@praxis.guard/auditor-cli 0.0.44 → 0.0.46

package/dist/bridge/execution-ticket-match.js

@@ -0,0 +1,40 @@
+import { shellApprovalFingerprintId, shellArgvApprovalId } from "./shell-approval-bridge.js";
+function argvDeepEqual(stored, requested) {
+    if (!Array.isArray(stored) || stored.length !== requested.length)
+        return false;
+    return stored.every((v, i) => typeof v === "string" && v === requested[i]);
+}
+function fingerprintDeepEqual(stored, requested) {
+    if (!stored || typeof stored !== "object")
+        return false;
+    return shellApprovalFingerprintId(stored) === shellApprovalFingerprintId(requested);
+}
+function isEquivalentMcpInvocation(approved, requested) {
+    if (approved.length < 3 || requested.length < 3)
+        return false;
+    if (approved[0] !== "mcp" || requested[0] !== "mcp")
+        return false;
+    if (approved[2] !== requested[2])
+        return false;
+    if (approved[1] === requested[1])
+        return true;
+    return approved[1] === "stdio" || requested[1] === "stdio";
+}
+export function shellApprovalId(argv, fingerprint) {
+    if (fingerprint)
+        return shellApprovalFingerprintId(fingerprint);
+    return shellArgvApprovalId(argv);
+}
+export function argvMatchesApproval(approved, requested, kind, approvedFingerprint, requestedFingerprint) {
+    if (kind === "shell" && approvedFingerprint && requestedFingerprint) {
+        return fingerprintDeepEqual(approvedFingerprint, requestedFingerprint);
+    }
+    if (!approved)
+        return false;
+    if (argvDeepEqual(approved, requested))
+        return true;
+    if (kind === "mcp")
+        return isEquivalentMcpInvocation(approved, requested);
+    return false;
+}
+//# sourceMappingURL=execution-ticket-match.js.map

package/dist/bridge/execution-ticket-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-match.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-match.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAG7F,SAAS,aAAa,CAAC,MAAe,EAAE,SAA4B;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAe,EAAE,SAA0C;IACvF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,0BAA0B,CAAC,MAAyC,CAAC,KAAK,0BAA0B,CAAC,SAAS,CAAC,CAAC;AACzH,CAAC;AAED,SAAS,yBAAyB,CAChC,QAA2B,EAC3B,SAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAuB,EACvB,WAAoD;IAEpD,IAAI,WAAW;QAAE,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAuC,EACvC,SAA4B,EAC5B,IAAsB,EACtB,mBAA4D,EAC5D,oBAA6D;IAE7D,IAAI,IAAI,KAAK,OAAO,IAAI,mBAAmB,IAAI,oBAAoB,EAAE,CAAC;QACpE,OAAO,oBAAoB,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/bridge/execution-ticket-record.d.ts

@@ -0,0 +1,14 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+/**
+ * After redeem, persist a signed execution ticket for hook verification (dual-write with bridge).
+ *
+ * When a fingerprint is provided the primary file is indexed by the fingerprint hash.
+ * We also write an argv-hash alias so hooks that lack fingerprint context (e.g. the
+ * Claude Code PreToolUse hook) can find and consume the ticket by argv alone.
+ */
+export declare function recordExecutionTicket(ticket: string, argv: readonly string[], opts?: {
+    storageRoot?: string;
+    kind?: "shell" | "mcp";
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+}): Promise<void>;
+//# sourceMappingURL=execution-ticket-record.d.ts.map

package/dist/bridge/execution-ticket-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-record.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket-record.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAOnF;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE;IACL,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IACvB,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GACA,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/dist/bridge/execution-ticket-record.js

