@neurcode-ai/cli 0.9.26 → 0.9.28

package/dist/commands/policy.js

@@ -2,6 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.policyCommand = policyCommand;
 const project_root_1 = require("../utils/project-root");
+const config_1 = require("../config");
+const api_client_1 = require("../api-client");
+const custom_policy_rules_1 = require("../utils/custom-policy-rules");
+const policy_exceptions_1 = require("../utils/policy-exceptions");
+const policy_governance_1 = require("../utils/policy-governance");
+const policy_audit_1 = require("../utils/policy-audit");
 const policy_packs_1 = require("../utils/policy-packs");
 // Import chalk with fallback
 let chalk;
@@ -28,6 +34,60 @@ function toJsonPack(pack) {
         ruleCount: Array.isArray(pack.rules) ? pack.rules.length : 0,
     };
 }
+function loadPolicyRuntimeConfig() {
+    const config = (0, config_1.loadConfig)();
+    if (process.env.NEURCODE_API_KEY) {
+        config.apiKey = process.env.NEURCODE_API_KEY;
+    }
+    if (process.env.NEURCODE_API_URL) {
+        config.apiUrl = process.env.NEURCODE_API_URL.replace(/\/$/, '');
+    }
+    else if (config.apiUrl) {
+        config.apiUrl = config.apiUrl.replace(/\/$/, '');
+    }
+    return config;
+}
+function resolveExpiresAt(input) {
+    if (input.expiresAt && input.expiresAt.trim()) {
+        return new Date(input.expiresAt.trim()).toISOString();
+    }
+    if (Number.isFinite(input.expiresInDays) && input.expiresInDays > 0) {
+        const ms = input.expiresInDays * 24 * 60 * 60 * 1000;
+        return new Date(Date.now() + ms).toISOString();
+    }
+    return new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString();
+}
+function resolveActor(explicit) {
+    if (explicit && explicit.trim())
+        return explicit.trim();
+    return process.env.NEURCODE_ACTOR || process.env.GITHUB_ACTOR || process.env.USER || 'unknown';
+}
+async function resolveCustomPolicies(client, includeDashboardPolicies, requireDashboardPolicies) {
+    if (!includeDashboardPolicies) {
+        return {
+            includeDashboardPolicies: false,
+            customPolicies: [],
+        };
+    }
+    try {
+        const customPolicies = await client.getActiveCustomPolicies();
+        return {
+            includeDashboardPolicies: true,
+            customPolicies,
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        if (requireDashboardPolicies) {
+            throw new Error(`Failed to load dashboard custom policies: ${message}`);
+        }
+        return {
+            includeDashboardPolicies: false,
+            customPolicies: [],
+            dashboardWarning: `Dashboard policies unavailable (${message}); continuing without dashboard rules.`,
+        };
+    }
+}
 function policyCommand(program) {
     const policy = program
         .command('policy')
@@ -144,5 +204,574 @@ function policyCommand(program) {
         }
         console.log(chalk.green('\n✅ Policy pack removed for this repository.\n'));
     });
+    policy
+        .command('lock')
+        .description('Generate or update committed policy lock baseline (neurcode.policy.lock.json)')
+        .option('--no-dashboard', 'Exclude dashboard custom policies from the lock baseline')
+        .option('--require-dashboard', 'Fail if dashboard custom policies cannot be loaded')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const config = loadPolicyRuntimeConfig();
+        const client = new api_client_1.ApiClient(config);
+        const includeDashboard = options.dashboard !== false;
+        try {
+            const customPolicyResolution = await resolveCustomPolicies(client, includeDashboard, options.requireDashboard === true);
+            const installedPack = (0, policy_packs_1.getInstalledPolicyPackRules)(cwd);
+            const customRules = customPolicyResolution.includeDashboardPolicies
+                ? (0, custom_policy_rules_1.mapActiveCustomPoliciesToRules)(customPolicyResolution.customPolicies)
+                : [];
+            const snapshot = (0, policy_packs_1.buildPolicyStateSnapshot)({
+                policyPack: installedPack,
+                policyPackRules: installedPack?.rules || [],
+                customPolicies: customPolicyResolution.customPolicies,
+                customRules,
+                includeDashboardPolicies: customPolicyResolution.includeDashboardPolicies,
+            });
+            const lockPath = (0, policy_packs_1.writePolicyLockFile)(cwd, snapshot);
+            try {
+                (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
+                    actor: resolveActor(),
+                    action: 'policy_lock_written',
+                    entityType: 'policy_lock',
+                    entityId: 'neurcode.policy.lock.json',
+                    metadata: {
+                        policyPack: snapshot.policyPack ? `${snapshot.policyPack.id}@${snapshot.policyPack.version}` : 'none',
+                        mode: snapshot.customPolicies.mode,
+                        effectiveRuleCount: snapshot.effective.ruleCount,
+                    },
+                });
+            }
+            catch {
+                // Non-blocking audit write.
