@frostbridge/imdl 0.1.11 → 0.1.13

package/dist/index.js

@@ -7,7 +7,7 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // src/index.ts
-import { Command } from "commander";
+import { Command as Command2 } from "commander";
 
 // src/commands/scan.ts
 import pc from "picocolors";
@@ -633,7 +633,7 @@ import { existsSync as existsSync5, readFileSync as readFileSync2, writeFileSync
 import { join as join4 } from "path";
 
 // src/config/store.ts
-import { readFileSync, writeFileSync, mkdirSync, existsSync as existsSync4, unlinkSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync as existsSync4, unlinkSync, chmodSync } from "fs";
 import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
 import { randomUUID } from "crypto";
@@ -647,8 +647,10 @@ function getBufferDir() {
   return BUFFER_DIR;
 }
 function ensureImdlDir() {
-  if (!existsSync4(IMDL_DIR)) mkdirSync(IMDL_DIR, { recursive: true, mode: 448 });
-  if (!existsSync4(BUFFER_DIR)) mkdirSync(BUFFER_DIR, { recursive: true, mode: 448 });
+  mkdirSync(IMDL_DIR, { recursive: true, mode: 448 });
+  chmodSync(IMDL_DIR, 448);
+  mkdirSync(BUFFER_DIR, { recursive: true, mode: 448 });
+  chmodSync(BUFFER_DIR, 448);
 }
 function isLocalUrl(url) {
   try {
@@ -1231,7 +1233,8 @@ var AGENTS = [
     hooksFile: join6(homedir4(), ".claude", "settings.json"),
     hooks: {
       PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: "imdl hook pre-tool", timeout: 5 }] }],
-      PostToolUse: [{ matcher: "*", hooks: [{ type: "command", command: "imdl hook post-tool", timeout: 5 }] }]
+      PostToolUse: [{ matcher: "*", hooks: [{ type: "command", command: "imdl hook post-tool", timeout: 5 }] }],
+      UserPromptSubmit: [{ matcher: "*", hooks: [{ type: "command", command: "imdl hook prompt", timeout: 5 }] }]
     }
   },
   {
@@ -2705,8 +2708,8 @@ function resumeCommand() {
 import pc6 from "picocolors";
 
 // src/adapters/index.ts
-import { existsSync as existsSync18, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import { join as join18 } from "path";
 
 // src/transport/buffer.ts
 import { appendFileSync, readFileSync as readFileSync11, writeFileSync as writeFileSync5, existsSync as existsSync15, statSync as statSync7, unlinkSync as unlinkSync2 } from "fs";
@@ -3149,6 +3152,21 @@ var ClaudeCodeAdapter = class {
             cwd: entry.cwd,
             agentType: "claude-code"
           });
+        } else if (Array.isArray(content)) {
+          const textBlock = content.find(
+            (block) => block && block.type === "text" && typeof block.text === "string" && block.text.length > 0
+          );
+          if (textBlock) {
+            if (this.isNoisePrompt(textBlock.text)) continue;
+            events.push({
+              sessionId: entry.sessionId || this.sessionIdFromPath(path),
+              type: "user_prompt",
+              prompt: textBlock.text.slice(0, 1e4),
+              timestamp: entry.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+              cwd: entry.cwd,
+              agentType: "claude-code"
+            });
+          }
         }
       }
       if (entry.type === "assistant" && entry.message?.usage) {
@@ -3677,6 +3695,23 @@ var CursorAdapter = class _CursorAdapter {
                     });
                   }
                 }
+                const usage = entry.message?.usage || entry.usage;
+                if (usage && (usage.input_tokens || usage.output_tokens)) {
+                  events.push({
+                    sessionId: sid,
+                    type: "notification",
+                    timestamp: now,
+                    cwd: projectPath,
+                    agentType: "cursor",
+                    usage: {
+                      model: entry.message?.model || entry.model || "unknown",
+                      inputTokens: usage.input_tokens || 0,
+                      outputTokens: usage.output_tokens || 0,
+                      cacheReadTokens: usage.cache_read_input_tokens || 0,
+                      cacheWriteTokens: usage.cache_creation_input_tokens || 0
+                    }
+                  });
+                }
               }
             }
           } catch {
@@ -3727,12 +3762,141 @@ var CursorAdapter = class _CursorAdapter {
   }
 };
 
+// src/adapters/codex.ts
+import { existsSync as existsSync18, readdirSync as readdirSync5, readFileSync as readFileSync13, statSync as statSync10 } from "fs";
+import { join as join17 } from "path";
+import { homedir as homedir14 } from "os";
+var CodexAdapter = class {
+  agentType = "codex";
+  async extractEvents(source) {
