@praxis.guard/auditor-cli 0.0.44 → 0.0.46

package/dist/adapters/claude-code.js

@@ -1,247 +1,2 @@
-import { existsSync } from "node:fs";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-const MCP_SERVER_KEY = "praxis-guard";
-const AGENT_HOST = "claude-code";
-const HOOK_COMMAND = "auditor hook claude-code";
-/**
- * Resolve the Claude Code global config file path (~/.claude.json).
- *
- * Set `PRAXIS_CLAUDE_CODE_SETTINGS` to override (used by tests).
- */
-export function claudeCodeSettingsPath() {
-    const override = process.env.PRAXIS_CLAUDE_CODE_SETTINGS?.trim();
-    if (override)
-        return override;
-    return path.join(os.homedir(), ".claude.json");
-}
-/**
- * Resolve the Claude Code install directory used for detection.
- * When PRAXIS_CLAUDE_CODE_SETTINGS is set (test mode), use its parent dir
- * so detectInstalled() stays hermetic in tests.
- */
-function claudeCodeInstallDir() {
-    const override = process.env.PRAXIS_CLAUDE_CODE_SETTINGS?.trim();
-    if (override)
-        return path.dirname(override);
-    return path.join(os.homedir(), ".claude");
-}
-async function readJson(pathname) {
-    try {
-        const raw = await readFile(pathname, "utf8");
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new Error("JSON root must be an object");
-        }
-        return parsed;
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        if (e.code === "ENOENT")
-            return null;
-        throw new Error([
-            `Invalid JSON at ${pathname}: ${msg}`,
-            "Refusing to overwrite existing file.",
-            "Fix the JSON manually or back up the file and re-run setup.",
-        ].join(" "));
-    }
-}
-/**
- * Atomic write: write to a temp file then rename into place.
- * Prevents partial writes from corrupting ~/.claude.json.
- */
-async function writeJsonAtomic(pathname, data) {
-    const dir = path.dirname(pathname);
-    await mkdir(dir, { recursive: true });
-    const tmp = path.join(dir, `.${path.basename(pathname)}.tmp.${Date.now()}`);
-    try {
-        await writeFile(tmp, `${JSON.stringify(data, null, 2)}\n`, "utf8");
-        await rename(tmp, pathname);
-    }
-    catch (e) {
-        // Best-effort cleanup of the temp file on failure.
-        await writeFile(tmp, "", "utf8").catch(() => undefined);
-        throw e;
-    }
-}
-function hasConfiguredMcpServer(config) {
-    if (!config)
-        return false;
-    const servers = (config.mcpServers ?? {});
-    const server = servers[MCP_SERVER_KEY];
-    if (!server || typeof server !== "object")
-        return false;
-    const map = server;
-    if (map.command !== "auditor")
-        return false;
-    if (!Array.isArray(map.args) || map.args.length !== 1 || map.args[0] !== "mcp")
-        return false;
-    const env = map.env;
-    if (!env || typeof env !== "object")
-        return false;
-    return env.PRAXIS_AGENT_HOST === AGENT_HOST;
-}
-function hasConfiguredPreToolUseHook(config) {
-    if (!config)
-        return false;
-    const hooks = config.hooks;
-    if (!hooks || typeof hooks !== "object" || Array.isArray(hooks))
-        return false;
-    const preToolUse = hooks.PreToolUse;
-    if (!Array.isArray(preToolUse))
-        return false;
-    return preToolUse.some((entry) => {
-        if (!entry || typeof entry !== "object")
-            return false;
-        const e = entry;
-        if (e.matcher !== "Bash")
-            return false;
-        const innerHooks = e.hooks;
-        if (!Array.isArray(innerHooks))
-            return false;
-        return innerHooks.some((h) => {
-            if (!h || typeof h !== "object")
-                return false;
-            return h.command === HOOK_COMMAND;
-        });
-    });
-}
-/**
- * ClaudeCodeAdapter: hook (PreToolUse on Bash) + MCP, both in ~/.claude.json.
- *
- * Unlike ClaudeDesktopAdapter (MCP-only), Claude Code exposes a PreToolUse hook that
- * fires before every Bash tool call, giving Praxis shell governance.
- *
- * IMPORTANT — hook output format:
- * Verify the exact format with a test script before relying on this adapter in production.
- * Run docs/auditor-cli-claude-code-hook-format-test.sh and confirm Claude Code blocks.
- * If the format is wrong, edit HOOK_BLOCK_RESPONSE in run-claude-code-pre-tool-use.ts.
- *
- * Binary path:
- * The hook config uses the bare "auditor" command (consistent with Cursor's adapter),
- * NOT an absolute path. Absolute paths break with mise/nvm node version upgrades.
- * At setup time we warn if auditor is not on PATH, but do not abort.
- *
- * See docs/auditor-cli-multi-agent-adapter-design.md.
- */
-export class ClaudeCodeAdapter {
-    id = "claude-code";
-    label = "Claude Code";
-    detectInstalled() {
-        return existsSync(claudeCodeInstallDir());
-    }
-    async upsertHook(opts) {
