => {
+    const trimmed = line.trim();
+    if (PANOPTICON_COMMENTS.some((c) => trimmed.startsWith(c))) return true;
+    for (const v of PANOPTICON_VARS) {
+      if (trimmed === `export ${v}` || trimmed.startsWith(`export ${v}=`))
+        return true;
+    }
+    return false;
+  };
+  const wantedLines = [
+    ["# >>> panopticon >>>", "# >>> panopticon >>>"],
+    [
+      "OTEL_EXPORTER_OTLP_ENDPOINT",
+      `export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:${config.port}`
+    ],
+    [
+      "OTEL_EXPORTER_OTLP_PROTOCOL",
+      "export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf"
+    ],
+    ["OTEL_METRICS_EXPORTER", "export OTEL_METRICS_EXPORTER=otlp"],
+    ["OTEL_LOGS_EXPORTER", "export OTEL_LOGS_EXPORTER=otlp"],
+    ["OTEL_LOG_TOOL_DETAILS", "export OTEL_LOG_TOOL_DETAILS=1"],
+    ["OTEL_LOG_USER_PROMPTS", "export OTEL_LOG_USER_PROMPTS=1"],
+    ["OTEL_METRIC_EXPORT_INTERVAL", "export OTEL_METRIC_EXPORT_INTERVAL=10000"]
+  ];
+  const selectedTargetList = target === "all" ? allTargets() : allTargets().filter((v) => v.id === target);
+  for (const t of selectedTargetList) {
+    for (const [varName, value] of t.shellEnv.envVars(config.port, proxy)) {
+      wantedLines.push([varName, `export ${varName}=${value}`]);
+    }
+  }
+  wantedLines.push(["# <<< panopticon <<<", "# <<< panopticon <<<"]);
+  const lines = rcContent.split("\n");
+  const seen = /* @__PURE__ */ new Set();
+  let lastPanopticonIdx = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (!isPanopticonLine(lines[i])) continue;
+    lastPanopticonIdx = i;
+    const match = wantedLines.find(([key]) => {
+      if (key.startsWith("#")) return lines[i].trim().startsWith(key);
+      return lines[i].trim() === `export ${key}` || lines[i].trim().startsWith(`export ${key}=`);
+    });
+    if (match) {
+      if (!force && lines[i].trim() !== match[1] && !match[0].startsWith("#")) {
+        console.log(`      \u26A0 Keeping existing value: ${lines[i].trim()}`);
+        console.log(`        (default would be: ${match[1]})`);
+        console.log("        (use --force to overwrite)");
+      } else {
+        lines[i] = match[1];
+      }
+      seen.add(match[0]);
+    } else {
+      lines[i] = "";
+    }
+  }
+  const newLines = wantedLines.filter(([key]) => !seen.has(key)).map(([, val]) => val);
+  if (newLines.length > 0) {
+    if (lastPanopticonIdx >= 0) {
+      lines.splice(lastPanopticonIdx + 1, 0, ...newLines);
+    } else {
+      lines.push("", ...newLines, "");
+    }
+  }
+  fs2.writeFileSync(shellRc, lines.join("\n"));
+  console.log(
+    `      ${lastPanopticonIdx >= 0 ? "Updated" : "Added"} env vars in ${shellRc}
+`
+  );
+}
+function removeShellEnv() {
+  const shellRc = path2.join(
+    os.homedir(),
+    process.env.SHELL?.includes("zsh") ? ".zshrc" : ".bashrc"
+  );
+  if (!fs2.existsSync(shellRc)) return;
+  const content = fs2.readFileSync(shellRc, "utf-8");
+  const lines = content.split("\n");
+  let inBlock = false;
+  const filtered = lines.filter((line) => {
+    if (line.trim().startsWith("# >>> panopticon")) {
+      inBlock = true;
+      return false;
+    }
+    if (line.trim().startsWith("# <<< panopticon")) {
+      inBlock = false;
+      return false;
+    }
+    return !inBlock;
+  });
+  fs2.writeFileSync(shellRc, filtered.join("\n"));
+  console.log(`      Removed panopticon env vars from ${shellRc}
+`);
+}
+var program = new Command();
+program.name("panopticon").description("Observability for Claude Code").version(
+  true ? "0.1.0+2aee981" : "dev"
+);