@@ -0,0 +1,51 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { verifyExecutionTicket } from "../approval/grant.js";
+import { guardSubpath } from "./guard-storage-root.js";
+import { shellArgvApprovalId } from "./shell-approval-bridge.js";
+import { shellApprovalId } from "./execution-ticket-match.js";
+function executionTicketDir(storageRoot) {
+    return guardSubpath("tickets", storageRoot);
+}
+/**
+ * After redeem, persist a signed execution ticket for hook verification (dual-write with bridge).
+ *
+ * When a fingerprint is provided the primary file is indexed by the fingerprint hash.
+ * We also write an argv-hash alias so hooks that lack fingerprint context (e.g. the
+ * Claude Code PreToolUse hook) can find and consume the ticket by argv alone.
+ */
+export async function recordExecutionTicket(ticket, argv, opts) {
+    const id = shellApprovalId(argv, opts?.approval_fingerprint);
+    const dir = executionTicketDir(opts?.storageRoot);
+    await mkdir(dir, { recursive: true });
+    const claims = verifyExecutionTicket(ticket);
+    const expMs = claims ? claims.exp * 1000 : Date.now() + 10 * 60 * 1000;
+    const content = JSON.stringify({
+        exp: expMs,
+        argv: [...argv],
+        fingerprint: opts?.approval_fingerprint ?? undefined,
+        ticket,
+        kind: opts?.kind ?? claims?.kind ?? "shell",
+    });
+    const file = path.join(dir, `${id}_${randomUUID()}.json`);
+    await writeFile(file, content, "utf8");
+    // When stored by fingerprint hash, also write an argv-hash alias so hooks
+    // without fingerprint context (e.g. claude-code PreToolUse) can find it.
+    // The alias omits the fingerprint so tryConsumeTicketToken hashes by argv,
+    // matching the argv_sha256 the server put in the JWT.
+    if (opts?.approval_fingerprint && (opts?.kind ?? claims?.kind ?? "shell") === "shell") {
+        const argvId = shellArgvApprovalId(argv);
+        if (argvId !== id) {
+            const aliasContent = JSON.stringify({
+                exp: expMs,
+                argv: [...argv],
+                ticket,
+                kind: opts?.kind ?? claims?.kind ?? "shell",
+            });
+            const aliasFile = path.join(dir, `${argvId}_${randomUUID()}.json`);
+            await writeFile(aliasFile, aliasContent, "utf8");
+        }
+    }
+}
+//# sourceMappingURL=execution-ticket-record.js.map

package/dist/bridge/execution-ticket-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-record.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,SAAS,kBAAkB,CAAC,WAAoB;IAC9C,OAAO,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAuB,EACvB,IAIC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,IAAI,EAAE,oBAAoB,IAAI,SAAS;QACpD,MAAM;QACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvC,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClC,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,MAAM;gBACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;aAC5C,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/bridge/execution-ticket.d.ts

@@ -1,25 +1,4 @@
-import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
-export declare const EXECUTION_TICKET_ENV = "PRAXIS_GUARD_EXECUTION_TICKET";
+export { EXECUTION_TICKET_ENV, tryConsumeExecutionTicket } from "./execution-ticket-consume.js";
+export { recordExecutionTicket } from "./execution-ticket-record.js";
 export declare function executionTicketDir(storageRoot?: string): string;
-/**
- * After redeem, persist a signed execution ticket for hook verification (dual-write with bridge).
- *
- * When a fingerprint is provided the primary file is indexed by the fingerprint hash.
- * We also write an argv-hash alias so hooks that lack fingerprint context (e.g. the
- * Claude Code PreToolUse hook) can find and consume the ticket by argv alone.
- */
-export declare function recordExecutionTicket(ticket: string, argv: readonly string[], opts?: {
-    storageRoot?: string;
-    kind?: "shell" | "mcp";
-    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
-}): Promise<void>;
-/**
- * Verify a signed execution ticket locally and consume it once (env var or ticket files).
- */
-export declare function tryConsumeExecutionTicket(argv: readonly string[], opts?: {
-    storageRoot?: string;
-    kind?: "shell" | "mcp";
-    tool_input_sha256?: string | null;
-    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
-}): Promise<boolean>;
 //# sourceMappingURL=execution-ticket.d.ts.map

package/dist/bridge/execution-ticket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-ticket.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAEnF,eAAO,MAAM,oBAAoB,kCAAkC,CAAC;AAEpE,wBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/D;AA+CD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE;IACL,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IACvB,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GACA,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE;IACL,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GACA,OAAO,CAAC,OAAO,CAAC,CAoElB"}
+{"version":3,"file":"execution-ticket.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,wBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/D"}

