@goplus/agentguard 1.1.8 → 1.1.10

package/dist/tests/cli-checkup.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-checkup.test.js","sourceRoot":"","sources":["../../src/tests/cli-checkup.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,2DAA2C;AAC3C,qCAAsC;AACtC,qCAAiC;AACjC,yCAA0C;AAE1C,MAAM,WAAW,GAAG,IAAA,mBAAO,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAErD,SAAS,MAAM,CACb,IAAc,EACd,IAAY,EACZ,MAA8B,EAAE;IAEhC,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;YAC/C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;SACvD,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAA,oBAAQ,EAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAA,cAAE,EAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAEzD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAMtC,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACtD,gBAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACzC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QACvC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC9C,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE;YAC7C,gCAAgC,EAAE,aAAa;SAChD,CAAC,CAAC;QAEH,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACzD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;QAC/D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAEjG,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAwC,CAAC;QAChF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/cli-init.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli-init.test.d.ts.map

package/dist/tests/cli-init.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-init.test.d.ts","sourceRoot":"","sources":["../../src/tests/cli-init.test.ts"],"names":[],"mappings":""}

package/dist/tests/cli-init.test.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+(0, node_test_1.describe)('init CLI', () => {
+    (0, node_test_1.it)('persists the selected agent host in AgentGuard config', async () => {
+        const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentguard-init-home-'));
+        const cwd = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentguard-init-cwd-'));
+        const cliPath = (0, node_path_1.resolve)('dist', 'cli.js');
+        await execFileAsync(process.execPath, [cliPath, 'init', '--agent', 'codex', '--force'], {
+            cwd,
+            env: { ...process.env, AGENTGUARD_HOME: home },
+        });
+        const config = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(home, 'config.json'), 'utf8'));
+        strict_1.default.equal(config.agentHost, 'codex');
+    });
+    (0, node_test_1.it)('accepts Hermes and QClaw agent installers', async () => {
+        for (const agent of ['hermes', 'qclaw']) {
+            const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), `agentguard-init-${agent}-home-`));
+            const cwd = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), `agentguard-init-${agent}-cwd-`));
+            const cliPath = (0, node_path_1.resolve)('dist', 'cli.js');
+            await execFileAsync(process.execPath, [cliPath, 'init', '--agent', agent, '--force'], {
+                cwd,
+                env: { ...process.env, AGENTGUARD_HOME: home },
+            });
+            const config = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(home, 'config.json'), 'utf8'));
+            strict_1.default.equal(config.agentHost, agent);
+        }
+    });
+});
+//# sourceMappingURL=cli-init.test.js.map

package/dist/tests/cli-init.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-init.test.js","sourceRoot":"","sources":["../../src/tests/cli-init.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,2DAA8C;AAC9C,qCAAoD;AACpD,yCAA0C;AAC1C,qCAAiC;AACjC,yCAAsC;AAEtC,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAE1C,IAAA,oBAAQ,EAAC,UAAU,EAAE,GAAG,EAAE;IACxB,IAAA,cAAE,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAA,mBAAO,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;YACtF,GAAG;YACH,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAA2B,CAAC;QACrG,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC;YAC3E,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,KAAK,OAAO,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,IAAA,mBAAO,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE1C,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE;gBACpF,GAAG;gBACH,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;aAC/C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAA2B,CAAC;YACrG,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/cli-policy.test.js

@@ -14,6 +14,53 @@ const node_util_1 = require("node:util");
 const policy_js_1 = require("../runtime/policy.js");
 const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
 (0, node_test_1.describe)('policy CLI', () => {
