@panguard-ai/panguard 1.6.1 → 1.7.1

package/dist/cli/consent.js

@@ -1,12 +1,15 @@
 /**
  * Telemetry consent — first-run collective-defense disclosure.
  *
- * On first interactive run we disclose what is shared (matched rule ID, a
- * one-way payload hash, source type — never prompts/code/data, no IP, a random
- * install ID) and default to ON (opt-out). Raw samples are never sent unless
- * the user opts in separately. Non-interactive (CI) stays OFF until explicitly
- * enabled. The guard event-processor will not upload anything before this
- * disclosure has been shown at least once (it gates on the marker written here).
+ * Collective-defense sharing is OPT-IN and defaults to OFF. On first interactive
+ * run we explain BOTH the value (your blocked attacks become ATR rules that
+ * protect everyone, and you get community rules back faster) and the privacy
+ * guarantee (matched rule ID, a one-way payload hash, source type — never
+ * prompts/code/file contents/keys, no IP, no hostname, a random install ID),
+ * then ask the user to turn it ON; pressing Enter declines. This is an informed
+ * invitation, not a nag or a pre-checked default. Raw samples are never sent.
+ * Non-interactive (CI) stays OFF until explicitly enabled. Nothing leaves the
+ * machine unless the user explicitly opts in (gates are `=== true`).
  */
 import { existsSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
@@ -20,8 +23,13 @@ const CONSENT_MARKER = join(GUARD_CONFIG_DIR, '.telemetry-prompted');
 export function hasConsentBeenAsked() {
     return existsSync(CONSENT_MARKER);
 }
-/** Mark consent as asked (regardless of answer) */
-function markConsentAsked() {
+/**
+ * Mark consent as asked (regardless of answer). Exported so a command that owns
+ * its own consent prompt (e.g. `pga setup`'s Threat Cloud question) can record
+ * that the user has already been asked — preventing the trailing
+ * `ensureTelemetryConsent()` from re-prompting and overwriting the first answer.
+ */
+export function markConsentAsked() {
     try {
         if (!existsSync(GUARD_CONFIG_DIR)) {
             mkdirSync(GUARD_CONFIG_DIR, { recursive: true });
@@ -49,17 +57,20 @@ export async function askTelemetryConsent() {
         return false;
     }
     console.log('');
-    console.log(`  ${symbols.info} ${c.bold('Collective defense')}`);
+    console.log(`  ${symbols.info} ${c.bold('Collective defense (optional, off by default)')}`);
+    console.log('');
+    console.log(`  ${c.dim('Why turn it on: every attack PanGuard blocks on your machine can become')}`);
+    console.log(`  ${c.dim('a new ATR rule that protects everyone — and you get those community')}`);
+    console.log(`  ${c.dim('rules back faster. More sensors means faster detection for all of us.')}`);
     console.log('');
-    console.log(`  ${c.dim('When PanGuard catches an attack, it shares an anonymized signature —')}`);
-    console.log(`  ${c.dim('the matched rule ID, a one-way hash of the payload, and the source')}`);
-    console.log(`  ${c.dim('type — so new attacks become rules that protect everyone.')}`);
+    console.log(`  ${c.dim('What is shared: only the matched rule ID, a one-way hash of the payload,')}`);
+    console.log(`  ${c.dim('and the source type. Never your prompts, code, file contents, keys, IP')}`);
+    console.log(`  ${c.dim('address, or hostname. A random install ID only. Raw samples are never sent.')}`);
     console.log('');
-    console.log(`  ${c.dim('Never your prompts, code, or data. No IP address. A random install ID')}`);
-    console.log(`  ${c.dim('only. Raw samples are never sent unless you opt in separately.')}`);
-    console.log(`  ${c.dim('Turn off anytime: pga config set telemetry false')}`);
+    console.log(`  ${c.dim('Stays off unless you opt in. Change anytime: pga config set telemetry true/false')}`);
     console.log('');
-    const answer = await promptYesNo('  Share anonymized threat signatures? [Y/n] ', true);
+    // Opt-in: default is NO. Pressing Enter declines (default OFF).
+    const answer = await promptYesNo('  Join collective defense and share anonymized threat signatures? [y/N] ', false);
     const config = loadGuardConfig();
     updateGuardConfig({ ...config, telemetryEnabled: answer, threatCloudUploadEnabled: answer });
     markConsentAsked();
@@ -73,8 +84,9 @@ export async function askTelemetryConsent() {
     return answer;
 }
 /**
- * Simple yes/no prompt. Empty input returns `defaultYes` (so a [Y/n] prompt
- * defaults to yes on Enter); otherwise true only for y/yes.
+ * Simple yes/no prompt. Empty input (Enter) returns `defaultYes`; otherwise true
+ * only for y/yes. For opt-in consent pass `defaultYes = false` so a bare Enter
+ * declines and nothing is shared.
  */
 function promptYesNo(question, defaultYes = false) {
     return new Promise((resolve) => {
@@ -90,6 +102,23 @@ function promptYesNo(question, defaultYes = false) {
         });
     });
 }
+/**
+ * Non-interactive read: has the user explicitly opted in to Threat Cloud upload?
+ *
+ * Use this on one-off code paths (e.g. `pga scan <path>`) that must NEVER trigger
+ * an outbound upload — or an interactive prompt — but still need to honour a prior
+ * opt-in. Defaults to FALSE (no upload) when config is absent or unreadable, so the
+ * privacy guarantee holds by default. Gate is `=== true`, matching the guard's
+ * upload gate.
+ */
+export function isThreatCloudUploadEnabled() {
+    try {
+        return loadGuardConfig().threatCloudUploadEnabled === true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Check and ask for telemetry consent if not yet asked.
  * Call this at the start of scan/setup commands.