package/dist/bridge/execution-ticket.js

@@ -1,184 +1,7 @@
-import { randomUUID } from "node:crypto";
-import { mkdir, readdir, readFile, unlink, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { getInstallId } from "../cli/install-id.js";
-import { verifyExecutionTicket } from "../approval/grant.js";
-import { resolveShellApprovalHash } from "../approval/argv-fingerprint.js";
 import { guardSubpath } from "./guard-storage-root.js";
-import { shellApprovalFingerprintId, shellArgvApprovalId } from "./shell-approval-bridge.js";
-export const EXECUTION_TICKET_ENV = "PRAXIS_GUARD_EXECUTION_TICKET";
+export { EXECUTION_TICKET_ENV, tryConsumeExecutionTicket } from "./execution-ticket-consume.js";
+export { recordExecutionTicket } from "./execution-ticket-record.js";
 export function executionTicketDir(storageRoot) {
     return guardSubpath("tickets", storageRoot);
 }
-function argvDeepEqual(stored, requested) {
-    if (!Array.isArray(stored) || stored.length !== requested.length)
-        return false;
-    return stored.every((v, i) => typeof v === "string" && v === requested[i]);
-}
-function fingerprintDeepEqual(stored, requested) {
-    if (!stored || typeof stored !== "object")
-        return false;
-    return shellApprovalFingerprintId(stored) === shellApprovalFingerprintId(requested);
-}
-function isEquivalentMcpInvocation(approved, requested) {
-    if (approved.length < 3 || requested.length < 3)
-        return false;
-    if (approved[0] !== "mcp" || requested[0] !== "mcp")
-        return false;
-    if (approved[2] !== requested[2])
-        return false;
-    if (approved[1] === requested[1])
-        return true;
-    return approved[1] === "stdio" || requested[1] === "stdio";
-}
-function shellApprovalId(argv, fingerprint) {
-    if (fingerprint)
-        return shellApprovalFingerprintId(fingerprint);
-    return shellArgvApprovalId(argv);
-}
-function argvMatchesApproval(approved, requested, kind, approvedFingerprint, requestedFingerprint) {
-    if (kind === "shell" && approvedFingerprint && requestedFingerprint) {
-        return fingerprintDeepEqual(approvedFingerprint, requestedFingerprint);
-    }
-    if (!approved)
-        return false;
-    if (argvDeepEqual(approved, requested))
-        return true;
-    if (kind === "mcp")
-        return isEquivalentMcpInvocation(approved, requested);
-    return false;
-}
-/**
- * After redeem, persist a signed execution ticket for hook verification (dual-write with bridge).
- *
- * When a fingerprint is provided the primary file is indexed by the fingerprint hash.
- * We also write an argv-hash alias so hooks that lack fingerprint context (e.g. the
- * Claude Code PreToolUse hook) can find and consume the ticket by argv alone.
- */
-export async function recordExecutionTicket(ticket, argv, opts) {
-    const id = shellApprovalId(argv, opts?.approval_fingerprint);
-    const dir = executionTicketDir(opts?.storageRoot);
-    await mkdir(dir, { recursive: true });
-    const claims = verifyExecutionTicket(ticket);
-    const expMs = claims ? claims.exp * 1000 : Date.now() + 10 * 60 * 1000;
-    const content = JSON.stringify({
-        exp: expMs,
-        argv: [...argv],
-        fingerprint: opts?.approval_fingerprint ?? undefined,
-        ticket,
-        kind: opts?.kind ?? claims?.kind ?? "shell",
-    });
-    const file = path.join(dir, `${id}_${randomUUID()}.json`);
-    await writeFile(file, content, "utf8");
-    // When stored by fingerprint hash, also write an argv-hash alias so hooks
-    // without fingerprint context (e.g. claude-code PreToolUse) can find it.
-    // The alias omits the fingerprint so tryConsumeTicketToken hashes by argv,
-    // matching the argv_sha256 the server put in the JWT.
-    if (opts?.approval_fingerprint && (opts?.kind ?? claims?.kind ?? "shell") === "shell") {
-        const argvId = shellArgvApprovalId(argv);
-        if (argvId !== id) {
-            const aliasContent = JSON.stringify({
-                exp: expMs,
-                argv: [...argv],
-                ticket,
-                kind: opts?.kind ?? claims?.kind ?? "shell",
-            });
-            const aliasFile = path.join(dir, `${argvId}_${randomUUID()}.json`);
-            await writeFile(aliasFile, aliasContent, "utf8");
-        }
-    }
-}
-/**
- * Verify a signed execution ticket locally and consume it once (env var or ticket files).
- */
-export async function tryConsumeExecutionTicket(argv, opts) {
-    const fromEnv = process.env[EXECUTION_TICKET_ENV]?.trim();
-    if (fromEnv && tryConsumeTicketToken(fromEnv, argv, opts)) {
-        return true;
-    }
-    const dir = executionTicketDir(opts?.storageRoot);
-    let names = [];
-    try {
-        names = await readdir(dir);
-    }
-    catch {
-        return false;
-    }
-    const now = Date.now();
-    const approvalId = shellApprovalId(argv, opts?.approval_fingerprint);
-    const candidates = opts?.kind === "mcp"
-        ? names.filter((n) => n.endsWith(".json"))
-        : names.filter((n) => n.startsWith(`${approvalId}_`) && n.endsWith(".json"));
-    for (const name of candidates) {
-        const file = path.join(dir, name);
-        try {
-            const raw = await readFile(file, "utf8");
-            const row = JSON.parse(raw);
-            if (typeof row.exp !== "number" || row.exp < now) {
-                await unlink(file).catch(() => { });
-                continue;
-            }
-            if (!argvMatchesApproval(row.argv, argv, opts?.kind ?? row.kind, row.fingerprint, opts?.approval_fingerprint)) {
-                continue;
-            }
-            const ticket = typeof row.ticket === "string" ? row.ticket : "";
-            if (!ticket ||
-                !tryConsumeTicketToken(ticket, argv, {
-                    kind: opts?.kind ?? row.kind,
-                    tool_input_sha256: opts?.tool_input_sha256,
-                    approved_argv: row.argv,
-                    approval_fingerprint: opts?.approval_fingerprint,
-                    approved_fingerprint: row.fingerprint,
-                })) {
-                continue;
-            }
-            if (row.kind && opts?.kind && row.kind !== opts.kind)
-                continue;
-            await unlink(file);
-            return true;
-        }
-        catch {
-            continue;
-        }
-    }
-    return false;
-}
-function tryConsumeTicketToken(ticket, argv, opts) {
-    const claims = verifyExecutionTicket(ticket);
-    const expectedHash = resolveShellApprovalHash({
-        kind: opts?.kind ?? "shell",
-        argv,
-        approval_fingerprint: opts?.approval_fingerprint,
-    });
-    if (!claims) {
-        return argvMatchesApproval(opts?.approved_argv, argv, opts?.kind, opts?.approved_fingerprint, opts?.approval_fingerprint);
-    }
-    const approvedArgv = opts?.approved_argv;
-    const approvedHash = resolveShellApprovalHash({
-        kind: opts?.kind ?? claims.kind ?? "shell",
-        argv: approvedArgv ?? argv,
-        approval_fingerprint: opts?.approved_fingerprint ?? opts?.approval_fingerprint,
-    });
-    if (approvedArgv) {
-        if (claims.argv_sha256 !== approvedHash)
-            return false;
-        if (!argvMatchesApproval(approvedArgv, argv, opts?.kind ?? claims.kind, opts?.approved_fingerprint, opts?.approval_fingerprint)) {
-            return false;
-        }
-    }
-    else if (claims.argv_sha256 !== expectedHash) {
-        return false;
-    }
-    if (claims.install_id !== getInstallId())
-        return false;
-    if (opts?.kind && claims.kind !== opts.kind)
-        return false;
-    const expectedToolHash = opts?.tool_input_sha256?.trim() || null;
-    const claimToolHash = typeof claims.tool_input_sha256 === "string" ? claims.tool_input_sha256.trim() : null;
-    if (claimToolHash && expectedToolHash && claimToolHash !== expectedToolHash)
-        return false;
-    if (claimToolHash && !expectedToolHash)
-        return false;
-    return true;
-}
 //# sourceMappingURL=execution-ticket.js.map