+    if (source.kind === "directory") {
+      return this.readSessionsDir(source.path, source.since);
+    }
+    return [];
+  }
+  readSessionsDir(basePath, since) {
+    if (!existsSync18(basePath)) return [];
+    const events = [];
+    const files = this.findSessionFiles(basePath, since);
+    for (const filePath of files) {
+      const fileEvents = this.readSessionFile(filePath, since);
+      events.push(...fileEvents);
+    }
+    return events;
+  }
+  findSessionFiles(basePath, since) {
+    const files = [];
+    const walk = (dir) => {
+      try {
+        for (const entry of readdirSync5(dir)) {
+          const full = join17(dir, entry);
+          try {
+            const stat = statSync10(full);
+            if (stat.isDirectory()) {
+              walk(full);
+            } else if (entry.endsWith(".jsonl")) {
+              if (!since || stat.mtimeMs >= since.getTime()) {
+                files.push(full);
+              }
+            }
+          } catch {
+          }
+        }
+      } catch {
+      }
+    };
+    walk(basePath);
+    return files;
+  }
+  readSessionFile(filePath, since) {
+    const events = [];
+    let content;
+    try {
+      content = readFileSync13(filePath, "utf-8");
+    } catch {
+      return [];
+    }
+    const lines = content.split("\n").filter((l) => l.trim());
+    const sessionId = this.sessionIdFromPath(filePath);
+    let cwd;
+    for (const line of lines) {
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (since && entry.timestamp) {
+        const entryTime = new Date(entry.timestamp).getTime();
+        if (entryTime <= since.getTime()) continue;
+      }
+      const ptype = entry.payload?.type;
+      if (ptype === "turn_context" && entry.payload.cwd) {
+        cwd = entry.payload.cwd;
+      }
+      if (ptype === "user_message" && entry.payload.message) {
+        const msg = entry.payload.message.trim();
+        if (msg.length > 0) {
+          events.push({
+            sessionId,
+            type: "user_prompt",
+            prompt: msg.slice(0, 1e4),
+            timestamp: entry.timestamp,
+            cwd,
+            agentType: "codex"
+          });
+        }
+      }
+      if (ptype === "function_call" && entry.payload.name) {
+        let toolInput;
+        if (entry.payload.arguments) {
+          try {
+            toolInput = JSON.parse(entry.payload.arguments);
+          } catch {
+            toolInput = { raw: entry.payload.arguments };
+          }
+        }
+        events.push({
+          sessionId,
+          type: "pre_tool_use",
+          toolName: entry.payload.name,
+          toolInput,
+          timestamp: entry.timestamp,
+          cwd,
+          agentType: "codex"
+        });
+      }
+      if (ptype === "function_call_output" && entry.payload.output) {
+        events.push({
+          sessionId,
+          type: "post_tool_use",
+          toolName: entry.payload.call_id || "unknown",
+          toolOutput: entry.payload.output.slice(0, 1e4),
+          timestamp: entry.timestamp,
+          cwd,
+          agentType: "codex"
+        });
+      }
+    }
+    return events;
+  }
+  sessionIdFromPath(filePath) {
+    const filename = filePath.split("/").pop() || "";
+    const match = filename.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/);
+    return match ? `codex-${match[1].slice(0, 8)}` : `codex-${filename.replace(".jsonl", "").slice(-8)}`;
+  }
+  static getSessionsDir() {
+    const dir = join17(homedir14(), ".codex", "sessions");
+    return existsSync18(dir) ? dir : null;
+  }
+};
+
 // src/adapters/index.ts
-var STATE_FILE = join17(getImdlDir(), "adapter-state.json");
+var STATE_FILE = join18(getImdlDir(), "adapter-state.json");
 function loadState() {
   try {
-    if (existsSync18(STATE_FILE)) {
-      return JSON.parse(readFileSync13(STATE_FILE, "utf-8"));
+    if (existsSync19(STATE_FILE)) {
+      return JSON.parse(readFileSync14(STATE_FILE, "utf-8"));
     }
   } catch {
   }
@@ -3744,12 +3908,15 @@ function saveState(state) {
 }
 var adapters = [
   new ClaudeCodeAdapter(),
-  new CursorAdapter()
+  new CursorAdapter(),
+  new CodexAdapter()
 ];
 async function collectPrompts() {
   const state = loadState();
   const config = loadConfig();
   let collected = 0;
+  const usageHeaders = { "Content-Type": "application/json" };
+  if (config.authToken) usageHeaders["X-IMDL-Key"] = config.authToken;
   const claudeDirs = ClaudeCodeAdapter.getAllProjectDirs();
   const claudeAdapter = new ClaudeCodeAdapter();
