@pixelzx/genesis 2026.5.3-2 → 2026.5.3-3

package/dist/embeddings-http-DI8wVPpp.js

@@ -1,205 +0,0 @@
-import { i as formatErrorMessage } from "./errors-Jbvi20TW.js";
-import { a as normalizeLowercaseStringOrEmpty, c as normalizeOptionalString } from "./string-coerce-C1IzJjqi.js";
-import { a as logWarn } from "./logger-DxTAquCB.js";
-import { a as loadConfig } from "./io-CRPT2IUI.js";
-import { y as resolveAgentDir } from "./agent-scope-CDjZLqNk.js";
-import "./config-DcheqK7J.js";
-import { t as resolveMemorySearchConfig } from "./memory-search-a-Znc7EF.js";
-import { n as listMemoryEmbeddingProviders, t as getMemoryEmbeddingProvider } from "./memory-embedding-provider-runtime-CnhYOzPo.js";
-import { c as resolveAgentIdForRequest, l as resolveAgentIdFromModel, p as resolveOpenAiCompatibleHttpOperatorScopes, s as getHeader, x as sendJson } from "./http-utils-CSMhLOmU.js";
-import { t as handleGatewayPostJsonEndpoint } from "./http-endpoint-helpers-BKYK0lXJ.js";
-import { Buffer } from "node:buffer";
-//#region src/gateway/embeddings-http.ts
-const DEFAULT_EMBEDDINGS_BODY_BYTES = 5 * 1024 * 1024;
-const MAX_EMBEDDING_INPUTS = 128;
-const MAX_EMBEDDING_INPUT_CHARS = 8192;
-const MAX_EMBEDDING_TOTAL_CHARS = 65536;
-function coerceRequest(value) {
-	return value && typeof value === "object" ? value : {};
-}
-function resolveInputTexts(input) {
-	if (typeof input === "string") return [input];
-	if (!Array.isArray(input)) return null;
-	if (input.every((entry) => typeof entry === "string")) return input;
-	return null;
-}
-function encodeEmbeddingBase64(embedding) {
-	const float32 = Float32Array.from(embedding);
-	return Buffer.from(float32.buffer).toString("base64");
-}
-function validateInputTexts(texts) {
-	if (texts.length > MAX_EMBEDDING_INPUTS) return `Too many inputs (max ${MAX_EMBEDDING_INPUTS}).`;
-	let totalChars = 0;
-	for (const text of texts) {
-		if (text.length > MAX_EMBEDDING_INPUT_CHARS) return `Input too long (max ${MAX_EMBEDDING_INPUT_CHARS} chars).`;
-		totalChars += text.length;
-		if (totalChars > MAX_EMBEDDING_TOTAL_CHARS) return `Total input too large (max ${MAX_EMBEDDING_TOTAL_CHARS} chars).`;
-	}
-}
-function resolveAutoExplicitProviders(cfg) {
-	return new Set(listMemoryEmbeddingProviders(cfg).filter((adapter) => adapter.allowExplicitWhenConfiguredAuto).map((adapter) => adapter.id));
-}
-function shouldContinueAutoSelection(adapter, err) {
-	return adapter.shouldContinueAutoSelection?.(err) ?? false;
-}
-async function createConfiguredEmbeddingProvider(params) {
-	const createWithAdapter = async (adapter) => {
-		return (await adapter.create({
-			config: params.cfg,
-			agentDir: params.agentDir,
-			model: params.model || adapter.defaultModel || "",
-			local: params.memorySearch?.local,
-			remote: params.memorySearch?.remote ? {
-				baseUrl: params.memorySearch?.remote.baseUrl,
-				apiKey: params.memorySearch?.remote.apiKey,
-				headers: params.memorySearch?.remote.headers
-			} : void 0,
-			outputDimensionality: params.memorySearch?.outputDimensionality
-		})).provider;
-	};
-	if (params.provider === "auto") {
-		const adapters = listMemoryEmbeddingProviders(params.cfg).filter((adapter) => typeof adapter.autoSelectPriority === "number").toSorted((a, b) => (a.autoSelectPriority ?? Number.MAX_SAFE_INTEGER) - (b.autoSelectPriority ?? Number.MAX_SAFE_INTEGER));
-		for (const adapter of adapters) try {