-        const dryRun = opts.dryRun ?? false;
-        const cfgPath = opts.explicitPath?.trim() || claudeCodeSettingsPath();
-        const existing = await readJson(cfgPath);
-        const before = JSON.stringify(existing ?? {});
-        const config = existing ? JSON.parse(JSON.stringify(existing)) : {};
-        if (!config.hooks || typeof config.hooks !== "object" || Array.isArray(config.hooks)) {
-            config.hooks = {};
-        }
-        const hooksMap = config.hooks;
-        if (!Array.isArray(hooksMap.PreToolUse)) {
-            hooksMap.PreToolUse = [];
-        }
-        const preToolUse = hooksMap.PreToolUse;
-        // Remove any existing Praxis PreToolUse[Bash] entry (idempotent upsert).
-        const filtered = preToolUse.filter((entry) => {
-            if (!entry || typeof entry !== "object")
-                return true;
-            const e = entry;
-            if (e.matcher !== "Bash")
-                return true;
-            const innerHooks = e.hooks;
-            if (!Array.isArray(innerHooks))
-                return true;
-            return !innerHooks.some((h) => {
-                if (!h || typeof h !== "object")
-                    return false;
-                return h.command === HOOK_COMMAND;
-            });
-        });
-        filtered.push({
-            matcher: "Bash",
-            hooks: [{ type: "command", command: HOOK_COMMAND }],
-        });
-        hooksMap.PreToolUse = filtered;
-        const changed = before !== JSON.stringify(config);
-        if (changed && !dryRun) {
-            await writeJsonAtomic(cfgPath, config);
-        }
-        return {
-            path: cfgPath,
-            changed,
-            message: changed
-                ? dryRun
-                    ? "would update Claude Code hook config (PreToolUse)"
-                    : "updated Claude Code hook config (PreToolUse)"
-                : "Claude Code hook config already up to date",
-        };
-    }
-    async upsertMcp(opts) {
-        const dryRun = opts.dryRun ?? false;
-        const cfgPath = opts.explicitPath?.trim() || claudeCodeSettingsPath();
-        const existing = await readJson(cfgPath);
-        const before = JSON.stringify(existing ?? {});
-        const config = existing ? JSON.parse(JSON.stringify(existing)) : {};
-        if (!config.mcpServers || typeof config.mcpServers !== "object" || Array.isArray(config.mcpServers)) {
-            config.mcpServers = {};
-        }
-        const servers = config.mcpServers;
-        const existingEntry = servers[MCP_SERVER_KEY] && typeof servers[MCP_SERVER_KEY] === "object"
-            ? servers[MCP_SERVER_KEY]
-            : {};
-        const existingEnv = existingEntry.env && typeof existingEntry.env === "object" && !Array.isArray(existingEntry.env)
-            ? existingEntry.env
-            : {};
-        servers[MCP_SERVER_KEY] = {
-            ...existingEntry,
-            command: "auditor",
-            args: ["mcp"],
-            env: { ...existingEnv, PRAXIS_AGENT_HOST: AGENT_HOST },
-        };
-        const changed = before !== JSON.stringify(config);
-        if (changed && !dryRun) {
-            await writeJsonAtomic(cfgPath, config);
-        }
-        return {
-            path: cfgPath,
-            changed,
-            message: changed
-                ? dryRun
-                    ? "would update Claude Code MCP config"
-                    : "updated Claude Code MCP config"
-                : "Claude Code MCP config already up to date",
-        };
-    }
-    async status(opts) {
-        const cfgPath = opts?.mcpConfigPath?.trim() || claudeCodeSettingsPath();
-        const config = await readJson(cfgPath).catch(() => null);
-        const hookConfigured = hasConfiguredPreToolUseHook(config);
-        const mcpConfigured = hasConfiguredMcpServer(config);
-        // Claude Code has one hook (PreToolUse) covering all tool calls.
-        // Report shell=true when PreToolUse is configured; mcp=true mirrors it
-        // (no separate MCP hook needed) so adapterReady() passes correctly.
-        const hook = {
-            global: {
-                shell: hookConfigured,
-                mcp: hookConfigured,
-                path: cfgPath,
-            },
-        };
-        const warnings = [];
-        if (hookConfigured && !mcpConfigured) {
-            warnings.push("Hook is configured but MCP is not. " +
-                "MUTATE approvals require both. Run: auditor setup mcp --for=claude-code");
-        }
-        return {
-            installed: this.detectInstalled(),
-            hook,
-            mcp: { configured: mcpConfigured, path: cfgPath },
-            warnings,
-        };
-    }
-}
+export { ClaudeCodeAdapter, claudeCodeSettingsPath } from "./claude-code/index.js";
 //# sourceMappingURL=claude-code.js.map

