@praxis.guard/auditor-cli 0.0.32 → 0.0.34

package/dist/hooks/run-before-shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-before-shell.js","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AAErG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iDAAiD,EAAE,MAAM,gDAAgD,CAAC;AACnH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,mCAAmC,EACnC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAc9D,SAAS,gBAAgB,CAAC,IAAU;IAClC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAA4B,EAAE,YAAqB;IACpF,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,MAAM,OAAO,GAAG,MAAM,aAAa,EAA+B,CAAC;IACnE,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,iBAAiB,GAAG,iDAAiD,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC;QAClE,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,qFAAqF;QACrF,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QACvD,MAAM,mBAAmB,CACvB;YACE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,sBAAsB;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,UAAU;YACvB,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,OAAO;YACnB,cAAc,EAAE,KAAK;YACrB,OAAO,EAAE,CAAC,GAAG,UAAU,wBAAwB,CAAC;YAChD,UAAU;SACX,EACD,YAAY,CACb,CAAC;QAEF,MAAM,QAAQ,GAAiC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAExD,MAAM,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;QACtD,MAAM,cAAc,CAAC;YACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,UAAU;YACvB,IAAI,EAAE,cAAc;YACpB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;YAC7B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1D,MAAM,EAAE,UAAU;YAClB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,UAAU;YACV,SAAS,EAAE,YAAY,EAAE;YACzB,IAAI,EAAE,OAAO;YACb,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,EAAE;gBACJ,IAAI,EAAE,sBAAsB;gBAC5B,cAAc,EAAE,KAAK;aACtB;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE7D,IAAI,IAAI,GAAS,cAAc,CAAC,IAAI,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,cAAc,IAAI,iBAAiB;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE3D,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,iBAAiB,CAAC,IAAI,IAAI,KAAK,MAAM;QAAE,IAAI,GAAG,QAAQ,CAAC;IACpF,IAAI,KAAK,CAAC,eAAe;QAAE,IAAI,GAAG,aAAa,CAAC;IAEhD,MAAM,WAAW,GAAG,uBAAuB,CACzC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAC;IAEF,IAAI,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,UAAU,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/C,cAAc,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvF,IAAI,cAAc;YAAE,UAAU,GAAG,OAAO,CAAC;IAC3C,CAAC;IAED,IAAI,cAAc,GAAoD,IAAI,CAAC;IAC3E,IAAI,UAAU,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAClF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC;gBAC7C,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,YAAY,EAAE,OAAO;gBACrB,WAAW;gBACX,UAAU,EAAE,OAAO,CAAC,OAAO;gBAC3B,OAAO,EAAE,UAAU,EAAE;gBACrB,cAAc;gBACd,OAAO;gBACP,QAAQ,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;gBAC5C,MAAM,EAAE,CAAC;aACV,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC7D,cAAc,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBACvF,IAAI,cAAc,EAAE,CAAC;oBACnB,UAAU,GAAG,OAAO,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC1B,kBAAkB,GAAG,kCAAkC,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACjD,cAAc,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAClF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;gBACjD,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,OAAO,CAAC,OAAO;gBAC3B,cAAc;gBACd,OAAO;gBACP,OAAO,EAAE,UAAU,EAAE;gBACrB,WAAW;aACZ,CAAC,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,cAAc,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,mCAAmC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,MAAM,YAAY,GAChB,UAAU,KAAK,MAAM;QACnB,CAAC,CAAC,sBAAsB,CAAC;YACrB,IAAI,EAAE,sBAAsB;YAC5B,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,cAAc;SACf,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,QAAQ,GACZ,UAAU,KAAK,OAAO;QACpB,CAAC,CAAC;YACE,UAAU;YACV,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QACH,CAAC,CAAC;YACE,UAAU;YACV,YAAY,EAAE,YAAa,CAAC,YAAY;YACxC,aAAa,EAAE,YAAa,CAAC,aAAa;SAC3C,CAAC;IAER,MAAM,YAAY,GAAG,WAAW,CAAC;IACjC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IACvD,MAAM,mBAAmB,CACvB;QACE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI;QACJ,cAAc;QACd,KAAK;QACL,IAAI;QACJ,UAAU;QACV,cAAc;QACd,iBAAiB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;QACrD,OAAO;QACP,oBAAoB,EAAE,kBAAkB;QACxC,UAAU;KACX,EACD,YAAY,CACb,CAAC;IAEF,oFAAoF;IACpF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAExD,2DAA2D;IAC3D,MAAM,MAAM,GAAG,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,cAAc,CAAC;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,IAAI,EAAE,cAAc;QACpB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI;QAC1B,GAAG,EAAE,OAAO,CAAC,OAAO;QACpB,IAAI;QACJ,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACpD,UAAU;QACV,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,EAAE;YACJ,IAAI,EAAE,sBAAsB;YAC5B,cAAc;YACd,mBAAmB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;YACvD,oBAAoB,EAAE,kBAAkB;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,0DAA0D;QACxE,aAAa,EAAE,uBAAuB,MAAM,CAAC,GAAG,CAAC,EAAE;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"run-before-shell.js","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,mCAAmC,EACnC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAK5B,SAAS,gBAAgB,CAAC,IAAU;IAClC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,MAAM,OAAO,GAAG,MAAM,aAAa,EAA+B,CAAC;IACnE,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,YAAY,CAAC;QAC5E,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;QACtD,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