-			const provider = await createWithAdapter(adapter);
-			if (provider) return provider;
-		} catch (err) {
-			if (shouldContinueAutoSelection(adapter, err)) continue;
-			throw err;
-		}
-		throw new Error("No embeddings provider available.");
-	}
-	const adapter = getMemoryEmbeddingProvider(params.provider, params.cfg);
-	if (!adapter) throw new Error(`Unknown memory embedding provider: ${params.provider}`);
-	const provider = await createWithAdapter(adapter);
-	if (!provider) throw new Error(`Memory embedding provider ${params.provider} is unavailable.`);
-	return provider;
-}
-function resolveEmbeddingsTarget(params) {
-	const raw = params.requestModel.trim();
-	const slash = raw.indexOf("/");
-	if (slash === -1) return {
-		provider: params.configuredProvider,
-		model: raw
-	};
-	const provider = normalizeLowercaseStringOrEmpty(raw.slice(0, slash));
-	const model = raw.slice(slash + 1).trim();
-	if (!model) return { errorMessage: "Unsupported embedding model reference." };
-	if (params.configuredProvider === "auto") {
-		const safeAutoExplicitProviders = resolveAutoExplicitProviders(params.cfg);
-		if (provider === "auto") return {
-			provider: "auto",
-			model
-		};
-		if (safeAutoExplicitProviders.has(provider)) return {
-			provider,
-			model
-		};
-		return { errorMessage: "This agent does not allow that embedding provider on `/v1/embeddings`." };
-	}
-	if (provider !== params.configuredProvider) return { errorMessage: "This agent does not allow that embedding provider on `/v1/embeddings`." };
-	return {
-		provider: params.configuredProvider,
-		model
-	};
-}
-async function handleOpenAiEmbeddingsHttpRequest(req, res, opts) {
-	const handled = await handleGatewayPostJsonEndpoint(req, res, {
-		pathname: "/v1/embeddings",
-		requiredOperatorMethod: "chat.send",
-		resolveOperatorScopes: resolveOpenAiCompatibleHttpOperatorScopes,
-		auth: opts.auth,
-		trustedProxies: opts.trustedProxies,
-		allowRealIpFallback: opts.allowRealIpFallback,
-		rateLimiter: opts.rateLimiter,
-		maxBodyBytes: opts.maxBodyBytes ?? DEFAULT_EMBEDDINGS_BODY_BYTES
-	});
-	if (handled === false) return false;
-	if (!handled) return true;
-	const payload = coerceRequest(handled.body);
-	const requestModel = normalizeOptionalString(payload.model) ?? "";
-	if (!requestModel) {
-		sendJson(res, 400, { error: {
-			message: "Missing `model`.",
-			type: "invalid_request_error"
-		} });
-		return true;
-	}
-	const cfg = loadConfig();
-	if (requestModel !== "genesis" && !resolveAgentIdFromModel(requestModel, cfg)) {
-		sendJson(res, 400, { error: {
-			message: "Invalid `model`. Use `genesis` or `genesis/<agentId>`.",
-			type: "invalid_request_error"
-		} });
-		return true;
-	}
-	const texts = resolveInputTexts(payload.input);
-	if (!texts) {
-		sendJson(res, 400, { error: {
-			message: "`input` must be a string or an array of strings.",
-			type: "invalid_request_error"
-		} });
-		return true;
-	}
-	const inputError = validateInputTexts(texts);
-	if (inputError) {
-		sendJson(res, 400, { error: {
-			message: inputError,
-			type: "invalid_request_error"
-		} });
-		return true;
-	}
-	const agentId = resolveAgentIdForRequest({
-		req,
-		model: requestModel
-	});
-	const agentDir = resolveAgentDir(cfg, agentId);
-	const memorySearch = resolveMemorySearchConfig(cfg, agentId);
-	const configuredProvider = memorySearch?.provider ?? "openai";