package/dist/adapters/claude-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/adapters/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAY7B,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAIhD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAiB,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb;YACE,mBAAmB,QAAQ,KAAK,GAAG,EAAE;YACrC,sCAAsC;YACtC,6DAA6D;SAC9D,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,mDAAmD;QACnD,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAsB;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAY,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,MAAiB,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,OAAQ,GAAe,CAAC,iBAAiB,KAAK,UAAU,CAAC;AAC3D,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAsB;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,UAAU,GAAI,KAAiB,CAAC,UAAU,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,CAAC,GAAG,KAAgB,CAAC;QAC3B,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC9C,OAAQ,CAAa,CAAC,OAAO,KAAK,YAAY,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,iBAAiB;IACnB,EAAE,GAAG,aAAsB,CAAC;IAC5B,KAAK,GAAG,aAAa,CAAC;IAE/B,eAAe;QACb,OAAO,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAoB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAY,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAE1F,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACrF,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAgB,CAAC;QAEzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,UAAU,GAAG,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAuB,CAAC;QAEpD,yEAAyE;QACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACrD,MAAM,CAAC,GAAG,KAAgB,CAAC;YAC3B,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC9C,OAAQ,CAAa,CAAC,OAAO,KAAK,YAAY,CAAC;YACjD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO;YACP,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,8CAA8C;gBAClD,CAAC,CAAC,4CAA4C;SACjD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAmB;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAY,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAqB,CAAC;QAC7C,MAAM,aAAa,GACjB,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ;YACpE,CAAC,CAAE,OAAO,CAAC,cAAc,CAAa;YACtC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,WAAW,GACf,aAAa,CAAC,GAAG,IAAI,OAAO,aAAa,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC;YAC7F,CAAC,CAAE,aAAa,CAAC,GAAe;YAChC,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,GAAG;YACxB,GAAG,aAAa;YAChB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,GAAG,EAAE,EAAE,GAAG,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE;SACvD,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO;YACP,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,gCAAgC;gBACpC,CAAC,CAAC,2CAA2C;SAChD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB;QAC5B,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAErD,iEAAiE;QACjE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,IAAI,GAAe;YACvB,MAAM,EAAE;gBACN,KAAK,EAAE,cAAc;gBACrB,GAAG,EAAE,cAAc;gBACnB,IAAI,EAAE,OAAO;aACd;SACF,CAAC;QAEF,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,cAAc,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CACX,qCAAqC;gBACnC,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;YACjC,IAAI;YACJ,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE;YACjD,QAAQ;SACT,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/adapters/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/adapters/codex.d.ts

