@goplus/agentguard 1.1.3 → 1.1.5

package/dist/cloud/client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentGuardCloudClient = void 0;
+exports.CloudRequestError = exports.AgentGuardCloudClient = void 0;
 const config_js_1 = require("../config.js");
 const redaction_js_1 = require("../runtime/redaction.js");
 const audit_js_1 = require("../runtime/audit.js");
@@ -48,6 +48,54 @@ class AgentGuardCloudClient {
         });
         return body.data.approvalId || null;
     }
+    /**
+     * Pull threat-feed advisories newer than `since`. Returns null when the
+     * cloud doesn't expose the endpoint yet (404) — callers should treat null
+     * as "no new advisories" rather than an error, so the subscribe command
+     * works against older AgentGuard Cloud versions too.
+     */
+    async pullAdvisories(since) {
+        const params = new URLSearchParams();
+        if (since)
+            params.set('since', since);
+        const qs = params.toString();
+        const path = `/api/v1/feed/advisories${qs ? `?${qs}` : ''}`;
+        try {
+            const body = await this.request(path);
+            return body.data.advisories ?? [];
+        }
+        catch (err) {
+            if (err instanceof CloudRequestError && err.status === 404) {
+                return null;
+            }
+            throw err;
+        }
+    }
+    /**
+     * Report the outcome of a single advisory self-check. Matches paths are
+     * redacted by the caller before they get here. Tolerates 404 so subscribe
+     * still completes locally even if the report sink is absent server-side.
+     */
+    async reportSelfCheck(advisoryId, matches, options = {}) {
+        this.requireApiKey();
+        try {
+            await this.request('/api/v1/feed/self-check-report', {
+                method: 'POST',
+                body: JSON.stringify({
+                    advisoryId,
+                    matches,
+                    elapsedMs: options.elapsedMs,
+                    warnings: options.warnings,
+                }),
+            });
+        }
+        catch (err) {
+            if (err instanceof CloudRequestError && err.status === 404) {
+                return;
+            }
+            throw err;
+        }
+    }
     async request(path, init = {}) {
         const response = await fetch(`${this.cloudUrl}${path}`, {
             ...init,
@@ -60,7 +108,7 @@ class AgentGuardCloudClient {
         });
         const body = (await response.json().catch(() => null));
         if (!response.ok || !body?.success) {
-            throw new Error(`AgentGuard Cloud request failed: ${response.status}`);
+            throw new CloudRequestError(response.status, path);
         }
         return body;
     }
@@ -71,6 +119,17 @@ class AgentGuardCloudClient {
     }
 }
 exports.AgentGuardCloudClient = AgentGuardCloudClient;
+class CloudRequestError extends Error {
+    status;
+    path;
+    constructor(status, path) {
+        super(`AgentGuard Cloud request failed: ${status} (${path})`);
+        this.status = status;
+        this.path = path;
+        this.name = 'CloudRequestError';
+    }
+}
+exports.CloudRequestError = CloudRequestError;
 function sanitizeActionRequest(action) {
     return {
         sessionId: (0, redaction_js_1.redactPreview)(action.sessionId, 160),