-	const target = resolveEmbeddingsTarget({
-		requestModel: normalizeOptionalString(getHeader(req, "x-genesis-model")) || normalizeOptionalString(memorySearch?.model) || "",
-		configuredProvider,
-		cfg
-	});
-	if ("errorMessage" in target) {
-		sendJson(res, 400, { error: {
-			message: target.errorMessage,
-			type: "invalid_request_error"
-		} });
-		return true;
-	}
-	try {
-		const embeddings = await (await createConfiguredEmbeddingProvider({
-			cfg,
-			agentDir,
-			provider: target.provider,
-			model: target.model,
-			memorySearch: memorySearch ? {
-				...memorySearch,
-				outputDimensionality: typeof payload.dimensions === "number" && payload.dimensions > 0 ? Math.floor(payload.dimensions) : memorySearch.outputDimensionality
-			} : void 0
-		})).embedBatch(texts);
-		const encodingFormat = payload.encoding_format === "base64" ? "base64" : "float";
-		sendJson(res, 200, {
-			object: "list",
-			data: embeddings.map((embedding, index) => ({
-				object: "embedding",
-				index,
-				embedding: encodingFormat === "base64" ? encodeEmbeddingBase64(embedding) : embedding
-			})),
-			model: requestModel,
-			usage: {
-				prompt_tokens: 0,
-				total_tokens: 0
-			}
-		});
-	} catch (err) {
-		logWarn(`openai-compat: embeddings request failed: ${formatErrorMessage(err)}`);
-		sendJson(res, 500, { error: {
-			message: "internal error",
-			type: "api_error"
-		} });
-	}
-	return true;
-}
-//#endregion
-export { handleOpenAiEmbeddingsHttpRequest };

package/dist/exec-approvals-cli-CElurcBk.js

@@ -1,498 +0,0 @@
-import { i as formatErrorMessage } from "./errors-Jbvi20TW.js";
-import { c as normalizeOptionalString } from "./string-coerce-C1IzJjqi.js";
-import { n as defaultRuntime } from "./runtime-CQ7eH0le.js";
-import { t as sanitizeForLog } from "./ansi-BZHMLcUk.js";
-import { t as formatDocsLink } from "./links-DmsJCU7L.js";
-import { n as isRich, r as theme } from "./theme-BrRleVfL.js";
-import { l as readBestEffortConfig } from "./io-CRPT2IUI.js";
-import "./config-DcheqK7J.js";
-import { j as saveExecApprovals, y as readExecApprovalsSnapshot } from "./exec-approvals-DzvbuePF.js";
-import { n as formatTimeAgo } from "./format-relative-DBI0ON8M.js";
-import { n as callGatewayFromCli } from "./gateway-rpc-E2ZcD2Pb.js";
-import { n as renderTable, t as getTerminalTableWidth } from "./table-C9qqU5my.js";
-import { t as collectExecPolicyScopeSnapshots } from "./exec-approvals-effective-oieH1iZY.js";
-import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-B284aspW.js";
-import fs from "node:fs/promises";
-import JSON5 from "json5";
-//#region src/cli/exec-approvals-cli.ts
-const APPROVALS_GET_DEFAULT_TIMEOUT_MS = 6e4;
-async function readStdin() {
-	const chunks = [];
-	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-	return Buffer.concat(chunks).toString("utf8");
-}
-async function resolveTargetNodeId(opts) {
-	if (opts.gateway) return null;
-	const raw = normalizeOptionalString(opts.node) ?? "";
-	if (!raw) return null;
-	return await resolveNodeId(opts, raw);
-}
-async function loadSnapshot(opts, nodeId) {
-	return await callGatewayFromCli(nodeId ? "exec.approvals.node.get" : "exec.approvals.get", opts, nodeId ? { nodeId } : {});
-}
-function loadSnapshotLocal() {
-	const snapshot = readExecApprovalsSnapshot();
-	return {
-		path: snapshot.path,
-		exists: snapshot.exists,
-		hash: snapshot.hash,