package/dist/cli/consent.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/cli/consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEvE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;AAErE,8CAA8C;AAC9C,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,mDAAmD;AACnD,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,aAAa,CAAC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,gBAAgB,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,sEAAsE,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,oEAAoE,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,2DAA2D,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,CAAC,uEAAuE,CAAC,EAAE,CACtF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gEAAgE,CAAC,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,8CAA8C,EAAE,IAAI,CAAC,CAAC;IAEvF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,gBAAgB,EAAE,CAAC;IAEnB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAU,GAAG,KAAK;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,UAAU,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,OAAO,CAAC,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IACD,yCAAyC;IACzC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/cli/consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEvE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC5D,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;AAErE,8CAA8C;AAC9C,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,aAAa,CAAC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,gBAAgB,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,yEAAyE,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qEAAqE,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,uEAAuE,CAAC,EAAE,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,0EAA0E,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,wEAAwE,CAAC,EAAE,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,6EAA6E,CAAC,EAAE,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,kFAAkF,CAAC,EAAE,CAAC,CAAC;IAC9G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,gEAAgE;IAChE,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,0EAA0E,EAC1E,KAAK,CACN,CAAC;IAEF,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7F,gBAAgB,EAAE,CAAC;IAEnB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAU,GAAG,KAAK;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,UAAU,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,OAAO,CAAC,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC;QACH,OAAO,eAAe,EAAE,CAAC,wBAAwB,KAAK,IAAI,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IACD,yCAAyC;IACzC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;AAC1C,CAAC"}

package/dist/cli/credentials.d.ts

@@ -17,6 +17,11 @@ export interface StoredCredentials {
 }
 export interface LlmConfig {
     provider: string;
+    /**
+     * Deprecated and never persisted. Cloud keys are read only from the
+     * ANTHROPIC_API_KEY / OPENAI_API_KEY environment variables (see
+     * panguard-guard llm-detect.ts). Kept optional for type back-compat only.
+     */
     apiKey?: string;
     model?: string;
     endpoint?: string;
@@ -30,7 +35,12 @@ export declare function saveCredentials(_creds: StoredCredentials): void;
 export declare function clearCredentials(): void;
 /** Always returns null — no LLM config stored. */
 export declare function loadLlmConfig(): LlmConfig | null;
-/** No-op in community edition. */
+/**
+ * No-op in community edition — this build does NOT persist an LLM config (and
+ * never a cloud key). The semantic layer resolves a provider at startup from
+ * the environment / local-runtime probe (see panguard-guard llm-detect.ts).
+ * Callers must not rely on a later loadLlmConfig() returning what they passed.
+ */
 export declare function saveLlmConfig(_config: LlmConfig): void;
 /** Always returns false in community edition. */
 export declare function deleteLlmConfig(): boolean;

package/dist/cli/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,YAAY,EAAE,IAAI,EAAE,CAAC;AAErB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAE1D;AAED,kCAAkC;AAClC,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAG;AAEnE,kCAAkC;AAClC,wBAAgB,gBAAgB,IAAI,IAAI,CAAG;AAE3C,kDAAkD;AAClD,wBAAgB,aAAa,IAAI,SAAS,GAAG,IAAI,CAEhD;AAED,kCAAkC;AAClC,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAAG;AAE1D,iDAAiD;AACjD,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C,YAAY,EAAE,IAAI,EAAE,CAAC;AAErB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAE1D;AAED,kCAAkC;AAClC,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAG;AAEnE,kCAAkC;AAClC,wBAAgB,gBAAgB,IAAI,IAAI,CAAG;AAE3C,kDAAkD;AAClD,wBAAgB,aAAa,IAAI,SAAS,GAAG,IAAI,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAAG;AAE1D,iDAAiD;AACjD,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}