   for (const dir of claudeDirs) {
@@ -3799,8 +3966,6 @@ async function collectPrompts() {
       appendEvent(buffered);
       collected++;
     }
-    const usageHeaders = { "Content-Type": "application/json" };
-    if (config.authToken) usageHeaders["X-IMDL-Key"] = config.authToken;
     for (const [sessionId, usage] of usageBySession) {
       try {
         await fetch(`${config.apiUrl}/api/sessions/${sessionId}/usage`, {
@@ -3814,11 +3979,22 @@ async function collectPrompts() {
     }
   }
   const cursorAdapter = new CursorAdapter();
+  const cursorUsageBySession = /* @__PURE__ */ new Map();
   if (CursorAdapter.getProjectsDir()) {
     try {
       const { events: transcriptEvents, newOffsets } = cursorAdapter.extractFromTranscripts(new Date(state.lastRun), state.offsets);
       state.offsets = newOffsets;
       for (const event of transcriptEvents) {
+        if (event.usage) {
+          const existing = cursorUsageBySession.get(event.sessionId) || { model: event.usage.model, input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+          existing.model = event.usage.model;
+          existing.input += event.usage.inputTokens;
+          existing.output += event.usage.outputTokens;
+          existing.cacheRead += event.usage.cacheReadTokens;
+          existing.cacheWrite += event.usage.cacheWriteTokens;
+          cursorUsageBySession.set(event.sessionId, existing);
+          continue;
+        }
         let violation;
         if (event.prompt) {
           const scan = scanPromptForSecrets(event.prompt);
@@ -3878,6 +4054,52 @@ async function collectPrompts() {
       }
     }
   }
+  for (const [sessionId, usage] of cursorUsageBySession) {
+    try {
+      await fetch(`${config.apiUrl}/api/sessions/${sessionId}/usage`, {
+        method: "POST",
+        headers: usageHeaders,
+        body: JSON.stringify(usage),
+        signal: AbortSignal.timeout(3e3)
+      });
+    } catch {
+    }
+  }
+  const codexSessionsDir = CodexAdapter.getSessionsDir();
+  if (codexSessionsDir) {
+    try {
+      const codexAdapter = new CodexAdapter();
+      const codexEvents = await codexAdapter.extractEvents({
+        kind: "directory",
+        path: codexSessionsDir,
+        since: new Date(state.lastRun)
+      });
+      for (const event of codexEvents) {
+        let violation;
+        if (event.prompt) {
+          const scan = scanPromptForSecrets(event.prompt);
+          if (scan.hasSecrets) {
+            violation = createPromptViolation(scan.findings);
+          }
+        }
+        const buffered = {
+          sessionId: event.sessionId,
+          type: event.type,
+          toolName: event.toolName,
+          toolInput: event.toolInput ? redactObject(event.toolInput) : void 0,
+          toolOutput: event.toolOutput ? redactObject(event.toolOutput) : void 0,
+          prompt: event.prompt ? redactObject(event.prompt) : void 0,
+          timestamp: event.timestamp,
+          cwd: event.cwd,
+          agentType: "codex",
+          violation
+        };
+        appendEvent(buffered);
+        collected++;
+      }
+    } catch {
+    }
+  }
   if (collected > 0) {
     try {
       await tryFlush();
@@ -3902,8 +4124,8 @@ async function collectCommand() {
 
 // src/commands/daemon.ts
 import pc7 from "picocolors";
-import { existsSync as existsSync19, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
+import { join as join19 } from "path";
 var INTERVAL_MS = 3e4;
 async function daemonCommand() {
   console.log(pc7.cyan("imdl daemon started \u2014 collecting every 30s"));
@@ -3912,9 +4134,10 @@ async function daemonCommand() {
     try {
       const count = await collectPrompts();
       const shellCount = await ingestShellEvents();
-      const total = count + shellCount;
+      const agentCount = await ingestAgentEvents();
+      const total = count + shellCount + agentCount;
       if (total > 0) {
-        console.log(pc7.green(`[${(/* @__PURE__ */ new Date()).toLocaleTimeString()}] Collected ${total} event${total !== 1 ? "s" : ""} (prompts: ${count}, shell: ${shellCount})`));
+        console.log(pc7.green(`[${(/* @__PURE__ */ new Date()).toLocaleTimeString()}] Collected ${total} event${total !== 1 ? "s" : ""} (prompts: ${count}, shell: ${shellCount}, os-agent: ${agentCount})`));
       }
       await tryFlush();
     } catch (err) {
@@ -3924,10 +4147,65 @@ async function daemonCommand() {
   await tick();
   setInterval(tick, INTERVAL_MS);
 }
+async function ingestAgentEvents() {
+  const agentLog = join19(getBufferDir(), "agent-events.ndjson");
