@oxagen/cli 2.1.4-619 → 2.1.4-627

package/oxagen.mjs

@@ -5028,6 +5028,12 @@ var init_envelope = __esm({
        * beside it for readers of the joined form.
        */
       policy_rules: external_exports.array(short).max(64).optional(),
+      /**
+       * The taint sources the decision read (#4666): each third-party read the
+       * run made before the call, by tool, or `web` for a web fetch or search.
+       * Absent when the run was untainted or no Cedar decision read it.
+       */
+      policy_taint: external_exports.array(short).max(32).optional(),
       policy_source: external_exports.enum(POLICY_SOURCES).optional(),
       policy_reason_code: short.optional(),
       policy_reason_digest: digest.optional(),
@@ -7180,6 +7186,70 @@ var init_builtins = __esm({
   }
 });
 
+// ../../packages/tacho/src/policy/run-facts.ts
+function taintSourceOf(action, tool) {
+  if (tool.side_effect !== "read" || tool.egress !== "third_party") return null;
+  return WEB_ACTIONS.has(action) ? WEB_TAINT_SOURCE : action;
+}
+function emptyRunCallLog() {
+  return { calls: [], reads: [], taint: [] };
+}
+function add(list, value, max2) {
+  if (list.length >= max2 || list.includes(value)) return;
+  list.push(value);
+}
+function noteRunCall(log, action, tool, targets = []) {
+  if (action === "") return;
+  add(log.calls, action, RUN_CALLS_MAX);
+  if (tool === null) return;
+  const source = taintSourceOf(action, tool);
+  if (source !== null) add(log.taint, source, RUN_TAINT_MAX);
+  if (tool.side_effect !== "read") return;
+  for (const target2 of targets) {
+    if (target2 === "" || target2.length > RUN_READ_MAX_CHARS) continue;
+    add(log.reads, target2, RUN_READS_MAX);
+  }
+}
+function runFactsOf(log) {
+  const sources = [...log.taint].sort();
+  return {
+    taint: { tainted: sources.length > 0, sources },
+    run: {
+      prior_calls: [...log.calls].sort(),
+      prior_reads: [...log.reads].sort()
+    }
+  };
+}
+function targetsOfArgs(args) {
+  const targets = [];
+  for (const value of Object.values(args ?? {})) {
+    if (typeof value === "string") {
+      if (value !== "" && !targets.includes(value)) targets.push(value);
+    } else if (Array.isArray(value)) {
+      for (const item of value) {
+        if (typeof item === "string" && item !== "" && !targets.includes(item))
+          targets.push(item);
+      }
+    }
+  }
+  return targets;
+}
+var WEB_TAINT_SOURCE, WEB_ACTIONS, RUN_TAINT_MAX, RUN_CALLS_MAX, RUN_READS_MAX, RUN_READ_MAX_CHARS;
+var init_run_facts = __esm({
+  "../../packages/tacho/src/policy/run-facts.ts"() {
+    "use strict";
+    WEB_TAINT_SOURCE = "web";
+    WEB_ACTIONS = /* @__PURE__ */ new Set([
+      "builtin__web_fetch",
+      "builtin__web_search"
+    ]);
+    RUN_TAINT_MAX = 32;
+    RUN_CALLS_MAX = 256;
+    RUN_READS_MAX = 256;
+    RUN_READ_MAX_CHARS = 512;
+  }
+});
+
 // ../../packages/tacho/src/policy/decision.ts
 function readCedarDecision(answer, approvalIds) {
   if (answer.type === "failure") {
@@ -7299,12 +7369,12 @@ function importedToolRequest(action, tool, input) {
   const { args: _types, ...classification } = tool;
   return { action, tool: classification, argSets: [args], errors };
 }
-function hookRequest(call) {
+function hookRequest(call, tools) {
   const mcpAction = call.action === void 0 ? mcpActionFor(call.toolName) : void 0;
-  if (mcpAction !== void 0 && Object.hasOwn(call.cedar.tools, mcpAction)) {
+  if (mcpAction !== void 0 && Object.hasOwn(tools, mcpAction)) {