@@ -0,0 +1,11 @@
+import type { AgentAdapter, AgentStatus, SetupResult, StatusOpts, UpsertHookOpts, UpsertMcpOpts } from "./types.js";
+export declare class CodexAdapter implements AgentAdapter {
+    readonly id: "codex";
+    readonly label = "Codex";
+    readonly preferredHookScope: "project";
+    detectInstalled(): boolean;
+    upsertHook(opts: UpsertHookOpts): Promise<SetupResult>;
+    upsertMcp(opts: UpsertMcpOpts): Promise<SetupResult>;
+    status(opts?: StatusOpts): Promise<AgentStatus>;
+}
+//# sourceMappingURL=codex.d.ts.map

package/dist/adapters/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/adapters/codex.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,cAAc,EACd,aAAa,EACd,MAAM,YAAY,CAAC;AAMpB,qBAAa,YAAa,YAAW,YAAY;IAC/C,QAAQ,CAAC,EAAE,EAAG,OAAO,CAAU;IAC/B,QAAQ,CAAC,KAAK,WAAW;IACzB,QAAQ,CAAC,kBAAkB,EAAG,SAAS,CAAU;IAEjD,eAAe,IAAI,OAAO;IAI1B,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAItD,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAI9C,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;CAoCtD"}

package/dist/adapters/codex.js

@@ -0,0 +1,52 @@
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { readCodexSetupStatus, upsertCodexConfig, upsertCodexHooks, } from "../codex/config.js";
+function codexHomeDir() {
+    return process.env.CODEX_HOME?.trim() || path.join(os.homedir(), ".codex");
+}
+export class CodexAdapter {
+    id = "codex";
+    label = "Codex";
+    preferredHookScope = "project";
+    detectInstalled() {
+        return existsSync(codexHomeDir());
+    }
+    upsertHook(opts) {
+        return upsertCodexHooks(opts.projectDir || process.cwd(), opts.dryRun);
+    }
+    upsertMcp(opts) {
+        return upsertCodexConfig(opts.projectDir || process.cwd(), opts.dryRun);
+    }
+    async status(opts) {
+        const projectDir = opts?.projectDir || process.cwd();
+        const codex = await readCodexSetupStatus(projectDir);
+        const warnings = [];
+        if (codex.preToolUseConfigured && !codex.permissionRequestConfigured) {
+            warnings.push("PreToolUse is configured but PermissionRequest is missing. Run: auditor setup hook --for=codex --project " +
+                projectDir);
+        }
+        if ((codex.preToolUseConfigured || codex.permissionRequestConfigured) && !codex.mcpConfigured) {
+            warnings.push("Hooks are configured but MCP is missing. Run: auditor setup mcp --for=codex --project " +
+                projectDir);
+        }
+        if (!codex.agentsGuidancePresent) {
+            warnings.push("AGENTS.md is recommended for repo-local Codex guidance.");
+        }
+        return {
+            installed: this.detectInstalled() || existsSync(path.join(projectDir, ".codex")),
+            hook: {
+                project: {
+                    shell: codex.preToolUseConfigured,
+                    mcp: codex.permissionRequestConfigured,
+                    path: codex.hooksPath,
+                    shellLabel: "PreToolUse",
+                    mcpLabel: "PermissionRequest",
+                },
+            },
+            mcp: { configured: codex.mcpConfigured, path: codex.configPath },
+            warnings,
+        };
+    }
+}
+//# sourceMappingURL=codex.js.map