+            }
+            if (options.json) {
+                console.log(JSON.stringify({
+                    lock: {
+                        path: lockPath,
+                        generatedAt: snapshot.generatedAt,
+                        mode: snapshot.customPolicies.mode,
+                        effectiveRuleCount: snapshot.effective.ruleCount,
+                        effectiveFingerprint: snapshot.effective.fingerprint,
+                        policyPack: snapshot.policyPack
+                            ? {
+                                id: snapshot.policyPack.id,
+                                version: snapshot.policyPack.version,
+                                ruleCount: snapshot.policyPack.ruleCount,
+                            }
+                            : null,
+                        customPolicyCount: snapshot.customPolicies.count,
+                    },
+                    warning: customPolicyResolution.dashboardWarning || null,
+                }, null, 2));
+                return;
+            }
+            console.log(chalk.green('\n✅ Policy lock baseline updated\n'));
+            console.log(chalk.cyan(`Path: ${lockPath}`));
+            console.log(chalk.dim(`Effective policy fingerprint: ${snapshot.effective.fingerprint}`));
+            console.log(chalk.dim(`Policy pack: ${snapshot.policyPack ? `${snapshot.policyPack.id}@${snapshot.policyPack.version}` : 'none'}`));
+            console.log(chalk.dim(`Dashboard policies: ${snapshot.customPolicies.mode} (${snapshot.customPolicies.count})`));
+            if (customPolicyResolution.dashboardWarning) {
+                console.log(chalk.yellow(`\n⚠️  ${customPolicyResolution.dashboardWarning}`));
+            }
+            console.log(chalk.dim('Commit this lock file so CI can enforce deterministic policy baselines.'));
+            console.log(chalk.dim('\nRun `neurcode policy check --require-lock` in CI to enforce this baseline.\n'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+    });
+    policy
+        .command('check')
+        .description('Validate current policy state against committed policy lock baseline')
+        .option('--require-lock', 'Fail if neurcode.policy.lock.json is missing')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const lockRead = (0, policy_packs_1.readPolicyLockFile)(cwd);
+        const lockMode = lockRead.lock?.customPolicies.mode;
+        const includeDashboardPolicies = lockMode === 'dashboard';
+        const config = loadPolicyRuntimeConfig();
+        const client = new api_client_1.ApiClient(config);
+        let customPolicies = [];
+        let dashboardError = null;
+        if (includeDashboardPolicies) {
+            try {
+                customPolicies = await client.getActiveCustomPolicies();
+            }
+            catch (error) {
+                dashboardError = error instanceof Error ? error.message : 'Unknown error';
+            }
+        }
+        const customRules = includeDashboardPolicies ? (0, custom_policy_rules_1.mapActiveCustomPoliciesToRules)(customPolicies) : [];
+        const installedPack = (0, policy_packs_1.getInstalledPolicyPackRules)(cwd);
+        const currentSnapshot = (0, policy_packs_1.buildPolicyStateSnapshot)({
+            policyPack: installedPack,
+            policyPackRules: installedPack?.rules || [],
+            customPolicies,
+            customRules,
+            includeDashboardPolicies,
+        });
+        const validation = (0, policy_packs_1.evaluatePolicyLock)(cwd, currentSnapshot, {
+            requireLock: options.requireLock === true,
+        });
+        if (dashboardError) {
+            validation.mismatches.unshift({
+                code: 'POLICY_LOCK_CUSTOM_POLICIES_MISMATCH',