+  if (!existsSync20(agentLog)) return 0;
+  const content = readFileSync15(agentLog, "utf-8").trim();
+  if (!content) return 0;
+  const config = loadConfig();
+  const lines = content.split("\n");
+  const events = lines.map((line) => {
+    try {
+      return JSON.parse(line);
+    } catch {
+      return null;
+    }
+  }).filter(Boolean);
+  if (events.length === 0) return 0;
+  const headers = { "Content-Type": "application/json" };
+  if (config.authToken) headers["X-IMDL-Key"] = config.authToken;
+  const sessionId = `os_${config.developerId}_${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`;
+  const apiEvents = events.map((e) => ({
+    type: e.event_type === "exec" ? "pre_tool_use" : "tool_call",
+    toolName: `os_${e.event_type}`,
+    toolInput: {
+      process: e.process,
+      path: e.path,
+      address: e.address,
+      pid: e.pid,
+      agent: e.agent
+    },
+    timestamp: e.timestamp,
+    violation: e.decision === "block" ? {
+      action: "block",
+      reason: e.reason,
+      policyName: e.policy_name
+    } : void 0,
+    source: "os_agent"
+  }));
+  let sent = 0;
+  for (let i = 0; i < apiEvents.length; i += 50) {
+    const batch = apiEvents.slice(i, i + 50);
+    try {
+      const res = await fetch(`${config.apiUrl}/api/sessions/${sessionId}/events`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ events: batch, developerId: config.developerId, source: "os_agent" }),
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (res.ok) sent += batch.length;
+    } catch {
+    }
+  }
+  if (sent === apiEvents.length) {
+    writeFileSync7(agentLog, "", { mode: 384 });
+  }
+  return sent;
+}
 async function ingestShellEvents() {
-  const shellLog = join18(getBufferDir(), "shell-events.ndjson");
-  if (!existsSync19(shellLog)) return 0;
-  const content = readFileSync14(shellLog, "utf-8").trim();
+  const shellLog = join19(getBufferDir(), "shell-events.ndjson");
+  if (!existsSync20(shellLog)) return 0;
+  const content = readFileSync15(shellLog, "utf-8").trim();
   if (!content) return 0;
   const config = loadConfig();
   const lines = content.split("\n");
@@ -4032,8 +4310,8 @@ async function requestCommand(options) {
 // src/commands/lock.ts
 import pc9 from "picocolors";
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync8, existsSync as existsSync20 } from "fs";
-import { join as join19, resolve as resolve3 } from "path";
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync8, existsSync as existsSync21 } from "fs";
+import { join as join20, resolve as resolve3 } from "path";
 var LOCKFILE_NAME = "mcp-lock.json";
 function computeIntegrity(server, identity) {
   const payload = JSON.stringify({
@@ -4048,7 +4326,7 @@ function computeIntegrity(server, identity) {
 }
 function getLockfilePath(customPath) {
   if (customPath) return resolve3(customPath);
-  return join19(process.cwd(), LOCKFILE_NAME);
+  return join20(process.cwd(), LOCKFILE_NAME);
 }
 async function lockCommand(options) {
   const detection = await detectMCPConfigs(options.path);
@@ -4118,7 +4396,7 @@ async function lockCommand(options) {
 }
 async function verifyCommand(options) {
   const lockPath = getLockfilePath(options.path);
-  if (!existsSync20(lockPath)) {
+  if (!existsSync21(lockPath)) {
     if (options.json) {
       console.log(JSON.stringify({ error: "No lockfile found. Run `imdl lock` first.", path: lockPath }));
     } else {
@@ -4130,7 +4408,7 @@ async function verifyCommand(options) {
   }
   let lockfile;
   try {
-    lockfile = JSON.parse(readFileSync15(lockPath, "utf-8"));
+    lockfile = JSON.parse(readFileSync16(lockPath, "utf-8"));
   } catch {
     console.log(pc9.red("Failed to parse lockfile."));
     process.exit(1);
@@ -4539,12 +4817,12 @@ async function checkCompliance(developerId) {
 }
 
 // src/permissions/fixer.ts
-import { existsSync as existsSync21, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
-import { join as join20 } from "path";
-import { homedir as homedir14 } from "os";
+import { existsSync as existsSync22, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
+import { join as join21 } from "path";
+import { homedir as homedir15 } from "os";
 function buildFixesFromChanges(changes) {
   const fixes = [];
-  const home = homedir14();
+  const home = homedir15();
   for (const change of changes) {
     const fix = buildFixForAgent(change, home);
     if (fix) fixes.push(fix);
@@ -4554,10 +4832,10 @@ function buildFixesFromChanges(changes) {
 function buildFixForAgent(change, home) {
   const { agentType, category, action, targetGrant } = change;
