@idevelopers/agentlock 0.1.0

package/dist/enforcement/match.js

@@ -0,0 +1,28 @@
+export function matchesAny(value, patterns) {
+    return patterns.some((pattern) => matchesPattern(value, pattern));
+}
+export function matchesPattern(value, pattern) {
+    const normalizedValue = normalize(value);
+    const normalizedPattern = normalize(pattern);
+    if (normalizedPattern === "**" || normalizedPattern === "*") {
+        return true;
+    }
+    if (!normalizedPattern.includes("*")) {
+        return (normalizedValue === normalizedPattern ||
+            normalizedValue.startsWith(`${normalizedPattern}/`) ||
+            normalizedValue.startsWith(`${normalizedPattern} `));
+    }
+    return globToRegExp(normalizedPattern).test(normalizedValue);
+}
+function globToRegExp(pattern) {
+    const marker = "\u0000";
+    const escaped = pattern
+        .replace(/[.+?^${}()|[\]\\]/g, "\\$&")
+        .replace(/\*\*/g, marker)
+        .replace(/\*/g, "[^/ ]*")
+        .replace(new RegExp(marker, "g"), ".*");
+    return new RegExp(`^${escaped}$`);
+}
+function normalize(value) {
+    return value.trim().replaceAll("\\", "/").replace(/\/+/g, "/");
+}

package/dist/enforcement/runner.js

@@ -0,0 +1,66 @@
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { tailRedacted } from "../util/redact.js";
+export async function runCommand(command, args, cwd, timeoutMs) {
+    const startedAt = Date.now();
+    return new Promise((resolve) => {
+        const child = spawn(command, args, {
+            cwd,
+            shell: false,
+            env: sanitizedEnv(cwd),
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+        }, timeoutMs);
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+            stdout = stdout.slice(-8192);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+            stderr = stderr.slice(-8192);
+        });
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            resolve({
+                status: "error",
+                exitCode: null,
+                durationMs: Date.now() - startedAt,
+                stdoutTail: tailRedacted(stdout),
+                stderrTail: tailRedacted(`${stderr}\n${error.message}`),
+            });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            resolve({
+                status: timedOut ? "timeout" : code === 0 ? "pass" : "fail",
+                exitCode: code,
+                durationMs: Date.now() - startedAt,
+                stdoutTail: tailRedacted(stdout),
+                stderrTail: tailRedacted(stderr),
+            });
+        });
+    });
+}
+function sanitizedEnv(cwd) {
+    const allowed = new Set(["PATH", "HOME", "TMPDIR", "TEMP", "TMP", "LANG", "LC_ALL", "SHELL"]);
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (!value) {
+            continue;
+        }
+        if (allowed.has(key)) {
+            env[key] = value;
+            continue;
+        }
+        if (!/(key|token|secret|password|credential|authorization|cookie|polar|agentlock|openai|anthropic|github|npm|aws|gcp|google|azure|cloudflare)/i.test(key)) {
+            env[key] = value;
+        }
+    }
+    env.PATH = [path.join(cwd, "node_modules", ".bin"), env.PATH].filter(Boolean).join(path.delimiter);
+    return env;
+}

package/dist/enforcement/secrets.js

@@ -0,0 +1,38 @@
+import path from "node:path";
+const SECRET_PATH_PATTERNS = [
+    ".env",
+    ".env.*",
+    "**/.env",
+    "**/.env.*",
+    "**/.npmrc",
+    "~/.npmrc",
+    "~/.aws/**",
+    "~/.ssh/**",
+    "~/.config/gcloud/**",
+    "~/.docker/config.json",
+    "~/.kube/config",
+    "**/*secret*",
+    "**/*credential*",
+    "**/*token*",
+    "**/Cookies",
+];
+export function defaultSecretPathPatterns() {
+    return [...SECRET_PATH_PATTERNS];
+}
+export function isLikelySecretPath(inputPath) {
+    const normalized = inputPath.replaceAll("\\", "/").toLowerCase();
+    const base = path.basename(normalized);
+    return (base === ".env" ||
+        base.startsWith(".env.") ||
+        base === ".npmrc" ||
+        base.includes("id_rsa") ||
+        base.includes("id_ed25519") ||
+        normalized.includes("/.ssh/") ||
+        normalized.includes("/.aws/") ||
+        normalized.includes("/.config/gcloud/") ||
+        normalized.includes("/.kube/config") ||
+        normalized.includes("credential") ||
+        normalized.includes("secret") ||
+        normalized.includes("token") ||
+        normalized.endsWith("/cookies"));
+}