+program.command("install").alias("setup").description("Build, register plugin, init DB, configure shell").option(
+  "--target <target>",
+  `Target CLI: ${targetIds().join(", ")}, all`,
+  "all"
+).option("--proxy", "Also route API traffic through the panopticon proxy").option("--force", "Overwrite customized env vars with defaults").action(async (opts) => {
+  const validTargets = [...targetIds(), "all"];
+  if (!validTargets.includes(opts.target)) {
+    console.error(
+      `Invalid target: ${opts.target}. Must be ${validTargets.join(", ")}.`
+    );
+    process.exit(1);
+  }
+  const pluginRoot = getPluginRoot();
+  await install(pluginRoot, opts);
+});
+program.command("uninstall").description("Remove panopticon hooks, shell config, and optionally all data").option(
+  "--target <target>",
+  `Target CLI: ${targetIds().join(", ")}, all`,
+  "all"
+).option("--purge", "Also remove database and all data").action(async (opts) => {
+  const validTargets = [...targetIds(), "all"];
+  if (!validTargets.includes(opts.target)) {
+    console.error(
+      `Invalid target: ${opts.target}. Must be ${validTargets.join(", ")}.`
+    );
+    process.exit(1);
+  }
+  const targetId = opts.target ?? "all";
+  const purge = !!opts.purge;
+  console.log("Uninstalling panopticon...\n");
+  console.log("[1/6] Stopping daemons...");
+  stopExistingDaemons();
+  console.log();
+  console.log("[2/6] Uninstalling MCP plugin...");
+  if (targetId === "all" || targetId === "claude") {
+    try {
+      execFileSync(
+        "claude",
+        ["plugin", "uninstall", "panopticon@local-plugins"],
+        {
+          stdio: "ignore",
+          timeout: 1e4
+        }
+      );
+      console.log("      Uninstalled plugin via Claude Code CLI");
+    } catch {
+    }
+  } else {
+    console.log("      Skipped (target-specific uninstall)");
+  }
+  console.log();
+  const selectedTargets = targetId === "all" ? allTargets() : allTargets().filter((t) => t.id === targetId);
+  for (const t of selectedTargets) {
+    console.log(`[3/6] Removing panopticon from ${t.detect.displayName}...`);
+    let existing;
+    if (t.config.configFormat === "toml") {
+      existing = readTomlFile(t.config.configPath);
+    } else {
+      existing = readJsonFile(t.config.configPath) ?? {};
+    }
+    const updated = t.hooks.removeInstallConfig(existing);
+    if (t.config.configFormat === "toml") {
+      writeTomlFile(t.config.configPath, updated);
+    } else {
+      writeJsonFile(t.config.configPath, updated);
+    }
+    console.log(`      ${t.config.configPath}
+`);
+  }
+  console.log("[4/6] Cleaning shell environment...");
+  removeShellEnv();
+  if (targetId === "all") {
+    console.log("[5/6] Removing marketplace and plugin cache...");
+    try {
+      fs2.rmSync(config.marketplaceDir, { recursive: true, force: true });
+      console.log(`      Removed ${config.marketplaceDir}`);
+    } catch {
+    }
+    try {
+      fs2.rmSync(config.pluginCacheDir, { recursive: true, force: true });
+      console.log(`      Removed ${config.pluginCacheDir}`);
+    } catch {
+    }
+    console.log();
+    console.log("[6/6] Removing skills...");
+    const pluginRoot = getPluginRoot();
+    const skillsSource = path2.join(pluginRoot, "skills");
+    const skillsTarget = path2.join(os.homedir(), ".claude", "skills");
+    if (fs2.existsSync(skillsSource)) {
+      for (const name of fs2.readdirSync(skillsSource)) {
+        const dest = path2.join(skillsTarget, name);
+        try {
+          fs2.rmSync(dest, { recursive: true, force: true });
+          console.log(`      Removed ${dest}`);
+        } catch {
+        }
+      }