package/dist/cloud/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/cloud/client.ts"],"names":[],"mappings":";;;AAAA,4CAAiD;AAQjD,0DAAwE;AACxE,kDAAsD;AAOtD,MAAa,qBAAqB;IACf,QAAQ,CAAS;IACjB,MAAM,CAAU;IAEjC,YAAY,MAAqD;QAC/D,IAAI,CAAC,QAAQ,GAAG,IAAA,6BAAiB,EAAC,MAAM,CAAC,QAAQ,IAAI,kCAAkC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAuC,gBAAgB,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB,4BAA4B,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAqB;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAkB,0BAA0B,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAA2B;QAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;aACtD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB,mBAAmB,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAc,IAAY,EAAE,OAAoB,EAAE;QACrE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,EAAE;YACtD,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF;AA1ED,sDA0EC;AAED,SAAS,qBAAqB,CAAC,MAAqB;IAClD,OAAO;QACL,SAAS,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,4BAAa,EAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,4BAAa,EAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACpF,QAAQ,EAAE,IAAA,6BAAc,EAAC,MAAM,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/cloud/client.ts"],"names":[],"mappings":";;;AAAA,4CAAiD;AAQjD,0DAAwE;AACxE,kDAAsD;AAQtD,MAAa,qBAAqB;IACf,QAAQ,CAAS;IACjB,MAAM,CAAU;IAEjC,YAAY,MAAqD;QAC/D,IAAI,CAAC,QAAQ,GAAG,IAAA,6BAAiB,EAAC,MAAM,CAAC,QAAQ,IAAI,kCAAkC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAuC,gBAAgB,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB,4BAA4B,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAqB;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAkB,0BAA0B,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAA2B;QAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;aACtD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB,mBAAmB,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;SAC7C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,KAAc;QACjC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA6B,IAAI,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,OAAyB,EACzB,UAAuD,EAAE;QAEzD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,gCAAgC,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU;oBACV,OAAO;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAc,IAAY,EAAE,OAAoB,EAAE;QACrE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,EAAE;YACtD,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF;AA7HD,sDA6HC;AAED,MAAa,iBAAkB,SAAQ,KAAK;IAExB;IACA;IAFlB,YACkB,MAAc,EACd,IAAY;QAE5B,KAAK,CAAC,oCAAoC,MAAM,KAAK,IAAI,GAAG,CAAC,CAAC;QAH9C,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AARD,8CAQC;AAED,SAAS,qBAAqB,CAAC,MAAqB;IAClD,OAAO;QACL,SAAS,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,IAAA,4BAAa,EAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,4BAAa,EAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,4BAAa,EAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACpF,QAAQ,EAAE,IAAA,6BAAc,EAAC,MAAM,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAKD,wBAAgB,kBAAkB,IAAI,eAAe,CASpD;AAED,wBAAgB,aAAa,IAAI,gBAAgB,CAUhD;AAED,wBAAgB,oBAAoB,IAAI,eAAe,CAKtD;AAED,wBAAgB,YAAY,IAAI,gBAAgB,CAQ/C;AAED,wBAAgB,UAAU,IAAI,gBAAgB,CAkB7C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAKzD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAW7F;AAED,wBAAgB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAKD,wBAAgB,kBAAkB,IAAI,eAAe,CASpD;AAED,wBAAgB,aAAa,IAAI,gBAAgB,CAUhD;AAED,wBAAgB,oBAAoB,IAAI,eAAe,CAKtD;AAED,wBAAgB,YAAY,IAAI,gBAAgB,CAQ/C;AAED,wBAAgB,UAAU,IAAI,gBAAgB,CAkB7C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAKzD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAW7F;AAED,wBAAgB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD;AAID,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAevD"}

