@i4ctime/q-ring 0.17.0 → 0.17.5

package/README.md

@@ -355,6 +355,8 @@ qring push cloudflare
 qring push github --keys DATABASE_URL,API_KEY --dry-run
 ```
 
+Canaries can ride along: `qring canary plant KEY --format aws --push github` plants a honeytoken locally and seeds it into the platform without reading it back (see Canary Honeytokens).
+
 ### Secret Liveness Validation
 
 Test if a secret is actually valid with its target service. q-ring auto-detects the provider from key prefixes (`sk-` → OpenAI, `ghp_` → GitHub, etc.) or accepts an explicit provider name.
@@ -508,21 +510,43 @@ Plant fake credentials that look and read exactly like real ones. Anything that
 # Plant a canary shaped like a real AWS access key
 qring canary plant AWS_SECRET_ACCESS_KEY --format aws
 
-# Other shapes: github, openai, anthropic, stripe, generic
-qring canary plant GHP_BACKUP_TOKEN --format github
+# Other shapes: aws-secret, github, github-pat, openai, openai-project,
+# anthropic, stripe, gitlab, slack, google, npm, generic
+qring canary plant GHP_BACKUP_TOKEN --format github-pat
 
 # See what's been tripped
 qring canary list
 qring audit --action canary
 ```
 
-Values are CSPRNG noise in the provider's real token shape (an `aws` canary matches `AKIA[A-Z0-9]{16}`) — plausible enough to be taken, never valid. Alerts are throttled to one per key per 30 seconds; the audit trail records every read.
+Values are CSPRNG noise in the provider's real token shape (an `aws` canary matches `AKIA[A-Z0-9]{16}`, an `anthropic` one the real `sk-ant-api03-…AA` layout) — plausible enough to be taken, never valid. Alerts are throttled to one per key per 30 seconds; the audit trail records every read.
+
+**Get paged.** Desktop notifications only help when you are at the machine. Register webhook channels and every trip reaches them too:
+
+```bash
+qring canary alert add --discord https://discord.com/api/webhooks/…
+qring canary alert add --slack   https://hooks.slack.com/services/…
+qring canary alert add --ntfy    https://ntfy.sh/my-canaries
+qring canary alert add --url     https://example.com/canary   # generic JSON POST
+qring canary alert list
+qring canary alert test          # send a clearly-labelled drill
+```
+
+Channels live in `~/.config/q-ring/canary-alerts.json` (mode `0600`). Sends are fire-and-forget, SSRF-guarded like hooks, throttled with the desktop alert, and never include the fake value — only the key, scope, source, and the agent label that reached for it.
+
+**Seed a tripwire into CI.** Plant a canary and push it to a deployment platform in one step, so a leaked GitHub Actions / Vercel / Cloudflare environment carries a decoy:
+
+```bash
+qring canary plant AWS_SECRET_ACCESS_KEY --format aws-secret --push github --repo you/your-app
+```
+
+Honest caveat: q-ring only sees reads that go through q-ring. A leaked value used directly on the platform side is not observable here — pair it with the provider's own alerting if you need that.
 
 Canaries are built to stay covert: they carry no identifying description (add an innocuous cover story with `--description` if you like), their flag never appears in MCP tool responses, and trip records are visible only from the operator's terminal — never to agents via MCP audit tools. Bulk `export` and `delete` trip them just like reads, so sweeping the ring or removing the tripwire both ring the bell. Done with one? `qring canary disarm <key>` turns it back into an ordinary secret (`qring set` over a canary warns you first — the flag deliberately survives overwrites so an agent can't launder it away).
 