package/dist/cli/credentials.js

@@ -16,7 +16,12 @@ export function clearCredentials() { }
 export function loadLlmConfig() {
     return null;
 }
-/** No-op in community edition. */
+/**
+ * No-op in community edition — this build does NOT persist an LLM config (and
+ * never a cloud key). The semantic layer resolves a provider at startup from
+ * the environment / local-runtime probe (see panguard-guard llm-detect.ts).
+ * Callers must not rely on a later loadLlmConfig() returning what they passed.
+ */
 export function saveLlmConfig(_config) { }
 /** Always returns false in community edition. */
 export function deleteLlmConfig() {

package/dist/cli/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,wEAAwE;AACxE,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,eAAe,CAAC,MAAyB,IAAS,CAAC;AAEnE,kCAAkC;AAClC,MAAM,UAAU,gBAAgB,KAAU,CAAC;AAE3C,kDAAkD;AAClD,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,aAAa,CAAC,OAAkB,IAAS,CAAC;AAE1D,iDAAiD;AACjD,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA6BH,wEAAwE;AACxE,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,eAAe,CAAC,MAAyB,IAAS,CAAC;AAEnE,kCAAkC;AAClC,MAAM,UAAU,gBAAgB,KAAU,CAAC;AAE3C,kDAAkD;AAClD,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAkB,IAAS,CAAC;AAE1D,iDAAiD;AACjD,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/dashboard-url.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Dashboard URL helpers — shared by `pga up` and `pga setup`.
+ *
+ * The Guard daemon's dashboard auth token lives in DashboardServer memory and
+ * mints the auth cookie ONLY for a request carrying it as `/?token=<token>`. A
+ * bare http://127.0.0.1:PORT therefore lands on a 401 "Invalid token" page on a
+ * rerun / already-running daemon / headless host. The daemon persists that token
+ * to ~/.panguard-guard/dashboard-token (0o600) once its dashboard is listening;
+ * callers read it here to construct the URL the user can actually open.
+ *
+ * Both `pga up` and `pga setup` open/print the dashboard, so these live in one
+ * module instead of being duplicated (and drifting) across commands.
+ */
+/**
+ * Read the dashboard port the daemon is actually configured to use, so the
+ * launch URL points at the right place even on a non-default port. Falls back
+ * to the shared default when config is absent or unreadable.
+ */
+export declare function readDashboardPort(): number;
+/** Base (unauthenticated) dashboard URL — only for human-readable hints. */
+export declare function dashboardBaseUrl(): string;
+/**
+ * Build the AUTHENTICATED dashboard launch URL, or null if the daemon has not
+ * (yet) persisted its launch token.
+ *
+ * Returns null when the token is absent so callers print guidance instead of a
+ * dead bare URL. The token is treated like the cookie: read from an owner-only
+ * file and never logged on its own.
+ */
+export declare function readAuthenticatedDashboardUrl(): string | null;
+//# sourceMappingURL=dashboard-url.d.ts.map

package/dist/cli/dashboard-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-url.d.ts","sourceRoot":"","sources":["../../src/cli/dashboard-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAa1C;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CAS7D"}