package/dist/adapters/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/adapters/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAW5B,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,OAAO,YAAY;IACd,EAAE,GAAG,OAAgB,CAAC;IACtB,KAAK,GAAG,OAAO,CAAC;IAChB,kBAAkB,GAAG,SAAkB,CAAC;IAEjD,eAAe;QACb,OAAO,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,IAAoB;QAC7B,OAAO,gBAAgB,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,SAAS,CAAC,IAAmB;QAC3B,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB;QAC5B,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CACX,2GAA2G;gBACzG,UAAU,CACb,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9F,QAAQ,CAAC,IAAI,CACX,wFAAwF;gBACtF,UAAU,CACb,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAChF,IAAI,EAAE;gBACJ,OAAO,EAAE;oBACP,KAAK,EAAE,KAAK,CAAC,oBAAoB;oBACjC,GAAG,EAAE,KAAK,CAAC,2BAA2B;oBACtC,IAAI,EAAE,KAAK,CAAC,SAAS;oBACrB,UAAU,EAAE,YAAY;oBACxB,QAAQ,EAAE,mBAAmB;iBAC9B;aACF;YACD,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE;YAChE,QAAQ;SACT,CAAC;IACJ,CAAC;CACF"}

package/dist/adapters/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/adapters/registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,YAAY,EAI/C,CAAC;AAEF,wBAAgB,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,YAAY,CAIpD;AAED,uDAAuD;AACvD,wBAAgB,uBAAuB,IAAI,YAAY,EAAE,CAQxD"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/adapters/registry.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,YAAY,EAK/C,CAAC;AAEF,wBAAgB,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,YAAY,CAIpD;AAED,uDAAuD;AACvD,wBAAgB,uBAAuB,IAAI,YAAY,EAAE,CAQxD"}

package/dist/adapters/registry.js

@@ -1,5 +1,6 @@
 import { ClaudeCodeAdapter } from "./claude-code.js";
 import { ClaudeDesktopAdapter } from "./claude-desktop.js";
+import { CodexAdapter } from "./codex.js";
 import { CursorAdapter } from "./cursor.js";
 /**
  * The set of agent adapters known to the CLI. Adding a new host is one append
@@ -9,6 +10,7 @@ export const ALL_ADAPTERS = [
     new CursorAdapter(),
     new ClaudeDesktopAdapter(),
     new ClaudeCodeAdapter(),
+    new CodexAdapter(),
 ];
 export function getAdapter(id) {
     const found = ALL_ADAPTERS.find((a) => a.id === id);

package/dist/adapters/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/adapters/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAA4B;IACnD,IAAI,aAAa,EAAE;IACnB,IAAI,oBAAoB,EAAE;IAC1B,IAAI,iBAAiB,EAAE;CACxB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,EAAW;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB;IACrC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,eAAe,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/adapters/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAA4B;IACnD,IAAI,aAAa,EAAE;IACnB,IAAI,oBAAoB,EAAE;IAC1B,IAAI,iBAAiB,EAAE;IACvB,IAAI,YAAY,EAAE;CACnB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,EAAW;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB;IACrC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,eAAe,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/select-targets.js

@@ -1,5 +1,5 @@
 import { ALL_ADAPTERS, getAdapter } from "./registry.js";
-const VALID_IDS = ["cursor", "claude-desktop", "claude-code"];
+const VALID_IDS = ["cursor", "claude-desktop", "claude-code", "codex"];
 /**
  * Parse repeated `--for=<agent>` flags from a setup command's argv tail.
  *
@@ -15,7 +15,7 @@ export function parseForFlag(args) {
         if (arg === "--for") {
             const value = args[i + 1];
             if (!value)
-                throw new Error("Missing value for --for (expected: cursor | claude-desktop | claude-code)");
+                throw new Error("Missing value for --for (expected: cursor | claude-desktop | claude-code | codex)");
             assertValidAgentId(value);
             forIds.push(value);
             i++;
@@ -24,7 +24,7 @@ export function parseForFlag(args) {
         if (arg.startsWith("--for=")) {
             const value = arg.slice("--for=".length);
             if (!value)
-                throw new Error("Missing value for --for= (expected: cursor | claude-desktop | claude-code)");
+                throw new Error("Missing value for --for= (expected: cursor | claude-desktop | claude-code | codex)");
             assertValidAgentId(value);
             forIds.push(value);
             continue;

package/dist/adapters/select-targets.js.map

@@ -1 +1 @@
-{"version":3,"file":"select-targets.js","sourceRoot":"","sources":["../../src/adapters/select-targets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGzD,MAAM,SAAS,GAAuB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;YACzG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;YAC1G,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAE,SAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAmB;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,eAAe,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"select-targets.js","sourceRoot":"","sources":["../../src/adapters/select-targets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGzD,MAAM,SAAS,GAAuB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAE3F;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;YACjH,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;YAClH,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAE,SAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAmB;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,eAAe,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9C,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/dist/adapters/types.d.ts