,UAAU;YACV,cAAc;YACd,YAAY,EAAE,YAAY,IAAI,EAAE;YAChC,eAAe;SAChB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,WAAW,GAAG,uBAAuB,CACzC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAC;IAEF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,UAAU,EAAE,wBAAwB;YACpC,cAAc;YACd,YAAY,EAAE,WAAW;YACzB,eAAe;YACf,QAAQ;SACT,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/C,MAAM,IAAI,GAAS,QAAQ,CAAC,IAAI,CAAC;IAEjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtF,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,kBAAkB;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnG,IAAI,UAAU,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,cAAc,GAAoD,IAAI,CAAC;IAE3E,IAAI,UAAU,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,IAAI;YACJ,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,cAAc;YACd,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC/C,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,YAAY,GAAG,mCAAmC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,MAAM,YAAY,GAChB,UAAU,KAAK,MAAM;QACnB,CAAC,CAAC,sBAAsB,CAAC;YACrB,IAAI,EAAE,sBAAsB;YAC5B,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,cAAc;SACf,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,QAAQ,GACZ,UAAU,KAAK,OAAO;QACpB,CAAC,CAAC;YACE,UAAU;YACV,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QACH,CAAC,CAAC;YACE,UAAU;YACV,YAAY,EAAE,YAAa,CAAC,YAAY;YACxC,aAAa,EAAE,YAAa,CAAC,aAAa;SAC3C,CAAC;IAER,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IACvD,MAAM,mBAAmB,CACvB;QACE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI;QACJ,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,IAAI;QACJ,UAAU;QACV,cAAc;QACd,iBAAiB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;QACrD,OAAO;QACP,oBAAoB,EAAE,kBAAkB;QACxC,UAAU;KACX,EACD,WAAW,CACZ,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,cAAc,CAAC;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,IAAI,EAAE,cAAc;QACpB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI;QAC1B,GAAG,EAAE,OAAO,CAAC,OAAO;QACpB,IAAI;QACJ,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACpD,UAAU;QACV,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,EAAE;YACJ,IAAI,EAAE,sBAAsB;YAC5B,cAAc;YACd,mBAAmB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;YACvD,oBAAoB,EAAE,kBAAkB;YACxC,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;SAC9C;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,0DAA0D;QACxE,aAAa,EAAE,uBAAuB,MAAM,CAAC,GAAG,CAAC,EAAE;KACpD,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { loadPoliciesV1 } from "./policy/index.js";
 export type { PoliciesV1, Tier, Classification } from "./policy/index.js";
 export { appendAuditJsonl } from "./audit/jsonl.js";
-export { DEFAULT_SHELL_BRIDGE_TTL_MS, recordShellApprovalBridge, shellArgvApprovalId, shellBridgeDir, shouldRecordShellBridge, tryConsumeShellApprovalBridge, } from "./bridge/shell-approval-bridge.js";
-export { DEFAULT_GOVERNED_SHELL_TOOLS, evaluateArgv, evaluateMcpProposal, evaluateShellProposal, gateShellCommand, parseCommandToArgv, type GuardEvaluation, type GuardReason, type ShellGateDecision, } from "./shell/evaluate.js";
+export { DEFAULT_SHELL_BRIDGE_TTL_MS, recordShellApprovalBridge, shellApprovalFingerprintId, shellArgvApprovalId, shellBridgeDir, shouldRecordShellBridge, tryConsumeShellApprovalBridge, } from "./bridge/shell-approval-bridge.js";
+export { analyzeShellCommand, evaluateArgv, evaluateMcpProposal, evaluateShellProposal, gateShellCommand, listShellGovernedTools, parseCommandToArgv, commandMayContainGovernedTool, DEFAULT_GOVERNED_SHELL_TOOLS, type GuardEvaluation, type GuardReason, type ShellAnalysis, type ShellApprovalFingerprintPayload, type ShellGateDecision, } from "./shell/evaluate.js";
 export { failClosedHookErrorResponse, runBeforeShellHookFromStdin, type BeforeShellExecutionPayload, type BeforeShellExecutionResponse, } from "./hooks/run-before-shell.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,4BAA4B,EAC5B,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,GAClC,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,6BAA6B,EAC7B,4BAA4B,EAC5B,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,+BAA+B,EACpC,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,GAClC,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { loadPoliciesV1 } from "./policy/index.js";
 export { appendAuditJsonl } from "./audit/jsonl.js";
-export { DEFAULT_SHELL_BRIDGE_TTL_MS, recordShellApprovalBridge, shellArgvApprovalId, shellBridgeDir, shouldRecordShellBridge, tryConsumeShellApprovalBridge, } from "./bridge/shell-approval-bridge.js";
-export { DEFAULT_GOVERNED_SHELL_TOOLS, evaluateArgv, evaluateMcpProposal, evaluateShellProposal, gateShellCommand, parseCommandToArgv, } from "./shell/evaluate.js";
+export { DEFAULT_SHELL_BRIDGE_TTL_MS, recordShellApprovalBridge, shellApprovalFingerprintId, shellArgvApprovalId, shellBridgeDir, shouldRecordShellBridge, tryConsumeShellApprovalBridge, } from "./bridge/shell-approval-bridge.js";
+export { analyzeShellCommand, evaluateArgv, evaluateMcpProposal, evaluateShellProposal, gateShellCommand, listShellGovernedTools, parseCommandToArgv, commandMayContainGovernedTool, DEFAULT_GOVERNED_SHELL_TOOLS, } from "./shell/evaluate.js";
 export { failClosedHookErrorResponse, runBeforeShellHookFromStdin, } from "./hooks/run-before-shell.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,4BAA4B,EAC5B,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,GAInB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,6BAA6B,EAC7B,4BAA4B,GAM7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,6BAA6B,CAAC"}