package/dist/cli/dashboard-url.js

@@ -0,0 +1,66 @@
+/**
+ * Dashboard URL helpers — shared by `pga up` and `pga setup`.
+ *
+ * The Guard daemon's dashboard auth token lives in DashboardServer memory and
+ * mints the auth cookie ONLY for a request carrying it as `/?token=<token>`. A
+ * bare http://127.0.0.1:PORT therefore lands on a 401 "Invalid token" page on a
+ * rerun / already-running daemon / headless host. The daemon persists that token
+ * to ~/.panguard-guard/dashboard-token (0o600) once its dashboard is listening;
+ * callers read it here to construct the URL the user can actually open.
+ *
+ * Both `pga up` and `pga setup` open/print the dashboard, so these live in one
+ * module instead of being duplicated (and drifting) across commands.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/** Default dashboard port — matches packages/panguard-guard config default. */
+const DEFAULT_DASHBOARD_PORT = 3100;
+/** Where the daemon persists its per-launch dashboard auth token (0o600). */
+const DASHBOARD_TOKEN_PATH = join(homedir(), '.panguard-guard', 'dashboard-token');
+/**
+ * Read the dashboard port the daemon is actually configured to use, so the
+ * launch URL points at the right place even on a non-default port. Falls back
+ * to the shared default when config is absent or unreadable.
+ */
+export function readDashboardPort() {
+    try {
+        const cfgPath = join(homedir(), '.panguard-guard', 'config.json');
+        if (existsSync(cfgPath)) {
+            const cfg = JSON.parse(readFileSync(cfgPath, 'utf-8'));
+            if (typeof cfg.dashboardPort === 'number' && cfg.dashboardPort > 0) {
+                return cfg.dashboardPort;
+            }
+        }
+    }
+    catch {
+        /* fall through to default */
+    }
+    return DEFAULT_DASHBOARD_PORT;
+}
+/** Base (unauthenticated) dashboard URL — only for human-readable hints. */
+export function dashboardBaseUrl() {
+    return `http://127.0.0.1:${readDashboardPort()}`;
+}
+/**
+ * Build the AUTHENTICATED dashboard launch URL, or null if the daemon has not
+ * (yet) persisted its launch token.
+ *
+ * Returns null when the token is absent so callers print guidance instead of a
+ * dead bare URL. The token is treated like the cookie: read from an owner-only
+ * file and never logged on its own.
+ */
+export function readAuthenticatedDashboardUrl() {
+    try {
+        if (!existsSync(DASHBOARD_TOKEN_PATH))
+            return null;
+        const token = readFileSync(DASHBOARD_TOKEN_PATH, 'utf-8').trim();
+        if (!token)
+            return null;
+        return `${dashboardBaseUrl()}/?token=${token}`;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=dashboard-url.js.map

package/dist/cli/dashboard-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-url.js","sourceRoot":"","sources":["../../src/cli/dashboard-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,6EAA6E;AAC7E,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAA+B,CAAC;YACrF,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;gBACnE,OAAO,GAAG,CAAC,aAAa,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,oBAAoB,iBAAiB,EAAE,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B;IAC3C,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,GAAG,gBAAgB,EAAE,WAAW,KAAK,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cli/first-run.d.ts

@@ -0,0 +1,35 @@
+/**
+ * First-run detection — durable, telemetry-independent.
+ *
+ * The flagship `pga up` and the bare `pga` interactive entry both need to know
+ * "has this machine completed the welcome + interactive setup at least once?".
+ *
+ * Previously each command answered that question with a marker that was wrong:
+ *   - `pga up` keyed off ~/.panguard/activated, which is ONLY written by the
+ *     opt-in Threat Cloud activation ping. A user who declines telemetry (the
+ *     default) never gets that file, so EVERY `pga up` re-ran the full
+ *     "Welcome to PanGuard AI!" + interactive setup.
+ *   - bare `pga` keyed off ~/.panguard/config.json, which is never written —
+ *     `pga setup` saves its config to ~/.panguard-guard/config.json — so the
+ *     setup wizard re-triggered on every bare invocation even after setup.
+ *
+ * The fix is a single dedicated marker, ~/.panguard/.initialized (0o600),
+ * written once after the first successful run and consulted by BOTH commands.
+ * It is independent of telemetry consent and of any config file location.
+ */
+/**
+ * Whether this is the machine's first run (no durable marker yet). Returns true
+ * on any read uncertainty only when the marker is genuinely absent — a present
+ * marker always means "not first run".
+ */
+export declare function isFirstRun(): boolean;
+/**
+ * Record that the first run has completed so subsequent `pga up` / bare `pga`
+ * skip the welcome + interactive setup and go straight to the normal flow.
+ *
+ * Idempotent and best-effort: creates ~/.panguard (0o700) if missing and writes
+ * the marker (0o600). A write failure is swallowed — we would simply re-detect
+ * first-run next time rather than crash a security tool's happy path.
+ */
+export declare function markInitialized(): void;
+//# sourceMappingURL=first-run.d.ts.map

package/dist/cli/first-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"first-run.d.ts","sourceRoot":"","sources":["../../src/cli/first-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,IAAI,IAAI,CActC"}