     return importedToolRequest(
       mcpAction,
-      call.cedar.tools[mcpAction],
+      tools[mcpAction],
       call.toolInput
     );
   }
@@ -7316,9 +7386,20 @@ function hookRequest(call) {
     errors: []
   };
 }
+function hookCallClass(call, tools) {
+  if (isOxagenTool(call.toolName)) return null;
+  const request3 = hookRequest(call, tools);
+  const targets = [];
+  for (const args of request3.argSets) {
+    for (const target2 of targetsOfArgs(args)) {
+      if (!targets.includes(target2)) targets.push(target2);
+    }
+  }
+  return { action: request3.action, tool: request3.tool, targets };
+}
 function evaluateHookCall(call) {
   if (isOxagenTool(call.toolName)) return null;
-  const request3 = hookRequest(call);
+  const request3 = hookRequest(call, call.cedar.tools);
   const { action } = request3;
   const principals = principalsFor(call.cedar, call.harness, call.agent);
   if (principals.length === 0) {
@@ -7350,7 +7431,12 @@ function evaluateHookCall(call) {
         args,
         now: call.now,
         tier: "harness",
+        ...call.facts !== void 0 ? { taint: call.facts.taint, run: call.facts.run } : {},
         ...principal.operator_role !== void 0 ? { operator_role: principal.operator_role } : {},
+        // The agent's budget from its row in Oxagen, which the bundle
+        // carries on the principal. The hook runs on the machine and cannot
+        // read the run's metered spend, so it does not subtract it: the
+        // gateway's decision of a served call does (#4666).
         ...principal.budget_remaining_cents !== void 0 ? { budget_remaining_cents: principal.budget_remaining_cents } : {},
         harness_tool: call.harnessTool ?? call.toolName,
         ...skill !== void 0 ? { skill } : {}
@@ -7377,6 +7463,7 @@ var init_hook = __esm({
     "use strict";
     init_builtins();
     init_context();
+    init_run_facts();
     init_decision();
     CALL_RESOURCE = { type: "Target", id: "call" };
     MCP_PREFIX = "mcp__";
@@ -7870,6 +7957,7 @@ function evaluatePreToolUse(input) {
       rules: [ask],
       reason_code: "rule_ask",
       reason: `Oxagen policy rule ${ask} requires a permission decision.`,
+      ...taintOf(cedar),
       ...base2,
       stale
     };
@@ -7890,6 +7978,7 @@ function evaluatePreToolUse(input) {
       rules: allowed,
       reason_code: "rule_allow",
       reason: `Allowed by Oxagen policy rule ${rule}.`,
+      ...taintOf(cedar),
       ...base2,
       stale
     };
@@ -7901,6 +7990,7 @@ function evaluatePreToolUse(input) {
       source: "bundle",
       reason_code: cedar.reason_code,
       reason: cedar.reason,
+      ...taintOf(cedar),
       ...base2,
       stale
     };
@@ -7915,6 +8005,9 @@ function evaluatePreToolUse(input) {
     stale
   };
 }
+function taintOf(cedar) {
+  return cedar?.taint === void 0 ? {} : { taint: cedar.taint };
+}
 function ruleNames(reasons) {
   return reasons.length > 0 ? { rule: reasons.join(" and "), rules: reasons } : {};
 }
@@ -7930,7 +8023,7 @@ function decideWithCedar(input) {
   const cedarBundle = input.bundle.cedar;
   if (cedarBundle === void 0 || input.cedar === void 0) return void 0;
   if (isOxagenTool(input.toolName)) return void 0;
-  const { runtime, harness, agent, skill, action, harness_tool } = input.cedar;
+  const { runtime, harness, agent, skill, action, harness_tool, facts } = input.cedar;
   const readOnly = cedarReadOnly(cedarBundle, input.toolName, harness, action);