-		file: snapshot.file
-	};
-}
-function saveSnapshotLocal(file) {
-	saveExecApprovals(file);
-	return loadSnapshotLocal();
-}
-async function loadSnapshotTarget(opts) {
-	if (!opts.gateway && !opts.node) return {
-		snapshot: loadSnapshotLocal(),
-		nodeId: null,
-		source: "local"
-	};
-	const nodeId = await resolveTargetNodeId(opts);
-	return {
-		snapshot: await loadSnapshot(opts, nodeId),
-		nodeId,
-		source: nodeId ? "node" : "gateway"
-	};
-}
-function exitWithError(message) {
-	defaultRuntime.error(message);
-	defaultRuntime.exit(1);
-	throw new Error(message);
-}
-function requireTrimmedNonEmpty(value, message) {
-	const trimmed = value.trim();
-	if (!trimmed) exitWithError(message);
-	return trimmed;
-}
-async function loadWritableSnapshotTarget(opts) {
-	const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
-	if (source === "local") defaultRuntime.log(theme.muted("Writing local approvals."));
-	const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
-	const baseHash = snapshot.hash;
-	if (!baseHash) exitWithError("Exec approvals hash missing; reload and retry.");
-	return {
-		snapshot,
-		nodeId,
-		source,
-		targetLabel,
-		baseHash
-	};
-}
-async function saveSnapshotTargeted(params) {
-	const next = params.source === "local" ? saveSnapshotLocal(params.file) : await saveSnapshot(params.opts, params.nodeId, params.file, params.baseHash);
-	if (params.opts.json) {
-		defaultRuntime.writeJson(next, 0);
-		return;
-	}
-	defaultRuntime.log(theme.muted(`Target: ${params.targetLabel}`));
-	renderApprovalsSnapshot(next, params.targetLabel);
-}
-function formatCliError(err) {
-	const msg = formatErrorMessage(err);
-	const safe = sanitizeForLog(msg.includes("\n") ? msg.split("\n")[0] : msg);
-	return safe.length > 300 ? `${safe.slice(0, 300)}...` : safe;
-}
-async function loadConfigForApprovalsTarget(params) {
-	try {
-		if (params.source === "local") return {
-			config: await readBestEffortConfig(),
-			timedOut: false
-		};
-		const snapshot = await callGatewayFromCli("config.get", params.opts, {});
-		return {
-			config: snapshot.config && typeof snapshot.config === "object" ? snapshot.config : null,
-			timedOut: false
-		};
-	} catch (err) {
-		return {
-			config: null,
-			timedOut: /^gateway timeout after \d+ms\b/i.test(formatCliError(err))
-		};
-	}
-}
-function buildEffectivePolicyReport(params) {
-	const cfg = params.configLoad.config;
-	const timeoutNote = params.configLoad.timedOut ? "Config fetch timed out. Re-run with a higher --timeout to inspect Effective Policy." : null;
-	if (params.source === "node") {
-		if (!cfg) return {
-			scopes: [],
-			note: timeoutNote ?? "Gateway config unavailable. Node output above shows host approvals state only, and final runtime policy still intersects with gateway tools.exec."
-		};
-		return {
-			scopes: collectExecPolicyScopeSnapshots({
-				cfg,
-				approvals: params.approvals,
-				hostPath: params.hostPath
-			}),
-			note: "Effective exec policy is the node host approvals file intersected with gateway tools.exec policy."
-		};
-	}
-	if (!cfg) return {
-		scopes: [],
-		note: timeoutNote ?? "Config unavailable."
-	};
-	return {
-		scopes: collectExecPolicyScopeSnapshots({
-			cfg,
-			approvals: params.approvals,
-			hostPath: params.hostPath
-		}),
-		note: "Effective exec policy is the host approvals file intersected with requested tools.exec policy."