package/dist/config.js

@@ -101,6 +101,7 @@ function validateApiKey(apiKey) {
         throw new Error('Invalid AgentGuard API key format. Expected an ag_live_ key.');
     }
 }
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '0.0.0.0']);
 function normalizeCloudUrl(value) {
     const normalized = value.replace(/\/+$/, '');
     let parsed;
@@ -110,8 +111,9 @@ function normalizeCloudUrl(value) {
     catch {
         throw new Error('Invalid Cloud URL.');
     }
-    if (parsed.protocol !== 'https:') {
-        throw new Error('Invalid Cloud URL. AgentGuard Cloud URLs must use https://.');
+    const isLoopback = LOOPBACK_HOSTS.has(parsed.hostname);
+    if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && isLoopback)) {
+        throw new Error('Invalid Cloud URL. AgentGuard Cloud URLs must use https:// (http:// allowed only for loopback hosts).');
     }
     return normalized;
 }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;AA0BA,gDASC;AAED,sCAUC;AAED,oDAKC;AAED,oCAQC;AAED,gCAkBC;AAED,gCAKC;AAED,oCAWC;AAED,gCAIC;AAED,wCAIC;AAED,8CAYC;AAlID,qCAAwF;AACxF,yCAA0C;AAC1C,qCAAkC;AAqBlC,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAC7D,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,SAAgB,kBAAkB;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,aAAa,CAAC,CAAC;IAC3E,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;QACrC,eAAe,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,mBAAmB,CAAC;QAChD,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;QACpC,cAAc,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,oBAAoB,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa;IAC3B,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB;IAClC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,IAAA,mBAAS,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,YAAY;IAC1B,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACrC,IAAI,CAAC,IAAA,oBAAU,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAA8B,CAAC;QAC/F,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,MAAM;YACT,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK;YACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YAC9C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe;YACnE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;YACjD,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;SACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CAAC,MAAwB;IACjD,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACrC,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAA,uBAAa,EAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,YAAY,CAAC,OAA8C;IACzE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAqB;QAC7B,GAAG,OAAO;QACV,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACtF,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,UAAU,CAAC,MAAe;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,gBAAgB,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IACzD,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAgB,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,YAAY;QACzE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;AA0BA,gDASC;AAED,sCAUC;AAED,oDAKC;AAED,oCAQC;AAED,gCAkBC;AAED,gCAKC;AAED,oCAWC;AAED,gCAIC;AAED,wCAIC;AAID,8CAeC;AAvID,qCAAwF;AACxF,yCAA0C;AAC1C,qCAAkC;AAqBlC,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAC7D,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,SAAgB,kBAAkB;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,aAAa,CAAC,CAAC;IAC3E,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;QACrC,eAAe,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,mBAAmB,CAAC;QAChD,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;QACpC,cAAc,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,oBAAoB,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa;IAC3B,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB;IAClC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,IAAA,mBAAS,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,YAAY;IAC1B,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACrC,IAAI,CAAC,IAAA,oBAAU,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAA8B,CAAC;QAC/F,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,MAAM;YACT,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK;YACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YAC9C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe;YACnE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;YACjD,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;SACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAgB,UAAU,CAAC,MAAwB;IACjD,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACrC,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAA,uBAAa,EAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,YAAY,CAAC,OAA8C;IACzE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAqB;QAC7B,GAAG,OAAO;QACV,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACtF,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,UAAU,CAAC,MAAe;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,gBAAgB,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IACzD,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAgB,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7E,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,YAAY;QACzE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,IAAI,CAAC;QACH,IAAA,mBAAS,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC"}

package/dist/feed/cron.d.ts

@@ -0,0 +1,25 @@
+export interface OpenClawCronInstallResult {
+    name: string;
+    schedule: string;
+    created: boolean;
+}
+export interface OpenClawGatewayOptions {
+    host?: string;
+    port?: number;
+    timeoutMs?: number;
+    request?: (method: string, params: unknown) => Promise<unknown>;
+}
+interface OpenClawCronJob {
+    id?: string;
+    name?: string;
+}
+export declare function parseIntervalMinutes(value: string): number;
+export declare function installOpenClawThreatFeedCron(options: {
+    name: string;
+    intervalMinutes: number;
+    force: boolean;
+}, gateway?: OpenClawGatewayOptions): Promise<OpenClawCronInstallResult>;
+export declare function extractOpenClawCronJobs(value: unknown): OpenClawCronJob[];
+export declare function openClawGatewayRequest(method: string, params: unknown, options?: OpenClawGatewayOptions): Promise<unknown>;
+export {};
+//# sourceMappingURL=cron.d.ts.map

package/dist/feed/cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../../src/feed/cron.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS1D;AAED,wBAAsB,6BAA6B,CACjD,OAAO,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB,EACD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,yBAAyB,CAAC,CAyDpC;AAoBD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,EAAE,CAczE;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,OAAO,CAAC,CA8ElB"}