   if (agentType === "claude-code") {
-    const configPath = join20(home, ".claude", "settings.json");
-    if (!existsSync21(configPath)) return null;
+    const configPath = join21(home, ".claude", "settings.json");
+    if (!existsSync22(configPath)) return null;
     try {
-      const settings = JSON.parse(readFileSync16(configPath, "utf-8"));
+      const settings = JSON.parse(readFileSync17(configPath, "utf-8"));
       const tools = settings.allowedTools || [];
       if (category === "shell") {
         if (!tools.includes("Bash") && !tools.some((t) => t.startsWith("Bash("))) return null;
@@ -4585,10 +4863,10 @@ function buildFixForAgent(change, home) {
     }
   }
   if (agentType === "cursor") {
-    const configPath = join20(home, ".cursor", "settings.json");
-    if (!existsSync21(configPath)) return null;
+    const configPath = join21(home, ".cursor", "settings.json");
+    if (!existsSync22(configPath)) return null;
     try {
-      const settings = JSON.parse(readFileSync16(configPath, "utf-8"));
+      const settings = JSON.parse(readFileSync17(configPath, "utf-8"));
       if ((category === "agentic_mode" || category === "shell") && settings["cursor.composer.yoloMode"] === true) {
         return { agentType, category: "agentic_mode", currentGrant: "unrestricted", newGrant: "confirmation", configPath, description: "Disable YOLO mode" };
       }
@@ -4597,10 +4875,10 @@ function buildFixForAgent(change, home) {
     }
   }
   if (agentType === "codex") {
-    const configPath = join20(home, ".codex", "config.json");
-    if (!existsSync21(configPath)) return null;
+    const configPath = join21(home, ".codex", "config.json");
+    if (!existsSync22(configPath)) return null;
     try {
-      const config = JSON.parse(readFileSync16(configPath, "utf-8"));
+      const config = JSON.parse(readFileSync17(configPath, "utf-8"));
       if ((category === "agentic_mode" || category === "shell") && config.sandbox_mode === "full_auto") {
         return { agentType, category: "agentic_mode", currentGrant: "unrestricted", newGrant: "confirmation", configPath, description: "Switch to supervised mode" };
       }
@@ -4609,10 +4887,10 @@ function buildFixForAgent(change, home) {
     }
   }
   if (agentType === "copilot") {
-    const configPath = join20(home, "Library", "Application Support", "Code", "User", "settings.json");
-    if (!existsSync21(configPath)) return null;
+    const configPath = join21(home, "Library", "Application Support", "Code", "User", "settings.json");
+    if (!existsSync22(configPath)) return null;
     try {
-      const settings = JSON.parse(readFileSync16(configPath, "utf-8"));
+      const settings = JSON.parse(readFileSync17(configPath, "utf-8"));
       if ((category === "agentic_mode" || category === "shell") && (settings["github.copilot.chat.agent.autoApprove"] || settings["chat.agent.autoApprove"])) {
         return { agentType, category: "agentic_mode", currentGrant: "unrestricted", newGrant: "confirmation", configPath, description: "Disable autoApprove" };
       }
@@ -4622,10 +4900,10 @@ function buildFixForAgent(change, home) {
   }
   if (agentType === "windsurf") {
     if (category === "mcp_tools") {
-      const configPath = join20(home, ".windsurf", "mcp.json");
-      if (!existsSync21(configPath)) return null;
+      const configPath = join21(home, ".windsurf", "mcp.json");
+      if (!existsSync22(configPath)) return null;
       try {
-        const config = JSON.parse(readFileSync16(configPath, "utf-8"));
+        const config = JSON.parse(readFileSync17(configPath, "utf-8"));
         const servers = Object.keys(config.mcpServers || {});
         if (servers.length === 0) return null;
         return { agentType, category, currentGrant: "unrestricted", newGrant: "denied", configPath, description: `Remove MCP servers (${servers.join(", ")})` };
@@ -4638,7 +4916,7 @@ function buildFixForAgent(change, home) {
 }
 function applyFix(fix) {
   try {
-    const content = readFileSync16(fix.configPath, "utf-8");
+    const content = readFileSync17(fix.configPath, "utf-8");
     const config = JSON.parse(content);
     let modified = false;
     if (fix.agentType === "claude-code") {
@@ -4929,13 +5207,13 @@ function grantLevel(grant) {
 
 // src/commands/gateway.ts
 import pc12 from "picocolors";
-import { existsSync as existsSync22, readFileSync as readFileSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync3 } from "fs";
-import { join as join21 } from "path";
-import { homedir as homedir15 } from "os";