+    (0, node_test_1.it)('shows the cached effective policy as JSON', async () => {
+        const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentguard-policy-show-'));
+        const policy = (0, policy_js_1.getDefaultEffectiveRuntimePolicy)();
+        policy.policyVersion = 'runtime-show-cache';
+        policy.mode = 'strict';
+        policy.blockedCommandPatterns = ['show-cache-danger'];
+        const cachePath = (0, node_path_1.join)(home, 'policy-cache.json');
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(home, 'config.json'), JSON.stringify({
+            version: 1,
+            level: 'balanced',
+            cloudUrl: 'https://agentguard.example',
+            policyCachePath: cachePath,
+            auditPath: (0, node_path_1.join)(home, 'audit.jsonl'),
+            eventSpoolPath: (0, node_path_1.join)(home, 'events-spool.jsonl'),
+        }));
+        (0, node_fs_1.writeFileSync)(cachePath, JSON.stringify(policy));
+        const cliPath = (0, node_path_1.resolve)('dist/cli.js');
+        const { stdout } = await execFileAsync(process.execPath, [cliPath, 'policy', 'show', '--json'], {
+            env: { ...process.env, AGENTGUARD_HOME: home },
+        });
+        const result = JSON.parse(stdout);
+        strict_1.default.equal(result.success, true);
+        strict_1.default.equal(result.source, 'cache');
+        strict_1.default.equal(result.cachePath, cachePath);
+        strict_1.default.equal(result.policy.policyVersion, 'runtime-show-cache');
+        strict_1.default.deepEqual(result.policy.blockedCommandPatterns, ['show-cache-danger']);
+    });
+    (0, node_test_1.it)('shows the bundled default policy when no cache exists', async () => {
+        const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentguard-policy-show-default-'));
+        const cachePath = (0, node_path_1.join)(home, 'policy-cache.json');
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(home, 'config.json'), JSON.stringify({
+            version: 1,
+            level: 'balanced',
+            cloudUrl: 'https://agentguard.example',
+            policyCachePath: cachePath,
+            auditPath: (0, node_path_1.join)(home, 'audit.jsonl'),
+            eventSpoolPath: (0, node_path_1.join)(home, 'events-spool.jsonl'),
+        }));
+        const cliPath = (0, node_path_1.resolve)('dist/cli.js');
+        const { stdout } = await execFileAsync(process.execPath, [cliPath, 'policy', 'show', '--json'], {
+            env: { ...process.env, AGENTGUARD_HOME: home },
+        });
+        const result = JSON.parse(stdout);
+        strict_1.default.equal(result.success, true);
+        strict_1.default.equal(result.source, 'default');
+        strict_1.default.equal(result.policy.policyVersion, 'runtime-local-v0.1');
+    });
     (0, node_test_1.it)('pulls the effective Cloud policy into the local cache', async () => {
         const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentguard-policy-cli-'));
         const policy = (0, policy_js_1.getDefaultEffectiveRuntimePolicy)();

package/dist/tests/cli-policy.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-policy.test.js","sourceRoot":"","sources":["../../src/tests/cli-policy.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,2DAA8C;AAC9C,qCAAmE;AACnE,yCAAyC;AACzC,yCAA0C;AAC1C,qCAAiC;AACjC,yCAAsC;AACtC,oDAAwE;AAExE,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAE1C,IAAA,oBAAQ,EAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAA,cAAE,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAA,4CAAgC,GAAE,CAAC;QAClD,MAAM,CAAC,aAAa,GAAG,kBAAkB,CAAC;QAC1C,MAAM,CAAC,sBAAsB,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,GAAG,0BAA0B,CAAC;QAE9C,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,GAAG,CAAC,GAAG,KAAK,4BAA4B,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,yBAAyB,EAAE,CAAC;gBACvG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,gBAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAClD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtD,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,QAAQ;gBACR,MAAM,EAAE,yBAAyB;gBACjC,eAAe,EAAE,SAAS;gBAC1B,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;gBACpC,cAAc,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,oBAAoB,CAAC;aACjD,CAAC,CAAC,CAAC;YAEJ,MAAM,OAAO,GAAG,IAAA,mBAAO,EAAC,aAAa,CAAC,CAAC;YACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBAC9F,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;aAC/C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAmE,CAAC;YACpG,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;YACvD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,SAAS,EAAE,MAAM,CAAC,CAAkB,CAAC;YAC5E,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;YACvD,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACzE,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;gBACjD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli-policy.test.js","sourceRoot":"","sources":["../../src/tests/cli-policy.