+                message: `Failed to load dashboard custom policies while checking lock: ${dashboardError}`,
+            });
+        }
+        const pass = (!validation.enforced || validation.matched) && !dashboardError;
+        if (options.json) {
+            console.log(JSON.stringify({
+                pass,
+                enforced: validation.enforced,
+                lockPath: validation.lockPath,
+                lockPresent: validation.lockPresent,
+                mismatches: validation.mismatches,
+                effectiveRuleCount: currentSnapshot.effective.ruleCount,
+                effectiveFingerprint: currentSnapshot.effective.fingerprint,
+            }, null, 2));
+            process.exit(pass ? 0 : 1);
+        }
+        if (pass) {
+            if (validation.enforced) {
+                console.log(chalk.green('\n✅ Policy lock check passed.\n'));
+                console.log(chalk.dim(`Lock: ${validation.lockPath}`));
+                console.log(chalk.dim(`Fingerprint: ${currentSnapshot.effective.fingerprint}\n`));
+            }
+            else {
+                console.log(chalk.yellow('\n⚠️  No policy lock found. Nothing to enforce.\n'));
+                console.log(chalk.dim(`Expected path: ${(0, policy_packs_1.getPolicyLockPath)(cwd)}`));
+                console.log(chalk.dim('Generate baseline: neurcode policy lock\n'));
+            }
+        }
+        else {
+            console.log(chalk.red('\n❌ Policy lock mismatch detected.\n'));
+            validation.mismatches.forEach((item) => {
+                console.log(chalk.red(`• [${item.code}] ${item.message}`));
+                if (item.expected || item.actual) {
+                    console.log(chalk.dim(`  expected: ${item.expected || '(none)'}`));
+                    console.log(chalk.dim(`  actual:   ${item.actual || '(none)'}`));
+                }
+            });
+            console.log(chalk.dim('\nIf this policy drift is intentional, refresh baseline: neurcode policy lock\n'));
+        }
+        process.exit(pass ? 0 : 1);
+    });
+    const governance = policy
+        .command('governance')
+        .description('Configure exception approval and policy audit governance');
+    governance
+        .command('status')
+        .description('Show policy governance settings for this repository')
+        .option('--json', 'Output as JSON')
+        .action((options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const config = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+        if (options.json) {
+            console.log(JSON.stringify({
+                path: (0, policy_governance_1.getPolicyGovernancePath)(cwd),
+                config,
+            }, null, 2));
+            return;
+        }
+        console.log(chalk.bold('\n🏛️  Policy Governance\n'));
+        console.log(chalk.dim(`Path: ${(0, policy_governance_1.getPolicyGovernancePath)(cwd)}`));
+        console.log(chalk.dim(`Exception approvals required: ${config.exceptionApprovals.required ? 'yes' : 'no'}`));
+        console.log(chalk.dim(`Minimum approvals: ${config.exceptionApprovals.minApprovals}`));
+        console.log(chalk.dim(`Disallow self approval: ${config.exceptionApprovals.disallowSelfApproval ? 'yes' : 'no'}`));
+        console.log(chalk.dim(`Allowed approvers: ${config.exceptionApprovals.allowedApprovers.length > 0 ? config.exceptionApprovals.allowedApprovers.join(', ') : '(any)'}`));
+        console.log(chalk.dim(`Require audit integrity: ${config.audit.requireIntegrity ? 'yes' : 'no'}`));
+        console.log('');
+    });
+    governance
+        .command('set')
+        .description('Update policy governance settings')
+        .option('--require-approval', 'Require approvals before exceptions become effective')
+        .option('--no-require-approval', 'Do not require approvals for exceptions')