package/dist/mcp/evaluate-guard.d.ts

@@ -0,0 +1,11 @@
+import { loadPoliciesV1 } from "../policy/index.js";
+import type { GuardInput } from "./guard-schemas.js";
+export type PolicyState = {
+    policy: Awaited<ReturnType<typeof loadPoliciesV1>>;
+    policyRevision: number | null;
+};
+export declare function evaluateGuard(input: GuardInput, policyState: PolicyState): Promise<{
+    response: Record<string, unknown>;
+    startedAt: number;
+}>;
+//# sourceMappingURL=evaluate-guard.d.ts.map

package/dist/mcp/evaluate-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AAavF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AA+CF,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA+HnE"}

package/dist/mcp/evaluate-guard.js

@@ -0,0 +1,159 @@
+import { v4 as uuidv4 } from "uuid";
+import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
+import { resolveGuardStorageRoot } from "../bridge/guard-storage-root.js";
+import { evaluateMcpProposal, evaluateShellProposal } from "../shell/evaluate.js";
+import { sendGuardEvent } from "../telemetry/guard-events.js";
+import { getInstallId } from "../cli/install-id.js";
+import { resolveGuardAuditStatus } from "./guard-audit-status.js";
+import { applyGuardMode, tierToPolicyDecision } from "./guard-mode.js";
+import { resetHeartbeatIdle } from "./guard-heartbeat.js";
+import { defaultApprovalBlock, resolveEnforceMutateApproval, } from "./guard-approval-block.js";
+function riskScore(skipped, tier) {
+    if (skipped)
+        return 0;
+    if (tier === "READ")
+        return 0;
+    if (tier === "MUTATE")
+        return 60;
+    return 95;
+}
+function resolveTierDecision(input) {
+    const { mode, skipped, tier } = input;
+    let enforceDecision = tierToPolicyDecision(tier, skipped);
+    const approvalBlock = defaultApprovalBlock();
+    if (skipped) {
+        return { enforceDecision: "allow", approvalBlock };
+    }
+    if (tier === "DESTRUCTIVE") {
+        return {
+            enforceDecision: "block",
+            approvalBlock: {
+                ...approvalBlock,
+                instructions: "DESTRUCTIVE actions cannot be approved via guard. Escalate outside the agent loop.",
+            },
+        };
+    }
+    if (tier === "READ") {
+        return { enforceDecision: "allow", approvalBlock };
+    }
+    if (mode === "shadow") {
+        return {
+            enforceDecision: "require_approval",
+            approvalBlock: {
+                ...approvalBlock,
+                instructions: "Shadow mode: no approval request created. Re-call with mode enforce to coordinate human approval.",
+            },
+        };
+    }
+    return { enforceDecision, approvalBlock };
+}
+export async function evaluateGuard(input, policyState) {
+    const startedAt = performance.now();
+    const event_id = uuidv4();
+    resetHeartbeatIdle();
+    policyState.policy = await loadPoliciesV1();
+    policyState.policyRevision = await readPoliciesV1Revision();
+    const storageRoot = resolveGuardStorageRoot(input.proposal.cwd);
+    const shellCommand = input.proposal.kind === "shell"
+        ? input.proposal.raw_command ?? input.proposal.argv.join(" ")
+        : null;
+    const shellResult = input.proposal.kind === "shell" && shellCommand
+        ? evaluateShellProposal(policyState.policy, shellCommand)
+        : null;
+    const mcpResult = input.proposal.kind === "mcp"
+        ? evaluateMcpProposal(policyState.policy, input.proposal.argv)
+        : null;
+    const skipped = shellResult?.skipped ?? mcpResult?.skipped ?? true;
+    const evaluation = shellResult?.evaluation ?? mcpResult.evaluation;
+    const analysis = shellResult?.analysis;
+    const argv = evaluation.argv;
+    const tier = evaluation.tier;
+    const reasons = [...evaluation.reasons];
+    const policyReasons = [...evaluation.reasons];
+    let { enforceDecision, approvalBlock } = resolveTierDecision({
+        mode: input.mode,
+        skipped,
+        tier,
+    });
+    let approvalRequestId = null;
+    if (!skipped &&
+        tier !== "DESTRUCTIVE" &&
+        tier !== "READ" &&
+        input.mode === "enforce") {
+        const mutate = await resolveEnforceMutateApproval({
+            guardInput: input,
+            argv,
+            storageRoot,
+            eventId: event_id,
+            policyRevision: policyState.policyRevision,
+            reasons,
+            approval_fingerprint: analysis?.approval_fingerprint_payload ?? null,
+        });
+        enforceDecision = mutate.enforceDecision;
+        approvalBlock = mutate.approvalBlock;
+        approvalRequestId = mutate.approvalRequestId;