package/dist/bridge/execution-ticket.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-ticket.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAG7F,MAAM,CAAC,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAEpE,MAAM,UAAU,kBAAkB,CAAC,WAAoB;IACrD,OAAO,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,MAAe,EAAE,SAA4B;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAe,EAAE,SAA0C;IACvF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,0BAA0B,CAAC,MAAyC,CAAC,KAAK,0BAA0B,CAAC,SAAS,CAAC,CAAC;AACzH,CAAC;AAED,SAAS,yBAAyB,CAChC,QAA2B,EAC3B,SAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CACtB,IAAuB,EACvB,WAAoD;IAEpD,IAAI,WAAW;QAAE,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAuC,EACvC,SAA4B,EAC5B,IAAsB,EACtB,mBAA4D,EAC5D,oBAA6D;IAE7D,IAAI,IAAI,KAAK,OAAO,IAAI,mBAAmB,IAAI,oBAAoB,EAAE,CAAC;QACpE,OAAO,oBAAoB,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAuB,EACvB,IAIC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,IAAI,EAAE,oBAAoB,IAAI,SAAS;QACpD,MAAM;QACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvC,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClC,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,MAAM;gBACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;aAC5C,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAuB,EACvB,IAKC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,OAAO,IAAI,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,IAAI,EAAE,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAMzB,CAAC;YACF,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;gBACjD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,IACE,CAAC,mBAAmB,CAClB,GAAG,CAAC,IAAI,EACR,IAAI,EACJ,IAAI,EAAE,IAAI,IAAK,GAAG,CAAC,IAAwB,EAC3C,GAAG,CAAC,WAAW,EACf,IAAI,EAAE,oBAAoB,CAC3B,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,IACE,CAAC,MAAM;gBACP,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE;oBACnC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAK,GAAG,CAAC,IAAwB;oBACjD,iBAAiB,EAAE,IAAI,EAAE,iBAAiB;oBAC1C,aAAa,EAAE,GAAG,CAAC,IAAI;oBACvB,oBAAoB,EAAE,IAAI,EAAE,oBAAoB;oBAChD,oBAAoB,EAAE,GAAG,CAAC,WAAW;iBACtC,CAAC,EACF,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC/D,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAc,EACd,IAAuB,EACvB,IAMC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO;QAC3B,IAAI;QACJ,oBAAoB,EAAE,IAAI,EAAE,oBAAoB;KACjD,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,mBAAmB,CACxB,IAAI,EAAE,aAAa,EACnB,IAAI,EACJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,oBAAoB,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;IACzC,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;QAC1C,IAAI,EAAE,YAAY,IAAI,IAAI;QAC1B,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,IAAI,IAAI,EAAE,oBAAoB;KAC/E,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QACtD,IACE,CAAC,mBAAmB,CAClB,YAAY,EACZ,IAAI,EACJ,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EACzB,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,oBAAoB,CAC3B,EACD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,gBAAgB,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACjE,MAAM,aAAa,GACjB,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,aAAa,IAAI,gBAAgB,IAAI,aAAa,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"execution-ticket.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,MAAM,UAAU,kBAAkB,CAAC,WAAoB;IACrD,OAAO,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC"}