package/dist/feed/cron.js

@@ -0,0 +1,173 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseIntervalMinutes = parseIntervalMinutes;
+exports.installOpenClawThreatFeedCron = installOpenClawThreatFeedCron;
+exports.extractOpenClawCronJobs = extractOpenClawCronJobs;
+exports.openClawGatewayRequest = openClawGatewayRequest;
+const node_http_1 = __importDefault(require("node:http"));
+function parseIntervalMinutes(value) {
+    if (!/^\d+$/.test(value)) {
+        throw new Error('Invalid --interval-minutes. Use an integer between 1 and 59.');
+    }
+    const minutes = Number.parseInt(value, 10);
+    if (!Number.isInteger(minutes) || minutes < 1 || minutes > 59) {
+        throw new Error('Invalid --interval-minutes. Use an integer between 1 and 59.');
+    }
+    return minutes;
+}
+async function installOpenClawThreatFeedCron(options, gateway = {}) {
+    const schedule = `*/${options.intervalMinutes} * * * *`;
+    const existing = await findOpenClawCronJobsByName(options.name, gateway);
+    if (existing.length > 0 && !options.force) {
+        return {
+            name: options.name,
+            schedule,
+            created: false,
+        };
+    }
+    const description = `AgentGuard Cloud threat feed self-check every ${options.intervalMinutes} minute${options.intervalMinutes === 1 ? '' : 's'}`;
+    const message = [
+        'Run `agentguard subscribe --json --cron-run`.',
+        '',
+        'Rules:',
+        '- If the JSON field `hardFailures` is greater than 0, output a short error summary and do not send a threat-match notification.',
+        '- If the JSON field `shouldNotify` is true, send `notification.body` exactly as-is using the current session notification context.',
+        '- If `shouldNotify` is false, output "skipped" and finish without sending any message.',
+        '- If the command fails or the JSON cannot be parsed, output a short error summary and do not send a threat-match notification.',
+        '',
+        'Follow these rules exactly.',
+    ].join('\n');
+    if (existing.length > 0) {
+        await removeOpenClawCronJobs(existing, gateway);
+    }
+    await openClawGatewayRequest('cron.add', [
+        {
+            name: options.name,
+            description,
+            enabled: true,
+            schedule: {
+                kind: 'every',
+                everyMs: options.intervalMinutes * 60 * 1000,
+            },
+            sessionTarget: 'isolated',
+            payload: {
+                kind: 'agentTurn',
+                message,
+                timeoutSeconds: 300,
+            },
+            delivery: {
+                mode: 'none',
+            },
+        },
+    ], gateway);
+    return {
+        name: options.name,
+        schedule,
+        created: true,
+    };
+}
+async function findOpenClawCronJobsByName(name, gateway) {
+    const listed = await openClawGatewayRequest('cron.list', {}, gateway).catch(() => null);
+    return extractOpenClawCronJobs(listed).filter((job) => job.name === name);
+}
+async function removeOpenClawCronJobs(jobs, gateway) {
+    for (const job of jobs) {
+        if (!job.id)
+            continue;
+        await openClawGatewayRequest('cron.remove', { jobId: job.id }, gateway);
+    }
+}
+function extractOpenClawCronJobs(value) {
+    if (Array.isArray(value))
+        return value;
+    if (!value || typeof value !== 'object')
+        return [];
+    const obj = value;
+    for (const candidate of [obj.jobs, obj.cronJobs, obj.result, obj.data]) {
+        const jobs = extractOpenClawCronJobs(candidate);
+        if (jobs.length > 0)
+            return jobs;
+    }
+    return [];
+}
+function openClawGatewayRequest(method, params, options = {}) {
+    if (options.request) {
+        return options.request(method, params);
+    }
+    const payload = JSON.stringify({
+        jsonrpc: '2.0',
+        method,
+        params,
+        id: 1,
+    });
+    const host = options.host ?? '127.0.0.1';
+    const port = options.port ?? 18789;
+    const timeoutMs = options.timeoutMs ?? 5000;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(err);
+        };
+        const succeed = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(value);
+        };
+        const req = node_http_1.default.request({
+            hostname: host,
+            port,
+            path: '/',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(payload),
+            },
+        }, (res) => {
+            let data = '';
+            res.setEncoding('utf8');
+            res.on('error', (err) => {
+                fail(new Error(`OpenClaw Gateway ${method} response failed: ${err.message}`));
+            });
+            res.on('data', (chunk) => {
+                data += chunk;
+            });
+            res.on('end', () => {
+                let parsed;
+                try {
+                    parsed = data ? JSON.parse(data) : null;
+                }
+                catch {
+                    fail(new Error(`OpenClaw Gateway returned non-JSON response: ${data}`));
+                    return;
+                }
+                if (parsed?.error) {
+                    fail(new Error(`OpenClaw Gateway ${method} failed: ${parsed.error.message ?? JSON.stringify(parsed.error)}`));
+                    return;
+                }
+                if (res.statusCode && res.statusCode >= 400) {
+                    fail(new Error(`OpenClaw Gateway ${method} failed with HTTP ${res.statusCode}`));
+                    return;
+                }
+                succeed(parsed?.result ?? parsed);
+            });
+        });
+        req.on('error', (err) => {
+            fail(new Error(`Could not reach OpenClaw Gateway at ${host}:${port}: ${err.message}`));
+        });
+        req.setTimeout(timeoutMs, () => {
+            const err = new Error(`OpenClaw Gateway ${method} request timed out after ${timeoutMs}ms`);
+            fail(err);
+            req.destroy(err);
+        });
+        req.write(payload);
+        req.end();
+    });
+}
+//# sourceMappingURL=cron.js.map