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,2DAA8C;AAC9C,qCAAmE;AACnE,yCAAyC;AACzC,yCAA0C;AAC1C,qCAAiC;AACjC,yCAAsC;AACtC,oDAAwE;AAExE,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAE1C,IAAA,oBAAQ,EAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAA,cAAE,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAA,4CAAgC,GAAE,CAAC;QAClD,MAAM,CAAC,aAAa,GAAG,oBAAoB,CAAC;QAC5C,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,sBAAsB,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAClD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACtD,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,4BAA4B;YACtC,eAAe,EAAE,SAAS;YAC1B,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;YACpC,cAAc,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,oBAAoB,CAAC;SACjD,CAAC,CAAC,CAAC;QACJ,IAAA,uBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAA,mBAAO,EAAC,aAAa,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;YAC9F,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAK/B,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC1C,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;QAChE,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAClD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACtD,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,4BAA4B;YACtC,eAAe,EAAE,SAAS;YAC1B,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;YACpC,cAAc,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,oBAAoB,CAAC;SACjD,CAAC,CAAC,CAAC;QAEJ,MAAM,OAAO,GAAG,IAAA,mBAAO,EAAC,aAAa,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;YAC9F,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAI/B,CAAC;QACF,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACvC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAA,4CAAgC,GAAE,CAAC;QAClD,MAAM,CAAC,aAAa,GAAG,kBAAkB,CAAC;QAC1C,MAAM,CAAC,sBAAsB,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,GAAG,0BAA0B,CAAC;QAE9C,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,GAAG,CAAC,GAAG,KAAK,4BAA4B,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,yBAAyB,EAAE,CAAC;gBACvG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,gBAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAClD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtD,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,UAAU;gBACjB,QAAQ;gBACR,MAAM,EAAE,yBAAyB;gBACjC,eAAe,EAAE,SAAS;gBAC1B,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;gBACpC,cAAc,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,oBAAoB,CAAC;aACjD,CAAC,CAAC,CAAC;YAEJ,MAAM,OAAO,GAAG,IAAA,mBAAO,EAAC,aAAa,CAAC,CAAC;YACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBAC9F,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;aAC/C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAmE,CAAC;YACpG,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;YACvD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,SAAS,EAAE,MAAM,CAAC,CAAkB,CAAC;YAC5E,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;YACvD,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACzE,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;gBACjD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/cli-subscribe.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli-subscribe.test.d.ts.map

package/dist/tests/cli-subscribe.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-subscribe.test.d.ts","sourceRoot":"","sources":["../../src/tests/cli-subscribe.test.ts"],"names":[],"mappings":""}

package/dist/tests/cli-subscribe.test.js

@@ -0,0 +1,123 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_http_1 = __importDefault(require("node:http"));
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const projectRoot = (0, node_path_1.resolve)(__dirname, '..', '..');
+const CLI_PATH = (0, node_path_1.join)(projectRoot, 'dist', 'cli.js');
+function runCli(args, home, cloudUrl) {
+    writeConfig(home, cloudUrl);
+    return new Promise((resolvePromise) => {
+        const child = (0, node_child_process_1.spawn)('node', [CLI_PATH, ...args], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                AGENTGUARD_HOME: home,
+                HOME: home,
+            },
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (d) => (stdout += d.toString()));
+        child.stderr.on('data', (d) => (stderr += d.toString()));
+        child.on('close', (code) => {
+            resolvePromise({ exitCode: code ?? 1, stdout, stderr });
+        });
+    });
+}
+function writeConfig(home, cloudUrl) {
+    (0, node_fs_1.mkdirSync)(home, { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(home, 'config.json'), JSON.stringify({