@@ -6,7 +6,7 @@
  * `upsertHook` and `upsertCloud` are optional — hosts that don't support pre-tool hooks
  * (e.g. Claude Desktop) simply omit them rather than implement no-op stubs.
  */
-export type AgentId = "cursor" | "claude-desktop" | "claude-code";
+export type AgentId = "cursor" | "claude-desktop" | "claude-code" | "codex";
 export type SetupResult = {
     path: string;
     changed: boolean;
@@ -29,16 +29,20 @@ export type AgentStatus = {
 };
 export type HookStatus = {
     /** Hook config status at the user-global scope (`~/.cursor/hooks.json` for Cursor). */
-    global: {
+    global?: {
         shell: boolean;
         mcp: boolean;
         path: string;
+        shellLabel?: string;
+        mcpLabel?: string;
     };
     /** Hook config status at the project scope, when applicable. */
     project?: {
         shell: boolean;
         mcp: boolean;
         path: string;
+        shellLabel?: string;
+        mcpLabel?: string;
     };
 };
 export type HookScope = "global" | "project";
@@ -50,6 +54,7 @@ export type UpsertHookOpts = {
 };
 export type UpsertMcpOpts = {
     explicitPath?: string;
+    projectDir?: string;
     dryRun?: boolean;
 };
 export type UpsertCloudOpts = {
@@ -66,6 +71,8 @@ export interface AgentAdapter {
     readonly id: AgentId;
     /** Display name for human-readable output. */
     readonly label: string;
+    /** Which hook scope this host primarily uses for readiness and doctor output. */
+    readonly preferredHookScope?: HookScope;
     /**
      * Cheap filesystem check: does this agent appear to be installed?
      * Drives auto-detect in `setup all` and `doctor`. Must not throw.

package/dist/adapters/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/adapters/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAElE,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,mEAAmE;IACnE,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,GAAG,CAAC,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,KAAK,CAAC,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,yEAAyE;IACzE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,uFAAuF;IACvF,MAAM,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,gEAAgE;IAChE,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAErB,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,eAAe,IAAI,OAAO,CAAC;IAE3B,mEAAmE;IACnE,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAErD,gFAAgF;IAChF,UAAU,CAAC,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAExD,6EAA6E;IAC7E,WAAW,CAAC,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE1D,kEAAkE;IAClE,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/adapters/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,gBAAgB,GAAG,aAAa,GAAG,OAAO,CAAC;AAE5E,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,mEAAmE;IACnE,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,GAAG,CAAC,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,KAAK,CAAC,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,yEAAyE;IACzE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,uFAAuF;IACvF,MAAM,CAAC,EAAE;QACP,KAAK,EAAE,OAAO,CAAC;QACf,GAAG,EAAE,OAAO,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,gEAAgE;IAChE,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,OAAO,CAAC;QACf,GAAG,EAAE,OAAO,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAErB,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,iFAAiF;IACjF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC;IAExC;;;OAGG;IACH,eAAe,IAAI,OAAO,CAAC;IAE3B,mEAAmE;IACnE,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAErD,gFAAgF;IAChF,UAAU,CAAC,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAExD,6EAA6E;IAC7E,WAAW,CAAC,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE1D,kEAAkE;IAClE,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjD"}

package/dist/bridge/execution-ticket-consume.d.ts

@@ -0,0 +1,12 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+export declare const EXECUTION_TICKET_ENV = "PRAXIS_GUARD_EXECUTION_TICKET";
+/**
+ * Verify a signed execution ticket locally and consume it once (env var or ticket files).
+ */
+export declare function tryConsumeExecutionTicket(argv: readonly string[], opts?: {
+    storageRoot?: string;
+    kind?: "shell" | "mcp";
+    tool_input_sha256?: string | null;
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+}): Promise<boolean>;
+//# sourceMappingURL=execution-ticket-consume.d.ts.map