+        .option('--min-approvals <n>', 'Minimum approvals required when approval mode is enabled', (value) => parseInt(value, 10))
+        .option('--allow-self-approval', 'Allow requester to approve their own exception')
+        .option('--restrict-approvers <csv>', 'Comma-separated allow-list of approver identities')
+        .option('--clear-approvers', 'Clear approver allow-list (allow any approver)')
+        .option('--require-audit-integrity', 'Fail verify if policy audit chain integrity is broken')
+        .option('--no-require-audit-integrity', 'Do not enforce policy audit integrity in verify')
+        .option('--json', 'Output as JSON')
+        .action((options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        try {
+            const next = (0, policy_governance_1.updatePolicyGovernanceConfig)(cwd, {
+                required: typeof options.requireApproval === 'boolean' ? options.requireApproval : undefined,
+                minApprovals: Number.isFinite(options.minApprovals) ? options.minApprovals : undefined,
+                disallowSelfApproval: typeof options.allowSelfApproval === 'boolean' ? !options.allowSelfApproval : undefined,
+                allowedApprovers: options.clearApprovers
+                    ? []
+                    : typeof options.restrictApprovers === 'string'
+                        ? options.restrictApprovers
+                            .split(',')
+                            .map((item) => item.trim())
+                            .filter(Boolean)
+                        : undefined,
+                requireAuditIntegrity: typeof options.requireAuditIntegrity === 'boolean' ? options.requireAuditIntegrity : undefined,
+            });
+            try {
+                (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
+                    actor: resolveActor(),
+                    action: 'governance_updated',
+                    entityType: 'policy_governance',
+                    entityId: 'neurcode.policy.governance.json',
+                    metadata: {
+                        requireApproval: next.exceptionApprovals.required,
+                        minApprovals: next.exceptionApprovals.minApprovals,
+                        disallowSelfApproval: next.exceptionApprovals.disallowSelfApproval,
+                        allowedApprovers: next.exceptionApprovals.allowedApprovers,
+                        requireAuditIntegrity: next.audit.requireIntegrity,
+                    },
+                });
+            }
+            catch {
+                // Non-blocking audit write.
+            }
+            if (options.json) {
+                console.log(JSON.stringify({ path: (0, policy_governance_1.getPolicyGovernancePath)(cwd), config: next }, null, 2));
+                return;
+            }
+            console.log(chalk.green('\n✅ Policy governance updated.\n'));
+            console.log(chalk.dim(`Path: ${(0, policy_governance_1.getPolicyGovernancePath)(cwd)}`));
+            console.log(chalk.dim(`Approval required: ${next.exceptionApprovals.required ? 'yes' : 'no'}`));
+            console.log(chalk.dim(`Min approvals: ${next.exceptionApprovals.minApprovals}`));
+            console.log(chalk.dim(`Disallow self approval: ${next.exceptionApprovals.disallowSelfApproval ? 'yes' : 'no'}`));
+            console.log(chalk.dim(`Require audit integrity: ${next.audit.requireIntegrity ? 'yes' : 'no'}`));
+            console.log(chalk.dim('Commit governance + audit files so CI can enforce approval and integrity rules.'));
+            console.log('');
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+    });
+    const audit = policy
+        .command('audit')
+        .description('Inspect policy audit chain integrity');
+    audit
+        .command('verify')