+        version: 1,
+        level: 'balanced',
+        cloudUrl,
+        apiKey: 'ag_live_test_key_123456',
+        policyCachePath: (0, node_path_1.join)(home, 'policy-cache.json'),
+        auditPath: (0, node_path_1.join)(home, 'audit.jsonl'),
+        eventSpoolPath: (0, node_path_1.join)(home, 'events-spool.jsonl'),
+    }));
+}
+function installMatchingSkill(home) {
+    const skillDir = (0, node_path_1.join)(home, '.claude', 'skills', 'malicious-demo');
+    (0, node_fs_1.mkdirSync)(skillDir, { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(skillDir, 'SKILL.md'), '# malicious-demo\n');
+}
+async function withFeedServer(advisories, fn) {
+    const reports = [];
+    const server = node_http_1.default.createServer((req, res) => {
+        if (req.method === 'GET' && req.url?.startsWith('/api/v1/feed/advisories')) {
+            res.setHeader('content-type', 'application/json');
+            res.end(JSON.stringify({ success: true, data: { advisories } }));
+            return;
+        }
+        if (req.method === 'POST' && req.url === '/api/v1/feed/self-check-report') {
+            let body = '';
+            req.on('data', (chunk) => {
+                body += chunk.toString();
+            });
+            req.on('end', () => {
+                reports.push(JSON.parse(body));
+                res.setHeader('content-type', 'application/json');
+                res.end(JSON.stringify({ success: true, data: { ok: true } }));
+            });
+            return;
+        }
+        res.statusCode = 404;
+        res.end(JSON.stringify({ success: false }));
+    });
+    await new Promise((resolvePromise) => server.listen(0, '127.0.0.1', resolvePromise));
+    const address = server.address();
+    strict_1.default.ok(address && typeof address === 'object');
+    const port = address.port;
+    const url = `http://127.0.0.1:${port}`;
+    try {
+        return await fn(url, reports);
+    }
+    finally {
+        await new Promise((resolvePromise) => server.close(() => resolvePromise()));
+    }
+}
+const advisory = {
+    id: 'AGS-2026-subscribe',
+    ecosystem: 'skill',
+    severity: 'high',
+    summary: 'Demo malicious skill',
+    detailsMd: 'Demo advisory',
+    affected: [{ namePattern: 'malicious-*' }],
+    publishedAt: '2026-05-20T00:00:00.000Z',
+};
+(0, node_test_1.describe)('CLI subscribe command modes', () => {
+    (0, node_test_1.it)('without --quiet notifies about new advisories without reporting self-check matches', async () => {
+        await withFeedServer([advisory], async (cloudUrl, reports) => {
+            const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ag-cli-subscribe-'));
+            installMatchingSkill(home);
+            const result = await runCli(['subscribe'], home, cloudUrl);
+            strict_1.default.equal(result.exitCode, 0);
+            strict_1.default.equal(result.stderr, '');
+            strict_1.default.match(result.stdout, /New threat-feed advisories found/);
+            strict_1.default.match(result.stdout, /AGS-2026-subscribe/);
+            strict_1.default.doesNotMatch(result.stdout, /Self-check found/);
+            strict_1.default.equal(reports.length, 0);
+        });
+    });
+    (0, node_test_1.it)('--quiet runs self-checks and reports local matches', async () => {
+        await withFeedServer([advisory], async (cloudUrl, reports) => {
+            const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ag-cli-subscribe-'));
+            installMatchingSkill(home);
+            const result = await runCli(['subscribe', '--quiet'], home, cloudUrl);
+            strict_1.default.equal(result.exitCode, 2);
+            strict_1.default.equal(result.stderr, '');
+            strict_1.default.match(result.stdout, /Self-check found 1 match/);
+            strict_1.default.equal(reports.length, 1);
+            strict_1.default.deepEqual(reports[0].advisoryId, 'AGS-2026-subscribe');
+        });
+    });
+});
+//# sourceMappingURL=cli-subscribe.test.js.map

package/dist/tests/cli-subscribe.