-	};
-}
-function renderEffectivePolicy(params) {
-	const rich = isRich();
-	const heading = (text) => rich ? theme.heading(text) : text;
-	const muted = (text) => rich ? theme.muted(text) : text;
-	if (params.report.scopes.length === 0 && !params.report.note) return;
-	defaultRuntime.log("");
-	defaultRuntime.log(heading("Effective Policy"));
-	if (params.report.scopes.length === 0) {
-		defaultRuntime.log(muted(params.report.note ?? "No effective policy details available."));
-		return;
-	}
-	const rows = params.report.scopes.map((summary) => ({
-		Scope: summary.scopeLabel,
-		Requested: `security=${summary.security.requested} (${summary.security.requestedSource})\nask=${summary.ask.requested} (${summary.ask.requestedSource})`,
-		Host: `security=${summary.security.host} (${summary.security.hostSource})\nask=${summary.ask.host} (${summary.ask.hostSource})\naskFallback=${summary.askFallback.effective} (${summary.askFallback.source})`,
-		Effective: `security=${summary.security.effective}\nask=${summary.ask.effective}`,
-		Notes: `${summary.security.note}; ${summary.ask.note}`
-	}));
-	defaultRuntime.log(renderTable({
-		width: getTerminalTableWidth(),
-		columns: [
-			{
-				key: "Scope",
-				header: "Scope",
-				minWidth: 12
-			},
-			{
-				key: "Requested",
-				header: "Requested",
-				minWidth: 24,
-				flex: true
-			},
-			{
-				key: "Host",
-				header: "Host",
-				minWidth: 24,
-				flex: true
-			},
-			{
-				key: "Effective",
-				header: "Effective",
-				minWidth: 16
-			},
-			{
-				key: "Notes",
-				header: "Notes",
-				minWidth: 20,
-				flex: true
-			}
-		],
-		rows
-	}).trimEnd());
-	defaultRuntime.log("");
-	defaultRuntime.log(muted(`Precedence: ${params.report.note}`));
-}
-function renderApprovalsSnapshot(snapshot, targetLabel) {
-	const rich = isRich();
-	const heading = (text) => rich ? theme.heading(text) : text;
-	const muted = (text) => rich ? theme.muted(text) : text;
-	const tableWidth = getTerminalTableWidth();
-	const file = snapshot.file ?? { version: 1 };
-	const defaults = file.defaults ?? {};
-	const defaultsParts = [
-		defaults.security ? `security=${defaults.security}` : null,
-		defaults.ask ? `ask=${defaults.ask}` : null,
-		defaults.askFallback ? `askFallback=${defaults.askFallback}` : null,
-		typeof defaults.autoAllowSkills === "boolean" ? `autoAllowSkills=${defaults.autoAllowSkills ? "on" : "off"}` : null
-	].filter(Boolean);
-	const agents = file.agents ?? {};
-	const allowlistRows = [];
-	const now = Date.now();
-	for (const [agentId, agent] of Object.entries(agents)) {
-		const allowlist = Array.isArray(agent.allowlist) ? agent.allowlist : [];
-		for (const entry of allowlist) {
-			const pattern = normalizeOptionalString(entry?.pattern) ?? "";
-			if (!pattern) continue;
-			const lastUsedAt = typeof entry.lastUsedAt === "number" ? entry.lastUsedAt : null;
-			allowlistRows.push({
-				Target: targetLabel,
-				Agent: agentId,
-				Pattern: pattern,
-				LastUsed: lastUsedAt ? formatTimeAgo(Math.max(0, now - lastUsedAt)) : muted("unknown")
-			});
-		}
-	}
-	const summaryRows = [
-		{
-			Field: "Target",
-			Value: targetLabel
-		},
-		{
-			Field: "Path",
-			Value: snapshot.path
-		},
-		{
-			Field: "Exists",
-			Value: snapshot.exists ? "yes" : "no"
-		},
-		{
-			Field: "Hash",
-			Value: snapshot.hash
-		},
-		{
-			Field: "Version",
-			Value: String(file.version ?? 1)
-		},
-		{
-			Field: "Socket",
-			Value: file.socket?.path ?? "default"
-		},
-		{
-			Field: "Defaults",
-			Value: defaultsParts.length > 0 ? defaultsParts.join(", ") : "none"
-		},
-		{
-			Field: "Agents",
-			Value: String(Object.keys(agents).length)
-		},
-		{
-			Field: "Allowlist",
-			Value: String(allowlistRows.length)
-		}
-	];
-	defaultRuntime.log(heading("Approvals"));
-	defaultRuntime.log(renderTable({
-		width: tableWidth,
-		columns: [{
-			key: "Field",
-			header: "Field",
-			minWidth: 8
-		}, {
-			key: "Value",