package/dist/index.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { registerTools } from "./server.js";
+async function main() {
+    const server = new McpServer({
+        name: "agentlock",
+        version: "0.1.0",
+    });
+    registerTools(server);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});

package/dist/license/constants.js

@@ -0,0 +1,2 @@
+export const AGENTLOCK_POLAR_ORGANIZATION_ID = "534c0711-1ded-497c-aa46-d1a7dfa46d6e";
+export const AGENTLOCK_CHECKOUT_URL = "https://polar.sh/idevelopers";

package/dist/license/gate.js

@@ -0,0 +1,6 @@
+import { AGENTLOCK_CHECKOUT_URL } from "./constants.js";
+export function requirePro(feature, tier) {
+    if (tier === "free") {
+        throw new Error(`Pro license required: ${feature}. Buy a license at ${process.env.AGENTLOCK_CHECKOUT_URL ?? AGENTLOCK_CHECKOUT_URL}, then activate it with agentlock_activate_license.`);
+    }
+}

package/dist/license/validator.js

@@ -0,0 +1,187 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Polar } from "@polar-sh/sdk";
+import { licenseCachePath } from "../util/paths.js";
+import { AGENTLOCK_POLAR_ORGANIZATION_ID } from "./constants.js";
+const OFFLINE_GRACE_MS = 72 * 60 * 60 * 1000;
+export class PolarLicenseValidator {
+    options;
+    cachePath;
+    constructor(options = {}) {
+        this.options = options;
+        this.cachePath = options.cachePath ?? licenseCachePath();
+    }
+    async verify() {
+        const cache = await readLicenseCache(this.cachePath);
+        if (!cache.key) {
+            return { tier: "free" };
+        }
+        const organizationId = this.options.organizationId ??
+            process.env.POLAR_ORGANIZATION_ID ??
+            defaultOrganizationId();
+        if (!organizationId) {
+            return cachedWithinGrace(cache) ?? { tier: "free" };
+        }
+        try {
+            const polar = new Polar({
+                server: process.env.POLAR_ENVIRONMENT === "sandbox" ? "sandbox" : "production",
+            });
+            const activationId = cache.activationId ??
+                (await activateLicenseKey(polar, cache.key, organizationId, this.cachePath, cache));
+            const validated = await polar.customerPortal.licenseKeys.validate({
+                key: cache.key,
+                organizationId,
+                activationId,
+            }, {
+                timeoutMs: 10000,
+            });
+            if (!isGrantedLicense(validated)) {
+                return { tier: "free" };
+            }
+            const verification = verificationFromPolarResponse(validated);
+            await writeLicenseCache(this.cachePath, {
+                ...cache,
+                activationId,
+                ...verification,
+                validatedAt: new Date().toISOString(),
+            });
+            return verification;
+        }
+        catch (error) {
+            if (isNetworkError(error)) {
+                return cachedWithinGrace(cache) ?? { tier: "free" };
+            }
+            return { tier: "free" };
+        }
+    }
+}
+export async function storeLicenseKey(key, cachePath = licenseCachePath()) {
+    const existing = await readLicenseCache(cachePath);
+    if (existing.key === key) {
+        await writeLicenseCache(cachePath, {
+            ...existing,
+            key,
+        });
+        return;
+    }
+    await writeLicenseCache(cachePath, { key });
+}
+function defaultOrganizationId() {
+    if (process.env.POLAR_ENVIRONMENT === "sandbox") {
+        return undefined;
+    }