   if (runtime === null) {
     if (readOnly) return void 0;
@@ -7966,6 +8059,7 @@ function decideWithCedar(input) {
       ...harness_tool !== void 0 ? { harnessTool: harness_tool } : {},
       ...action !== void 0 ? { action } : {},
       ...skill !== void 0 ? { skill } : {},
+      ...facts !== void 0 ? { facts } : {},
       now: input.now
     });
   } catch (error) {
@@ -7976,10 +8070,12 @@ function decideWithCedar(input) {
     };
   }
   if (verdict === null) return void 0;
+  const taint = facts !== void 0 ? { taint: facts.taint.sources } : {};
   if (verdict.errors.length > 0) {
     return {
       evaluated: "deny",
       ...ruleNames(verdict.reasons),
+      ...taint,
       reason_code: "cedar_error",
       reason: `Cedar could not decide ${verdict.action}: ${verdict.errors[0]}`
     };
@@ -7997,6 +8093,7 @@ function decideWithCedar(input) {
       return {
         evaluated: "allow",
         ...ruleNames(verdict.reasons),
+        ...taint,
         reason_code: "cedar_allow",
         reason: `The steering record's Cedar policy ${names} permits this tool, so the harness's own permission flow decides.`
       };
@@ -8004,6 +8101,7 @@ function decideWithCedar(input) {
       return {
         evaluated: "ask",
         ...ruleNames(verdict.reasons),
+        ...taint,
         reason_code: "cedar_require_approval",
         reason: `The steering record's Cedar policy ${names} requires a person's approval.`
       };
@@ -8011,6 +8109,7 @@ function decideWithCedar(input) {
       return {
         evaluated: "deny",
         ...ruleNames(verdict.reasons),
+        ...taint,
         reason_code: "cedar_deny",
         reason: verdict.reasons.length > 0 ? `Denied by the steering record's Cedar policy ${names}.` : `No Cedar policy in the steering record permits ${verdict.action} for this agent.`
       };
@@ -20235,7 +20334,7 @@ async function isDirectory(path2) {
 async function subagentFiles(sessionDir, tally2) {
   const dir = join11(sessionDir, "subagents");
   const out = [];
-  const add = async (folder, name) => {
+  const add2 = async (folder, name) => {
     const match = /^agent-(.+)\.jsonl$/.exec(name);
     if (match === null) return;
     const agentId = match[1];
@@ -20245,7 +20344,7 @@ async function subagentFiles(sessionDir, tally2) {
       meta: await readMeta(join11(folder, `agent-${agentId}.meta.json`))
     });
   };
-  for (const name of (await listDir(dir)).sort()) await add(dir, name);
+  for (const name of (await listDir(dir)).sort()) await add2(dir, name);
   const workflows = join11(dir, "workflows");
   for (const workflow of (await listDir(workflows)).sort()) {
     const folder = join11(workflows, workflow);
@@ -20254,7 +20353,7 @@ async function subagentFiles(sessionDir, tally2) {
         tally2.recordsIgnored["workflow-journal"] = (tally2.recordsIgnored["workflow-journal"] ?? 0) + 1;
         continue;
       }
-      await add(folder, name);
+      await add2(folder, name);
     }
   }
   return out;
@@ -23365,7 +23464,13 @@ var init_credential_store = __esm({
       /** `OPENAI_API_KEY` in Codex's `auth.json`. */
       "codex:auth.json",
       /** `TACHO_BROKER_<PROVIDER>_API_KEY` in the enrolling shell. */
-      "enroll:env"
+      "enroll:env",
+      /**
+       * The run token in an Oxagen Agent Runners sandbox's `launch` message. It
+       * is spent at the cloud gateway, which attaches the operator's model
+       * credential. It is not a model credential itself.