+import { existsSync as existsSync23, readFileSync as readFileSync18, writeFileSync as writeFileSync10, mkdirSync as mkdirSync3 } from "fs";
+import { join as join22 } from "path";
+import { homedir as homedir16 } from "os";
 import { execSync as execSync2, spawn } from "child_process";
-var IMDL_DIR3 = join21(homedir15(), ".imdl");
-var GATEWAY_CONFIG = join21(IMDL_DIR3, "gateway.toml");
-var GATEWAY_PID_FILE = join21(IMDL_DIR3, "gateway.pid");
+var IMDL_DIR3 = join22(homedir16(), ".imdl");
+var GATEWAY_CONFIG = join22(IMDL_DIR3, "gateway.toml");
+var GATEWAY_PID_FILE = join22(IMDL_DIR3, "gateway.pid");
 var DEFAULT_PORT = 9443;
 async function gatewayCommand(opts) {
   const status = await getGatewayStatus();
@@ -5010,7 +5288,7 @@ async function gatewayStartCommand(opts) {
     });
     child.unref();
     if (child.pid) {
-      if (!existsSync22(IMDL_DIR3)) mkdirSync3(IMDL_DIR3, { recursive: true });
+      if (!existsSync23(IMDL_DIR3)) mkdirSync3(IMDL_DIR3, { recursive: true });
       writeFileSync10(GATEWAY_PID_FILE, String(child.pid));
       console.log(pc12.green(`Gateway started (PID ${child.pid}, port ${port})`));
       console.log(pc12.dim(`  Config: ${GATEWAY_CONFIG}`));
@@ -5038,8 +5316,8 @@ async function gatewayStopCommand() {
     console.log(pc12.yellow("Could not stop gateway \u2014 process may have already exited."));
   }
   try {
-    const { unlinkSync: unlinkSync3 } = await import("fs");
-    unlinkSync3(GATEWAY_PID_FILE);
+    const { unlinkSync: unlinkSync4 } = await import("fs");
+    unlinkSync4(GATEWAY_PID_FILE);
   } catch {
   }
 }
@@ -5070,12 +5348,12 @@ async function gatewayDisableCommand(opts) {
   console.log(pc12.dim("Restart gateway for changes to take effect."));
 }
 async function gatewayAlertsCommand(opts) {
-  const logPath = join21(IMDL_DIR3, "gateway-alerts.jsonl");
-  if (!existsSync22(logPath)) {
+  const logPath = join22(IMDL_DIR3, "gateway-alerts.jsonl");
+  if (!existsSync23(logPath)) {
     console.log(pc12.dim("No alerts logged yet."));
     return;
   }
-  const lines = readFileSync17(logPath, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync18(logPath, "utf-8").split("\n").filter(Boolean);
   const limit = opts.limit ? parseInt(opts.limit, 10) : 20;
   const recent = lines.slice(-limit);
   if (opts.json) {
@@ -5177,9 +5455,9 @@ async function getGatewayStatus() {
   return { running: true, pid, port, stats, config };
 }
 function getRunningPid() {
-  if (!existsSync22(GATEWAY_PID_FILE)) return null;
+  if (!existsSync23(GATEWAY_PID_FILE)) return null;
   try {
-    const pid = parseInt(readFileSync17(GATEWAY_PID_FILE, "utf-8").trim(), 10);
+    const pid = parseInt(readFileSync18(GATEWAY_PID_FILE, "utf-8").trim(), 10);
     return isNaN(pid) ? null : pid;
   } catch {
     return null;
@@ -5194,9 +5472,9 @@ function isProcessAlive(pid) {
   }
 }
 function getConfiguredPort() {
-  if (!existsSync22(GATEWAY_CONFIG)) return DEFAULT_PORT;
+  if (!existsSync23(GATEWAY_CONFIG)) return DEFAULT_PORT;
   try {
-    const content = readFileSync17(GATEWAY_CONFIG, "utf-8");
+    const content = readFileSync18(GATEWAY_CONFIG, "utf-8");
     const match = content.match(/listen_port\s*=\s*(\d+)/);
     return match ? parseInt(match[1], 10) : DEFAULT_PORT;
   } catch {
@@ -5205,12 +5483,12 @@ function getConfiguredPort() {
 }
 function findGatewayBinary() {
   const candidates = [
-    join21(process.cwd(), "target", "release", "imdl-gateway"),
-    join21(process.cwd(), "..", "ai-gateway", "target", "release", "imdl-gateway"),
-    join21(homedir15(), ".imdl", "bin", "imdl-gateway")
+    join22(process.cwd(), "target", "release", "imdl-gateway"),
+    join22(process.cwd(), "..", "ai-gateway", "target", "release", "imdl-gateway"),
+    join22(homedir16(), ".imdl", "bin", "imdl-gateway")
   ];
   for (const path of candidates) {
-    if (existsSync22(path)) return path;
+    if (existsSync23(path)) return path;
   }
   try {
     const result = execSync2("which imdl-gateway", { encoding: "utf-8" }).trim();
@@ -5220,8 +5498,8 @@ function findGatewayBinary() {
   return null;
 }
 function ensureConfig(port) {
-  if (existsSync22(GATEWAY_CONFIG)) return;
-  if (!existsSync22(IMDL_DIR3)) mkdirSync3(IMDL_DIR3, { recursive: true });
+  if (existsSync23(GATEWAY_CONFIG)) return;
+  if (!existsSync23(IMDL_DIR3)) mkdirSync3(IMDL_DIR3, { recursive: true });
   const defaultToml = `# IMDL AI Gateway configuration
 listen_host = "127.0.0.1"
 listen_port = ${port}
@@ -5265,10 +5543,10 @@ function normalizeModule(input) {
   return map[input.toLowerCase()] ?? null;