package/dist/bridge/execution-ticket-consume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-consume.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket-consume.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAInF,eAAO,MAAM,oBAAoB,kCAAkC,CAAC;AAMpE;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE;IACL,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GACA,OAAO,CAAC,OAAO,CAAC,CAoElB"}

package/dist/bridge/execution-ticket-consume.js

@@ -0,0 +1,105 @@
+import { readdir, readFile, unlink } from "node:fs/promises";
+import path from "node:path";
+import { getInstallId } from "../cli/install-id.js";
+import { verifyExecutionTicket } from "../approval/grant.js";
+import { resolveShellApprovalHash } from "../approval/argv-fingerprint.js";
+import { guardSubpath } from "./guard-storage-root.js";
+import { argvMatchesApproval, shellApprovalId } from "./execution-ticket-match.js";
+export const EXECUTION_TICKET_ENV = "PRAXIS_GUARD_EXECUTION_TICKET";
+function executionTicketDir(storageRoot) {
+    return guardSubpath("tickets", storageRoot);
+}
+/**
+ * Verify a signed execution ticket locally and consume it once (env var or ticket files).
+ */
+export async function tryConsumeExecutionTicket(argv, opts) {
+    const fromEnv = process.env[EXECUTION_TICKET_ENV]?.trim();
+    if (fromEnv && tryConsumeTicketToken(fromEnv, argv, opts)) {
+        return true;
+    }
+    const dir = executionTicketDir(opts?.storageRoot);
+    let names = [];
+    try {
+        names = await readdir(dir);
+    }
+    catch {
+        return false;
+    }
+    const now = Date.now();
+    const approvalId = shellApprovalId(argv, opts?.approval_fingerprint);
+    const candidates = opts?.kind === "mcp"
+        ? names.filter((n) => n.endsWith(".json"))
+        : names.filter((n) => n.startsWith(`${approvalId}_`) && n.endsWith(".json"));
+    for (const name of candidates) {
+        const file = path.join(dir, name);
+        try {
+            const raw = await readFile(file, "utf8");
+            const row = JSON.parse(raw);
+            if (typeof row.exp !== "number" || row.exp < now) {
+                await unlink(file).catch(() => { });
+                continue;
+            }
+            if (!argvMatchesApproval(row.argv, argv, opts?.kind ?? row.kind, row.fingerprint, opts?.approval_fingerprint)) {
+                continue;
+            }
+            const ticket = typeof row.ticket === "string" ? row.ticket : "";
+            if (!ticket ||
+                !tryConsumeTicketToken(ticket, argv, {
+                    kind: opts?.kind ?? row.kind,
+                    tool_input_sha256: opts?.tool_input_sha256,
+                    approved_argv: row.argv,
+                    approval_fingerprint: opts?.approval_fingerprint,
+                    approved_fingerprint: row.fingerprint,
+                })) {
+                continue;
+            }
+            if (row.kind && opts?.kind && row.kind !== opts.kind)
+                continue;
+            await unlink(file);
+            return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
+function tryConsumeTicketToken(ticket, argv, opts) {
+    const claims = verifyExecutionTicket(ticket);
+    const expectedHash = resolveShellApprovalHash({
+        kind: opts?.kind ?? "shell",
+        argv,
+        approval_fingerprint: opts?.approval_fingerprint,
+    });
+    if (!claims) {
+        return argvMatchesApproval(opts?.approved_argv, argv, opts?.kind, opts?.approved_fingerprint, opts?.approval_fingerprint);
+    }
+    const approvedArgv = opts?.approved_argv;
+    const approvedHash = resolveShellApprovalHash({
+        kind: opts?.kind ?? claims.kind ?? "shell",
+        argv: approvedArgv ?? argv,
+        approval_fingerprint: opts?.approved_fingerprint ?? opts?.approval_fingerprint,
+    });
+    if (approvedArgv) {
+        if (claims.argv_sha256 !== approvedHash)
+            return false;
+        if (!argvMatchesApproval(approvedArgv, argv, opts?.kind ?? claims.kind, opts?.approved_fingerprint, opts?.approval_fingerprint)) {
+            return false;
+        }
+    }
+    else if (claims.argv_sha256 !== expectedHash) {
+        return false;
+    }
+    if (claims.install_id !== getInstallId())
+        return false;
+    if (opts?.kind && claims.kind !== opts.kind)
+        return false;
+    const expectedToolHash = opts?.tool_input_sha256?.trim() || null;
+    const claimToolHash = typeof claims.tool_input_sha256 === "string" ? claims.tool_input_sha256.trim() : null;
+    if (claimToolHash && expectedToolHash && claimToolHash !== expectedToolHash)
+        return false;
+    if (claimToolHash && !expectedToolHash)
+        return false;
+    return true;
+}
+//# sourceMappingURL=execution-ticket-consume.js.map