package/dist/cli/first-run.js

@@ -0,0 +1,59 @@
+/**
+ * First-run detection — durable, telemetry-independent.
+ *
+ * The flagship `pga up` and the bare `pga` interactive entry both need to know
+ * "has this machine completed the welcome + interactive setup at least once?".
+ *
+ * Previously each command answered that question with a marker that was wrong:
+ *   - `pga up` keyed off ~/.panguard/activated, which is ONLY written by the
+ *     opt-in Threat Cloud activation ping. A user who declines telemetry (the
+ *     default) never gets that file, so EVERY `pga up` re-ran the full
+ *     "Welcome to PanGuard AI!" + interactive setup.
+ *   - bare `pga` keyed off ~/.panguard/config.json, which is never written —
+ *     `pga setup` saves its config to ~/.panguard-guard/config.json — so the
+ *     setup wizard re-triggered on every bare invocation even after setup.
+ *
+ * The fix is a single dedicated marker, ~/.panguard/.initialized (0o600),
+ * written once after the first successful run and consulted by BOTH commands.
+ * It is independent of telemetry consent and of any config file location.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/** The PanGuard CLI state directory (NOT the Guard daemon's ~/.panguard-guard). */
+const PANGUARD_DIR = join(homedir(), '.panguard');
+/** Durable first-run marker. Presence => welcome + setup already completed. */
+const INITIALIZED_MARKER = join(PANGUARD_DIR, '.initialized');
+/**
+ * Whether this is the machine's first run (no durable marker yet). Returns true
+ * on any read uncertainty only when the marker is genuinely absent — a present
+ * marker always means "not first run".
+ */
+export function isFirstRun() {
+    return !existsSync(INITIALIZED_MARKER);
+}
+/**
+ * Record that the first run has completed so subsequent `pga up` / bare `pga`
+ * skip the welcome + interactive setup and go straight to the normal flow.
+ *
+ * Idempotent and best-effort: creates ~/.panguard (0o700) if missing and writes
+ * the marker (0o600). A write failure is swallowed — we would simply re-detect
+ * first-run next time rather than crash a security tool's happy path.
+ */
+export function markInitialized() {
+    try {
+        if (!existsSync(PANGUARD_DIR)) {
+            mkdirSync(PANGUARD_DIR, { recursive: true, mode: 0o700 });
+        }
+        if (!existsSync(INITIALIZED_MARKER)) {
+            writeFileSync(INITIALIZED_MARKER, new Date().toISOString(), {
+                encoding: 'utf-8',
+                mode: 0o600,
+            });
+        }
+    }
+    catch {
+        /* best-effort: re-detect first-run next time rather than fail the run */
+    }
+}
+//# sourceMappingURL=first-run.js.map

package/dist/cli/first-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"first-run.js","sourceRoot":"","sources":["../../src/cli/first-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,mFAAmF;AACnF,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAElD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpC,aAAa,CAAC,kBAAkB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;gBAC1D,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC"}

package/dist/cli/guard-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-config.d.ts","sourceRoot":"","sources":["../../src/cli/guard-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,iBAAiB,CAUnD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAKjE"}
+{"version":3,"file":"guard-config.d.ts","sourceRoot":"","sources":["../../src/cli/guard-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,iBAAiB,CAUnD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAgBjE"}

package/dist/cli/guard-config.js

@@ -2,7 +2,7 @@
  * Lightweight Guard config reader/writer for CLI commands.
  * Does not import the full Guard engine — only reads/writes ~/.panguard-guard/config.json.
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 const GUARD_CONFIG_DIR = join(homedir(), '.panguard-guard');
@@ -22,9 +22,21 @@ export function loadGuardConfig() {
 }
 /** Write updated guard config to ~/.panguard-guard/config.json */
 export function updateGuardConfig(config) {
+    // 0o700 dir + 0o600 file: the config can carry threatCloudApiKey and
+    // notification secrets — never world/group-readable on shared machines.
     if (!existsSync(GUARD_CONFIG_DIR)) {
-        mkdirSync(GUARD_CONFIG_DIR, { recursive: true });
+        mkdirSync(GUARD_CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+    writeFileSync(GUARD_CONFIG_PATH, JSON.stringify(config, null, 2), {
+        encoding: 'utf-8',
+        mode: 0o600,
+    });
+    // chmod even if the file already existed, to tighten a loosely-created file.
+    try {
+        chmodSync(GUARD_CONFIG_PATH, 0o600);
+    }
+    catch {
+        /* best effort — platforms without POSIX permissions */
     }
-    writeFileSync(GUARD_CONFIG_PATH, JSON.stringify(config, null, 2), 'utf-8');
 }
 //# sourceMappingURL=guard-config.js.map

package/dist/cli/guard-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-config.js","sourceRoot":"","sources":["../../src/cli/guard-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAYhE,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,SAAS,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"guard-config.js","sourceRoot":"","sources":["../../src/cli/guard-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAYhE,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,SAAS,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAChE,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,6EAA6E;IAC7E,IAAI,CAAC;QACH,SAAS,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC"}