 }
 function loadGatewayToml() {
-  if (!existsSync22(GATEWAY_CONFIG)) {
+  if (!existsSync23(GATEWAY_CONFIG)) {
     ensureConfig(DEFAULT_PORT);
   }
-  return readFileSync17(GATEWAY_CONFIG, "utf-8");
+  return readFileSync18(GATEWAY_CONFIG, "utf-8");
 }
 function saveGatewayToml(content) {
   writeFileSync10(GATEWAY_CONFIG, content, { mode: 384 });
@@ -5293,6 +5571,146 @@ function formatUptime(seconds) {
   return `${h}h ${m}m`;
 }
 
+// src/commands/uninstall.ts
+import { Command } from "commander";
+import { existsSync as existsSync24, readFileSync as readFileSync19, rmSync, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir17 } from "os";
+import { join as join23 } from "path";
+import pc13 from "picocolors";
+var uninstall = new Command("uninstall").description("Remove all IMDL components, hooks, and configuration").option("--keep-config", "Keep ~/.imdl config directory").option("--force", "Skip confirmation prompt").action(async (opts) => {
+  const home = homedir17();
+  const imdlDir = join23(home, ".imdl");
+  console.log("");
+  console.log(pc13.bold("  Frostbridge IMDL \u2014 Uninstaller"));
+  console.log("");
+  const removed = [];
+  const skipped = [];
+  const claudeSettings = join23(home, ".claude", "settings.json");
+  if (existsSync24(claudeSettings)) {
+    try {
+      const raw = readFileSync19(claudeSettings, "utf8");
+      const settings = JSON.parse(raw);
+      let modified = false;
+      for (const hookType of ["PreToolUse", "PostToolUse", "UserPromptSubmit"]) {
+        if (settings.hooks?.[hookType]) {
+          const before = settings.hooks[hookType].length;
+          settings.hooks[hookType] = settings.hooks[hookType].filter(
+            (h) => !h.hooks?.some((hh) => hh.command?.includes("imdl"))
+          );
+          if (settings.hooks[hookType].length < before) modified = true;
+          if (settings.hooks[hookType].length === 0) delete settings.hooks[hookType];
+        }
+      }
+      if (settings.hooks && Object.keys(settings.hooks).length === 0) delete settings.hooks;
+      if (modified) {
+        const { writeFileSync: writeFileSync12 } = await import("fs");
+        writeFileSync12(claudeSettings, JSON.stringify(settings, null, 2));
+        removed.push("Claude Code hooks");
+      }
+    } catch {
+      skipped.push("Claude Code hooks (could not parse settings.json)");
+    }
+  }
+  const cursorSettings = join23(home, ".cursor", "settings.json");
+  if (existsSync24(cursorSettings)) {
+    try {
+      const raw = readFileSync19(cursorSettings, "utf8");
+      const settings = JSON.parse(raw);
+      let modified = false;
+      if (settings.hooks) {
+        for (const hookType of Object.keys(settings.hooks)) {
+          const before = settings.hooks[hookType]?.length || 0;
+          if (Array.isArray(settings.hooks[hookType])) {
+            settings.hooks[hookType] = settings.hooks[hookType].filter(
+              (h) => !h.hooks?.some((hh) => hh.command?.includes("imdl"))
+            );
+            if (settings.hooks[hookType].length < before) modified = true;
+          }
+        }
+      }
+      if (modified) {
+        const { writeFileSync: writeFileSync12 } = await import("fs");
+        writeFileSync12(cursorSettings, JSON.stringify(settings, null, 2));
+        removed.push("Cursor hooks");
+      }
+    } catch {
+      skipped.push("Cursor hooks (could not parse settings.json)");
+    }
+  }
+  for (const rc of [".bashrc", ".zshrc", ".profile"]) {
+    const rcPath = join23(home, rc);
+    if (existsSync24(rcPath)) {
+      try {
+        const content = readFileSync19(rcPath, "utf8");
+        if (content.includes("imdl") || content.includes("frostbridge")) {
+          const lines = content.split("\n");
+          const filtered = lines.filter(
+            (l) => !l.includes("imdl") && !l.includes("frostbridge") && !l.includes("# Added by Frostbridge")
+          );
+          if (filtered.length < lines.length) {
+            const { writeFileSync: writeFileSync12 } = await import("fs");
+            writeFileSync12(rcPath, filtered.join("\n"));
+            removed.push(`Shell rc entries (${rc})`);
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  try {
+    const pidFile = join23(imdlDir, "daemon.pid");
+    if (existsSync24(pidFile)) {
+      const pid = parseInt(readFileSync19(pidFile, "utf8").trim());
+      if (pid > 0) {
+        try {
+          process.kill(pid, "SIGTERM");
+        } catch {
+        }
+        unlinkSync3(pidFile);
+        removed.push("Background daemon (killed)");