+    }
+    const { decision, shadow } = applyGuardMode({
+        mode: input.mode,
+        skipped,
+        tier,
+        policyReasons,
+        enforceDecision,
+    });
+    const response = {
+        mode: input.mode,
+        decision,
+        skipped,
+        tier,
+        risk_score: riskScore(skipped, tier),
+        reasons,
+        shadow,
+        approval: approvalBlock,
+        audit: {
+            event_id,
+            timestamp: new Date().toISOString(),
+            latency_ms: performance.now() - startedAt,
+        },
+        execution: {
+            attempted: false,
+            result: null,
+        },
+    };
+    const firstReason = reasons.find((r) => typeof r?.message === "string")?.message ??
+        reasons.find((r) => typeof r?.code === "string")?.code ??
+        null;
+    const actionVerb = argv[1] ?? null;
+    const actionResource = argv.length > 2 ? argv.slice(2).join(" ") : null;
+    const status = resolveGuardAuditStatus({ skipped, decision });
+    void sendGuardEvent({
+        ts: new Date().toISOString(),
+        status,
+        skipped,
+        ...(skipped
+            ? {
+                skip_reason: input.proposal.kind === "shell" ? "no_governed_invocation" : "mcp_policy_unmatched",
+            }
+            : {}),
+        tool: "auditor-mcp",
+        command_path: argv[0] ?? null,
+        verb: actionVerb,
+        resource: actionResource,
+        reason: firstReason,
+        cmd: shellCommand ?? argv.join(" "),
+        tier,
+        decision,
+        latency_ms: performance.now() - startedAt,
+        event_id,
+        installId: getInstallId(),
+        kind: input.proposal.kind,
+        ...(policyState.policyRevision !== null
+            ? { policy_revision: policyState.policyRevision }
+            : {}),
+        ...(approvalRequestId ? { approval_request_id: approvalRequestId } : {}),
+        meta: {
+            invocation_count: analysis?.invocations.length ?? null,
+        },
+    });
+    return { response, startedAt };
+}
+//# sourceMappingURL=evaluate-guard.js.map

package/dist/mcp/evaluate-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,2BAA2B,CAAC;AAQnC,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAU;IAC7C,IAAI,OAAO;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,oFAAoF;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,mGAAmG;aACtG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,WAAwB;IAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAC1B,kBAAkB,EAAE,CAAC;IAErB,WAAW,CAAC,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAE5D,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,YAAY,GAChB,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC7B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY;QAC7C,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;QAC3B,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC;IACnE,MAAM,UAAU,GAAG,WAAW,EAAE,UAAU,IAAI,SAAU,CAAC,UAAU,CAAC;IACpE,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAE7B,MAAM,IAAI,GAAS,UAAU,CAAC,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC;QAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;KACL,CAAC,CAAC;IACH,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAE5C,IACE,CAAC,OAAO;QACR,IAAI,KAAK,aAAa;QACtB,IAAI,KAAK,MAAM;QACf,KAAK,CAAC,IAAI,KAAK,SAAS,EACxB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,UAAU,EAAE,KAAK;YACjB,IAAI;YACJ,WAAW;YACX,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,OAAO;YACP,oBAAoB,EAAE,QAAQ,EAAE,4BAA4B,IAAI,IAAI;SACrE,CAAC,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;QACJ,aAAa;QACb,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QACpC,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE;YACL,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;SAC1C;QACD,SAAS,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IAEF,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;QACtD,IAAI,CAAC;IACP,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9D,KAAK,cAAc,CAAC;QAClB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,OAAO;QACP,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,WAAW,EACT,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB;aACtF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;QACzC,QAAQ;QACR,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACzB,GAAG,CAAC,WAAW,CAAC,cAAc,KAAK,IAAI;YACrC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,cAAc,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,EAAE;YACJ,gBAAgB,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;SACvD;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/dist/mcp/guard-approval-block.d.ts