+    }
+    console.log();
+  } else {
+    console.log("[5/6] Skipping marketplace (target-specific uninstall)");
+    console.log("[6/6] Skipping skills (target-specific uninstall)\n");
+  }
+  if (purge) {
+    console.log("Purging data...");
+    closeDb();
+    try {
+      fs2.rmSync(config.dataDir, { recursive: true, force: true });
+      console.log(`      Removed ${config.dataDir}`);
+    } catch {
+    }
+    try {
+      fs2.rmSync(LOG_DIR, { recursive: true, force: true });
+      console.log(`      Removed ${LOG_DIR}`);
+    } catch {
+    }
+    console.log();
+  }
+  console.log("Done! Panopticon has been uninstalled.");
+  if (!purge) {
+    console.log(
+      `Database preserved at ${config.dataDir} (use --purge to remove)`
+    );
+  }
+});
+program.command("update").description("Update panopticon to the latest version").action(async () => {
+  const currentVersion = true ? "0.1.0+2aee981" : "unknown";
+  console.log(`Current: ${currentVersion}`);
+  console.log(
+    "To update, re-run the install command for your package manager:\n"
+  );
+  console.log("  pnpm install -g @fml-inc/panopticon@latest");
+  console.log("  # or: npm install -g @fml-inc/panopticon@latest\n");
+  console.log("Then run: panopticon install");
+});
+async function install(pluginRoot, opts) {
+  const force = opts.force ?? false;
+  const target = opts.target ?? "claude";
+  console.log("Installing panopticon...\n");
+  const pkgJson = readJsonFile(path2.join(pluginRoot, "package.json"));
+  const version = pkgJson?.version ?? "0.0.0-dev";
+  console.log("[1/5] Initializing database and log directory...");
+  ensureDataDir();
+  const logDir = path2.dirname(logPaths.server);
+  fs2.mkdirSync(logDir, { recursive: true });
+  getDb();
+  closeDb();
+  console.log(`      ${config.dbPath}`);
+  console.log(`      ${logDir}`);
+  const pricing = await refreshPricing2();
+  console.log(
+    pricing ? `      Cached pricing for ${Object.keys(pricing.models).length} models
+` : "      Could not fetch pricing (will use defaults)\n"
+  );
+  console.log("[2/5] Setting up local marketplace...");
+  fs2.mkdirSync(path2.join(config.marketplaceDir, ".claude-plugin"), {
+    recursive: true
+  });
+  const manifest = readJsonFile(config.marketplaceManifest) ?? {
+    name: "local-plugins",
+    owner: { name: os.userInfo().username },
+    plugins: []
+  };
+  const plugins = manifest.plugins ?? [];
+  const existing = plugins.findIndex((p) => p.name === "panopticon");
+  const entry = {
+    name: "panopticon",
+    source: "./panopticon",
+    description: pkgJson?.description ?? "Observability for Claude Code"
+  };
+  if (existing >= 0) {
+    plugins[existing] = entry;
+  } else {
+    plugins.push(entry);
+  }
+  manifest.plugins = plugins;
+  writeJsonFile(config.marketplaceManifest, manifest);
+  const symlinkType = process.platform === "win32" ? "junction" : "dir";
+  const marketplaceLink = path2.join(config.marketplaceDir, "panopticon");
+  try {
+    fs2.unlinkSync(marketplaceLink);
+  } catch {
+  }
+  fs2.symlinkSync(pluginRoot, marketplaceLink, symlinkType);
+  const cacheDir = path2.join(config.pluginCacheDir, version);
+  fs2.mkdirSync(cacheDir, { recursive: true });
+  const filesToSync = [
+    ".claude-plugin",
+    "hooks",
+    "bin",
+    "dist",
+    "skills",
+    "node_modules",
+    "package.json",
+    "package-lock.json"
+  ];
+  for (const name of filesToSync) {
+    const src = path2.join(pluginRoot, name);
+    const dest = path2.join(cacheDir, name);
+    if (fs2.existsSync(src)) {
+      fs2.rmSync(dest, { recursive: true, force: true });