+      }
+    }
+  } catch {
+  }
+  if (!opts.keepConfig && existsSync24(imdlDir)) {
+    rmSync(imdlDir, { recursive: true, force: true });
+    removed.push("~/.imdl config directory");
+  } else if (opts.keepConfig) {
+    skipped.push("~/.imdl (--keep-config)");
+  }
+  const bufferDir = join23(home, ".imdl", "buffer");
+  if (existsSync24(bufferDir)) {
+    rmSync(bufferDir, { recursive: true, force: true });
+    removed.push("Event buffer");
+  }
+  console.log(pc13.dim("  Uninstalling npm packages..."));
+  const { execSync: execSync3 } = await import("child_process");
+  const packages = ["@frostbridge/imdl", "@frostbridge/imdl-shell-wrapper", "@frostbridge/imdl-mcp-proxy"];
+  for (const pkg of packages) {
+    try {
+      execSync3(`npm uninstall -g ${pkg} 2>/dev/null`, { stdio: "pipe" });
+      removed.push(`npm: ${pkg}`);
+    } catch {
+    }
+  }
+  console.log("");
+  if (removed.length > 0) {
+    console.log(pc13.green(pc13.bold("  Removed:")));
+    for (const item of removed) {
+      console.log(pc13.green(`    \u2713 ${item}`));
+    }
+  }
+  if (skipped.length > 0) {
+    console.log(pc13.yellow(pc13.bold("  Skipped:")));
+    for (const item of skipped) {
+      console.log(pc13.yellow(`    \u25CB ${item}`));
+    }
+  }
+  console.log("");
+  console.log(pc13.dim("  IMDL has been completely removed from this machine."));
+  console.log("");
+});
+
 // src/bifrost/compiler.ts
 function globToRegex(glob) {
   const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\?/g, ".").replace(/\{\{GLOBSTAR\}\}/g, ".*");
@@ -5601,18 +6019,18 @@ function ruleTypeToCategory(type) {
 }
 
 // src/transport/sync.ts
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync11, existsSync as existsSync23 } from "fs";
-import { join as join22 } from "path";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync11, existsSync as existsSync25 } from "fs";
+import { join as join24 } from "path";
 var SYNC_INTERVAL = 6e4;
 var SYNC_TIMEOUT = 3e3;
 function getSyncStateFile() {
-  return join22(getImdlDir(), "last_sync.json");
+  return join24(getImdlDir(), "last_sync.json");
 }
 function getLastSyncTime() {
   try {
     const file = getSyncStateFile();
-    if (existsSync23(file)) {
-      const data = JSON.parse(readFileSync18(file, "utf-8"));
+    if (existsSync25(file)) {
+      const data = JSON.parse(readFileSync20(file, "utf-8"));
       return data.lastSync || 0;
     }
   } catch {
@@ -6023,7 +6441,7 @@ function getSafeAlternative(toolName, toolInput) {
 }
 
 // src/index.ts
-var program = new Command();
+var program = new Command2();
 program.name("imdl").description("IMDL \u2014 Intelligent Mediation & Detection Layer. AI agent security.").version("0.1.0");
 program.command("scan").description("Scan MCP server configs for security risks").option("-p, --path <path>", "Path to MCP config file").option("-u, --url <url>", "GitHub URL or org/repo to scan").option("--json", "Output as JSON").option("--no-color", "Disable colored output").option("-q, --quiet", "Only show warnings and errors").option("-d, --deep", "Deep scan: static code analysis + GitHub issue scanning").action(scanCommand);
 program.command("init").description("Detect AI agents and install monitoring hooks").option("-t, --token <token>", "Invite token to join a team").option("--team-token <token>", "Alias for --token").option("--api <url>", "API URL to connect to").option("--non-interactive", "Skip all prompts and use defaults").action((opts) => initCommand({ teamToken: opts.token || opts.teamToken, apiUrl: opts.api, nonInteractive: opts.nonInteractive }));
@@ -6050,5 +6468,6 @@ gwCmd.command("enable <module>").description("Enable a gateway module (secrets,
 gwCmd.command("disable <module>").description("Disable a gateway module").action((module) => gatewayDisableCommand({ module }));
 gwCmd.command("alerts").description("Show recent gateway security alerts").option("-n, --limit <count>", "Number of alerts to show", "20").option("--json", "Output as JSON").action(gatewayAlertsCommand);
 gwCmd.command("cost").description("Show AI spend and usage breakdown").option("--json", "Output as JSON").action(gatewayCostCommand);
+program.addCommand(uninstall);
 program.command("hook <type>").description("Handle hook events from AI agents (internal)").action(handleHook);
 program.parse();

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "restricted"
   },
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "IMDL — Intelligent Mediation & Detection Layer. AI agent security CLI.",
   "files": [
     "dist"