package/dist/feed/cron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.js","sourceRoot":"","sources":["../../src/feed/cron.ts"],"names":[],"mappings":";;;;;AAoBA,oDASC;AAED,sEAgEC;AAoBD,0DAcC;AAED,wDAkFC;AArND,0DAA6B;AAoB7B,SAAgB,oBAAoB,CAAC,KAAa;IAChD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAEM,KAAK,UAAU,6BAA6B,CACjD,OAIC,EACD,UAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,KAAK,OAAO,CAAC,eAAe,UAAU,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ;YACR,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,iDAAiD,OAAO,CAAC,eAAe,UAAU,OAAO,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACjJ,MAAM,OAAO,GAAG;QACd,+CAA+C;QAC/C,EAAE;QACF,QAAQ;QACR,iIAAiI;QACjI,oIAAoI;QACpI,wFAAwF;QACxF,gIAAgI;QAChI,EAAE;QACF,6BAA6B;KAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,sBAAsB,CAC1B,UAAU,EACV;QACE;YACE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW;YACX,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,eAAe,GAAG,EAAE,GAAG,IAAI;aAC7C;YACD,aAAa,EAAE,UAAU;YACzB,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,OAAO;gBACP,cAAc,EAAE,GAAG;aACpB;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,MAAM;aACb;SACF;KACF,EACD,OAAO,CACR,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAAY,EACZ,OAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,IAAuB,EACvB,OAA+B;IAE/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,SAAS;QACtB,MAAM,sBAAsB,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAgB,uBAAuB,CAAC,KAAc;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAA0B,CAAC;IAC5D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,KAKX,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,sBAAsB,CACpC,MAAc,EACd,MAAe,EACf,UAAkC,EAAE;IAEpC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,OAAO,EAAE,KAAK;QACd,MAAM;QACN,MAAM;QACN,EAAE,EAAE,CAAC;KACN,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAE5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,GAAU,EAAE,EAAE;YAC1B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE;YACjC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,mBAAI,CAAC,OAAO,CACtB;YACE,QAAQ,EAAE,IAAI;YACd,IAAI;YACJ,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;aAC7C;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,IAAI,CAAC,IAAI,KAAK,CAAC,oBAAoB,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,MAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,IAAI,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC,CAAC;oBACxE,OAAO;gBACT,CAAC;gBACD,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;oBAClB,IAAI,CAAC,IAAI,KAAK,CAAC,oBAAoB,MAAM,YAAY,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC9G,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;oBAC5C,IAAI,CAAC,IAAI,KAAK,CAAC,oBAAoB,MAAM,qBAAqB,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBACjF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,IAAI,CAAC,IAAI,KAAK,CAAC,uCAAuC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,oBAAoB,MAAM,4BAA4B,SAAS,IAAI,CAAC,CAAC;YAC3F,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/feed/selfcheck.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Self-check engine — runs a single threat-feed advisory against the locally
+ * installed skills / plugins / MCP servers and reports which artifacts match.
+ *
+ * Designed to be cheap (read-only filesystem ops, hashing only when an
+ * advisory actually asks for a hash) and never crash on a single bad artifact.
+ */
+import type { Advisory, SelfCheckResult } from './types.js';
+/**
+ * Default search locations for each ecosystem.
+ *
+ * Skill locations cover the four agent frameworks that use the agentskills.io
+ * SKILL.md standard: Claude Code, OpenClaw, Hermes Agent, Cursor (project
+ * scope only — caller can supply extra roots). MCP server locations cover
+ * Claude Code's `~/.claude.json` and Codex's `~/.codex/config.toml` install
+ * conventions, but inspection of those is config-aware and lives elsewhere.
+ */
+export declare const DEFAULT_SKILL_ROOTS: string[];
+export interface RunSelfCheckOptions {
+    /** Override the default per-ecosystem search roots. */
+    skillRoots?: string[];
+    /** Cap on hashing work: skill dirs beyond this count are skipped. */
+    maxArtifacts?: number;
+}
+/**
+ * Run one advisory against the local environment. Never throws — failures
+ * become warnings on the result so the caller can keep iterating advisories.
+ */
+export declare function runSelfCheckForAdvisory(advisory: Advisory, options?: RunSelfCheckOptions): Promise<SelfCheckResult>;
+export declare function safeRegexTest(pattern: string, body: string): boolean;
+/**
+ * Simple glob match supporting `*` as a single-segment wildcard. Sufficient
+ * for `slack-webhook-*` style advisories without pulling in a glob lib.
+ */
+export declare function globMatch(pattern: string, value: string): boolean;
+//# sourceMappingURL=selfcheck.d.ts.map