+    return process.env.AGENTLOCK_POLAR_ORGANIZATION_ID ?? AGENTLOCK_POLAR_ORGANIZATION_ID;
+}
+async function activateLicenseKey(polar, key, organizationId, cachePath, cache) {
+    const activation = await polar.customerPortal.licenseKeys.activate({
+        key,
+        organizationId,
+        label: process.env.AGENTLOCK_ACTIVATION_LABEL ?? "agentlock-local",
+        meta: {
+            app: "agentlock",
+        },
+    }, {
+        timeoutMs: 10000,
+    });
+    await writeLicenseCache(cachePath, {
+        ...cache,
+        activationId: activation.id,
+    });
+    return activation.id;
+}
+async function readLicenseCache(cachePath) {
+    try {
+        const raw = await readFile(cachePath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT") {
+            return {};
+        }
+        throw error;
+    }
+}
+async function writeLicenseCache(cachePath, cache) {
+    await mkdir(path.dirname(cachePath), { recursive: true });
+    await writeFile(cachePath, JSON.stringify(cache, null, 2), "utf8");
+}
+function cachedWithinGrace(cache) {
+    if (!cache.tier || cache.tier === "free" || !cache.validatedAt) {
+        return undefined;
+    }
+    const validatedAt = new Date(cache.validatedAt).getTime();
+    if (Number.isNaN(validatedAt) || Date.now() - validatedAt > OFFLINE_GRACE_MS) {
+        return undefined;
+    }
+    return {
+        tier: cache.tier,
+        validUntil: cache.validUntil,
+        seats: cache.seats,
+    };
+}
+function isGrantedLicense(response) {
+    const record = asRecord(response);
+    if (record["valid"] === false) {
+        return false;
+    }
+    const status = record["status"];
+    if (typeof status === "string" && status !== "granted") {
+        return false;
+    }
+    return true;
+}
+function verificationFromPolarResponse(response) {
+    const record = asRecord(response);
+    const tier = inferTier(record);
+    const expiresAt = record["expiresAt"];
+    const limitActivations = numberValue(record["limitActivations"]);
+    return {
+        tier,
+        validUntil: expiresAt instanceof Date
+            ? expiresAt.toISOString()
+            : typeof expiresAt === "string"
+                ? expiresAt
+                : undefined,
+        seats: tier === "team" ? limitActivations ?? undefined : undefined,
+    };
+}
+function inferTier(record) {
+    const explicitTier = nestedString(record, ["metadata", "tier"]) ??
+        nestedString(record, ["benefit", "metadata", "tier"]) ??
+        nestedString(record, ["product", "metadata", "tier"]);
+    if (explicitTier === "team") {
+        return "team";
+    }
+    if (explicitTier === "pro") {
+        return "pro";
+    }
+    const limitActivations = numberValue(record["limitActivations"]);
+    if (limitActivations && limitActivations > 1) {
+        return "team";
+    }
+    return "pro";
+}
+function nestedString(record, pathParts) {
+    let current = record;
+    for (const part of pathParts) {
+        current = asRecord(current)[part];
+    }
+    return typeof current === "string" ? current.toLowerCase() : undefined;
+}
+function numberValue(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function asRecord(value) {
+    return typeof value === "object" && value !== null
+        ? value
+        : {};
+}
+function isNetworkError(error) {
+    const record = asRecord(error);
+    const name = String(record["name"] ?? "");
+    const message = String(record["message"] ?? "");
+    return /(connection|network|timeout|abort|econn|enotfound|etimedout)/i.test(`${name} ${message}`);
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}