@@ -0,0 +1,27 @@
+import type { GuardDecision } from "./guard-mode.js";
+import type { GuardInput } from "./guard-schemas.js";
+export type ApprovalBlock = {
+    required: boolean;
+    request_id: string | null;
+    expires_at: string | null;
+    open_url: string | null;
+    instructions: string | null;
+    redeemed: boolean;
+    approved_by: string | null;
+};
+export declare function defaultApprovalBlock(): ApprovalBlock;
+export declare function approvalBlockNoToken(): ApprovalBlock;
+export declare function resolveEnforceMutateApproval(input: {
+    guardInput: GuardInput;
+    argv: string[];
+    storageRoot: string;
+    eventId: string;
+    policyRevision: number | null;
+    reasons: unknown[];
+    approval_fingerprint?: import("../shell/analyze-command.js").ShellApprovalFingerprintPayload | null;
+}): Promise<{
+    enforceDecision: GuardDecision;
+    approvalBlock: ApprovalBlock;
+    approvalRequestId: string | null;
+}>;
+//# sourceMappingURL=guard-approval-block.d.ts.map

package/dist/mcp/guard-approval-block.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-approval-block.d.ts","sourceRoot":"","sources":["../../src/mcp/guard-approval-block.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,wBAAgB,oBAAoB,IAAI,aAAa,CAUpD;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAWpD;AAuFD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,oBAAoB,CAAC,EAAE,OAAO,6BAA6B,EAAE,+BAA+B,GAAG,IAAI,CAAC;CACrG,GAAG,OAAO,CAAC;IACV,eAAe,EAAE,aAAa,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC,CA2DD"}