package/dist/cli/dispatch-hook.d.ts

@@ -0,0 +1,2 @@
+export declare function dispatchHookCommand(name: string | undefined): Promise<boolean>;
+//# sourceMappingURL=dispatch-hook.d.ts.map

package/dist/cli/dispatch-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-hook.d.ts","sourceRoot":"","sources":["../../src/cli/dispatch-hook.ts"],"names":[],"mappings":"AAIA,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBpF"}

package/dist/cli/dispatch-hook.js

@@ -0,0 +1,29 @@
+import { runBeforeMcpHookFromStdin } from "../hooks/run-before-mcp.js";
+import { runBeforeShellHookFromStdin } from "../hooks/run-before-shell.js";
+import { runClaudeCodePreToolUseHookFromStdin } from "../hooks/run-claude-code-pre-tool-use.js";
+export async function dispatchHookCommand(name) {
+    if (name === "before-shell") {
+        await runBeforeShellHookFromStdin();
+        return true;
+    }
+    if (name === "before-mcp") {
+        await runBeforeMcpHookFromStdin();
+        return true;
+    }
+    if (name === "claude-code") {
+        await runClaudeCodePreToolUseHookFromStdin();
+        return true;
+    }
+    if (name === "codex-pre-tool-use") {
+        const { runCodexPreToolUseHookFromStdin } = await import("../hooks/run-codex-hooks.js");
+        await runCodexPreToolUseHookFromStdin();
+        return true;
+    }
+    if (name === "codex-permission-request") {
+        const { runCodexPermissionRequestHookFromStdin } = await import("../hooks/run-codex-hooks.js");
+        await runCodexPermissionRequestHookFromStdin();
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=dispatch-hook.js.map

package/dist/cli/dispatch-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-hook.js","sourceRoot":"","sources":["../../src/cli/dispatch-hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,oCAAoC,EAAE,MAAM,0CAA0C,CAAC;AAEhG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,2BAA2B,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,yBAAyB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,oCAAoC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,MAAM,EAAE,+BAA+B,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACxF,MAAM,+BAA+B,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,MAAM,EAAE,sCAAsC,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC/F,MAAM,sCAAsC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/dispatch-setup.d.ts

@@ -0,0 +1,2 @@
+export declare function dispatchSetupCommand(sub: string | undefined, args: string[]): Promise<void>;
+//# sourceMappingURL=dispatch-setup.d.ts.map

package/dist/cli/dispatch-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-setup.d.ts","sourceRoot":"","sources":["../../src/cli/dispatch-setup.ts"],"names":[],"mappings":"AAAA,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCjG"}