package/dist/scan/environment.js

@@ -0,0 +1,100 @@
+import { access, readFile, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { redactValue } from "../util/redact.js";
+const repoSecretFiles = [
+    ".env",
+    ".env.local",
+    ".env.production",
+    ".npmrc",
+    ".mcp.json",
+    ".cursor/mcp.json",
+    ".claude/settings.local.json",
+];
+const homeSecretFiles = [
+    "~/.aws/credentials",
+    "~/.aws/config",
+    "~/.config/gcloud/application_default_credentials.json",
+    "~/.docker/config.json",
+    "~/.kube/config",
+    "~/.npmrc",
+    "~/.ssh/id_rsa",
+    "~/.ssh/id_ed25519",
+    "~/Library/Application Support/Google/Chrome/Default/Cookies",
+];
+export async function scanEnvironment(root, includeHome) {
+    const resolvedRoot = path.resolve(root);
+    const risks = [];
+    for (const file of repoSecretFiles) {
+        await addIfExists(risks, path.join(resolvedRoot, file), file, "repo-secret");
+    }
+    if (includeHome) {
+        for (const file of homeSecretFiles) {
+            await addIfExists(risks, expandHome(file), file, "home-secret");
+        }
+    }
+    await scanPackageScripts(risks, resolvedRoot);
+    return redactValue({
+        root: resolvedRoot,
+        scannedAt: new Date().toISOString(),
+        riskCount: risks.length,
+        risks,
+        notes: [
+            "AgentLock reports file presence and risky configuration surfaces only.",
+            "Secret values are never printed by the scanner.",
+        ],
+    });
+}
+async function addIfExists(risks, absolutePath, displayPath, category) {
+    try {
+        const fileStat = await stat(absolutePath);
+        if (!fileStat.isFile()) {
+            return;
+        }
+    }
+    catch {
+        return;
+    }
+    risks.push({
+        category,
+        severity: severityForPath(displayPath),
+        path: displayPath,
+        message: `${displayPath} exists and may be accessible to local AI agents or MCP tools.`,
+        recommendation: "Deny this path in agentlock.policy.json unless the current task explicitly needs it.",
+    });
+}
+async function scanPackageScripts(risks, root) {
+    const packagePath = path.join(root, "package.json");
+    try {
+        await access(packagePath);
+        const raw = await readFile(packagePath, "utf8");
+        const parsed = JSON.parse(raw);
+        const scripts = parsed.scripts ?? {};
+        for (const [name, command] of Object.entries(scripts)) {
+            if (/\b(publish|deploy|push|terraform apply|prisma migrate reset)\b/i.test(command)) {
+                risks.push({
+                    category: "dangerous-script",
+                    severity: "medium",
+                    path: `package.json#scripts.${name}`,
+                    message: `Script '${name}' appears to run a publish, deploy, push, or database migration action.`,
+                    recommendation: "Require explicit approval before an agent runs this script.",
+                });
+            }
+        }
+    }
+    catch {
+        return;
+    }
+}
+function severityForPath(displayPath) {
+    if (displayPath.includes(".ssh") || displayPath.includes("Cookies") || displayPath.includes("credentials")) {
+        return "high";
+    }
+    if (displayPath.includes(".env") || displayPath.includes(".npmrc")) {
+        return "high";
+    }
+    return "medium";
+}
+function expandHome(inputPath) {
+    return inputPath.startsWith("~/") ? path.join(os.homedir(), inputPath.slice(2)) : inputPath;
+}

package/dist/server.js

@@ -0,0 +1,14 @@
+import { registerActivateLicenseTool } from "./tools/activate_license.js";
+import { registerAuditLogTool } from "./tools/audit_log.js";
+import { registerCheckActionTool } from "./tools/check_action.js";
+import { registerGeneratePolicyTool } from "./tools/generate_policy.js";
+import { registerRunGuardedCommandTool } from "./tools/run_guarded_command.js";
+import { registerScanEnvironmentTool } from "./tools/scan_environment.js";
+export function registerTools(server) {
+    registerScanEnvironmentTool(server);
+    registerGeneratePolicyTool(server);
+    registerCheckActionTool(server);
+    registerRunGuardedCommandTool(server);
+    registerAuditLogTool(server);
+    registerActivateLicenseTool(server);
+}