package/dist/bridge/execution-ticket-consume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-consume.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-consume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnF,MAAM,CAAC,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAEpE,SAAS,kBAAkB,CAAC,WAAoB;IAC9C,OAAO,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAuB,EACvB,IAKC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,OAAO,IAAI,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,IAAI,EAAE,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAMzB,CAAC;YACF,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;gBACjD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,IACE,CAAC,mBAAmB,CAClB,GAAG,CAAC,IAAI,EACR,IAAI,EACJ,IAAI,EAAE,IAAI,IAAK,GAAG,CAAC,IAAwB,EAC3C,GAAG,CAAC,WAAW,EACf,IAAI,EAAE,oBAAoB,CAC3B,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,IACE,CAAC,MAAM;gBACP,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE;oBACnC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAK,GAAG,CAAC,IAAwB;oBACjD,iBAAiB,EAAE,IAAI,EAAE,iBAAiB;oBAC1C,aAAa,EAAE,GAAG,CAAC,IAAI;oBACvB,oBAAoB,EAAE,IAAI,EAAE,oBAAoB;oBAChD,oBAAoB,EAAE,GAAG,CAAC,WAAW;iBACtC,CAAC,EACF,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC/D,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAc,EACd,IAAuB,EACvB,IAMC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO;QAC3B,IAAI;QACJ,oBAAoB,EAAE,IAAI,EAAE,oBAAoB;KACjD,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,mBAAmB,CACxB,IAAI,EAAE,aAAa,EACnB,IAAI,EACJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,oBAAoB,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;IACzC,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;QAC1C,IAAI,EAAE,YAAY,IAAI,IAAI;QAC1B,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,IAAI,IAAI,EAAE,oBAAoB;KAC/E,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QACtD,IACE,CAAC,mBAAmB,CAClB,YAAY,EACZ,IAAI,EACJ,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EACzB,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,oBAAoB,CAC3B,EACD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,gBAAgB,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACjE,MAAM,aAAa,GACjB,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,aAAa,IAAI,gBAAgB,IAAI,aAAa,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/bridge/execution-ticket-match.d.ts

@@ -0,0 +1,4 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+export declare function shellApprovalId(argv: readonly string[], fingerprint?: ShellApprovalFingerprintPayload | null): string;
+export declare function argvMatchesApproval(approved: readonly string[] | undefined, requested: readonly string[], kind?: "shell" | "mcp", approvedFingerprint?: ShellApprovalFingerprintPayload | null, requestedFingerprint?: ShellApprovalFingerprintPayload | null): boolean;
+//# sourceMappingURL=execution-ticket-match.d.ts.map

package/dist/bridge/execution-ticket-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-match.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket-match.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAuBnF,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,CAAC,EAAE,+BAA+B,GAAG,IAAI,GACnD,MAAM,CAGR;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACvC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,EACtB,mBAAmB,CAAC,EAAE,+BAA+B,GAAG,IAAI,EAC5D,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,GAC5D,OAAO,CAQT"}