package/dist/mcp/guard-approval-block.js

@@ -0,0 +1,155 @@
+import { resolveGuardToken } from "../cli/credentials.js";
+import { resolveMutateApproval } from "../approval/mcp-flow.js";
+export function defaultApprovalBlock() {
+    return {
+        required: false,
+        request_id: null,
+        expires_at: null,
+        open_url: null,
+        instructions: null,
+        redeemed: false,
+        approved_by: null,
+    };
+}
+export function approvalBlockNoToken() {
+    return {
+        required: true,
+        request_id: null,
+        expires_at: null,
+        open_url: null,
+        instructions: "MUTATE requires human approval. Run `auditor login` (or set PRAXIS_GUARD_TOKEN), then call guard again.",
+        redeemed: false,
+        approved_by: null,
+    };
+}
+function approvalBlockFromOutcome(outcome, fallbackRequestId) {
+    if (outcome.kind === "allow") {
+        if (!outcome.ticketRecorded) {
+            return {
+                enforceDecision: "require_approval",
+                approvalRequestId: outcome.request_id,
+                approvalBlock: {
+                    required: true,
+                    request_id: outcome.request_id,
+                    expires_at: null,
+                    open_url: null,
+                    instructions: "Approval redeemed but execution ticket was not written under .cursor/guard/tickets. Fix permissions and call guard_wait again.",
+                    redeemed: false,
+                    approved_by: outcome.approved_by,
+                },
+            };
+        }
+        return {
+            enforceDecision: "allow",
+            approvalRequestId: outcome.request_id,
+            approvalBlock: {
+                required: false,
+                request_id: outcome.request_id,
+                expires_at: null,
+                open_url: null,
+                instructions: "Approval redeemed; retry the same shell/MCP invocation (hook consumes execution ticket).",
+                redeemed: outcome.redeemed,
+                approved_by: outcome.approved_by,
+            },
+        };
+    }
+    if (outcome.kind === "credential_not_recorded") {
+        return {
+            enforceDecision: "require_approval",
+            approvalRequestId: outcome.request_id,
+            approvalBlock: {
+                required: true,
+                request_id: outcome.request_id,
+                expires_at: null,
+                open_url: null,
+                instructions: `${outcome.message} Hooks will deny until a credential is recorded; retry guard after fixing local write permissions.`,
+                redeemed: false,
+                approved_by: null,
+            },
+        };
+    }
+    if (outcome.kind === "require_approval") {
+        return {
+            enforceDecision: "require_approval",
+            approvalRequestId: outcome.request_id,
+            approvalBlock: {
+                required: true,
+                request_id: outcome.request_id,
+                expires_at: outcome.expires_at,
+                open_url: outcome.open_url,
+                instructions: "Human must approve in the Praxis app (or dev: `auditor approvals approve <id>`). Prefer guard_wait with context.approval.request_id and context.wait_ms, then retry once.",
+                redeemed: false,
+                approved_by: null,
+            },
+        };
+    }
+    return {
+        enforceDecision: "require_approval",
+        approvalRequestId: null,
+        approvalBlock: {
+            required: true,
+            request_id: fallbackRequestId,
+            expires_at: null,
+            open_url: null,
+            instructions: `Approval backend error: ${outcome.message}. Hooks will deny MUTATE until resolved.`,
+            redeemed: false,
+            approved_by: null,
+        },
+    };
+}
+export async function resolveEnforceMutateApproval(input) {
+    const { guardInput, argv, storageRoot, eventId, policyRevision, reasons } = input;
+    if (!resolveGuardToken()) {
+        reasons.push({
+            code: "approval_backend_unavailable",
+            message: "No guard token; cannot create approval request.",
+        });
+        return {
+            enforceDecision: "require_approval",
+            approvalBlock: approvalBlockNoToken(),
+            approvalRequestId: null,
+        };
+    }
+    const outcome = await resolveMutateApproval({
+        argv,
+        proposalKind: guardInput.proposal.kind,
+        storageRoot,
+        rawDisplay: guardInput.proposal.raw_command ?? argv.join(" "),
+        eventId,
+        policyRevision,
+        reasons,
+        sessionId: guardInput.context?.session_id ?? null,
+        environment: guardInput.context?.environment ?? null,
+        approval: guardInput.context?.approval ?? null,
+        waitMs: guardInput.context?.wait_ms ?? null,
+        tool_input_sha256: guardInput.context?.tool_input_sha256 ?? null,
+        approval_fingerprint: input.approval_fingerprint ?? null,
+    });
+    const mapped = approvalBlockFromOutcome(outcome, guardInput.context?.approval?.request_id ?? null);
+    if (outcome.kind === "allow" && outcome.ticketRecorded) {
+        reasons.push({
+            code: "execution_ticket_recorded",
+            message: "Recorded signed execution ticket for hooks (same argv within TTL).",
+        });
+    }
+    else if (outcome.kind === "allow" && !outcome.ticketRecorded) {
+        reasons.push({
+            code: "hook_credential_not_recorded",
+            message: "Execution ticket file was not recorded for hooks.",
+        });
+    }
+    else if (outcome.kind === "credential_not_recorded") {
+        reasons.push({
+            code: "hook_credential_not_recorded",
+            message: outcome.message,
+        });
+    }
+    else if (outcome.kind === "backend_unavailable") {
+        reasons.push({
+            code: "approval_backend_unavailable",
+            message: outcome.message,
+        });
+    }
+    return mapped;
+}
+//# sourceMappingURL=guard-approval-block.js.map

package/dist/mcp/guard-approval-block.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-approval-block.js","sourceRoot":"","sources":["../../src/mcp/guard-approval-block.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAA2B,MAAM,yBAAyB,CAAC;AAczF,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,YAAY,EACV,yGAAyG;QAC3G,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAA2B,EAC3B,iBAAgC;IAEhC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO;gBACL,eAAe,EAAE,kBAAkB;gBACnC,iBAAiB,EAAE,OAAO,CAAC,UAAU;gBACrC,aAAa,EAAE;oBACb,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,IAAI;oBACd,YAAY,EACV,gIAAgI;oBAClI,QAAQ,EAAE,KAAK;oBACf,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,iBAAiB,EAAE,OAAO,CAAC,UAAU;YACrC,aAAa,EAAE;gBACb,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;gBACd,YAAY,EACV,0FAA0F;gBAC5F,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAC/C,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,iBAAiB,EAAE,OAAO,CAAC,UAAU;YACrC,aAAa,EAAE;gBACb,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,GAAG,OAAO,CAAC,OAAO,oGAAoG;gBACpI,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,IAAI;aAClB;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACxC,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,iBAAiB,EAAE,OAAO,CAAC,UAAU;YACrC,aAAa,EAAE;gBACb,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EACV,2KAA2K;gBAC7K,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,IAAI;aAClB;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,eAAe,EAAE,kBAAkB;QACnC,iBAAiB,EAAE,IAAI;QACvB,aAAa,EAAE;YACb,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,iBAAiB;YAC7B,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,2BAA2B,OAAO,CAAC,OAAO,0CAA0C;YAClG,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,IAAI;SAClB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAQlD;IAKC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAElF,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE,oBAAoB,EAAE;YACrC,iBAAiB,EAAE,IAAI;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,IAAI;QACJ,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI;QACtC,WAAW;QACX,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,OAAO;QACP,cAAc;QACd,OAAO;QACP,SAAS,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;QACjD,WAAW,EAAE,UAAU,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI;QACpD,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI;QAC9C,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI;QAC3C,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,IAAI,IAAI;QAChE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;KACzD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,wBAAwB,CACrC,OAAO,EACP,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,CACjD,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/mcp/guard-heartbeat.d.ts