+      fs2.cpSync(src, dest, { recursive: true, dereference: true });
+    }
+  }
+  const binDir = path2.join(pluginRoot, "bin");
+  if (fs2.existsSync(binDir)) {
+    for (const file of fs2.readdirSync(binDir)) {
+      const binPath = path2.join(binDir, file);
+      if (fs2.statSync(binPath).isFile()) {
+        fs2.chmodSync(binPath, 493);
+      }
+    }
+    const cachedBinDir = path2.join(cacheDir, "bin");
+    if (fs2.existsSync(cachedBinDir)) {
+      for (const file of fs2.readdirSync(cachedBinDir)) {
+        const binPath = path2.join(cachedBinDir, file);
+        if (fs2.statSync(binPath).isFile()) {
+          fs2.chmodSync(binPath, 493);
+        }
+      }
+    }
+  }
+  console.log(`      Marketplace: ${config.marketplaceDir}`);
+  console.log(`      Cache: ${cacheDir}
+`);
+  const selectedTargets = target === "all" ? allTargets() : [getTarget(target)].filter(
+    Boolean
+  );
+  for (const t of selectedTargets) {
+    console.log(`[3/5] Registering panopticon in ${t.detect.displayName}...`);
+    let existingConfig;
+    if (t.config.configFormat === "toml") {
+      existingConfig = readTomlFile(t.config.configPath);
+    } else {
+      existingConfig = readJsonFile(t.config.configPath) ?? {};
+    }
+    const updatedConfig = t.hooks.applyInstallConfig(existingConfig, {
+      pluginRoot,
+      port: config.port,
+      proxy: !!opts.proxy
+    });
+    if (t.config.configFormat === "toml") {
+      writeTomlFile(t.config.configPath, updatedConfig);
+    } else {
+      writeJsonFile(t.config.configPath, updatedConfig);
+    }
+    if (opts.proxy && t.id === "codex") {
+      console.log("      API proxy enabled (--proxy)");
+    }
+    console.log(`      ${t.config.configPath}
+`);
+  }
+  const skippedTargets = allTargets().filter(
+    (v) => !selectedTargets.some((st) => st.id === v.id)
+  );
+  for (const t of skippedTargets) {
+    console.log(`[3/5] Skipping ${t.detect.displayName} settings...
+`);
+  }
+  console.log("[4/5] Installing skills...");
+  const skillsSource = path2.join(pluginRoot, "skills");
+  const skillsTarget = path2.join(os.homedir(), ".claude", "skills");
+  if (fs2.existsSync(skillsSource)) {
+    for (const skillName of fs2.readdirSync(skillsSource)) {
+      const src = path2.join(skillsSource, skillName);
+      if (!fs2.statSync(src).isDirectory()) continue;
+      const dest = path2.join(skillsTarget, skillName);
+      fs2.mkdirSync(dest, { recursive: true });
+      for (const file of fs2.readdirSync(src)) {
+        fs2.cpSync(path2.join(src, file), path2.join(dest, file), {
+          recursive: true
+        });
+      }
+      console.log(`      ${skillName} -> ${dest}`);
+    }
+  }
+  console.log();
+  console.log("[5/5] Configuring shell environment...");
+  configureShellEnv(force, target, !!opts.proxy);
+  stopExistingDaemons();
+  const serverScript = path2.resolve(
+    path2.dirname(fileURLToPath(import.meta.url)),
+    "server.js"
+  );
+  const logFd = openLogFd("server");
+  const child = spawn("node", [serverScript], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    env: { ...process.env, PANOPTICON_PORT: String(config.port) }
+  });
+  if (child.pid) {
+    fs2.writeFileSync(config.serverPidFile, String(child.pid));
+    console.log(`
+Server started (PID ${child.pid}) on :${config.port}`);
+  }
+  child.unref();
+  fs2.closeSync(logFd);
+  const assistant = target === "all" ? allTargets().map((v) => v.detect.displayName).join(", ") : getTarget(target)?.detect.displayName ?? target;
+  console.log(`Done! Start a new ${assistant} session to activate.