package/dist/cli/dispatch-setup.js

@@ -0,0 +1,34 @@
+export async function dispatchSetupCommand(sub, args) {
+    if (sub === "all") {
+        const { runSetupAll } = await import("./setup-all.js");
+        await runSetupAll(args);
+        return;
+    }
+    if (sub === "hook") {
+        const { runSetupHook } = await import("./setup-hook.js");
+        await runSetupHook(args);
+        return;
+    }
+    if (sub === "mcp") {
+        const { runSetupMcp } = await import("./setup-mcp.js");
+        await runSetupMcp(args);
+        return;
+    }
+    if (sub === "cloud") {
+        const { runSetupCloud } = await import("./setup-cloud.js");
+        await runSetupCloud(args);
+        return;
+    }
+    if (sub === "doctor") {
+        const { runSetupDoctor } = await import("./setup-doctor.js");
+        await runSetupDoctor(args);
+        return;
+    }
+    if (sub === "codex") {
+        const { runSetupCodex } = await import("./setup-codex.js");
+        await runSetupCodex(args);
+        return;
+    }
+    throw new Error(`Unknown setup command: ${sub ?? "(missing)"}`);
+}
+//# sourceMappingURL=dispatch-setup.js.map

package/dist/cli/dispatch-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-setup.js","sourceRoot":"","sources":["../../src/cli/dispatch-setup.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAuB,EAAE,IAAc;IAChF,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC3D,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAmEA,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAkG/C"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAyEA,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAkG/C"}

package/dist/cli/doctor.js

@@ -13,7 +13,8 @@ import { readPoliciesMetaFile } from "./policies-meta.js";
 function adapterReady(adapter, status) {
     // For an adapter to count as "ready", every surface it declares MUST be configured.
     // Cursor (hook + mcp + cloud) requires all three; Claude Desktop (mcp only) just needs MCP.
-    if (adapter.upsertHook && !(status.hook?.global.shell && status.hook?.global.mcp))
+    const hookStatus = adapter.preferredHookScope === "project" ? status.hook?.project : status.hook?.global;
+    if (adapter.upsertHook && !(hookStatus?.shell && hookStatus?.mcp))
         return false;
     if (!status.mcp?.configured)
         return false;
@@ -25,17 +26,20 @@ function pushAdapterLines(lines, adapter, status) {
     const installedTag = status.installed ? "installed" : "not installed";
     lines.push(`  ${adapter.label} (${installedTag}):`);
     if (adapter.upsertHook) {
-        const g = status.hook?.global ?? { shell: false, mcp: false, path: "" };
-        const ready = g.shell && g.mcp;
-        lines.push(`    hook (global): ${ready ? "configured" : "missing (run \`auditor setup hook\`)"} (${g.path})`);
-        lines.push(`      beforeShell: ${g.shell ? "ok" : "missing"} | beforeMCP: ${g.mcp ? "ok" : "missing"}`);
-        const p = status.hook?.project;
-        if (p) {
-            const hasProj = p.shell || p.mcp;
-            lines.push(`    hook (project): ${hasProj ? "present" : "none"} (${p.path})`);
-            if (hasProj) {
-                lines.push(`      beforeShell: ${p.shell ? "ok" : "—"} | beforeMCP: ${p.mcp ? "ok" : "—"}`);
-            }
+        const globalEntry = status.hook?.global;
+        const projectEntry = status.hook?.project;
+        if (globalEntry && adapter.preferredHookScope !== "project") {
+            const ready = globalEntry.shell && globalEntry.mcp;
+            lines.push(`    hook (global): ${ready ? "configured" : "missing (run \`auditor setup hook\`)"} (${globalEntry.path})`);
+            lines.push(`      ${globalEntry.shellLabel ?? "beforeShell"}: ${globalEntry.shell ? "ok" : "missing"} | ${globalEntry.mcpLabel ?? "beforeMCP"}: ${globalEntry.mcp ? "ok" : "missing"}`);
+        }
+        if (projectEntry) {
+            const ready = projectEntry.shell && projectEntry.mcp;
+            lines.push(`    hook (project): ${ready ? "configured" : "missing (run \`auditor setup hook --project\`)"} (${projectEntry.path})`);
+            lines.push(`      ${projectEntry.shellLabel ?? "beforeShell"}: ${projectEntry.shell ? "ok" : "missing"} | ${projectEntry.mcpLabel ?? "beforeMCP"}: ${projectEntry.mcp ? "ok" : "missing"}`);
+        }
+        else if (adapter.preferredHookScope !== "project") {
+            lines.push("    hook (project): none");
         }
     }
     const m = status.mcp ?? { configured: false, path: "" };
@@ -64,7 +68,7 @@ export async function runDoctor() {
     const lines = [
         `auditor doctor`,
         `Install ID: ${getInstallId()}`,
-        `MCP stdio: auditor mcp   (Cursor: command auditor, args [mcp])`,
+        `MCP stdio: auditor mcp   (Cursor/Codex: command auditor, args [mcp])`,
         `Node: ${process.version}`,
         `Policy file: ${policyPath}`,
         `Policy source: ${policySource}`,