@@ -0,0 +1,6 @@
+/** Reset adaptive heartbeat backoff after guard tool activity. */
+export declare function resetHeartbeatIdle(): void;
+export declare function sendGuardHeartbeat(): Promise<void>;
+/** Send an initial heartbeat and schedule periodic idle heartbeats. */
+export declare function startGuardHeartbeatLoop(): void;
+//# sourceMappingURL=guard-heartbeat.d.ts.map

package/dist/mcp/guard-heartbeat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-heartbeat.d.ts","sourceRoot":"","sources":["../../src/mcp/guard-heartbeat.ts"],"names":[],"mappings":"AA6BA,kEAAkE;AAClE,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmCxD;AAED,uEAAuE;AACvE,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C"}

package/dist/mcp/guard-heartbeat.js

@@ -0,0 +1,68 @@
+import { resolveGuardToken } from "../cli/credentials.js";
+import { getInstallId } from "../cli/install-id.js";
+import { AUDITOR_CLI_VERSION } from "../runtime/version.js";
+import { prodFunctionUrl } from "../cli/function-url.js";
+const DEFAULT_HEARTBEAT_URL = prodFunctionUrl("guardHeartbeat");
+const HEARTBEAT_BASE_INTERVAL_MS = 5 * 60 * 1000;
+const HEARTBEAT_MAX_INTERVAL_MS = 30 * 60 * 1000;
+let heartbeatTimer = null;
+let consecutiveIdleHeartbeats = 0;
+function getNextHeartbeatInterval() {
+    if (consecutiveIdleHeartbeats < 3)
+        return HEARTBEAT_BASE_INTERVAL_MS;
+    return Math.min(HEARTBEAT_BASE_INTERVAL_MS * Math.pow(1.5, consecutiveIdleHeartbeats - 2), HEARTBEAT_MAX_INTERVAL_MS);
+}
+function scheduleNextHeartbeat() {
+    if (heartbeatTimer)
+        clearTimeout(heartbeatTimer);
+    heartbeatTimer = setTimeout(async () => {
+        consecutiveIdleHeartbeats++;
+        await sendGuardHeartbeat();
+        scheduleNextHeartbeat();
+    }, getNextHeartbeatInterval());
+}
+/** Reset adaptive heartbeat backoff after guard tool activity. */
+export function resetHeartbeatIdle() {
+    consecutiveIdleHeartbeats = 0;
+}
+export async function sendGuardHeartbeat() {
+    const heartbeatUrl = process.env.PRAXIS_GUARD_HEARTBEAT_URL || DEFAULT_HEARTBEAT_URL;
+    const token = resolveGuardToken();
+    if (!token)
+        return;
+    const payload = {
+        installId: getInstallId(),
+        kind: "auditor-mcp",
+        version: AUDITOR_CLI_VERSION,
+        status: "running",
+        client: {
+            os: process.platform,
+            arch: process.arch,
+            node: process.version,
+        },
+    };
+    try {
+        const res = await fetch(heartbeatUrl, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(3000),
+        });
+        if (!res.ok) {
+            process.stderr.write(`[auditor:mcp] heartbeat failed (${res.status}).\n`);
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[auditor:mcp] heartbeat error: ${msg}\n`);
+    }
+}
+/** Send an initial heartbeat and schedule periodic idle heartbeats. */
+export function startGuardHeartbeatLoop() {
+    void sendGuardHeartbeat();
+    scheduleNextHeartbeat();
+}
+//# sourceMappingURL=guard-heartbeat.js.map

package/dist/mcp/guard-heartbeat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-heartbeat.js","sourceRoot":"","sources":["../../src/mcp/guard-heartbeat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,qBAAqB,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAEhE,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,IAAI,cAAc,GAAyC,IAAI,CAAC;AAChE,IAAI,yBAAyB,GAAG,CAAC,CAAC;AAElC,SAAS,wBAAwB;IAC/B,IAAI,yBAAyB,GAAG,CAAC;QAAE,OAAO,0BAA0B,CAAC;IACrE,OAAO,IAAI,CAAC,GAAG,CACb,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,GAAG,CAAC,CAAC,EACzE,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,cAAc;QAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACjD,cAAc,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;QACrC,yBAAyB,EAAE,CAAC;QAC5B,MAAM,kBAAkB,EAAE,CAAC;QAC3B,qBAAqB,EAAE,CAAC;IAC1B,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB;IAChC,yBAAyB,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,qBAAqB,CAAC;IACrF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE;YACN,EAAE,EAAE,OAAO,CAAC,QAAQ;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,OAAO;SACtB;KACF,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uBAAuB;IACrC,KAAK,kBAAkB,EAAE,CAAC;IAC1B,qBAAqB,EAAE,CAAC;AAC1B,CAAC"}