package/dist/feed/selfcheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfcheck.d.ts","sourceRoot":"","sources":["../../src/feed/selfcheck.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EACV,QAAQ,EAGR,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,UAK/B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,eAAe,CAAC,CAqC1B;AAgGD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBpE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAOjE"}

package/dist/feed/selfcheck.js

@@ -0,0 +1,198 @@
+"use strict";
+/**
+ * Self-check engine — runs a single threat-feed advisory against the locally
+ * installed skills / plugins / MCP servers and reports which artifacts match.
+ *
+ * Designed to be cheap (read-only filesystem ops, hashing only when an
+ * advisory actually asks for a hash) and never crash on a single bad artifact.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SKILL_ROOTS = void 0;
+exports.runSelfCheckForAdvisory = runSelfCheckForAdvisory;
+exports.safeRegexTest = safeRegexTest;
+exports.globMatch = globMatch;
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const hash_js_1 = require("../utils/hash.js");
+/**
+ * Default search locations for each ecosystem.
+ *
+ * Skill locations cover the four agent frameworks that use the agentskills.io
+ * SKILL.md standard: Claude Code, OpenClaw, Hermes Agent, Cursor (project
+ * scope only — caller can supply extra roots). MCP server locations cover
+ * Claude Code's `~/.claude.json` and Codex's `~/.codex/config.toml` install
+ * conventions, but inspection of those is config-aware and lives elsewhere.
+ */
+exports.DEFAULT_SKILL_ROOTS = [
+    (0, node_path_1.join)((0, node_os_1.homedir)(), '.claude', 'skills'),
+    (0, node_path_1.join)((0, node_os_1.homedir)(), '.openclaw', 'skills'),
+    (0, node_path_1.join)((0, node_os_1.homedir)(), '.openclaw', 'workspace', 'skills'),
+    (0, node_path_1.join)((0, node_os_1.homedir)(), '.hermes', 'skills'),
+];
+/**
+ * Run one advisory against the local environment. Never throws — failures
+ * become warnings on the result so the caller can keep iterating advisories.
+ */
+async function runSelfCheckForAdvisory(advisory, options = {}) {
+    const startedAt = Date.now();
+    const matches = [];
+    const warnings = [];
+    if (advisory.withdrawnAt) {
+        return { advisoryId: advisory.id, matchedArtifacts: [], elapsedMs: 0, warnings };
+    }
+    if (advisory.ecosystem !== 'skill') {
+        warnings.push(`ecosystem "${advisory.ecosystem}" not implemented; only "skill" is supported in this build`);
+        return { advisoryId: advisory.id, matchedArtifacts: [], elapsedMs: Date.now() - startedAt, warnings };
+    }
+    const roots = options.skillRoots ?? exports.DEFAULT_SKILL_ROOTS;
+    const skillDirs = await listSkillDirs(roots);
+    const cap = options.maxArtifacts ?? 500;
+    const considered = skillDirs.slice(0, cap);
+    if (skillDirs.length > cap) {
+        warnings.push(`only checked first ${cap} of ${skillDirs.length} skill directories`);
+    }
+    for (const dir of considered) {
+        try {
+            const m = await matchSkillDir(dir, advisory.affected);
+            if (m)
+                matches.push(m);
+        }
+        catch (err) {
+            warnings.push(`skipped ${dir}: ${err.message}`);
+        }
+    }
+    return {
+        advisoryId: advisory.id,
+        matchedArtifacts: matches,
+        elapsedMs: Date.now() - startedAt,
+        warnings,
+    };
+}
+/** Enumerate every immediate subdirectory of `roots` that contains a SKILL.md. */
+async function listSkillDirs(roots) {
+    const found = [];
+    for (const root of roots) {
+        if (!(0, node_fs_1.existsSync)(root))
+            continue;
+        let entries;
+        try {
+            entries = await (0, promises_1.readdir)(root, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const skillPath = (0, node_path_1.join)(root, entry.name);