+       */
+      "sandbox:launch"
     ];
     CREDENTIAL_KINDS = ["api_key", "bearer"];
     sealedSchema = external_exports.object({
@@ -23976,7 +24081,7 @@ import { readFileSync as readFileSync11 } from "node:fs";
 import { dirname as dirname9, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-619";
+  if (true) return "2.1.4-627";
   try {
     const here = dirname9(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -35821,8 +35926,18 @@ function refusalMarkOf(result2) {
     return void 0;
   const mark = _meta[REFUSAL_META_KEY];
   if (mark === null || typeof mark !== "object") return void 0;
-  const { ruleIds } = mark;
-  return { ruleIds: Array.isArray(ruleIds) ? ruleIds : [] };
+  const { ruleIds, taint } = mark;
+  return {
+    ruleIds: Array.isArray(ruleIds) ? ruleIds : [],
+    ...Array.isArray(taint) ? { taint } : {}
+  };
+}
+function refusalTaintOf(rpc) {
+  if (rpc?.error !== void 0) return void 0;
+  const listed = refusalMarkOf(rpc?.result)?.taint;
+  if (listed === void 0) return void 0;
+  const taint = listed.filter((source) => typeof source === "string").filter((source) => source !== "").slice(0, REFUSAL_TAINT_MAX).map((source) => source.slice(0, REFUSAL_RULE_MAX));
+  return taint;
 }
 function toolErrorTextOf(result2) {
   if (result2 === null || typeof result2 !== "object") return void 0;
@@ -36067,6 +36182,7 @@ function createMcpGateway(deps) {
     const isCall = request3.method === "tools/call";
     if (!isCall && status2 !== "rejected") return;
     const ruleIds = status2 === "rejected" ? refusalRulesOf(rpc) : void 0;
+    const taint = status2 === "rejected" ? refusalTaintOf(rpc) : void 0;
     const toolUseId = isCall ? toolUseIdOf(request3.params) : void 0;
     deps.record({
       sessionId: context.sessionId,
@@ -36077,6 +36193,7 @@ function createMcpGateway(deps) {
       durationMs,
       ...refusedReason === void 0 ? {} : { refusedReason },
       ...ruleIds === void 0 ? {} : { ruleIds },
+      ...taint === void 0 ? {} : { taint },
       ...exchangeOf(request3, rpc, log)
     });
   }
@@ -36140,7 +36257,7 @@ function toolNameOf(params) {
   const name = params?.["name"];
   return typeof name === "string" && name.length > 0 ? name : "unknown";
 }
-var RPC_INVALID_REQUEST, RPC_INTERNAL_ERROR, RPC_REFUSED, CLAUDE_CODE_TOOL_USE_ID_META, MAX_TOOL_USE_ID_LENGTH, DEFAULT_TIMEOUT_MS3, UPSTREAM_EXCERPT_MAX, KERNEL_REFUSAL_PREFIXES, REFUSAL_RULES_MAX, REFUSAL_RULE_MAX;
+var RPC_INVALID_REQUEST, RPC_INTERNAL_ERROR, RPC_REFUSED, CLAUDE_CODE_TOOL_USE_ID_META, MAX_TOOL_USE_ID_LENGTH, DEFAULT_TIMEOUT_MS3, UPSTREAM_EXCERPT_MAX, KERNEL_REFUSAL_PREFIXES, REFUSAL_TAINT_MAX, REFUSAL_RULES_MAX, REFUSAL_RULE_MAX;
 var init_mcp_gateway = __esm({
   "../../packages/tacho/src/collector/mcp-gateway.ts"() {
     "use strict";
@@ -36159,6 +36276,7 @@ var init_mcp_gateway = __esm({
       'IAM denied "',
       'IAM requires approval for "'
     ];
+    REFUSAL_TAINT_MAX = 32;
     REFUSAL_RULES_MAX = 64;
     REFUSAL_RULE_MAX = 512;
   }
@@ -40489,6 +40607,34 @@ var init_recall_hints = __esm({
   }
 });
 
+// ../../packages/tacho/src/collector/policy-run.ts
+function notePolicyRunCall(record, call) {
+  const counted = hookCallClass(
+    {
+      harness: call.harness,
+      toolName: call.toolName,
+      ...call.toolInput !== void 0 ? { toolInput: call.toolInput } : {}
+    },
+    call.cedar.tools
+  );
+  if (counted === null) return;
+  record.policyRun ??= emptyRunCallLog();
+  noteRunCall(record.policyRun, counted.action, counted.tool, counted.targets);
+}
+function policyRunFacts(record) {
+  return runFactsOf(record.policyRun ?? emptyRunCallLog());
+}
+function forgetPolicyRun(record) {
+  delete record.policyRun;
+}
+var init_policy_run = __esm({
+  "../../packages/tacho/src/collector/policy-run.ts"() {
+    "use strict";
+    init_hook();
+    init_run_facts();
+  }
+});
+
 // ../../packages/tacho/src/collector/hook-handler.ts
 import { homedir as homedir4 } from "node:os";
 import { dirname as dirname17, isAbsolute as isAbsolute6 } from "node:path";
@@ -40517,6 +40663,10 @@ function policyFacts2(evaluation, view) {
     // The list is what the Run page's Policy tab prints (#3971); the joined
     // `policy_rule` stays for older readers and `tacho.session_commands`.