+        .description('Verify append-only policy audit chain integrity')
+        .option('--json', 'Output as JSON')
+        .action((options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const result = (0, policy_audit_1.verifyPolicyAuditIntegrity)(cwd);
+        if (options.json) {
+            console.log(JSON.stringify({
+                path: (0, policy_audit_1.getPolicyAuditPath)(cwd),
+                ...result,
+            }, null, 2));
+            process.exit(result.valid ? 0 : 1);
+        }
+        if (result.valid) {
+            console.log(chalk.green('\n✅ Policy audit chain is valid.\n'));
+            console.log(chalk.dim(`Path: ${(0, policy_audit_1.getPolicyAuditPath)(cwd)}`));
+            console.log(chalk.dim(`Events: ${result.count}`));
+            console.log(chalk.dim(`Last hash: ${result.lastHash || '(none)'}\n`));
+            process.exit(0);
+        }
+        console.log(chalk.red('\n❌ Policy audit chain integrity check failed.\n'));
+        console.log(chalk.dim(`Path: ${(0, policy_audit_1.getPolicyAuditPath)(cwd)}`));
+        result.issues.forEach((issue) => console.log(chalk.red(`• ${issue}`)));
+        console.log('');
+        process.exit(1);
+    });
+    const exception = policy
+        .command('exception')
+        .description('Manage time-bound policy exceptions (audited allow-list)');
+    exception
+        .command('list')
+        .description('List policy exceptions for this repository')
+        .option('--all', 'Include inactive/expired exceptions')
+        .option('--json', 'Output as JSON')
+        .action((options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const data = (0, policy_exceptions_1.listPolicyExceptions)(cwd);
+        const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+        const allowedApprovers = new Set(governance.exceptionApprovals.allowedApprovers.map((item) => item.toLowerCase()));
+        const withStatus = data.all.map((entry) => {
+            const unexpired = new Date(entry.expiresAt).getTime() > Date.now();
+            let effectiveApprovals = entry.approvals;
+            if (governance.exceptionApprovals.disallowSelfApproval) {
+                const requested = (entry.requestedBy || entry.createdBy || '').toLowerCase();
+                effectiveApprovals = effectiveApprovals.filter((item) => item.approver.toLowerCase() !== requested);
+            }
+            if (allowedApprovers.size > 0) {
+                effectiveApprovals = effectiveApprovals.filter((item) => allowedApprovers.has(item.approver.toLowerCase()));
+            }
+            const status = !entry.active || !unexpired
+                ? 'inactive'
+                : !governance.exceptionApprovals.required
+                    ? 'active'
+                    : effectiveApprovals.length >= governance.exceptionApprovals.minApprovals
+                        ? 'approved'
+                        : 'pending';
+            return {
+                ...entry,
+                status,
+                effectiveApprovals: effectiveApprovals.length,
+            };
+        });
+        const items = options.all ? withStatus : withStatus.filter((entry) => entry.status !== 'inactive');
+        if (options.json) {
+            console.log(JSON.stringify({
+                path: (0, policy_exceptions_1.getPolicyExceptionsPath)(cwd),
+                governance,
+                total: data.all.length,
+                active: data.active.length,
+                expired: data.expired.length,
+                exceptions: items,
+            }, null, 2));
+            return;
+        }
+        if (items.length === 0) {
+            console.log(chalk.yellow('\n⚠️  No policy exceptions found.\n'));
+            console.log(chalk.dim('Add one: neurcode policy exception add --rule <pattern> --file <glob> --reason "<why>"\n'));