+            const manifest = (0, node_path_1.join)(skillPath, 'SKILL.md');
+            if ((0, node_fs_1.existsSync)(manifest))
+                found.push(skillPath);
+        }
+    }
+    return found;
+}
+/**
+ * Match one skill directory against an advisory's affected[] matchers.
+ * Returns the first match found (per matcher precedence: hash > regex > name).
+ * Returns null when nothing matched.
+ */
+async function matchSkillDir(skillDir, affected) {
+    const name = (0, node_path_1.basename)(skillDir);
+    const manifestPath = (0, node_path_1.join)(skillDir, 'SKILL.md');
+    // Canonical hash input: the SKILL.md content. The cloud publishes
+    // SKILL.md hashes (not directory rollups), so this is the field that
+    // must match server-side for `sha256` matchers to be meaningful.
+    let localHash = null;
+    const wantsHash = affected.some((m) => m.sha256);
+    if (wantsHash && (0, node_fs_1.existsSync)(manifestPath)) {
+        try {
+            localHash = await (0, hash_js_1.hashFile)(manifestPath);
+        }
+        catch {
+            localHash = null;
+        }
+    }
+    // Regex matching needs the manifest body — only read if some matcher asks.
+    let body = null;
+    const wantsBody = affected.some((m) => m.bodyRegex);
+    if (wantsBody) {
+        try {
+            body = await (0, promises_1.readFile)(manifestPath, 'utf8');
+            // Cap body length to keep regex evaluation bounded.
+            if (body.length > MAX_BODY_BYTES)
+                body = body.slice(0, MAX_BODY_BYTES);
+        }
+        catch {
+            body = '';
+        }
+    }
+    for (const matcher of affected) {
+        if (matcher.sha256 && localHash && matcher.sha256.toLowerCase() === localHash.toLowerCase()) {
+            return { path: skillDir, matchedBy: 'sha256', hash: localHash };
+        }
+        if (matcher.bodyRegex && body !== null) {
+            if (safeRegexTest(matcher.bodyRegex, body)) {
+                return { path: skillDir, matchedBy: 'bodyRegex' };
+            }
+        }
+        if (matcher.namePattern && globMatch(matcher.namePattern, name)) {
+            return { path: skillDir, matchedBy: 'namePattern' };
+        }
+    }
+    return null;
+}
+/**
+ * Defense against catastrophic backtracking and malformed regex coming
+ * from upstream advisory data:
+ *   - cap the pattern length
+ *   - reject patterns with obvious nested-quantifier shapes that explode
+ *     under ReDoS (e.g. `(.+)+`, `(a*)*`, `(a|a)*`)
+ *   - swallow compile errors silently (treated as "no match")
+ *
+ * Node's RegExp has no built-in timeout; the cheap-but-effective fix is
+ * to bound both the pattern and the body. We accept a slight false-negative
+ * rate over freezing on a hostile feed.
+ */
+const MAX_REGEX_LEN = 256;
+const MAX_BODY_BYTES = 256 * 1024;
+const CATASTROPHIC = [
+    /\([^)]*[+*]\)[+*]/, // nested quantifier: (x+)+
+    /\(([^|()]+\|)+\1\)[+*]/, // alternation duplicate: (a|a)*
+];
+function safeRegexTest(pattern, body) {
+    if (typeof pattern !== 'string' || pattern.length === 0)
+        return false;
+    if (pattern.length > MAX_REGEX_LEN)
+        return false;
+    for (const danger of CATASTROPHIC) {
+        if (danger.test(pattern))
+            return false;
+    }
+    let re;
+    try {
+        re = new RegExp(pattern);
+    }
+    catch {
+        return false;
+    }
+    try {
+        return re.test(body);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Simple glob match supporting `*` as a single-segment wildcard. Sufficient
+ * for `slack-webhook-*` style advisories without pulling in a glob lib.
+ */
+function globMatch(pattern, value) {
+    const re = new RegExp('^' +
+        pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*') +
+        '$');
+    return re.test(value);
+}
+//# sourceMappingURL=selfcheck.js.map