 ### MCP Airlock
 
-Run a third-party MCP server behind q-ring. The airlock sits between your agent host and the wrapped server, spawns it with a **stripped environment** (no inherited API keys — opt back in with `--inherit-env`), and records every tool call that crosses it as a `wrap` event in the audit chain, grouped per session and labeled with the calling client's identity. Tool arguments are never logged — they may contain secrets.
+Run a third-party MCP server behind q-ring. The airlock sits between your agent host and the wrapped server, spawns it with a **stripped environment** (no inherited API keys — opt back in with `--inherit-env`), records every tool call, resource read, and prompt fetch that crosses it as a `wrap` event in the audit chain (grouped per session and labeled with the calling client's identity), **scrubs known secret values out of every result** before it reaches the transcript, and enforces the project's `policy.wrap` rules. Tool and prompt arguments are never logged — they may contain secrets.
 
 ```json
 {
@@ -535,9 +559,42 @@ Run a third-party MCP server behind q-ring. The airlock sits between your agent
 }
 ```
 
-Tools-only proxy today: `tools/list` and `tools/call` pass through verbatim (pagination, progress notifications, cancellation, and `tools/list_changed` included; long-running tools are governed by the host's own timeout, with a generous airlock ceiling configurable via `QRING_WRAP_TIMEOUT_MS`). A wrapped server's *resources and prompts* are not proxied yet — a resources-heavy server will look tools-only behind the airlock.
+Tools, resources, and prompts all pass through verbatim (pagination, progress notifications, cancellation, subscriptions, and the `list_changed` / `updated` notifications included); the airlock advertises exactly the capabilities the wrapped server has. Long-running tools are governed by the host's own timeout, with a generous airlock ceiling configurable via `QRING_WRAP_TIMEOUT_MS`.
+
+```bash
+# Wrap a remote Streamable HTTP server; the Bearer token comes from q-ring (audited read)
+qring mcp wrap --url https://mcp.example.com/mcp --auth-secret EXAMPLE_MCP_TOKEN
+
+# Keep results verbatim (default: known secret values are replaced with [QRING:REDACTED])
+qring mcp wrap --no-redact -- npx -y some-mcp-server
+```
+
+**Wrap policy.** Govern the wrapped server from `.q-ring.json` — the same file, the same fail-closed engine:
+
+```json
+{
+  "policy": {
+    "wrap": {
+      "allowTools": ["github_*", "search"],
+      "denyTools": ["github_delete_*"],
+      "approveTools": ["github_merge_pr"],
+      "rateLimit": { "maxCalls": 60, "perSeconds": 60 },
+      "toolRateLimits": { "search": { "maxCalls": 5, "perSeconds": 10 } },
+      "redactResults": true
+    }
+  }
+}
+```
+
+Denied tools are hidden from `tools/list` and refused on call with a `policy_deny` audit event; `approveTools` are refused until you grant them:
 
-Be clear about what the airlock is: env stripping plus a tamper-evident record of every tool call. It is **not a sandbox** — the wrapped process still runs as your user with normal filesystem, network, and OS-keychain access, and tool descriptions/results pass through uninspected. See `docs/threat-model.md` for the honest boundary picture.
+```bash
+qring mcp approve github_merge_pr --for 900 --reason "release 1.4"
+qring mcp approvals
+qring mcp approve github_merge_pr --revoke
+```
+
+Be clear about what the airlock is: env stripping, a tamper-evident record of every crossing, policy at the tool boundary, and best-effort redaction of secret *values* the ring knows about. It is **not a sandbox** — the wrapped process still runs as your user with normal filesystem, network, and OS-keychain access, and tool descriptions pass through uninspected. See `docs/threat-model.md` for the honest boundary picture.
 
 ### Just-In-Time (JIT) Provisioning
 
@@ -632,7 +689,7 @@ qring wizard myservice --hook-exec "pm2 restart app"
 
 ### Governance Policy
 
-Define project-level governance rules in `.q-ring.json` to control which MCP tools can be used, which keys are accessible, and which commands can be executed. Policy is enforced at both the MCP server and keyring level.
+Define project-level governance rules in `.q-ring.json` to control which MCP tools can be used, which keys are accessible, which commands can be executed, and what a wrapped MCP server may do behind the airlock. Policy is enforced at the MCP server, keyring, and airlock level.
 
 Over MCP, policy is resolved from the directory the server was **launched** in — not from the `projectPath` a caller passes — so an agent can't sidestep restrictions by pointing at a directory with no policy. Launch the MCP server from your project root (where `.q-ring.json` lives). Edits to `.q-ring.json` are picked up automatically (the policy cache invalidates on file change), so you don't need to restart the server.
 