package/dist/mcp/guard-schemas.d.ts

@@ -0,0 +1,42 @@
+import { z } from "zod";
+export declare const GuardModeSchema: z.ZodEnum<{
+    shadow: "shadow";
+    enforce: "enforce";
+}>;
+export declare const ProposalKindSchema: z.ZodEnum<{
+    shell: "shell";
+    mcp: "mcp";
+}>;
+export declare const GuardInputSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        shadow: "shadow";
+        enforce: "enforce";
+    }>;
+    proposal: z.ZodObject<{
+        kind: z.ZodEnum<{
+            shell: "shell";
+            mcp: "mcp";
+        }>;
+        argv: z.ZodArray<z.ZodString>;
+        cwd: z.ZodOptional<z.ZodString>;
+        raw_command: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    context: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodOptional<z.ZodString>;
+        session_id: z.ZodOptional<z.ZodString>;
+        trace_id: z.ZodOptional<z.ZodString>;
+        agent_id: z.ZodOptional<z.ZodString>;
+        user_id: z.ZodOptional<z.ZodString>;
+        environment: z.ZodOptional<z.ZodString>;
+        approval: z.ZodOptional<z.ZodObject<{
+            request_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            grant: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>;
+        wait_ms: z.ZodOptional<z.ZodNumber>;
+        tool_input_sha256: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type GuardInput = z.infer<typeof GuardInputSchema>;
+export declare const GUARD_TOOL_DESCRIPTION: string;
+export declare const GUARD_WAIT_TOOL_DESCRIPTION: string;
+//# sourceMappingURL=guard-schemas.d.ts.map

package/dist/mcp/guard-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-schemas.d.ts","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;EAAgC,CAAC;AAC7D,eAAO,MAAM,kBAAkB;;;EAA2B,CAAC;AAS3D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,sBAAsB,QAI8E,CAAC;AAElH,eAAO,MAAM,2BAA2B,QAGyE,CAAC"}

package/dist/mcp/guard-schemas.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+export const GuardModeSchema = z.enum(["shadow", "enforce"]);
+export const ProposalKindSchema = z.enum(["shell", "mcp"]);
+const ApprovalContextSchema = z
+    .object({
+    request_id: z.string().nullable().optional(),
+    grant: z.string().nullable().optional(),
+})
+    .optional();
+export const GuardInputSchema = z.object({
+    mode: GuardModeSchema,
+    proposal: z.object({
+        kind: ProposalKindSchema,
+        argv: z.array(z.string()).min(1),
+        cwd: z.string().optional(),
+        raw_command: z.string().optional(),
+    }),
+    context: z
+        .object({
+        provider: z.string().optional(),
+        session_id: z.string().optional(),
+        trace_id: z.string().optional(),
+        agent_id: z.string().optional(),
+        user_id: z.string().optional(),
+        environment: z.string().optional(),
+        approval: ApprovalContextSchema,
+        wait_ms: z.number().int().nonnegative().optional(),
+        tool_input_sha256: z.string().nullable().optional(),
+    })
+        .optional(),
+});
+export const GUARD_TOOL_DESCRIPTION = "Policy gatekeeper for agent actions. Evaluates a proposal argv against policies.v1.json. " +
+    "Required `mode`: `shadow` (dry-run — response `decision` is always `allow`; see `shadow` for the policy verdict) " +
+    "or `enforce` (coordination — real `allow` / `require_approval` / `block`; runs human approval for MUTATE). " +
+    "For MUTATE after approval, pass `context.approval.request_id` (and optional `grant`) from the app or dev CLI.";
+export const GUARD_WAIT_TOOL_DESCRIPTION = "Poll until a MUTATE approval request is approved, redeem grant, and record a signed execution ticket for hooks. " +
+    "Uses enforce semantics (approval backend). Prefer this over a separate `guard` + retry. " +
+    "Set `context.wait_ms` (e.g. 120000) and `context.approval.request_id` from hook deny or a prior `guard` call.";
+//# sourceMappingURL=guard-schemas.js.map

package/dist/mcp/guard-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-schemas.js","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IACF,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GACjC,2FAA2F;IAC3F,mHAAmH;IACnH,6GAA6G;IAC7G,+GAA+G,CAAC;AAElH,MAAM,CAAC,MAAM,2BAA2B,GACtC,kHAAkH;IAClH,0FAA0F;IAC1F,+GAA+G,CAAC"}