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-subscribe.test.js","sourceRoot":"","sources":["../../src/tests/cli-subscribe.test.ts"],"names":[],"mappings":";;;;;AAAA,yCAAyC;AACzC,gEAAwC;AACxC,2DAA2C;AAC3C,qCAAgE;AAChE,0DAA6B;AAE7B,qCAAiC;AACjC,yCAA0C;AAG1C,MAAM,WAAW,GAAG,IAAA,mBAAO,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAErD,SAAS,MAAM,CAAC,IAAc,EAAE,IAAY,EAAE,QAAgB;IAC5D,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;YAC/C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE,IAAI;aACX;SACF,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,IAAA,mBAAS,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;QACtD,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,UAAU;QACjB,QAAQ;QACR,MAAM,EAAE,yBAAyB;QACjC,eAAe,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,mBAAmB,CAAC;QAChD,SAAS,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,aAAa,CAAC;QACpC,cAAc,EAAE,IAAA,gBAAI,EAAC,IAAI,EAAE,oBAAoB,CAAC;KACjD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACnE,IAAA,mBAAS,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,UAAsB,EACtB,EAAmD;IAEnD,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,mBAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,gCAAgC,EAAE,CAAC;YAC1E,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,gBAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAI,OAAuB,CAAC,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAa;IACzB,EAAE,EAAE,oBAAoB;IACxB,SAAS,EAAE,OAAO;IAClB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,sBAAsB;IAC/B,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;IAC1C,WAAW,EAAE,0BAA0B;CACxC,CAAC;AAEF,IAAA,oBAAQ,EAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,IAAA,cAAE,EAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,cAAc,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC3D,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC9D,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAE3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAE3D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACjC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;YAChE,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;YAClD,gBAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YACvD,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,cAAc,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC3D,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC9D,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAE3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAEtE,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACjC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;YACxD,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAChC,gBAAM,CAAC,SAAS,CAAE,OAAO,CAAC,CAAC,CAA4B,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/feed-cron.test.js

@@ -5,6 +5,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_test_1 = require("node:test");
 const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
 const cron_js_1 = require("../feed/cron.js");
 function fakeGateway(jobs = []) {
     const calls = [];
@@ -19,43 +22,293 @@ function fakeGateway(jobs = []) {
     };
 }
 (0, node_test_1.describe)('feed/cron', () => {
-    (0, node_test_1.it)('parseIntervalMinutes rejects non-numeric and out-of-range values', () => {
-        strict_1.default.equal((0, cron_js_1.parseIntervalMinutes)('15'), 15);
-        strict_1.default.throws(() => (0, cron_js_1.parseIntervalMinutes)('5abc'), /Invalid --interval-minutes/);
-        strict_1.default.throws(() => (0, cron_js_1.parseIntervalMinutes)('0'), /Invalid --interval-minutes/);
-        strict_1.default.throws(() => (0, cron_js_1.parseIntervalMinutes)('60'), /Invalid --interval-minutes/);
+    (0, node_test_1.it)('validateCronExpression rejects non-five-field values', () => {
+        strict_1.default.equal((0, cron_js_1.validateCronExpression)('0 * * * *'), '0 * * * *');
+        strict_1.default.equal((0, cron_js_1.validateCronExpression)('  */5   * * * *  '), '*/5 * * * *');
+        strict_1.default.throws(() => (0, cron_js_1.validateCronExpression)('0 * * *'), /Invalid --cron/);
+        strict_1.default.throws(() => (0, cron_js_1.validateCronExpression)('0 * * * * *'), /Invalid --cron/);
     });
-    (0, node_test_1.it)('adds an OpenClaw cron job with silent delivery and interval schedule', async () => {
+    (0, node_test_1.it)('adds an OpenClaw cron job with silent delivery and cron schedule', async () => {
         const gateway = fakeGateway();
-        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', intervalMinutes: 15, force: false }, { request: gateway.request });
+        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', cronExpression: '0 * * * *', quiet: false, force: false, timezone: 'Asia/Shanghai' }, { request: gateway.request });
         strict_1.default.equal(result.created, true);
+        strict_1.default.equal(result.schedule, '0 * * * *');
+        strict_1.default.equal(result.timezone, 'Asia/Shanghai');
         strict_1.default.deepEqual(gateway.calls.map((call) => call.method), ['cron.list', 'cron.add']);
         const job = gateway.calls[1].params[0];
         strict_1.default.equal(job.name, 'agentguard-threat-feed');
-        strict_1.default.deepEqual(job.schedule, { kind: 'every', everyMs: 900000 });
+        strict_1.default.deepEqual(job.schedule, { kind: 'cron', expr: '0 * * * *', tz: 'Asia/Shanghai' });
         strict_1.default.deepEqual(job.delivery, { mode: 'none' });