     ...evaluation.rules !== void 0 && evaluation.rules.length > 0 ? { policy_rules: evaluation.rules.slice(0, 64) } : {},
+    // The taint sources Cedar decided the call with (#4666). An empty list
+    // says the session was assessed and clean; no member says it was not
+    // assessed (ADR-201).
+    ...evaluation.taint !== void 0 ? { policy_taint: evaluation.taint.slice(0, 32) } : {},
     ...evaluation.capability_id !== void 0 ? { capability_id: evaluation.capability_id } : {}
   };
 }
@@ -40746,6 +40896,7 @@ async function handleHookEvent(raw, env, deps, replay, harness, agent, hookId) {
 async function cedarCallFor(view, record, input, deps, action) {
   if (view.bundle.cedar === void 0) return void 0;
   const custom2 = record.customAgent;
+  const facts = policyRunFacts(record);
   return {
     // No loader means no evaluator: a mutating tool is refused rather than
     // decided without the bundle's policies.
@@ -40755,7 +40906,9 @@ async function cedarCallFor(view, record, input, deps, action) {
     ...input.agent_type !== void 0 ? { skill: input.agent_type } : {},
     ...action !== void 0 ? { action } : {},
     // Cursor's adapter renames `Shell` to `Bash` and keeps Cursor's own name here.
-    ...typeof input["cursor_tool_name"] === "string" ? { harness_tool: input["cursor_tool_name"] } : {}
+    ...typeof input["cursor_tool_name"] === "string" ? { harness_tool: input["cursor_tool_name"] } : {},
+    // The taint and prior calls of the calls that ran in the session (#4666).
+    facts
   };
 }
 function evaluationRequestFor(view, toolName3, toolInput, record, deps, input, cedar) {
@@ -41316,6 +41469,13 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
     case "PostToolUse":
     case "PostToolUseFailure": {
       events.push(...record.recorder.ingestHook(payload, env, at, withReplay));
+      if (view.bundle.cedar !== void 0 && input.tool_name !== void 0)
+        notePolicyRunCall(record, {
+          cedar: view.bundle.cedar,
+          harness: record.customAgent !== void 0 ? "custom" : record.harness ?? "claude-code",
+          toolName: input.tool_name,
+          ...input.tool_input !== void 0 ? { toolInput: input.tool_input } : {}
+        });
       if (input.hook_event_name === "PostToolUseFailure")
         noteToolFailure(record, input.tool_name);
       else if (deps.noteMemoryReads !== void 0 && (record.harness ?? "claude-code") === "claude-code")
@@ -41380,6 +41540,7 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
       events.push(...record.recorder.ingestHook(payload, env, at, withReplay));
       deps.registry.seal(record);
       forgetRecallHints(record);
+      forgetPolicyRun(record);
       const harness2 = skillsHarness(record);
       if (deps.skills !== void 0 && harness2 !== void 0)
         await deps.skills.remove(harness2, record.harnessSessionId, env);
@@ -41455,6 +41616,7 @@ var init_hook_handler = __esm({
     init_reflection_ask();
     init_interjection2();
     init_recall_hints();
+    init_policy_run();
     CONTAINMENT_REQUIRED_REASON = "This agent's mandate requires the contained tier. Start it with `oxagen agent run --contained`.";
     MESSAGE_BOUNDARIES = /* @__PURE__ */ new Set([
       "SessionStart",
@@ -41999,7 +42161,8 @@ function gatewayFrameBody(call) {
         policy_source: "kernel",
         policy_reason_code: "mcp_refused",
         policy_reason_digest: digestText(call.refusedReason ?? "refused"),
-        ...call.ruleIds === void 0 || call.ruleIds.length === 0 ? {} : { policy_rules: call.ruleIds }
+        ...call.ruleIds === void 0 || call.ruleIds.length === 0 ? {} : { policy_rules: call.ruleIds },