@@ -663,6 +720,11 @@ Example policy in `.q-ring.json`:
     "secrets": {
       "requireApprovalForTags": ["production"],
       "maxTtlSeconds": 86400
+    },
+    "wrap": {
+      "denyTools": ["*_delete_*"],
+      "approveTools": ["deploy_*"],
+      "rateLimit": { "maxCalls": 60, "perSeconds": 60 }
     }
   }
 }
@@ -700,6 +762,25 @@ qring audit:export --format json --since 2026-03-01
 qring audit:export --format csv --output audit-report.csv
 ```
 
+### Agent Session Timeline
+
+Every MCP session is stamped with the client's identity (`clientInfo` name@version) and every airlock session with a correlation id. `audit:sessions` folds the flat audit feed back into one timeline per agent process, so "what did Cursor do in that session?" is one command instead of a grep.
+
+```bash
+# One block per session: agent, source, window, event + denial counts, keys touched
+qring audit:sessions
+
+# Narrow to one client, widen the window, print every event line
+qring audit:sessions --agent "Cursor@1.2.3" --since 7d --verbose
+
+# Machine-readable
+qring audit:sessions --json
+```
+
+Airlock sessions (`qring mcp wrap`) show up as `airlock: <wrapped command>` with every proxied call in order. The status dashboard (`qring status`) renders the same data as an expandable **Agent Sessions (24h)** card.
+
+Agents can look at their own history too — as MCP **resources**, not tools: `qring://sessions` lists session summaries and `qring://sessions/{id}` returns one timeline (key names and actions only, never values). Two guarantees hold on the agent side: canary trips are stripped before anything is summarised, so a honeytoken can never be discovered from a session view, and denying the `audit_log` tool in `.q-ring.json` policy hides the resources as well — one switch controls audit visibility for agents.
+
 ### Encrypted File Backend (Headless / CI)
 
 Hosts with no OS keyring at all (headless Linux, containers, CI) can opt into an encrypted file store. Everything — secrets, the audit anchor, the agent-memory key — routes through it.
@@ -780,6 +861,7 @@ What you get:
 - **Secrets table** — searchable, sortable view of every secret (key, scope, env, type, decay, tags, last read), with quick chips for `expired`, `stale`, and `protected` filters. Press `/` to focus the search box.
 - **Quantum cards** — decay timers, superposition states, entanglement pairs, and active quantum tunnels.
 - **Approvals & hooks** — live list of valid (and tampered) approval grants and every registered hook with its match summary.
+- **Agent sessions (24h)** — one expandable row per MCP client or airlock session: agent label, source, window, event and denial counts, recent events.
 - **Agent memory** — count of encrypted memory keys persisted at `~/.config/q-ring/agent-memory.enc`.
 - **Anomaly alerts** — burst reads, off-hours access, tampered audit chain, and other suspicious patterns.
 - **Audit log (24h)** — filterable feed with action chips (`read`/`write`/`delete`/`export`), source chips (`cli`/`mcp`/`hook`/`agent`), and a free-text filter.

package/dist/{chunk-SQKTDYSO.js → chunk-5ZCQSBVS.js}

@@ -1569,10 +1569,23 @@ var secretsPolicySchema = z2.object({
   requireRotationFormatForTags: stringArray.optional(),
   maxTtlSeconds: z2.number().optional()
 }).strict();
+var rateLimitSchema = z2.object({
+  maxCalls: z2.number().int().positive(),
+  perSeconds: z2.number().positive()
+}).strict();
+var wrapPolicySchema = z2.object({
+  allowTools: stringArray.optional(),
+  denyTools: stringArray.optional(),
+  approveTools: stringArray.optional(),
+  rateLimit: rateLimitSchema.optional(),
+  toolRateLimits: z2.record(z2.string(), rateLimitSchema).optional(),
+  redactResults: z2.boolean().optional()
+}).strict();
 var policySchema = z2.object({
   mcp: mcpPolicySchema.optional(),