-			header: "Value",
-			minWidth: 24,
-			flex: true
-		}],
-		rows: summaryRows
-	}).trimEnd());
-	if (allowlistRows.length === 0) {
-		defaultRuntime.log("");
-		defaultRuntime.log(muted("No allowlist entries."));
-		return;
-	}
-	defaultRuntime.log("");
-	defaultRuntime.log(heading("Allowlist"));
-	defaultRuntime.log(renderTable({
-		width: tableWidth,
-		columns: [
-			{
-				key: "Target",
-				header: "Target",
-				minWidth: 10
-			},
-			{
-				key: "Agent",
-				header: "Agent",
-				minWidth: 8
-			},
-			{
-				key: "Pattern",
-				header: "Pattern",
-				minWidth: 20,
-				flex: true
-			},
-			{
-				key: "LastUsed",
-				header: "Last Used",
-				minWidth: 10
-			}
-		],
-		rows: allowlistRows
-	}).trimEnd());
-}
-async function saveSnapshot(opts, nodeId, file, baseHash) {
-	return await callGatewayFromCli(nodeId ? "exec.approvals.node.set" : "exec.approvals.set", opts, nodeId ? {
-		nodeId,
-		file,
-		baseHash
-	} : {
-		file,
-		baseHash
-	});
-}
-function resolveAgentKey(value) {
-	const trimmed = normalizeOptionalString(value) ?? "";
-	return trimmed ? trimmed : "*";
-}
-function normalizeAllowlistEntry(entry) {
-	const pattern = normalizeOptionalString(entry?.pattern) ?? "";
-	return pattern ? pattern : null;
-}
-function ensureAgent(file, agentKey) {
-	const agents = file.agents ?? {};
-	const entry = agents[agentKey] ?? {};
-	file.agents = agents;
-	return entry;
-}
-function isEmptyAgent(agent) {
-	const allowlist = Array.isArray(agent.allowlist) ? agent.allowlist : [];
-	return !agent.security && !agent.ask && !agent.askFallback && agent.autoAllowSkills === void 0 && allowlist.length === 0;
-}
-async function loadWritableAllowlistAgent(opts) {
-	const { snapshot, nodeId, source, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
-	const file = snapshot.file ?? { version: 1 };
-	file.version = 1;
-	const agentKey = resolveAgentKey(opts.agent);
-	const agent = ensureAgent(file, agentKey);
-	return {
-		nodeId,
-		source,
-		targetLabel,
-		baseHash,
-		file,
-		agentKey,
-		agent,
-		allowlistEntries: Array.isArray(agent.allowlist) ? agent.allowlist : []
-	};
-}
-async function runAllowlistMutation(pattern, opts, mutate) {
-	try {
-		const trimmedPattern = requireTrimmedNonEmpty(pattern, "Pattern required.");
-		const context = await loadWritableAllowlistAgent(opts);
-		if (!await mutate({
-			...context,
-			trimmedPattern
-		})) return;
-		await saveSnapshotTargeted({
-			opts,
-			source: context.source,
-			nodeId: context.nodeId,
-			file: context.file,
-			baseHash: context.baseHash,
-			targetLabel: context.targetLabel
-		});
-	} catch (err) {
-		defaultRuntime.error(formatCliError(err));
-		defaultRuntime.exit(1);
-	}
-}
-function registerAllowlistMutationCommand(params) {
-	const command = params.allowlist.command(`${params.name} <pattern>`).description(params.description).option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).option("--agent <id>", "Agent id (defaults to \"*\")").action(async (pattern, opts) => {
-		await runAllowlistMutation(pattern, opts, params.mutate);
-	});
-	nodesCallOpts(command);
-	return command;
-}
-function registerExecApprovalsCli(program) {
-	const formatExample = (cmd, desc) => `  ${theme.command(cmd)}\n    ${theme.muted(desc)}`;
-	const approvals = program.command("approvals").alias("exec-approvals").description("Manage exec approvals (gateway or node host)").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/approvals", "docs.genesis.ai/cli/approvals")}\n`);
-	nodesCallOpts(approvals.command("get").description("Fetch exec approvals snapshot").option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).action(async (opts) => {
-		try {
-			const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
-			const effectivePolicy = buildEffectivePolicyReport({
-				configLoad: await loadConfigForApprovalsTarget({
-					opts,
-					source
-				}),
-				source,
-				approvals: snapshot.file,
-				hostPath: snapshot.path