+`);
+  console.log("Verify with: panopticon status");
+}
+program.command("start").description("Start panopticon server (background)").action(async () => {
+  ensureDataDir();
+  if (fs2.existsSync(config.serverPidFile)) {
+    const pid = parseInt(
+      fs2.readFileSync(config.serverPidFile, "utf-8").trim(),
+      10
+    );
+    try {
+      process.kill(pid, 0);
+      console.log(`Panopticon already running (PID ${pid})`);
+      return;
+    } catch {
+      fs2.unlinkSync(config.serverPidFile);
+    }
+  }
+  for (const legacyPid of [config.pidFile, config.proxyPidFile]) {
+    if (fs2.existsSync(legacyPid)) {
+      try {
+        const pid = parseInt(fs2.readFileSync(legacyPid, "utf-8").trim(), 10);
+        process.kill(pid, "SIGTERM");
+      } catch {
+      }
+      try {
+        fs2.unlinkSync(legacyPid);
+      } catch {
+      }
+    }
+  }
+  const serverScript = path2.resolve(
+    path2.dirname(fileURLToPath(import.meta.url)),
+    "server.js"
+  );
+  const logFd = openLogFd("server");
+  const child = spawn("node", [serverScript], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    env: {
+      ...process.env,
+      PANOPTICON_PORT: String(config.port)
+    }
+  });
+  await new Promise((resolve, reject) => {
+    child.on("error", (err) => {
+      reject(new Error(`Failed to start: ${err.message}`));
+    });
+    setTimeout(() => {
+      if (child.pid) {
+        fs2.writeFileSync(config.serverPidFile, String(child.pid));
+        child.unref();
+        fs2.closeSync(logFd);
+        console.log(
+          `Panopticon started (PID ${child.pid}) on :${config.port}`
+        );
+        console.log(`Log: ${logPaths.server}`);
+        resolve();
+      } else {
+        fs2.closeSync(logFd);
+        reject(new Error("Failed to start panopticon server"));
+      }
+    }, 500);
+  });
+});
+program.command("stop").description("Stop panopticon server").action(() => {
+  if (!fs2.existsSync(config.serverPidFile)) {
+    console.log("Panopticon is not running (no PID file)");
+    return;
+  }
+  const pid = parseInt(
+    fs2.readFileSync(config.serverPidFile, "utf-8").trim(),
+    10
+  );
+  try {
+    process.kill(pid, "SIGTERM");
+    fs2.unlinkSync(config.serverPidFile);
+    console.log(`Panopticon stopped (PID ${pid})`);
+  } catch {
+    fs2.unlinkSync(config.serverPidFile);
+    console.log("Panopticon was not running (stale PID file removed)");
+  }
+});
+program.command("doctor").description("Check system health, server, database, and configuration").option("--json", "Output as JSON").action(async (opts) => {
+  const { doctor } = await import("./doctor.js");
+  const result = await doctor();
+  if (opts.json) {
+    output(result);
+    return;
+  }
+  console.log(
+    `System: ${result.system.os} \xB7 Node ${result.system.node}${result.system.sandbox ? " \xB7 Sandbox" : ""}`
+  );
+  console.log();
+  for (const check of result.checks) {
+    const icon = check.status === "ok" ? "\x1B[32m\u2713\x1B[0m" : check.status === "warn" ? "\x1B[33m!\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
+    console.log(`  ${icon}  ${check.label.padEnd(12)} ${check.detail}`);
+  }
+  console.log();
+  const passed = result.checks.filter((c) => c.status === "ok").length;
+  const warned = result.checks.filter((c) => c.status === "warn").length;
+  const failed = result.checks.filter((c) => c.status === "fail").length;
+  const parts = [];
+  if (passed > 0) parts.push(`\x1B[32m${passed} passed\x1B[0m`);
+  if (warned > 0)
+    parts.push(`\x1B[33m${warned} warning${warned > 1 ? "s" : ""}\x1B[0m`);
+  if (failed > 0) parts.push(`\x1B[31m${failed} failed\x1B[0m`);
+  console.log(`  ${parts.join(", ")}`);
+  if (result.recentErrors.length > 0) {
+    console.log();
+    console.log("  Recent errors:");
+    for (const err of result.recentErrors) {
+      console.log(`    [${err.id}] ${err.body}`);
+    }
+  }
+  if (result.recentEvents.length > 0) {
+    console.log();
+    console.log("  Recent events:");
+    for (const evt of result.recentEvents) {
+      const tool = evt.toolName ? ` (${evt.toolName})` : "";
+      console.log(`    ${evt.eventType}${tool} \u2014 ${evt.timestamp}`);
+    }
+  }
+  console.log();
+});
+program.command("status").description("Show server status and database stats").action(async () => {
+  const server = isProcessRunning(config.serverPidFile);
+  console.log("Panopticon Status");
+  console.log("=================");