   exec: execPolicySchema.optional(),
-  secrets: secretsPolicySchema.optional()
+  secrets: secretsPolicySchema.optional(),
+  wrap: wrapPolicySchema.optional()
 }).strict();
 var PolicyConfigError = class extends Error {
   constructor(message) {
@@ -1582,6 +1595,10 @@ var PolicyConfigError = class extends Error {
 };
 var cachedPolicy = null;
 var policyRoot = null;
+function setPolicyRoot(root) {
+  policyRoot = root;
+  cachedPolicy = null;
+}
 function getPolicyRoot() {
   return policyRoot;
 }
@@ -1725,9 +1742,55 @@ function getPolicySummary(projectPath) {
     hasMcpPolicy: !!policy.mcp,
     hasExecPolicy: !!policy.exec,
     hasSecretPolicy: !!policy.secrets,
+    hasWrapPolicy: !!policy.wrap,
     details: policy
   };
 }
+function matchesToolPattern(pattern, toolName) {
+  if (!pattern.includes("*")) return pattern === toolName;
+  const re = new RegExp(
+    "^" + pattern.split("*").map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$"
+  );
+  return re.test(toolName);
+}
+function anyPatternMatches(patterns, toolName) {
+  return patterns?.find((p) => matchesToolPattern(p, toolName));
+}
+function checkWrapToolPolicy(toolName, projectPath) {
+  const wrap = loadPolicy(projectPath).wrap;
+  if (!wrap) return { allowed: true, policySource: "no-policy" };
+  const denied = anyPatternMatches(wrap.denyTools, toolName);
+  if (denied) {
+    return {
+      allowed: false,
+      reason: `wrapped tool "${toolName}" is denied by policy (${denied})`,
+      policySource: ".q-ring.json policy.wrap.denyTools"
+    };
+  }
+  if (wrap.allowTools && !anyPatternMatches(wrap.allowTools, toolName)) {
+    return {
+      allowed: false,
+      reason: `wrapped tool "${toolName}" is not in the allow list`,
+      policySource: ".q-ring.json policy.wrap.allowTools"
+    };
+  }
+  return { allowed: true, policySource: ".q-ring.json policy.wrap" };
+}
+function wrapToolRequiresApproval(toolName, projectPath) {
+  const wrap = loadPolicy(projectPath).wrap;
+  return !!anyPatternMatches(wrap?.approveTools, toolName);
+}
+function getWrapRateLimit(toolName, projectPath) {
+  const wrap = loadPolicy(projectPath).wrap;
+  if (!wrap) return void 0;
+  const perTool = wrap.toolRateLimits ? Object.entries(wrap.toolRateLimits).find(
+    ([pattern]) => matchesToolPattern(pattern, toolName)
+  )?.[1] : void 0;
+  return perTool ?? wrap.rateLimit;
+}
+function wrapRedactsResults(projectPath) {
+  return loadPolicy(projectPath).wrap?.redactResults ?? true;
+}
 
 // src/utils/hash.ts
 import { createHash as createHash2 } from "crypto";
@@ -1829,6 +1892,180 @@ function notifyApprovalRequested(key, source) {
   );
 }
 
+// src/core/canary-webhooks.ts
+import { existsSync as existsSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7 } from "fs";
+import { join as join10 } from "path";
+import { homedir as homedir7 } from "os";
+import { randomUUID as randomUUID2 } from "crypto";
+var CANARY_ALERT_TYPES = ["discord", "slack", "ntfy", "generic"];
+function getRegistryPath4() {
+  const override = process.env.QRING_CANARY_ALERTS_PATH;
+  if (override) return override;
+  const dir = join10(homedir7(), ".config", "q-ring");
+  if (!existsSync7(dir)) mkdirSync7(dir, { recursive: true, mode: 448 });
+  return join10(dir, "canary-alerts.json");
+}
+function loadRegistry4() {
+  return loadJsonRegistry(getRegistryPath4(), { channels: [] });
+}
+function saveRegistry4(registry2) {
+  writeFileSync6(getRegistryPath4(), JSON.stringify(registry2, null, 2), { mode: 384 });
+}
+function assertHttpUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid webhook URL: ${url}`);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error(`Webhook URL must be http(s): ${url}`);
+  }
+}
+function addCanaryAlert(entry) {
+  if (!CANARY_ALERT_TYPES.includes(entry.type)) {