         strict_1.default.equal(job.sessionTarget, 'isolated');
         strict_1.default.equal(job.payload.kind, 'agentTurn');
+        strict_1.default.deepEqual(job.payload.agentguard, {
+            mode: 'manual',
+            command: 'agentguard subscribe --json --cron-run',
+        });
+        strict_1.default.match(job.payload.message, /Mode: manual/);
+        strict_1.default.match(job.payload.message, /Command: `agentguard subscribe --json --cron-run`/);
+        strict_1.default.match(job.payload.message, /agentguard subscribe --json --cron-run/);
         strict_1.default.match(job.payload.message, /hardFailures/);
-        strict_1.default.equal('timezone' in job, false);
+    });
+    (0, node_test_1.it)('auto-installs system crontab jobs for Codex and Claude Code agents', async () => {
+        const calls = [];
+        const home = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentguard-system-'));
+        const runner = async (command, args, input) => {
+            calls.push({ command, args, input });
+            if (command === 'crontab' && args[0] === '-l') {
+                return { stdout: '# existing\n', stderr: '' };
+            }
+            return { stdout: '', stderr: '' };
+        };
+        const result = await (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: true,
+            force: false,
+            backend: 'auto',
+            agentHost: 'codex',
+            agentGuardHome: home,
+            timezone: 'UTC',
+        }, { runCommand: runner });
+        strict_1.default.equal(result.backend, 'system');
+        strict_1.default.equal(result.created, true);
+        strict_1.default.equal(calls[0].command, 'crontab');
+        strict_1.default.deepEqual(calls[0].args, ['-l']);
+        strict_1.default.equal(calls[1].command, 'crontab');
+        strict_1.default.deepEqual(calls[1].args, ['-']);
+        strict_1.default.match(calls[1].input ?? '', /# AgentGuard begin agentguard-threat-feed/);
+        strict_1.default.match(calls[1].input ?? '', /agentguard-system-.*\/scripts\/agentguard-threat-feed\.sh/);
+        strict_1.default.doesNotMatch(calls[1].input ?? '', /AGENTGUARD_HOME=/);
+        const script = (0, node_fs_1.readFileSync)((0, node_path_1.join)(home, 'scripts', 'agentguard-threat-feed.sh'), 'utf8');
+        strict_1.default.match(script, new RegExp(`export AGENTGUARD_HOME='${home.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}'`));
+        strict_1.default.match(script, /exec agentguard subscribe --quiet --json --cron-run/);
+    });
+    (0, node_test_1.it)('rejects unsafe AgentGuard home paths for system crontab jobs', async () => {
+        await strict_1.default.rejects(() => (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: true,
+            force: false,
+            backend: 'system',
+            agentGuardHome: '/tmp/ag-home"; touch /tmp/pwned #',
+            timezone: 'UTC',
+        }), /must not contain quotes or newlines/);
+    });
+    (0, node_test_1.it)('uses native OpenClaw cron command before Gateway fallback for OpenClaw agents', async () => {
+        const calls = [];
+        const runner = async (command, args) => {
+            calls.push({ command, args });
+            if (args.join(' ') === 'cron list')
+                return { stdout: '', stderr: '' };
+            return { stdout: 'created', stderr: '' };
+        };
+        const result = await (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: false,
+            force: false,
+            backend: 'auto',
+            agentHost: 'openclaw',
+            timezone: 'UTC',
+        }, { runCommand: runner });
+        strict_1.default.equal(result.backend, 'openclaw');
+        strict_1.default.deepEqual(calls.map((call) => call.args.slice(0, 2).join(' ')), ['cron list', 'cron add']);
+        strict_1.default.ok(calls[1].args.includes('--timeout-seconds'));
+        strict_1.default.ok(calls[1].args.includes('300'));
+    });
+    (0, node_test_1.it)('does not treat native OpenClaw cron name substrings as existing jobs', async () => {
+        const calls = [];
+        const runner = async (command, args) => {
+            calls.push({ command, args });
+            if (args.join(' ') === 'cron list') {
+                return { stdout: 'agentguard-threat-feed-extra    0 * * * *\n', stderr: '' };
+            }
+            return { stdout: 'created', stderr: '' };
+        };
+        const result = await (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: false,
+            force: false,
+            backend: 'auto',
+            agentHost: 'openclaw',
+            timezone: 'UTC',
+        }, { runCommand: runner });
+        strict_1.default.equal(result.created, true);