+            return;
+        }
+        console.log(chalk.bold('\n🧾 Policy Exceptions\n'));
+        items.forEach((entry) => {
+            console.log(chalk.cyan(`• ${entry.id}`));
+            console.log(chalk.dim(`  status=${entry.status || (entry.active ? 'active' : 'inactive')}`));
+            console.log(chalk.dim(`  rule=${entry.rulePattern} file=${entry.filePattern}`));
+            console.log(chalk.dim(`  expires=${entry.expiresAt} active=${entry.active ? 'yes' : 'no'}`));
+            console.log(chalk.dim(`  approvals=${entry.approvals.length}${typeof entry.effectiveApprovals === 'number' ? ` (effective=${entry.effectiveApprovals})` : ''}`));
+            console.log(chalk.dim(`  reason=${entry.reason}`));
+            console.log(chalk.dim(`  requestedBy=${entry.requestedBy || entry.createdBy || 'unknown'}`));
+            if (entry.ticket) {
+                console.log(chalk.dim(`  ticket=${entry.ticket}`));
+            }
+            console.log('');
+        });
+        if (!options.all && data.expired.length > 0) {
+            console.log(chalk.dim(`(${data.expired.length} expired/inactive hidden; use --all)`));
+        }
+        console.log('');
+    });
+    exception
+        .command('add')
+        .description('Add a policy exception entry')
+        .requiredOption('--rule <pattern>', 'Rule pattern (exact, wildcard, or /regex/)')
+        .requiredOption('--file <pattern>', 'File pattern (exact, wildcard, or /regex/)')
+        .requiredOption('--reason <text>', 'Business justification for this exception')
+        .option('--ticket <id>', 'Ticket or approval reference (e.g. SEC-123)')
+        .option('--severity <level>', 'Optional severity scope: allow|warn|block')
+        .option('--expires-at <iso>', 'Expiry timestamp in ISO-8601')
+        .option('--expires-in-days <n>', 'Expiry offset in days (default: 30)', (value) => parseInt(value, 10))
+        .option('--json', 'Output as JSON')
+        .action((options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        try {
+            const severity = options.severity === 'allow' || options.severity === 'warn' || options.severity === 'block'
+                ? options.severity
+                : undefined;
+            if (options.severity && !severity) {
+                throw new Error('severity must be one of: allow, warn, block');
+            }
+            const expiresAt = resolveExpiresAt({
+                expiresAt: options.expiresAt,
+                expiresInDays: options.expiresInDays,
+            });
+            const createdBy = resolveActor();
+            const created = (0, policy_exceptions_1.addPolicyException)(cwd, {
+                rulePattern: options.rule,
+                filePattern: options.file,
+                reason: options.reason,
+                ticket: options.ticket,
+                severity,
+                expiresAt,
+                createdBy,
+                requestedBy: createdBy,
+            });
+            const governance = (0, policy_governance_1.readPolicyGovernanceConfig)(cwd);
+            try {
+                (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
+                    actor: createdBy,
+                    action: 'exception_added',
+                    entityType: 'policy_exception',
+                    entityId: created.id,
+                    metadata: {
+                        rulePattern: created.rulePattern,
+                        filePattern: created.filePattern,
+                        expiresAt: created.expiresAt,
+                        requireApproval: governance.exceptionApprovals.required,
+                    },
+                });
+            }
+            catch {
+                // Non-blocking audit write.