package/dist/cli/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,SAAS,YAAY,CAAC,OAAqB,EAAE,MAAmB;IAC9D,oFAAoF;IACpF,4FAA4F;IAC5F,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAe,EACf,OAAqB,EACrB,MAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,sBAAsB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sCAAsC,KAAK,CAAC,CAAC,IAAI,GAAG,CAClG,CAAC;QACF,KAAK,CAAC,IAAI,CACR,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAC5F,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAC9E,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CACR,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAChF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qCAAqC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC9F,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,wBAAwB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC9D,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,mBAAmB;YACpC,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,qDAAqD,CAAC;IAE9D,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,eAAe,YAAY,EAAE,EAAE;QAC/B,gEAAgE;QAChE,SAAS,OAAO,CAAC,OAAO,EAAE;QAC1B,gBAAgB,UAAU,EAAE;QAC5B,kBAAkB,YAAY,EAAE;QAChC,kBAAkB,QAAQ,EAAE;QAC5B,IAAI;YACF,CAAC,CAAC,4BAA4B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,uEAAuE;QAC3E,eAAe,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE;QACnD,cAAc,SAAS,EAAE;QACzB,2BAA2B,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,EAAE;KAC5F,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,eAAe,GAAqD,EAAE,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACxD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,QAAQ,eAAe,EAAE,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,CAAC,IAAI,CACR,WAAW;QACT,CAAC,CAAC,SAAS,WAAW,YAAY,KAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACF,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,KAAK;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IAEpE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAuB;gBAChD,GAAG,EAAE,eAAe;gBACpB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACtB,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,qCAAqC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,CAC/E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,wBAAwB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,2EAA2E;IAC3E,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,UAAU,IAAI,SAAS,CAAC;IACtC,KAAK,CAAC,IAAI,CACR,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,UAAU,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAChH,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,SAAS,YAAY,CAAC,OAAqB,EAAE,MAAmB;IAC9D,oFAAoF;IACpF,4FAA4F;IAC5F,MAAM,UAAU,GACd,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;IACxF,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAe,EACf,OAAqB,EACrB,MAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;QAC1C,IAAI,WAAW,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC;YACnD,KAAK,CAAC,IAAI,CACR,sBAAsB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sCAAsC,KAAK,WAAW,CAAC,IAAI,GAAG,CAC5G,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,WAAW,CAAC,UAAU,IAAI,aAAa,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,WAAW,CAAC,QAAQ,IAAI,WAAW,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAC5K,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC;YACrD,KAAK,CAAC,IAAI,CACR,uBAAuB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gDAAgD,KAAK,YAAY,CAAC,IAAI,GAAG,CACxH,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,YAAY,CAAC,UAAU,IAAI,aAAa,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,CAAC,QAAQ,IAAI,WAAW,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAChL,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qCAAqC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC9F,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,wBAAwB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC9D,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,mBAAmB;YACpC,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,qDAAqD,CAAC;IAE9D,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,eAAe,YAAY,EAAE,EAAE;QAC/B,sEAAsE;QACtE,SAAS,OAAO,CAAC,OAAO,EAAE;QAC1B,gBAAgB,UAAU,EAAE;QAC5B,kBAAkB,YAAY,EAAE;QAChC,kBAAkB,QAAQ,EAAE;QAC5B,IAAI;YACF,CAAC,CAAC,4BAA4B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,uEAAuE;QAC3E,eAAe,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE;QACnD,cAAc,SAAS,EAAE;QACzB,2BAA2B,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,EAAE;KAC5F,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,eAAe,GAAqD,EAAE,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACxD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,QAAQ,eAAe,EAAE,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,CAAC,IAAI,CACR,WAAW;QACT,CAAC,CAAC,SAAS,WAAW,YAAY,KAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACF,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,KAAK;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IAEpE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAuB;gBAChD,GAAG,EAAE,eAAe;gBACpB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACtB,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,qCAAqC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,CAC/E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,wBAAwB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,2EAA2E;IAC3E,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,UAAU,IAAI,SAAS,CAAC;IACtC,KAAK,CAAC,IAAI,CACR,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,UAAU,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAChH,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/cli/help.d.ts