package/dist/tools/activate_license.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { AGENTLOCK_CHECKOUT_URL } from "../license/constants.js";
+import { PolarLicenseValidator, storeLicenseKey, } from "../license/validator.js";
+import { jsonToolResult } from "./response.js";
+const activateLicenseInputSchema = {
+    key: z.string().min(1),
+};
+export function registerActivateLicenseTool(server) {
+    server.registerTool("agentlock_activate_license", {
+        title: "Activate AgentLock License",
+        description: "Store and verify a Polar license key.",
+        inputSchema: activateLicenseInputSchema,
+    }, async ({ key }) => {
+        await storeLicenseKey(key);
+        const verification = await new PolarLicenseValidator().verify();
+        return jsonToolResult({
+            tier: verification.tier,
+            validUntil: verification.validUntil,
+            checkoutUrl: verification.tier === "free"
+                ? process.env.AGENTLOCK_CHECKOUT_URL ?? AGENTLOCK_CHECKOUT_URL
+                : undefined,
+        });
+    });
+}

package/dist/tools/audit_log.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { readAuditEntries } from "../audit/log.js";
+import { requirePro } from "../license/gate.js";
+import { PolarLicenseValidator } from "../license/validator.js";
+import { jsonToolResult } from "./response.js";
+const auditLogInputSchema = {
+    limit: z.number().int().positive().max(200).default(50),
+};
+export function registerAuditLogTool(server) {
+    server.registerTool("agentlock_audit_log", {
+        title: "Read AgentLock Audit Log",
+        description: "Read recent redacted local AgentLock audit entries.",
+        inputSchema: auditLogInputSchema,
+    }, async ({ limit }) => {
+        const license = await new PolarLicenseValidator().verify();
+        requirePro("agentlock_audit_log", license.tier);
+        return jsonToolResult({
+            tier: license.tier,
+            entries: await readAuditEntries(limit),
+        });
+    });
+}

package/dist/tools/check_action.js

@@ -0,0 +1,44 @@
+import { z } from "zod";
+import { appendAuditEntry } from "../audit/log.js";
+import { loadPolicy } from "../config/policy.js";
+import { actionTypeSchema } from "../config/schema.js";
+import { evaluateAction } from "../enforcement/evaluator.js";
+import { requirePro } from "../license/gate.js";
+import { PolarLicenseValidator } from "../license/validator.js";
+import { jsonToolResult } from "./response.js";
+const checkActionInputSchema = {
+    type: actionTypeSchema,
+    capsuleId: z.string().min(1).optional(),
+    path: z.string().min(1).optional(),
+    command: z.string().min(1).optional(),
+    args: z.array(z.string()).default([]),
+    domain: z.string().min(1).optional(),
+    mcpServer: z.string().min(1).optional(),
+    mcpTool: z.string().min(1).optional(),
+    approved: z.boolean().default(false),
+};
+export function registerCheckActionTool(server) {
+    server.registerTool("agentlock_check_action", {
+        title: "Check AgentLock Action",
+        description: "Evaluate a file, command, network, or MCP action against the active AgentLock policy.",
+        inputSchema: checkActionInputSchema,
+    }, async (input) => {
+        const license = await new PolarLicenseValidator().verify();
+        requirePro("agentlock_check_action", license.tier);
+        const loaded = await loadPolicy(process.cwd());
+        const result = evaluateAction(loaded.policy, input, process.cwd());
+        await appendAuditEntry({
+            timestamp: new Date().toISOString(),
+            tool: "agentlock_check_action",
+            decision: result.decision,
+            action: input,
+            result,
+        });
+        return jsonToolResult({
+            ...result,
+            policySource: loaded.source,
+            policyPath: loaded.path,
+            tier: license.tier,
+        });
+    });
+}