package/dist/cli/index.js

@@ -70,6 +70,7 @@ const migrateProCommand = lazyCommand('migrate-pro', 'Convert Sigma/YARA detecti
 import { upgradeCommand } from './commands/upgrade.js';
 import { configCommand } from './commands/config.js';
 import { doctorCommand } from './commands/doctor.js';
+import { hookCommand } from './commands/hook.js';
 import { auditCommand } from './commands/audit.js';
 import { skillsCommand } from './commands/skills.js';
 import { hacktivityCommand } from './commands/hacktivity.js';
@@ -99,6 +100,7 @@ program.addCommand(whoamiCommand());
 program.addCommand(chatCommand());
 program.addCommand(configCommand());
 program.addCommand(doctorCommand());
+program.addCommand(hookCommand());
 // report (AI Compliance Audit Evidence generator) is the enterprise tier's
 // core differentiator and is NOT released in the free community plan. It stays
 // hidden until the paid tier launches behind a license gate. Do not register it
@@ -117,9 +119,17 @@ program.addCommand(hardeningCommand(), hidden);
 program.addCommand(hacktivityCommand(), hidden);
 program.addCommand(migrateProCommand(), hidden);
 const userArgs = process.argv.slice(2);
-const helpFlags = new Set(['-h', '--help', '-V', '--version']);
+// "-v" is treated as a version alias too: a single-letter flag must never fall
+// through to the side-effectful first-run setup wizard (which writes config
+// files). Commander only registers -V/--version, so we map -v to version output
+// ourselves below.
+const helpFlags = new Set(['-h', '--help', '-V', '--version', '-v']);
 const hasSubcommand = userArgs.some((a) => !a.startsWith('-'));
 const hasHelpOrVersion = userArgs.some((a) => helpFlags.has(a));
+// The `hook` command is invoked by Claude Code per tool call and its stdout is
+// parsed as JSON — it must emit NOTHING else (no update banner, no update check,
+// no first-run wizard). Detect it early and stay silent + fast.
+const isHookCommand = userArgs[0] === 'hook';
 /**
  * Show "What's new" message once after upgrade.
  * Compares current version against ~/.panguard/.last-seen-version.
@@ -268,24 +278,35 @@ async function checkForUpdates() {
     }
 }
 async function main() {
-    // Show "what's new" on interactive use (not --json, not --help)
+    // "-v" version alias. Commander only registers -V/--version, so a bare `pga -v`
+    // would otherwise reach program.parseAsync() as an unknown option (or, worse,
+    // fall through to the first-run setup wizard which writes config). Handle it
+    // here, printing the same bare version string as --version, then exit.
+    if (userArgs.length === 1 && userArgs[0] === '-v') {
+        console.log(PANGUARD_VERSION);
+        return;
+    }
+    // Show "what's new" on interactive use (not --json, not --help, not the hook)
     const isJsonMode = userArgs.includes('--json');
-    if (!hasHelpOrVersion && !isJsonMode) {
+    if (!hasHelpOrVersion && !isJsonMode && !isHookCommand) {
         await showWhatsNewIfUpgraded();
         // Non-blocking update check (fire and forget on non-JSON interactive use)
         void checkForUpdates();
     }
-    if (!hasSubcommand && !hasHelpOrVersion) {
-        // First-run detection: if no config exists, auto-run setup wizard
-        const { existsSync } = await import('node:fs');
-        const { join } = await import('node:path');
-        const configPath = join(process.env['HOME'] ?? process.env['USERPROFILE'] ?? '.', '.panguard', 'config.json');
-        const isFirstRun = !existsSync(configPath);
-        if (isFirstRun) {
-            // First time user — run setup wizard directly
+    if (!hasSubcommand && !hasHelpOrVersion && !isHookCommand) {
+        // First-run detection uses the shared durable marker
+        // (~/.panguard/.initialized), the SAME marker `pga up` and `pga setup`
+        // write on first success. The old check looked at ~/.panguard/config.json,
+        // a file that is never written (setup saves to ~/.panguard-guard/config.json),
+        // so the setup wizard re-triggered on every bare `pga` even after setup.
+        const { isFirstRun, markInitialized } = await import('./first-run.js');
+        if (isFirstRun()) {
+            // First time user — run setup wizard directly, then mark initialized so
+            // subsequent bare `pga` goes straight to the interactive menu.
             console.log('\n  Welcome to Panguard AI! / Panguard AI!\n');
             console.log('  First time detected. Starting setup wizard...\n');
             await program.parseAsync(['node', 'panguard', 'setup']);
+            markInitialized();
             return;
         }
         // Extract --lang value if present