+    throw new Error(
+      `Unknown alert type "${entry.type}". Available: ${CANARY_ALERT_TYPES.join(", ")}`
+    );
+  }
+  assertHttpUrl(entry.url);
+  const registry2 = loadRegistry4();
+  const channel = {
+    id: randomUUID2().slice(0, 8),
+    type: entry.type,
+    url: entry.url,
+    description: entry.description,
+    enabled: true,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  registry2.channels.push(channel);
+  saveRegistry4(registry2);
+  return channel;
+}
+function listCanaryAlerts() {
+  return loadRegistry4().channels;
+}
+function removeCanaryAlert(id) {
+  const registry2 = loadRegistry4();
+  const before = registry2.channels.length;
+  registry2.channels = registry2.channels.filter((c) => c.id !== id);
+  if (registry2.channels.length === before) return false;
+  saveRegistry4(registry2);
+  return true;
+}
+function setCanaryAlertEnabled(id, enabled) {
+  const registry2 = loadRegistry4();
+  const channel = registry2.channels.find((c) => c.id === id);
+  if (!channel) return false;
+  channel.enabled = enabled;
+  saveRegistry4(registry2);
+  return true;
+}
+function describeAlertUrl(url) {
+  try {
+    const u = new URL(url);
+    const tail = u.pathname.length > 12 ? `${u.pathname.slice(0, 8)}\u2026${u.pathname.slice(-4)}` : u.pathname;
+    return `${u.protocol}//${u.host}${tail}`;
+  } catch {
+    return url;
+  }
+}
+function headline(event) {
+  return event.test ? "q-ring canary alert test" : "q-ring: CANARY TRIPPED";
+}
+function summary(event) {
+  const who = event.agent ? `${event.source} (${event.agent})` : event.source;
+  const where = event.env ? `${event.scope}/${event.env}` : event.scope;
+  return event.test ? `This is a test from \`qring canary alert test\`. Trips on honeytoken "${event.key}" (${where}) would arrive here.` : `Honeytoken "${event.key}" (${where}) was read by ${who} at ${event.timestamp}. ${event.detail}. This credential is fake \u2014 but something reached for it. Investigate: qring audit --action canary`;
+}
+function buildAlertPayload(type, event) {
+  const json = { "Content-Type": "application/json", "User-Agent": "q-ring-canary/1.0" };
+  switch (type) {
+    case "discord":
+      return {
+        body: JSON.stringify({ content: `\u{1F6A8} **${headline(event)}**
+${summary(event)}` }),
+        headers: json
+      };
+    case "slack":
+      return {
+        body: JSON.stringify({ text: `:rotating_light: *${headline(event)}*
+${summary(event)}` }),
+        headers: json
+      };
+    case "ntfy":
+      return {
+        body: summary(event),
+        headers: {
+          "Content-Type": "text/plain",
+          "User-Agent": "q-ring-canary/1.0",
+          Title: headline(event),
+          Priority: event.test ? "3" : "5",
+          Tags: event.test ? "test_tube" : "rotating_light"
+        }
+      };
+    case "generic":
+      return {
+        body: JSON.stringify({
+          event: "canary",
+          test: event.test ?? false,
+          key: event.key,
+          scope: event.scope,
+          env: event.env,
+          source: event.source,
+          agent: event.agent ?? void 0,
+          detail: event.detail,
+          timestamp: event.timestamp
+        }),
+        headers: json
+      };
+  }
+}
+async function sendOne(channel, event) {
+  const base = { channelId: channel.id, type: channel.type };
+  const ssrfBlock = await checkSSRF(channel.url);
+  if (ssrfBlock) {
+    logAudit({
+      action: "policy_deny",
+      key: event.key,
+      scope: event.scope,
+      source: "hook",
+      detail: `canary alert SSRF blocked: ${describeAlertUrl(channel.url)}`
+    });
+    return { ...base, success: false, message: ssrfBlock };
+  }
+  try {
+    const { body, headers } = buildAlertPayload(channel.type, event);