+  console.log();
+  console.log(
+    `Server: ${server.running ? `running (PID ${server.pid}, port ${config.port})` : "stopped"}`
+  );
+  console.log(`Database: ${config.dbPath}`);
+  console.log();
+  console.log("Log files:");
+  for (const name of DAEMON_NAMES) {
+    const logPath = logPaths[name];
+    let sizeStr = "not created";
+    try {
+      const stat = fs2.statSync(logPath);
+      sizeStr = stat.size < 1024 ? `${stat.size} B` : `${(stat.size / 1024).toFixed(1)} KB`;
+    } catch {
+    }
+    console.log(`  ${name}: ${logPath} (${sizeStr})`);
+  }
+  if (fs2.existsSync(config.dbPath)) {
+    const stat = fs2.statSync(config.dbPath);
+    console.log(`Database size: ${(stat.size / 1024).toFixed(1)} KB`);
+    if (server.running) {
+      try {
+        const stats = await dbStats();
+        console.log();
+        console.log("Row counts:");
+        console.log(`  sessions:       ${stats.sessions}`);
+        console.log(`  messages:       ${stats.messages}`);
+        console.log(`  tool_calls:     ${stats.tool_calls}`);
+        console.log(`  scanner_turns:  ${stats.scanner_turns}`);
+        console.log(`  scanner_events: ${stats.scanner_events}`);
+        console.log(`  hook_events:    ${stats.hook_events}`);
+        console.log(`  otel_logs:      ${stats.otel_logs}`);
+        console.log(`  otel_metrics:   ${stats.otel_metrics}`);
+      } catch {
+        console.log("  (could not read database)");
+      }
+    }
+  } else {
+    console.log("Database: not initialized (run 'panopticon install')");
+  }
+  try {
+    const cfg = loadUnifiedConfig();
+    const targets = cfg.sync.targets;
+    if (targets.length > 0) {
+      console.log();
+      console.log("Sync targets:");
+      for (const t of targets) {
+        console.log(`  ${t.name} \u2192 ${t.url}`);
+        if (server.running) {
+          try {
+            const result = await syncPending(t.name);
+            if (result.totalPending === 0) {
+              console.log("    status: up to date");
+            } else {
+              console.log(`    pending: ${result.totalPending} total`);
+              for (const [table, info] of Object.entries(result.tables)) {
+                console.log(
+                  `      ${table}: ${info.pending} (${info.watermark} / ${info.maxId})`
+                );
+              }
+            }
+          } catch {
+          }
+        }
+      }
+    }
+  } catch {
+  }
+});
+program.command("logs").alias("log").description("View daemon logs (otlp, mcp)").argument("[daemon]", "Daemon name (otlp, mcp)", "otlp").option("-f, --follow", "Follow log output (like tail -f)").option("-n, --lines <count>", "Number of lines to show", "50").action(async (daemon, opts) => {
+  if (!DAEMON_NAMES.includes(daemon)) {
+    console.error(`Unknown daemon: ${daemon}`);
+    console.log(`Available: ${DAEMON_NAMES.join(", ")}`);
+    process.exit(1);
+  }
+  const logPath = logPaths[daemon];
+  const numLines = parseInt(opts.lines, 10);
+  if (!fs2.existsSync(logPath)) {
+    console.log(`No logs yet for ${daemon} (${logPath})`);
+    return;
+  }
+  const lines = tailLines(logPath, numLines);
+  for (const line of lines) {
+    console.log(line);
+  }
+  if (opts.follow) {
+    let pos = fs2.statSync(logPath).size;
+    fs2.watchFile(logPath, { interval: 200 }, () => {
+      const stat = fs2.statSync(logPath);
+      if (stat.size > pos) {
+        const fd = fs2.openSync(logPath, "r");
+        const buf = Buffer.alloc(stat.size - pos);
+        fs2.readSync(fd, buf, 0, buf.length, pos);
+        fs2.closeSync(fd);
+        process.stdout.write(buf.toString("utf-8"));
+        pos = stat.size;
+      } else if (stat.size < pos) {
+        pos = 0;
+      }
+    });
+    await new Promise(() => {
+    });
+  }
+});
+program.command("prune").description("Delete old data from the database").option("--older-than <age>", "Max age (e.g. 30d, 24h, 60m)", "30d").option("--dry-run", "Show estimate without deleting").option("--vacuum", "Reclaim disk space after pruning").option("--yes", "Skip confirmation prompt").action(async (opts) => {
+  const ageMs = parseAge(opts.olderThan);
+  const cutoffMs = Date.now() - ageMs;
+  const cutoffDate = new Date(cutoffMs).toISOString();
+  console.log(
+    `Pruning rows older than ${opts.olderThan} (before ${cutoffDate})`
+  );
+  console.log();
+  const estimate = await pruneEstimate(cutoffMs);