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,mCAAmC;AACnC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACvC,gBAAgB,EAAE,GAAG;QACrB,OAAO,EAAE,gBAAgB;QACzB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,YAAY;KACrD,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,2EAA2E;AAC3E,6EAA6E;AAC7E,qDAAqD;AACrD,wDAAwD;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,4EAA4E;AAC5E,SAAS,WAAW,CAClB,IAAY,EACZ,IAAY,EACZ,UAAkB,EAClB,UAAkB;IAElB,OAAO,GAAG,EAAE;QACV,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChD,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;gBACrC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,EAAa,CAAC;gBAC7C,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;gBACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,gBAAgB,GAAG,WAAW,CAClC,WAAW,EACX,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,CACnB,CAAC;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,WAAW,CACnC,aAAa,EACb,6DAA6D,EAC7D,oCAAoC,EACpC,mBAAmB,CACpB,CAAC;AACF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,sCAAsC,CAAC;KACnD,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE7B,sCAAsC;AACtC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;AAErC,gDAAgD;AAChD,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AAEpC,2CAA2C;AAC3C,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,uCAAuC;AAEvC,kEAAkE;AAClE,gEAAgE;AAChE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;AAElC,2DAA2D;AAC3D,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5C,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1C,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1C,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5C,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/C,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;AAChD,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;AAEhD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE;;;;GAIG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEpD,yBAAyB;IACzB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,uBAAuB;IACvB,IAAI,QAAQ,KAAK,gBAAgB;QAAE,OAAO;IAE1C,yDAAyD;IACzD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,WAAW,gBAAgB,IAAI,CAAC,CAAC;QAEjF,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACnD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,sEAAsE;YACtE,MAAM,cAAc,GAAG;gBACrB,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,YAAY;gBAClE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,WAAW;aACtD,CAAC;YACF,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;gBAC/B,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClB,SAAS,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACrC,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,kCAAkC;gBAClC,MAAM,aAAa,GAAG,OAAO,gBAAgB,GAAG,CAAC;gBACjD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;gBAClD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;oBAClB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC1D,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;oBAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CACjC,WAAW,EACX,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAC1C,CAAC;oBACF,wEAAwE;oBACxE,MAAM,OAAO,GAAG,OAAO;yBACpB,KAAK,CAAC,IAAI,CAAC;yBACX,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;yBAC3C,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;yBACX,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE;wBACjB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;wBACrD,IAAI,CAAC,KAAK;4BAAE,OAAO,CAAC,CAAC;wBACrB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC;oBAC3D,CAAC,CAAC,CAAC;oBACL,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;wBAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;4BACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBACxB,CAAC;wBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;YAC9C,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,WAAW,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe;IAC5B,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAElD,+BAA+B;IAC/B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACxE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;gBAAE,OAAO;QAC3D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yDAAyD,EAAE;YACjF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;YAClC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,gBAAgB;YAAE,OAAO;QAEnD,+DAA+D;QAC/D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GACX,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CACT,yBAAyB,gBAAgB,WAAW,MAAM,EAAE,GAAG,wBAAwB,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,gEAAgE;IAChE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,sBAAsB,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,KAAK,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxC,kEAAkE;QAClE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,EACxD,WAAW,EACX,aAAa,CACd,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE3C,IAAI,UAAU,EAAE,CAAC;YACf,8CAA8C;YAC9C,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACjE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAY,EAAE,EAAE;IAClC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBAC3B,IAAI,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;aACpE,CAAC,CAAC;YACH,wDAAwD;YACxD,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,mCAAmC;AACnC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACvC,gBAAgB,EAAE,GAAG;QACrB,OAAO,EAAE,gBAAgB;QACzB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,YAAY;KACrD,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,2EAA2E;AAC3E,6EAA6E;AAC7E,qDAAqD;AACrD,wDAAwD;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,4EAA4E;AAC5E,SAAS,WAAW,CAClB,IAAY,EACZ,IAAY,EACZ,UAAkB,EAClB,UAAkB;IAElB,OAAO,GAAG,EAAE;QACV,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChD,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;gBACrC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,EAAa,CAAC;gBAC7C,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;gBACjC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,gBAAgB,GAAG,WAAW,CAClC,WAAW,EACX,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,CACnB,CAAC;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,WAAW,CACnC,aAAa,EACb,6DAA6D,EAC7D,oCAAoC,EACpC,mBAAmB,CACpB,CAAC;AACF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,sCAAsC,CAAC;KACnD,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE7B,sCAAsC;AACtC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;AAErC,gDAAgD;AAChD,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AAEpC,2CAA2C;AAC3C,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACpC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;AAClC,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,uCAAuC;AAEvC,kEAAkE;AAClE,gEAAgE;AAChE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;AAElC,2DAA2D;AAC3D,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5C,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1C,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1C,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5C,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/C,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;AAChD,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;AAEhD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvC,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,mBAAmB;AACnB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AACrE,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,+EAA+E;AAC/E,iFAAiF;AACjF,gEAAgE;AAChE,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;AAE7C;;;;GAIG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAEpD,yBAAyB;IACzB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,uBAAuB;IACvB,IAAI,QAAQ,KAAK,gBAAgB;QAAE,OAAO;IAE1C,yDAAyD;IACzD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,WAAW,gBAAgB,IAAI,CAAC,CAAC;QAEjF,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACnD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,sEAAsE;YACtE,MAAM,cAAc,GAAG;gBACrB,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,YAAY;gBAClE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,WAAW;aACtD,CAAC;YACF,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;gBAC/B,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClB,SAAS,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACrC,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,kCAAkC;gBAClC,MAAM,aAAa,GAAG,OAAO,gBAAgB,GAAG,CAAC;gBACjD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;gBAClD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;oBAClB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC1D,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;oBAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CACjC,WAAW,EACX,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAC1C,CAAC;oBACF,wEAAwE;oBACxE,MAAM,OAAO,GAAG,OAAO;yBACpB,KAAK,CAAC,IAAI,CAAC;yBACX,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;yBAC3C,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;yBACX,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE;wBACjB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;wBACrD,IAAI,CAAC,KAAK;4BAAE,OAAO,CAAC,CAAC;wBACrB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC;oBAC3D,CAAC,CAAC,CAAC;oBACL,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;wBAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;4BACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBACxB,CAAC;wBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;YAC9C,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,WAAW,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe;IAC5B,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAElD,+BAA+B;IAC/B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACxE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;gBAAE,OAAO;QAC3D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yDAAyD,EAAE;YACjF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;YAClC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,gBAAgB;YAAE,OAAO;QAEnD,+DAA+D;QAC/D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GACX,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CACT,yBAAyB,gBAAgB,WAAW,MAAM,EAAE,GAAG,wBAAwB,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;QACvD,MAAM,sBAAsB,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,KAAK,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1D,qDAAqD;QACrD,uEAAuE;QACvE,2EAA2E;QAC3E,+EAA+E;QAC/E,yEAAyE;QACzE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvE,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,wEAAwE;YACxE,+DAA+D;YAC/D,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACjE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACxD,eAAe,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAY,EAAE,EAAE;IAClC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBAC3B,IAAI,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;aACpE,CAAC,CAAC;YACH,wDAAwD;YACxD,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cli/interactive/actions/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../../src/cli/interactive/actions/setup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1D;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+K9D"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../../src/cli/interactive/actions/setup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAE1C,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1D;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuK9D"}