+            }
+            if (options.json) {
+                console.log(JSON.stringify({
+                    created,
+                    path: (0, policy_exceptions_1.getPolicyExceptionsPath)(cwd),
+                    requiresApproval: governance.exceptionApprovals.required,
+                }, null, 2));
+                return;
+            }
+            console.log(chalk.green('\n✅ Policy exception added\n'));
+            console.log(chalk.cyan(`ID: ${created.id}`));
+            console.log(chalk.dim(`Rule: ${created.rulePattern}`));
+            console.log(chalk.dim(`File: ${created.filePattern}`));
+            console.log(chalk.dim(`Expires: ${created.expiresAt}`));
+            console.log(chalk.dim(`Reason: ${created.reason}`));
+            if (governance.exceptionApprovals.required) {
+                console.log(chalk.yellow(`Approval required: ${governance.exceptionApprovals.minApprovals} approver(s) before this exception is active.`));
+            }
+            if (created.ticket) {
+                console.log(chalk.dim(`Ticket: ${created.ticket}`));
+            }
+            console.log(chalk.dim('\nAudit tip: commit policy exception changes with approval context.\n'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+    });
+    exception
+        .command('approve')
+        .description('Approve a policy exception by ID')
+        .argument('<id>', 'Exception ID to approve')
+        .option('--by <actor>', 'Approver identity (defaults to NEURCODE_ACTOR/GITHUB_ACTOR/USER)')
+        .option('--comment <text>', 'Approval comment')
+        .option('--json', 'Output as JSON')
+        .action((id, options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const approver = resolveActor(options.by);
+        try {
+            const updated = (0, policy_exceptions_1.approvePolicyException)(cwd, String(id).trim(), {
+                approver,
+                comment: options.comment,
+            });
+            if (!updated) {
+                if (options.json) {
+                    console.log(JSON.stringify({ error: 'Exception not found' }, null, 2));
+                    process.exit(1);
+                }
+                console.log(chalk.yellow('\n⚠️  Exception not found.\n'));
+                process.exit(1);
+            }
+            try {
+                (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
+                    actor: approver,
+                    action: 'exception_approved',
+                    entityType: 'policy_exception',
+                    entityId: updated.id,
+                    metadata: {
+                        comment: options.comment || null,
+                        approvals: updated.approvals.length,
+                    },
+                });
+            }
+            catch {
+                // Non-blocking audit write.
+            }
+            if (options.json) {
+                console.log(JSON.stringify({
+                    approved: true,
+                    exception: updated,
+                }, null, 2));
+                return;
+            }
+            console.log(chalk.green('\n✅ Policy exception approval recorded.\n'));
+            console.log(chalk.dim(`ID: ${updated.id}`));
+            console.log(chalk.dim(`Approvals: ${updated.approvals.length}`));
+            console.log(chalk.dim(`Approver: ${approver}`));
+            console.log('');
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+    });
+    exception
+        .command('remove')
+        .description('Deactivate a policy exception by ID')
+        .argument('<id>', 'Exception ID to deactivate')
+        .option('--json', 'Output as JSON')
+        .action((id, options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const removed = (0, policy_exceptions_1.revokePolicyException)(cwd, String(id).trim());
+        if (removed) {
+            try {
+                (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
+                    actor: resolveActor(),
+                    action: 'exception_revoked',
+                    entityType: 'policy_exception',
+                    entityId: String(id).trim(),
+                    metadata: {},
+                });
+            }
+            catch {
+                // Non-blocking audit write.
+            }
+        }
+        if (options.json) {
+            console.log(JSON.stringify({ removed }, null, 2));
+            process.exit(removed ? 0 : 1);
+        }
+        if (!removed) {
+            console.log(chalk.yellow('\n⚠️  Exception not found or already inactive.\n'));
+            process.exit(1);
+        }
+        console.log(chalk.green('\n✅ Policy exception deactivated.\n'));
+    });
+    exception
+        .command('prune')
+        .description('Prune expired/inactive policy exceptions')
+        .option('--json', 'Output as JSON')
+        .action((options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const result = (0, policy_exceptions_1.pruneExpiredPolicyExceptions)(cwd);
+        if (result.removed > 0) {
+            try {
+                (0, policy_audit_1.appendPolicyAuditEvent)(cwd, {
+                    actor: resolveActor(),
+                    action: 'exception_pruned',
+                    entityType: 'policy_exception',
+                    entityId: null,
+                    metadata: {
+                        removed: result.removed,
+                        remaining: result.remaining,
+                    },
+                });
+            }
+            catch {
+                // Non-blocking audit write.
+            }
+        }
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log(chalk.green('\n✅ Policy exceptions pruned.\n'));
+        console.log(chalk.dim(`Removed: ${result.removed}`));
+        console.log(chalk.dim(`Remaining active: ${result.remaining}\n`));
+    });
 }
 //# sourceMappingURL=policy.js.map