package/dist/feed/selfcheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfcheck.js","sourceRoot":"","sources":["../../src/feed/selfcheck.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAyCH,0DAwCC;AAgGD,sCAiBC;AAMD,8BAOC;AA7MD,qCAAqC;AACrC,+CAAqD;AACrD,qCAAkC;AAClC,yCAA2C;AAC3C,8CAA4C;AAQ5C;;;;;;;;GAQG;AACU,QAAA,mBAAmB,GAAG;IACjC,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,QAAQ,CAAC;IACpC,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,WAAW,EAAE,QAAQ,CAAC;IACtC,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC;IACnD,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,QAAQ,CAAC;CACrC,CAAC;AASF;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,UAA+B,EAAE;IAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,SAAS,4DAA4D,CAAC,CAAC;QAC5G,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC;IACxG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,IAAI,2BAAmB,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC;IACxC,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,sBAAsB,GAAG,OAAO,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,WAAW,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,gBAAgB,EAAE,OAAO;QACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACjC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,aAAa,CAAC,KAAe;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;YAAE,SAAS;QAChC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC7C,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,QAAgB,EAChB,QAA4B;IAE5B,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEhD,kEAAkE;IAClE,qEAAqE;IACrE,iEAAiE;IACjE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,SAAS,IAAI,IAAA,oBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAA,kBAAQ,EAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAA,mBAAQ,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAC5C,oDAAoD;YACpD,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc;gBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACvC,IAAI,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;YACpD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAClC,MAAM,YAAY,GAAG;IACnB,mBAAmB,EAAE,2BAA2B;IAChD,wBAAwB,EAAE,gCAAgC;CAC3D,CAAC;AAEF,SAAgB,aAAa,CAAC,OAAe,EAAE,IAAY;IACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,KAAK,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,OAAe,EAAE,KAAa;IACtD,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,GAAG;QACD,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QACpE,GAAG,CACN,CAAC;IACF,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/feed/state.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Local feed-subscription state I/O.
+ *
+ * Persisted at `~/.agentguard/feed-state.json` so the `subscribe` command
+ * doesn't re-process the same advisory across invocations / cron ticks.
+ *
+ * Kept tiny (single JSON object) on purpose — bigger ledgers go through the
+ * audit log path, not here.
+ */
+import type { FeedState } from './types.js';
+export declare function loadFeedState(): FeedState;
+export declare function saveFeedState(state: FeedState): void;
+export declare function markAdvisorySeen(state: FeedState, advisoryId: string): FeedState;
+//# sourceMappingURL=state.d.ts.map

package/dist/feed/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/feed/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,wBAAgB,aAAa,IAAI,SAAS,CAezC;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAQpD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,CAOhF"}