package/dist/cli/interactive/actions/setup.js

@@ -29,8 +29,8 @@ export async function actionMCPSetup(lang) {
                 : 'No AI agent platforms detected');
             console.log('');
             console.log(c.dim(lang === 'zh-TW'
-                ? '  \u652F\u63F4\u5E73\u53F0: Claude Code, Cursor, OpenClaw, Codex, WorkBuddy, NemoClaw, ArkClaw, Claude Desktop'
-                : '  Supported: Claude Code, Cursor, OpenClaw, Codex, WorkBuddy, NemoClaw, ArkClaw, Claude Desktop'));
+                ? '  \u652F\u63F4\u5E73\u53F0: Claude Code, Cursor, OpenClaw, Codex, WorkBuddy, Claude Desktop'
+                : '  Supported: Claude Code, Cursor, OpenClaw, Codex, WorkBuddy, Claude Desktop'));
             return;
         }
         detectSp.succeed(lang === 'zh-TW'
@@ -101,14 +101,6 @@ export async function actionMCPSetup(lang) {
                 en: 'Close and reopen WorkBuddy',
                 zh: '\u95DC\u9589\u4E26\u91CD\u65B0\u958B\u555F WorkBuddy',
             },
-            nemoclaw: {
-                en: 'Close and reopen NemoClaw',
-                zh: '\u95DC\u9589\u4E26\u91CD\u65B0\u958B\u555F NemoClaw',
-            },
-            arkclaw: {
-                en: 'Close and reopen ArkClaw',
-                zh: '\u95DC\u9589\u4E26\u91CD\u65B0\u958B\u555F ArkClaw',
-            },
         };
         for (const p of unconfigured) {
             const hint = restartHints[p.id];