+        ...call.taint === void 0 ? {} : { policy_taint: call.taint }
       } : {}
     }
   };
@@ -49842,6 +50005,33 @@ import { readdir as readdir3, readFile as readFile3, stat as stat2 } from "node:
 import { homedir as homedir7, hostname as osHostname2 } from "node:os";
 import { dirname as dirname21, join as join39 } from "node:path";
 import { execFile as execFile4, spawnSync as spawnSync7 } from "node:child_process";
+function cloudGatewayUpstreams(origin = CLOUD_GATEWAY_ORIGIN) {
+  const base2 = new URL(origin).origin;
+  const openai = `${base2}${CLOUD_GATEWAY_BASE_PATH}/openai/v1`;
+  return {
+    anthropic: `${base2}${CLOUD_GATEWAY_BASE_PATH}/anthropic`,
+    openai,
+    chatgpt: openai
+  };
+}
+function cloudGatewayCredentialStore(disk, runToken) {
+  const held = (provider) => ({
+    kind: provider === "anthropic" ? "api_key" : "bearer",
+    secret: runToken
+  });
+  return {
+    ...disk,
+    has: () => true,
+    read: (provider) => held(provider),
+    take: () => {
+      throw new Error(
+        "A sandbox's local gateway holds no model credential. The cloud gateway attaches the operator's key."
+      );
+    },
+    release: () => void 0,
+    status: () => []
+  };
+}
 function defaultExec(command2, args) {
   const result2 = spawnSync7(command2, args, {
     encoding: "utf8",
@@ -50137,10 +50327,14 @@ async function initializeDaemon(options, server, port, ready) {
   const bootId = `tachod-${ulid(now())}`;
   const hostRecord = registry2.ensure(bootId, { pid: process.pid }).record;
   const hostRecorder = hostRecord.recorder;
-  const credentialStore = openCredentialStore({
+  const diskCredentialStore = openCredentialStore({
     file: paths.credentials,
     key: paths.credentialsKey
   });
+  const credentialStore = options.cloudGateway !== void 0 ? cloudGatewayCredentialStore(
+    diskCredentialStore,
+    options.cloudGateway.runToken
+  ) : diskCredentialStore;
   const runTokenKey = () => readRunTokenKey(paths.runTokenKey) ?? loadOrCreateRunTokenKey(paths.runTokenKey).key;
   runTokenKey();
   function inCustody(provider) {
@@ -51788,11 +51982,11 @@ async function initializeDaemon(options, server, port, ready) {
       bundle: host.bundle,
       hostStatus: hostStatusInForce(host, bundleVerified)
     }),
-    upstreams: () => ({
+    upstreams: () => options.cloudGateway !== void 0 ? cloudGatewayUpstreams(options.cloudGateway.origin) : {
       ...DEFAULT_MODEL_UPSTREAMS,
       ...displacedUpstreams,
       ...options.modelUpstreams
-    }),
+    },
     // A restart must not hand the agent's day back either (ADR-160). The day
     // counter asks this once per process (`createDaySpend`), so the figure
     // read at startup is used once. A first call on a later day than
@@ -51971,6 +52165,7 @@ async function initializeDaemon(options, server, port, ready) {
   }
   const api = {
     runContained: contained.run,
+    runSandbox: contained.runSandbox,
     githubLease: (input) => githubProxy.issue(input),
     githubProxy: (req, res) => githubProxy.handle(req, res),
     localToken: host.local_token,
@@ -52375,6 +52570,7 @@ async function initializeDaemon(options, server, port, ready) {
           }
           registry2.settleSwept(candidate);
           forgetRecallHints(candidate.record);
+          forgetPolicyRun(candidate.record);
           closed2.push(candidate);
         }
         if (!queues.hostBusy()) {
@@ -52631,7 +52827,7 @@ async function initializeDaemon(options, server, port, ready) {
     }
   };
 }
-var DEFAULT_TIMERS, STATIC_TOKEN_RENEWAL_CHECK_MS, MEMORY_SCAN_MS, QUEUED_PROMPT_CLASS, RECORDER_EVENTS_KEPT, STOPPING, STOPPED_EXEC, STATE_WRITE_DEFER_MS;