package/dist/tools/generate_policy.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+import { generatePolicy } from "../enforcement/generate_policy.js";
+import { jsonToolResult } from "./response.js";
+const generatePolicyInputSchema = {
+    mode: z.enum(["strict", "balanced", "relaxed"]).default("balanced"),
+};
+export function registerGeneratePolicyTool(server) {
+    server.registerTool("agentlock_generate_policy", {
+        title: "Generate AgentLock Policy",
+        description: "Generate a starter agentlock.policy.json permission capsule.",
+        inputSchema: generatePolicyInputSchema,
+    }, async ({ mode }) => {
+        const policy = generatePolicy({ mode: mode });
+        return jsonToolResult({
+            recommendedPath: "agentlock.policy.json",
+            policy,
+        });
+    });
+}

package/dist/tools/response.js

@@ -0,0 +1,10 @@
+export function jsonToolResult(value) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(value, null, 2),
+            },
+        ],
+    };
+}

package/dist/tools/run_guarded_command.js

@@ -0,0 +1,68 @@
+import { z } from "zod";
+import { appendAuditEntry } from "../audit/log.js";
+import { loadPolicy } from "../config/policy.js";
+import { evaluateAction } from "../enforcement/evaluator.js";
+import { runCommand } from "../enforcement/runner.js";
+import { requirePro } from "../license/gate.js";
+import { PolarLicenseValidator } from "../license/validator.js";
+import { jsonToolResult } from "./response.js";
+const runGuardedCommandInputSchema = {
+    command: z.string().min(1),
+    args: z.array(z.string()).default([]),
+    cwd: z.string().min(1).optional(),
+    capsuleId: z.string().min(1).optional(),
+    approved: z.boolean().default(false),
+    timeoutMs: z.number().int().positive().max(600000).default(120000),
+};
+export function registerRunGuardedCommandTool(server) {
+    server.registerTool("agentlock_run_guarded_command", {
+        title: "Run AgentLock Guarded Command",
+        description: "Run a local command only after AgentLock policy allows it.",
+        inputSchema: runGuardedCommandInputSchema,
+    }, async ({ command, args, cwd, capsuleId, approved, timeoutMs }) => {
+        const license = await new PolarLicenseValidator().verify();
+        requirePro("agentlock_run_guarded_command", license.tier);
+        const runCwd = cwd ?? process.cwd();
+        const loaded = await loadPolicy(process.cwd());
+        const action = {
+            type: "command",
+            command,
+            args,
+            capsuleId,
+            approved,
+        };
+        const evaluation = evaluateAction(loaded.policy, action, runCwd);
+        if (evaluation.decision !== "allow") {
+            await appendAuditEntry({
+                timestamp: new Date().toISOString(),
+                tool: "agentlock_run_guarded_command",
+                decision: evaluation.decision,
+                action,
+                result: evaluation,
+            });
+            return jsonToolResult({
+                ran: false,
+                evaluation,
+                policySource: loaded.source,
+                policyPath: loaded.path,
+                tier: license.tier,
+            });
+        }
+        const result = await runCommand(command, args, runCwd, timeoutMs);
+        await appendAuditEntry({
+            timestamp: new Date().toISOString(),
+            tool: "agentlock_run_guarded_command",
+            decision: evaluation.decision,
+            action,
+            result,
+        });
+        return jsonToolResult({
+            ran: true,
+            evaluation,
+            commandResult: result,
+            policySource: loaded.source,
+            policyPath: loaded.path,
+            tier: license.tier,
+        });
+    });
+}

package/dist/tools/scan_environment.js

@@ -0,0 +1,16 @@
+import { z } from "zod";
+import { scanEnvironment } from "../scan/environment.js";
+import { jsonToolResult } from "./response.js";
+const scanEnvironmentInputSchema = {
+    root: z.string().min(1).optional(),
+    includeHome: z.boolean().default(true),
+};
+export function registerScanEnvironmentTool(server) {
+    server.registerTool("agentlock_scan_environment", {
+        title: "Scan AgentLock Environment",
+        description: "Scan local AI-agent, MCP, and secret-adjacent surfaces without printing secret values.",
+        inputSchema: scanEnvironmentInputSchema,
+    }, async ({ root, includeHome }) => {
+        return jsonToolResult(await scanEnvironment(root ?? process.cwd(), includeHome));
+    });
+}