+    const res = await httpRequest({
+      url: channel.url,
+      method: "POST",
+      headers,
+      body,
+      timeoutMs: 1e4
+    });
+    return {
+      ...base,
+      success: res.statusCode >= 200 && res.statusCode < 300,
+      message: `HTTP ${res.statusCode}`
+    };
+  } catch (err) {
+    return { ...base, success: false, message: err instanceof Error ? err.message : "HTTP error" };
+  }
+}
+async function sendCanaryAlerts(event, onlyId) {
+  const channels = listCanaryAlerts().filter((c) => onlyId ? c.id === onlyId : c.enabled);
+  if (channels.length === 0) return [];
+  const results = await Promise.allSettled(channels.map((c) => sendOne(c, event)));
+  return results.map(
+    (r, i) => r.status === "fulfilled" ? r.value : {
+      channelId: channels[i].id,
+      type: channels[i].type,
+      success: false,
+      message: String(r.reason)
+    }
+  );
+}
+
 // src/core/canary-alert.ts
 var TRIP_THROTTLE_MS = 30 * 1e3;
 var lastAlerted = /* @__PURE__ */ new Map();
@@ -1842,16 +2079,27 @@ function recordCanaryTrip(trip) {
     source: trip.source,
     detail: `CANARY TRIPPED: ${trip.detail ?? `honeytoken read via ${trip.source}`}`
   });
-  if (!notificationsEnabled()) return;
   const now = Date.now();
   const last = lastAlerted.get(trip.key);
   if (last !== void 0 && now - last < TRIP_THROTTLE_MS) return;
   lastAlerted.set(trip.key, now);
-  const who = agent ? `${trip.source} (${agent})` : trip.source;
-  notifyUser(
-    "q-ring: CANARY TRIPPED",
-    `Honeytoken "${trip.key}" was read by ${who}. This credential is fake \u2014 but something reached for it. Investigate: qring audit --action canary`
-  );
+  if (notificationsEnabled()) {
+    const who = agent ? `${trip.source} (${agent})` : trip.source;
+    notifyUser(
+      "q-ring: CANARY TRIPPED",
+      `Honeytoken "${trip.key}" was read by ${who}. This credential is fake \u2014 but something reached for it. Investigate: qring audit --action canary`
+    );
+  }
+  void sendCanaryAlerts({
+    key: trip.key,
+    scope: trip.scope,
+    env: trip.env,
+    source: trip.source,
+    agent,
+    detail: trip.detail ?? `honeytoken read via ${trip.source}`,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  }).catch(() => {
+  });
 }
 
 // src/core/provision.ts
@@ -2567,9 +2815,9 @@ function tunnelList() {
 }
 
 // src/core/memory.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7, chmodSync as chmodSync3 } from "fs";
-import { join as join10 } from "path";
-import { homedir as homedir7, hostname, userInfo } from "os";
+import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync7, mkdirSync as mkdirSync8, chmodSync as chmodSync3 } from "fs";
+import { join as join11 } from "path";
+import { homedir as homedir8, hostname, userInfo } from "os";
 import {
   createCipheriv as createCipheriv2,
   createDecipheriv as createDecipheriv2,
@@ -2581,21 +2829,21 @@ var MEMORY_FILE = "agent-memory.enc";
 var KEYRING_SERVICE = "qring-memory-key";
 var KEYRING_ACCOUNT = "encryption-key";
 function getMemoryDir() {
-  const dir = join10(homedir7(), ".config", "q-ring");
-  if (!existsSync7(dir)) {
-    mkdirSync7(dir, { recursive: true, mode: 448 });
+  const dir = join11(homedir8(), ".config", "q-ring");
+  if (!existsSync8(dir)) {
+    mkdirSync8(dir, { recursive: true, mode: 448 });
   }
   return dir;
 }
 function writeMemoryFile(path, data) {
-  writeFileSync6(path, data, { mode: 384 });
+  writeFileSync7(path, data, { mode: 384 });
   try {
     chmodSync3(path, 384);
   } catch {
   }
 }
 function getMemoryPath() {
-  return join10(getMemoryDir(), MEMORY_FILE);
+  return join11(getMemoryDir(), MEMORY_FILE);
 }
 var PBKDF2_ITERATIONS2 = 21e4;
 var KEY_LENGTH2 = 32;
@@ -2689,7 +2937,7 @@ function decrypt(blob) {
 }
 function loadStore2() {