+  const total = Object.values(estimate).reduce((a, b) => a + b, 0);
+  console.log("Rows to delete:");
+  for (const [key, count] of Object.entries(estimate)) {
+    if (count > 0) console.log(`  ${key}: ${count}`);
+  }
+  console.log(`  total: ${total}`);
+  console.log();
+  if (total === 0) {
+    console.log("Nothing to prune.");
+    return;
+  }
+  if (opts.dryRun) {
+    console.log("Dry run \u2014 no rows deleted.");
+    return;
+  }
+  if (!opts.yes) {
+    const answer = await promptUser("Proceed with deletion? [y/N] ");
+    if (answer.toLowerCase() !== "y") {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const result = await pruneExecute(cutoffMs, {
+    vacuum: opts.vacuum
+  });
+  console.log("Deleted:");
+  for (const [key, count] of Object.entries(result)) {
+    if (count > 0) console.log(`  ${key}: ${count}`);
+  }
+  if (opts.vacuum) {
+    console.log("\nDisk space reclaimed.");
+  }
+});
+program.command("sync").description("Manage sync targets (OTLP export)").addCommand(
+  new Command("add").description("Add or update a sync target").argument("<name>", "Target name").argument("<url>", "OTLP endpoint base URL").option("--token <token>", "Bearer token for auth").option(
+    "--token-command <command>",
+    "Shell command that returns a token (e.g. 'gh auth token')"
+  ).action(async (name, url, opts) => {
+    await syncTargetAdd({
+      name,
+      url,
+      token: opts.token ?? void 0,
+      tokenCommand: opts.tokenCommand ?? void 0
+    });
+    console.log(`Added sync target "${name}" \u2192 ${url}`);
+    console.log("Restart panopticon to activate.");
+  })
+).addCommand(
+  new Command("remove").description("Remove a sync target").argument("<name>", "Target name").action(async (name) => {
+    const result = await syncTargetRemove(name);
+    if (result.ok) {
+      console.log(`Removed sync target "${name}"`);
+      console.log("Restart panopticon to apply.");
+    } else {
+      console.log(`No target named "${name}"`);
+    }
+  })
+).addCommand(
+  new Command("list").description("List sync targets").action(async () => {
+    const result = await syncTargetList();
+    if (result.targets.length === 0) {
+      console.log("No sync targets configured.");
+      return;
+    }
+    for (const t of result.targets) {
+      const auth = t.token ? " (token)" : t.tokenCommand ? ` (token-command: ${t.tokenCommand})` : "";
+      console.log(`  ${t.name} \u2192 ${t.url}${auth}`);
+    }
+  })
+).addCommand(
+  new Command("reset").description("Reset sync watermarks (re-syncs all data)").argument("[target]", "Reset only this sync target (default: all)").action(async (targetName) => {
+    await syncReset(targetName);
+    console.log(
+      targetName ? `Reset sync watermarks for "${targetName}"` : "Reset all sync watermarks"
+    );
+    console.log("Restart panopticon to re-sync.");
+  })
+).addCommand(
+  new Command("watermark").description("Get or set sync watermarks").argument("<target>", "Sync target name").argument("[table]", "Table name (omit to show all)").option("--set <value>", "Set watermark to this value", parseInt).action(async (target, table, opts) => {
+    if (opts?.set !== void 0) {
+      if (!table) {
+        console.error("Table name is required when setting a watermark");
+        process.exit(1);
+      }
+      const result = await syncWatermarkSet(target, table, opts.set);
+      console.log(`${result.key} = ${result.value}`);
+    } else {
+      const result = await syncWatermarkGet(target, table);
+      if (table) {
+        const r = result;
+        console.log(`${r.key} = ${r.value}`);
+      } else {
+        const r = result;
+        console.log(`Watermarks for "${r.target}":`);
+        for (const [tbl, value] of Object.entries(r.watermarks)) {
+          console.log(`  ${tbl}: ${value}`);
+        }
+      }
+    }
+  })
+);
+program.command("sessions").description("List recent sessions with stats (event count, tools, cost)").option("--limit <n>", "Max sessions to return (default 20)", parseInt).option(
+  "--since <duration>",
+  'Time filter: ISO date or relative like "24h", "7d", "30m"'
+).action(async (opts) => {
+  output(await listSessions({ limit: opts.limit, since: opts.since }));
+});
+program.command("timeline").description("Get messages and tool calls for a session").argument("<session-id>", "The session ID to query").option("--limit <n>", "Max messages to return (default 50)", parseInt).option("--offset <n>", "Number of messages to skip", parseInt).option("--full", "Return full content instead of truncated").action(async (sessionId, opts) => {