+        strict_1.default.deepEqual(calls.map((call) => call.args.slice(0, 2).join(' ')), ['cron list', 'cron add']);
+    });
+    (0, node_test_1.it)('leaves exact native OpenClaw cron names untouched unless force is set', async () => {
+        const calls = [];
+        const runner = async (command, args) => {
+            calls.push({ command, args });
+            return {
+                stdout: JSON.stringify({ jobs: [{ name: 'agentguard-threat-feed' }] }),
+                stderr: '',
+            };
+        };
+        const result = await (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: false,
+            force: false,
+            backend: 'auto',
+            agentHost: 'openclaw',
+            timezone: 'UTC',
+        }, { runCommand: runner });
+        strict_1.default.equal(result.created, false);
+        strict_1.default.deepEqual(calls.map((call) => call.args.slice(0, 2).join(' ')), ['cron list']);
+    });
+    (0, node_test_1.it)('does not fall back to OpenClaw Gateway when native OpenClaw cron add fails', async () => {
+        const gateway = fakeGateway();
+        const runner = async (_command, args) => {
+            if (args.join(' ') === 'cron list')
+                return { stdout: '', stderr: '' };
+            throw new Error('invalid native OpenClaw cron arguments');
+        };
+        await strict_1.default.rejects(() => (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: false,
+            force: false,
+            backend: 'auto',
+            agentHost: 'openclaw',
+            timezone: 'UTC',
+        }, { runCommand: runner, gateway: { request: gateway.request } }), /invalid native OpenClaw cron arguments/);
+        strict_1.default.deepEqual(gateway.calls, []);
+    });
+    (0, node_test_1.it)('auto-installs QClaw Gateway cron jobs for QClaw agents', async () => {
+        const gateway = fakeGateway();
+        const runner = async () => {
+            throw new Error('system cron should not be used for qclaw auto target');
+        };
+        const result = await (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: false,
+            force: false,
+            backend: 'auto',
+            agentHost: 'qclaw',
+            timezone: 'UTC',
+        }, { runCommand: runner, gateway: { request: gateway.request } });
+        strict_1.default.equal(result.backend, 'qclaw-gateway');
+        strict_1.default.deepEqual(gateway.calls.map((call) => call.method), ['cron.list', 'cron.add']);
+        const job = gateway.calls[1].params[0];
+        strict_1.default.equal(job.name, 'agentguard-threat-feed');
+        strict_1.default.deepEqual(job.schedule, { kind: 'cron', expr: '0 * * * *', tz: 'UTC' });
+        strict_1.default.equal(job.payload.agentguard.command, 'agentguard subscribe --json --cron-run');
+    });
+    (0, node_test_1.it)('auto-installs native Hermes cron jobs for Hermes agents', async () => {
+        const calls = [];
+        const hermesHome = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'agentguard-hermes-'));
+        const runner = async (command, args) => {
+            calls.push({ command, args });
+            if (args.join(' ') === 'cron list')
+                return { stdout: 'No scheduled jobs.', stderr: '' };
+            return { stdout: 'created', stderr: '' };
+        };
+        const result = await (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: true,
+            force: false,
+            backend: 'auto',
+            agentHost: 'hermes',
+            agentGuardHome: '/tmp/ag-home',
+            hermesHome,
+            timezone: 'UTC',
+        }, { runCommand: runner });
+        strict_1.default.equal(result.backend, 'hermes');
+        strict_1.default.equal(result.script, 'agentguard-agentguard-threat-feed.sh');
+        strict_1.default.deepEqual(calls.map((call) => call.args.slice(0, 2).join(' ')), ['cron list', 'cron create']);
+        strict_1.default.deepEqual(calls[1].args, [
+            'cron',
+            'create',
+            '0 * * * *',
+            '--name',
+            'agentguard-threat-feed',
+            '--deliver',
+            'local',
+            '--script',
+            'agentguard-agentguard-threat-feed.sh',
+            '--no-agent',
+        ]);
+        const script = (0, node_fs_1.readFileSync)((0, node_path_1.join)(hermesHome, 'scripts', 'agentguard-agentguard-threat-feed.sh'), 'utf8');
+        strict_1.default.match(script, /export AGENTGUARD_HOME='\/tmp\/ag-home'/);
+        strict_1.default.match(script, /exec agentguard subscribe --quiet --json --cron-run/);
+    });
+    (0, node_test_1.it)('requires init --agent when auto has no saved agent host', async () => {
+        await strict_1.default.rejects(() => (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: false,