-			});
-			if (opts.json) {
-				defaultRuntime.writeJson({
-					...snapshot,
-					effectivePolicy
-				}, 0);
-				return;
-			}
-			const muted = (text) => isRich() ? theme.muted(text) : text;
-			if (source === "local") {
-				defaultRuntime.log(muted("Showing local approvals."));
-				defaultRuntime.log("");
-			}
-			renderApprovalsSnapshot(snapshot, source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway");
-			renderEffectivePolicy({ report: effectivePolicy });
-		} catch (err) {
-			defaultRuntime.error(formatCliError(err));
-			defaultRuntime.exit(1);
-		}
-	}), { timeoutMs: APPROVALS_GET_DEFAULT_TIMEOUT_MS });
-	nodesCallOpts(approvals.command("set").description("Replace exec approvals with a JSON file").option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).option("--file <path>", "Path to JSON file to upload").option("--stdin", "Read JSON from stdin", false).action(async (opts) => {
-		try {
-			if (!opts.file && !opts.stdin) exitWithError("Provide --file or --stdin.");
-			if (opts.file && opts.stdin) exitWithError("Use either --file or --stdin (not both).");
-			const { source, nodeId, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
-			const raw = opts.stdin ? await readStdin() : await fs.readFile(String(opts.file), "utf8");
-			let file;
-			try {
-				file = JSON5.parse(raw);
-			} catch (err) {
-				exitWithError(`Failed to parse approvals JSON: ${String(err)}`);
-			}
-			file.version = 1;
-			await saveSnapshotTargeted({
-				opts,
-				source,
-				nodeId,
-				file,
-				baseHash,
-				targetLabel
-			});
-		} catch (err) {
-			defaultRuntime.error(formatCliError(err));
-			defaultRuntime.exit(1);
-		}
-	}));
-	const allowlist = approvals.command("allowlist").description("Edit the per-agent allowlist").addHelpText("after", () => `\n${theme.heading("Examples:")}\n${formatExample("genesis approvals allowlist add \"~/Projects/**/bin/rg\"", "Allowlist a local binary pattern for the main agent.")}\n${formatExample("genesis approvals allowlist add --agent main --node <id|name|ip> \"/usr/bin/uptime\"", "Allowlist on a specific node/agent.")}\n${formatExample("genesis approvals allowlist add --agent \"*\" \"/usr/bin/uname\"", "Allowlist for all agents (wildcard).")}\n${formatExample("genesis approvals allowlist remove \"~/Projects/**/bin/rg\"", "Remove an allowlist pattern.")}\n\n${theme.muted("Docs:")} ${formatDocsLink("/cli/approvals", "docs.genesis.ai/cli/approvals")}\n`);
-	registerAllowlistMutationCommand({
-		allowlist,
-		name: "add",
-		description: "Add a glob pattern to an allowlist",
-		mutate: ({ trimmedPattern, file, agent, agentKey, allowlistEntries }) => {
-			if (allowlistEntries.some((entry) => normalizeAllowlistEntry(entry) === trimmedPattern)) {
-				defaultRuntime.log("Already allowlisted.");
-				return false;
-			}
-			allowlistEntries.push({
-				pattern: trimmedPattern,
-				lastUsedAt: Date.now()
-			});
-			agent.allowlist = allowlistEntries;
-			file.agents = {
-				...file.agents,
-				[agentKey]: agent
-			};
-			return true;
-		}
-	});
-	registerAllowlistMutationCommand({
-		allowlist,
-		name: "remove",
-		description: "Remove a glob pattern from an allowlist",
-		mutate: ({ trimmedPattern, file, agent, agentKey, allowlistEntries }) => {
-			const nextEntries = allowlistEntries.filter((entry) => normalizeAllowlistEntry(entry) !== trimmedPattern);
-			if (nextEntries.length === allowlistEntries.length) {
-				defaultRuntime.log("Pattern not found.");
-				return false;
-			}
-			if (nextEntries.length === 0) delete agent.allowlist;
-			else agent.allowlist = nextEntries;
-			if (isEmptyAgent(agent)) {
-				const agents = { ...file.agents };
-				delete agents[agentKey];
-				file.agents = Object.keys(agents).length > 0 ? agents : void 0;
-			} else file.agents = {
-				...file.agents,
-				[agentKey]: agent
-			};
-			return true;
-		}
-	});
-}
-//#endregion
-export { registerExecApprovalsCli };