   const path = getMemoryPath();
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     return { entries: {} };
   }
   try {
@@ -2740,8 +2988,80 @@ function clearMemory() {
   saveStore2({ entries: {} });
 }
 
+// src/core/sessions.ts
+var DEFAULT_MAX_EVENTS = 200;
+var UNLABELED = "unlabeled";
+function slug(label) {
+  return label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || UNLABELED;
+}
+function sessionKeyFor(event) {
+  if (event.action === "wrap" && event.correlationId) return `wrap:${event.correlationId}`;
+  if (event.agent) return `pid:${event.pid}:${slug(event.agent)}`;
+  if (event.source === "mcp" || event.source === "agent") return `pid:${event.pid}:${UNLABELED}`;
+  return null;
+}
+function wrapLabelFrom(detail) {
+  const m = detail?.match(/^airlock session started: (.+?)(?: \(env (?:inherited|stripped)\))?$/);
+  return m?.[1];
+}
+function buildSessions(events, maxEvents = DEFAULT_MAX_EVENTS) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    const key = sessionKeyFor(e);
+    if (!key) continue;
+    const bucket = byKey.get(key);
+    if (bucket) bucket.push(e);
+    else byKey.set(key, [e]);
+  }
+  const sessions = [];
+  for (const [key, bucket] of byKey) {
+    bucket.sort((a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime());
+    const first = bucket[0];
+    const last = bucket[bucket.length - 1];
+    const countsByAction = {};
+    const sources = /* @__PURE__ */ new Map();
+    const keys = /* @__PURE__ */ new Set();
+    let denials = 0;
+    let wrapLabel;
+    for (const e of bucket) {
+      countsByAction[e.action] = (countsByAction[e.action] ?? 0) + 1;
+      sources.set(e.source, (sources.get(e.source) ?? 0) + 1);
+      if (e.key) keys.add(e.key);
+      if (e.action === "policy_deny") denials++;
+      if (!wrapLabel && e.action === "wrap") wrapLabel = wrapLabelFrom(e.detail);
+    }
+    const source = [...sources.entries()].sort((a, b) => b[1] - a[1])[0][0];
+    const agent = bucket.find((e) => e.agent)?.agent ?? UNLABELED;
+    const isWrap = key.startsWith("wrap:");
+    sessions.push({
+      id: isWrap ? key.slice("wrap:".length) : `${first.pid}-${slug(agent)}`,
+      agent,
+      source,
+      pid: first.pid,
+      startedAt: first.timestamp,
+      endedAt: last.timestamp,
+      eventCount: bucket.length,
+      countsByAction,
+      keys: [...keys].sort(),
+      denials,
+      ...isWrap ? { wrapLabel: wrapLabel ?? "(unknown command)" } : {},
+      events: bucket.slice(-maxEvents).reverse()
+    });
+  }
+  sessions.sort((a, b) => new Date(b.endedAt).getTime() - new Date(a.endedAt).getTime());
+  return sessions;
+}
+function loadEvents(query) {
+  return queryAudit({ since: query.since, agent: query.agent }).filter((e) => e.action !== "list");
+}
+function listAgentSessions(query = {}) {
+  const sessions = buildSessions(loadEvents(query), query.maxEvents);
+  return query.limit ? sessions.slice(0, query.limit) : sessions;
+}
+
 export {
   PACKAGE_VERSION,
+  hashProjectPath,
   serviceForScope,
   checkDecay,
   readProjectConfig,
@@ -2763,12 +3083,24 @@ export {
   fireHooks,
   grantApproval,
   revokeApproval,
+  hasApproval,
   countLegacyApprovals,
   listApprovals,
+  addCanaryAlert,
+  listCanaryAlerts,
+  removeCanaryAlert,
+  setCanaryAlertEnabled,
+  describeAlertUrl,
+  sendCanaryAlerts,
   registry,
+  setPolicyRoot,
   checkExecPolicy,
   getExecMaxRuntime,
   getPolicySummary,
+  checkWrapToolPolicy,
+  wrapToolRequiresApproval,
+  getWrapRateLimit,
+  wrapRedactsResults,
   getSecret,
   getEnvelope,
   setSecret,
@@ -2787,6 +3119,8 @@ export {
   recall,
   listMemory,
   forget,
-  clearMemory
+  clearMemory,
+  buildSessions,
+  listAgentSessions
 };
-//# sourceMappingURL=chunk-SQKTDYSO.js.map
+//# sourceMappingURL=chunk-5ZCQSBVS.js.map