+var DEFAULT_TIMERS, STATIC_TOKEN_RENEWAL_CHECK_MS, MEMORY_SCAN_MS, CLOUD_GATEWAY_ORIGIN, CLOUD_GATEWAY_BASE_PATH, QUEUED_PROMPT_CLASS, RECORDER_EVENTS_KEPT, STOPPING, STOPPED_EXEC, STATE_WRITE_DEFER_MS;
 var init_daemon = __esm({
   "../../packages/tacho/src/collector/daemon.ts"() {
     "use strict";
@@ -52686,6 +52882,7 @@ var init_daemon = __esm({
     init_machine();
     init_push_basis();
     init_recall_hints();
+    init_policy_run();
     init_session_skills();
     init_credential_issuer();
     init_day_spend();
@@ -52720,6 +52917,8 @@ var init_daemon = __esm({
     };
     STATIC_TOKEN_RENEWAL_CHECK_MS = 60 * 6e4;
     MEMORY_SCAN_MS = 5 * 6e4;
+    CLOUD_GATEWAY_ORIGIN = "https://api.oxagen.sh";
+    CLOUD_GATEWAY_BASE_PATH = "/v1/gateway";
     QUEUED_PROMPT_CLASS = RETENTION_CLASS_BY_KIND["oxagen:message"] ?? "model_call";
     RECORDER_EVENTS_KEPT = 64;
     STOPPING = "tachod is stopping; tacho-hook spools this hook for the next start";
@@ -52868,7 +53067,7 @@ async function stopAll(daemons) {
   const failed3 = results.find((result2) => result2.status === "rejected");
   if (failed3 !== void 0) throw failed3.reason;
 }
-async function runDaemonProcess() {
+async function runDaemonProcess(options = {}) {
   const paths = tachoHome(process.env);
   const daemons = [];
   let stopping;
@@ -52912,6 +53111,18 @@ async function runDaemonProcess() {
   process.on("SIGHUP", () => {
     for (const daemon of daemons) daemon.refreshBundle().catch(() => void 0);
   });
+  if (options.started !== void 0) {
+    try {
+      await options.started(daemons);
+    } catch (error) {
+      log(
+        `tachod: ${error instanceof Error ? error.message : String(error)}, stopping
+`
+      );
+      stopWithin(stopOnce, STOP_GRACE_MS, () => exit(1), log);
+      return;
+    }
+  }
   await new Promise(() => void 0);
 }
 var STOP_GRACE_MS;
@@ -54940,7 +55151,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-619",
+      version: "2.1.4-627",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -64051,7 +64262,7 @@ var require_YAMLMap = __commonJS({
       static from(schema, obj2, ctx) {
         const { keepUndefined, replacer } = ctx;
         const map = new this(schema);
-        const add = (key, value) => {
+        const add2 = (key, value) => {
           if (typeof replacer === "function")
             value = replacer.call(obj2, key, value);
           else if (Array.isArray(replacer) && !replacer.includes(key))
@@ -64061,10 +64272,10 @@ var require_YAMLMap = __commonJS({
         };
         if (obj2 instanceof Map) {
           for (const [key, value] of obj2)
-            add(key, value);
+            add2(key, value);
         } else if (obj2 && typeof obj2 === "object") {
           for (const key of Object.keys(obj2))
-            add(key, obj2[key]);
+            add2(key, obj2[key]);
         }
         if (typeof schema.sortMapEntries === "function") {
           map.items.sort(schema.sortMapEntries);
@@ -78587,10 +78798,10 @@ var init_esm2 = __esm({
             lpos = pos, lm = null;
             break;
           } else {
-            var add = sym - 254;
+            var add2 = sym - 254;
             if (sym > 264) {
               var i2 = sym - 257, b5 = fleb[i2];
-              add = bits(dat, pos, (1 << b5) - 1) + fl[i2];
+              add2 = bits(dat, pos, (1 << b5) - 1) + fl[i2];
               pos += b5;
             }
             var d = dm[bits16(dat, pos) & dms], dsym = d >> 4;
@@ -78609,7 +78820,7 @@ var init_esm2 = __esm({
             }
             if (resize)
               cbuf(bt + 131072);