+  const result = await sessionTimeline({
+    sessionId,
+    limit: opts.limit,
+    offset: opts.offset,
+    fullPayloads: opts.full
+  });
+  output(result);
+});
+program.command("costs").description("Token usage and cost breakdowns").option(
+  "--since <duration>",
+  'Time filter: ISO date or relative like "24h", "7d"'
+).option("--group-by <key>", "Group by: session, model, or day").action(async (opts) => {
+  output(await costBreakdown({ since: opts.since, groupBy: opts.groupBy }));
+});
+program.command("summary").description("Activity summary \u2014 sessions, prompts, tools, files, costs").option(
+  "--since <duration>",
+  'Time window (default "24h"). ISO date or relative like "24h", "7d"'
+).action(async (opts) => {
+  output(await activitySummary({ since: opts.since }));
+});
+program.command("plans").description("List plans created by Claude Code (from ExitPlanMode events)").option("--session <id>", "Filter to a specific session").option(
+  "--since <duration>",
+  'Time filter: ISO date or relative like "24h", "7d"'
+).option("--limit <n>", "Max plans to return (default 20)", parseInt).action(async (opts) => {
+  output(
+    await listPlans({
+      session_id: opts.session,
+      since: opts.since,
+      limit: opts.limit
+    })
+  );
+});
+program.command("search").description("Full-text search across events and messages").argument("<query>", "Text to search for").option("--types <types...>", "Filter to specific event types").option(
+  "--since <duration>",
+  'Time filter: ISO date or relative like "24h", "7d"'
+).option("--limit <n>", "Max results (default 20)", parseInt).option("--offset <n>", "Number of results to skip", parseInt).option("--full", "Return full payloads instead of truncated").action(async (query, opts) => {
+  const result = await search({
+    query,
+    eventTypes: opts.types,
+    since: opts.since,
+    limit: opts.limit,
+    offset: opts.offset,
+    fullPayloads: opts.full
+  });
+  output(result);
+});
+program.command("print").alias("event").description("Get full details for a record by source and ID").argument("<source>", "Source: hook, otel, or message").argument("<id>", "Record ID from search/timeline results").action(async (source, id) => {
+  if (source !== "hook" && source !== "otel" && source !== "message") {
+    console.error(
+      `Invalid source: ${source} (must be "hook", "otel", or "message")`
+    );
+    process.exit(1);
+  }
+  const result = await print({ source, id: parseInt(id, 10) });
+  if (!result) {
+    console.error(`No ${source} record found with id ${id}`);
+    process.exit(1);
+  }
+  output(result);
+});
+program.command("query").description("Execute a read-only SQL query against the database").argument("<sql>", "SQL query (SELECT/WITH/PRAGMA only)").action(async (sql) => {
+  try {
+    output(await rawQuery(sql));
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    process.exit(1);
+  }
+});
+program.command("db-stats").description("Show database row counts for each table").action(async () => {
+  output(await dbStats());
+});
+program.command("refresh-pricing").description("Fetch latest model pricing from LiteLLM").action(async () => {
+  console.log("Fetching pricing from LiteLLM...");
+  const result = await refreshPricing();
+  if (result && typeof result === "object" && "models" in result) {
+    const models = result.models;
+    console.log(`Cached pricing for ${Object.keys(models).length} models`);
+  } else if (result && typeof result === "object" && "ok" in result) {
+    console.log("Pricing refreshed.");
+  } else {
+    console.error("Failed to fetch pricing");
+    process.exit(1);
+  }
+});
+var permissions = program.command("permissions").description("Show or apply permission rules");
+permissions.command("show", { isDefault: true }).description("Show current approvals and allowed tools/commands").action(() => {
+  output(permissionsShow());
+});
+permissions.command("apply").description("Apply permission rules (reads JSON payload from stdin)").action(async () => {
+  const input = JSON.parse(await readStdin());
+  output(permissionsApply(input));
+});
+program.parseAsync().catch((err) => {
+  console.error("Error:", err.message);
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map