@@ -0,0 +1,2 @@
+export declare function printHelp(): void;
+//# sourceMappingURL=help.d.ts.map

package/dist/cli/help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AA2DA,wBAAgB,SAAS,IAAI,IAAI,CAEhC"}

package/dist/cli/help.js

@@ -0,0 +1,61 @@
+import process from "node:process";
+const HELP_TEXT = `auditor — Praxis guard CLI
+
+Usage:
+  auditor setup all          Configure all detected agents (use --for=<agent>; Codex uses --project/cwd)
+  auditor setup hook         Configure hook settings (Cursor global by default; Codex is repo-local)
+  auditor setup mcp          Configure MCP settings (Cursor global by default; Codex uses --project/cwd)
+  auditor setup cloud        Configure .cursor/environment.json for Cloud Agents
+  auditor setup doctor       Validate configured agent setup, including project-local Codex
+  auditor setup codex        Configure repo-local .codex MCP + hooks (--project, --dry-run)
+  auditor setup codex doctor Validate repo-local Codex setup
+  auditor login              Authenticate this CLI with your Praxis account (device code flow)
+  auditor logout [--revoke]  Remove saved credentials (and optionally revoke token server-side)
+  auditor token create       Generate a new bearer token (for Cloud Agents, CI, etc.)
+  auditor whoami             Show signed-in uid, email, and token source (calls Cloud Function)
+  auditor mcp                MCP stdio server (tools: guard, guard_wait) — use in Cursor mcp.json
+  auditor approvals list     List pending approval requests
+  auditor approvals open <id>  Print approval URL for a request
+  auditor approvals approve <id>  Dev-only: approve request (GUARD_APPROVAL_DEV=1)
+  auditor approvals deny <id>   Deny an approval request (human auth or dev)
+  auditor approvals watch <id>  Poll until approved and write execution ticket
+  auditor hook before-shell  Cursor beforeShellExecution (stdin JSON → stdout JSON)
+  auditor hook before-mcp    Cursor beforeMCPExecution (stdin JSON → stdout JSON)
+  auditor hook claude-code   Claude Code PreToolUse/Bash (stdin JSON → stdout JSON)
+  auditor hook codex-pre-tool-use       Codex PreToolUse (Bash + MCP)
+  auditor hook codex-permission-request Codex PermissionRequest (Bash + MCP)
+  auditor doctor             Show policy path, sync revision, auth status
+  auditor policies sync      Fetch policies from Cloud Functions → local policies.v1.json + meta
+  auditor version            Package version and git short SHA when available
+  auditor help | --help      This message
+
+Auth:
+  Token is resolved in order: PRAXIS_GUARD_TOKEN env var → ~/.config/praxis/credentials.json.
+  Run \`auditor login\` to authenticate interactively.
+
+Defaults (production):
+  Project ID and region use built-in Praxis production values unless overridden below.
+  Function URLs are derived from project/region or explicit base-url env vars.
+
+Local development:
+  Set PRAXIS_FIREBASE_FUNCTIONS_EMULATOR_HOST to your Functions emulator host:port.
+
+Env (all optional):
+  PRAXIS_GUARD_TOKEN                       Override token (CI/CD). Skips credential file.
+  PRAXIS_FIREBASE_ID_TOKEN                 Alternative: Firebase Auth ID JWT for the functions project.
+  PRAXIS_FIREBASE_FUNCTIONS_EMULATOR_HOST  Functions emulator host:port (local dev).
+  PRAXIS_FIREBASE_PROJECT_ID               Override Firebase project id.
+  PRAXIS_FIREBASE_FUNCTIONS_REGION         Override Functions region.
+  PRAXIS_FIREBASE_CALLABLE_BASE_URL        Full override base URL (no trailing slash).
+  PRAXIS_GUARD_EVENT_URL                   Full override for guard event endpoint.
+  PRAXIS_APP_URL                           Web app origin for login and approval links.
+  PRAXIS_POLICIES_V1_PATH                  Override path for policies.v1.json (default: ~/.praxis/policies.v1.json).
+  PRAXIS_POLICIES_META_PATH                Override path for policies.v1.meta.json (default beside policy file).
+  PRAXIS_GUARD_STORAGE_ROOT                Workspace root for .praxis/guard tickets/pending (auto-detected from cwd).
+  PRAXIS_HOOK_INLINE_APPROVAL              Set to 0 to disable hook-inline approval request on MUTATE deny (default: on).
+  PRAXIS_HOOK_INLINE_APPROVAL_TIMEOUT_MS   Max ms for inline approval HTTP from hooks (default: 1200).
+`;
+export function printHelp() {
+    process.stdout.write(HELP_TEXT);
+}
+//# sourceMappingURL=help.js.map

package/dist/cli/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/cli/help.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDjB,CAAC;AAEF,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA+DA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyJ1D"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAQA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkH1D"}