-            var end = bt + add;
+            var end = bt + add2;
             if (bt < dt) {
               var shift = dl - dt, dend = Math.min(dt, end);
               if (shift + bt < 0)
@@ -90587,7 +90798,7 @@ var require_umd = __commonJS({
           return this.not().add(ONE);
         };
         LongPrototype.neg = LongPrototype.negate;
-        LongPrototype.add = function add(addend) {
+        LongPrototype.add = function add2(addend) {
           if (!isLong3(addend)) addend = fromValue(addend);
           var a48 = this.high >>> 16;
           var a32 = this.high & 65535;
@@ -92076,7 +92287,7 @@ var require_namespace = __commonJS({
         return this.nested[name].values;
       throw Error("no such enum: " + name);
     };
-    Namespace.prototype.add = function add(object) {
+    Namespace.prototype.add = function add2(object) {
       if (!(object instanceof Field && object.extend !== void 0 || object instanceof Type || object instanceof OneOf || object instanceof Enum || object instanceof Service || object instanceof Namespace))
         throw TypeError("object must be a valid nested object");
       if (object.name === "__proto__")
@@ -92460,7 +92671,7 @@ var require_service2 = __commonJS({
       });
       return this;
     };
-    Service.prototype.add = function add(object) {
+    Service.prototype.add = function add2(object) {
       if (this.get(object.name))
         throw Error("duplicate name '" + object.name + "' in " + this);
       if (object instanceof Method) {
@@ -93187,7 +93398,7 @@ var require_type = __commonJS({
         return this.nested[name];
       return null;
     };
-    Type.prototype.add = function add(object) {
+    Type.prototype.add = function add2(object) {
       if (this.get(object.name))
         throw Error("duplicate name '" + object.name + "' in " + this);
       if (object instanceof Field && object.extend === void 0) {
@@ -94114,7 +94325,7 @@ var require_oneof = __commonJS({
             oneof.parent.add(oneof.fieldsArray[i2]);
       }
     }
-    OneOf.prototype.add = function add(field) {
+    OneOf.prototype.add = function add2(field) {
       if (!(field instanceof Field))
         throw TypeError("field must be a Field");
       if (field.parent && field.parent !== this.parent)
@@ -94446,7 +94657,7 @@ var require_enum = __commonJS({
         keepComments ? this.comments : void 0
       ]);
     };
-    Enum.prototype.add = function add(name, id, comment, options) {
+    Enum.prototype.add = function add2(name, id, comment, options) {
       if (!util2.isString(name))
         throw TypeError("name must be a string");
       if (!util2.isInteger(id))
@@ -122693,6 +122904,7 @@ var init_policy2 = __esm({
     init_decision();
     init_hook();
     init_runtime();
+    init_run_facts();
   }
 });
 
@@ -123498,6 +123710,14 @@ var init_decision_rules = __esm({
   }
 });
 
+// ../../packages/policy/src/run-facts.ts
+var init_run_facts2 = __esm({
+  "../../packages/policy/src/run-facts.ts"() {
+    "use strict";
+    init_policy2();
+  }
+});
+
 // ../../packages/policy/src/visibility.ts
 var init_visibility = __esm({
   "../../packages/policy/src/visibility.ts"() {
@@ -123515,6 +123735,7 @@ var init_src7 = __esm({
     init_compile3();
     init_decision_rules();
     init_evaluate();
+    init_run_facts2();
     init_schema4();
     init_tests();
     init_visibility();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxagen/cli",
-  "version": "2.1.4-619",
+  "version": "2.1.4-627",
   "description": "Oxagen governance CLI — spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
   "type": "module",
   "bin": {