+            force: false,
+            backend: 'auto',
+            timezone: 'UTC',
+        }), /agentguard init --agent/);
+    });
+    (0, node_test_1.it)('fails fast when Hermes cron list is unavailable', async () => {
+        const runner = async () => {
+            throw new Error('hermes command not found');
+        };
+        await strict_1.default.rejects(() => (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: false,
+            force: false,
+            backend: 'hermes',
+            timezone: 'UTC',
+        }, { runCommand: runner }), /Could not list Hermes cron jobs/);
+    });
+    (0, node_test_1.it)('falls back to OpenClaw Gateway when native OpenClaw cron command fails', async () => {
+        const gateway = fakeGateway();
+        const runner = async () => {
+            throw new Error('openclaw command not found');
+        };
+        const result = await (0, cron_js_1.installThreatFeedCron)({
+            name: 'agentguard-threat-feed',
+            cronExpression: '0 * * * *',
+            quiet: false,
+            force: false,
+            backend: 'auto',
+            agentHost: 'openclaw',
+            timezone: 'UTC',
+        }, { runCommand: runner, gateway: { request: gateway.request } });
+        strict_1.default.equal(result.backend, 'openclaw-gateway');
+        strict_1.default.deepEqual(gateway.calls.map((call) => call.method), ['cron.list', 'cron.add']);
+    });
+    (0, node_test_1.it)('fails fast when OpenClaw Gateway cron.list is unavailable', async () => {
+        await strict_1.default.rejects(() => (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', cronExpression: '0 * * * *', quiet: false, force: false, timezone: 'UTC' }, {
+            async request(method) {
+                if (method === 'cron.list')
+                    throw new Error('Gateway unavailable');
+                return { ok: true };
+            },
+        }), /Gateway unavailable/);
     });
     (0, node_test_1.it)('leaves an existing cron job untouched unless force is set', async () => {
         const gateway = fakeGateway([{ id: 'job-1', name: 'agentguard-threat-feed' }]);
-        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', intervalMinutes: 15, force: false }, { request: gateway.request });
+        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', cronExpression: '0 * * * *', quiet: false, force: false, timezone: 'UTC' }, { request: gateway.request });
         strict_1.default.equal(result.created, false);
         strict_1.default.deepEqual(gateway.calls.map((call) => call.method), ['cron.list']);
     });
     (0, node_test_1.it)('removes an existing cron job by jobId when force is set', async () => {
         const gateway = fakeGateway([{ id: 'job-1', name: 'agentguard-threat-feed' }]);
-        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', intervalMinutes: 5, force: true }, { request: gateway.request });
+        const result = await (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', cronExpression: '*/5 * * * *', quiet: true, force: true, timezone: 'UTC' }, { request: gateway.request });
         strict_1.default.equal(result.created, true);
         strict_1.default.deepEqual(gateway.calls.map((call) => call.method), ['cron.list', 'cron.remove', 'cron.add']);
         strict_1.default.deepEqual(gateway.calls[1].params, { jobId: 'job-1' });
-        strict_1.default.deepEqual(gateway.calls[2].params[0].schedule, { kind: 'every', everyMs: 300000 });
+        strict_1.default.deepEqual(gateway.calls[2].params[0].schedule, { kind: 'cron', expr: '*/5 * * * *', tz: 'UTC' });
+        strict_1.default.deepEqual(gateway.calls[2].params[0].payload.agentguard, {
+            mode: 'quiet',
+            command: 'agentguard subscribe --quiet --json --cron-run',
+        });
+        strict_1.default.match(gateway.calls[2].params[0].payload.message, /Mode: quiet/);
+        strict_1.default.match(gateway.calls[2].params[0].payload.message, /Command: `agentguard subscribe --quiet --json --cron-run`/);
+        strict_1.default.match(gateway.calls[2].params[0].payload.message, /agentguard subscribe --quiet --json --cron-run/);
     });
     (0, node_test_1.it)('does not add a replacement if force removal fails', async () => {
         const calls = [];
-        await strict_1.default.rejects(() => (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', intervalMinutes: 5, force: true }, {
+        await strict_1.default.rejects(() => (0, cron_js_1.installOpenClawThreatFeedCron)({ name: 'agentguard-threat-feed', cronExpression: '*/5 * * * *', quiet: false, force: true, timezone: 'UTC' }, {
             async request(method, params) {
                 calls.push({ method, params });
                 if (method === 'cron.list')