@praxis.guard/auditor-cli 0.0.57 → 0.0.59

package/dist/bridge/execution-ticket-record.js

@@ -8,44 +8,45 @@ import { shellApprovalId } from "./execution-ticket-match.js";
 function executionTicketDir(storageRoot) {
     return guardSubpath("tickets", storageRoot);
 }
+function ticketExpiryMs(ticket) {
+    const claims = verifyExecutionTicket(ticket);
+    return claims ? claims.exp * 1000 : Date.now() + 10 * 60 * 1000;
+}
+function buildTicketRecord(ticket, argv, expMs, resolvedRoot, opts, claims, includeFingerprint) {
+    return JSON.stringify({
+        exp: expMs,
+        argv: [...argv],
+        fingerprint: includeFingerprint ? (opts?.approval_fingerprint ?? undefined) : undefined,
+        ticket,
+        kind: opts?.kind ?? claims?.kind ?? "shell",
+        storage_root: resolvedRoot,
+        request_id: opts?.request_id ?? claims?.request_id,
+        argv_sha256: opts?.argv_sha256 ?? claims?.argv_sha256,
+    });
+}
+async function writeTicketFile(dir, id, content) {
+    await writeFile(path.join(dir, `${id}_${randomUUID()}.json`), content, "utf8");
+}
+async function writeArgvAliasTicket(dir, argv, primaryId, aliasContent) {
+    const argvId = shellArgvApprovalId(argv);
+    if (argvId === primaryId)
+        return;
+    await writeTicketFile(dir, argvId, aliasContent);
+}
 /**
  * After redeem, persist a signed execution ticket for hook verification (dual-write with bridge).
- *
- * When a fingerprint is provided the primary file is indexed by the fingerprint hash.
- * We also write an argv-hash alias so hooks that lack fingerprint context (e.g. the
- * Claude Code PreToolUse hook) can find and consume the ticket by argv alone.
  */
 export async function recordExecutionTicket(ticket, argv, opts) {
     const id = shellApprovalId(argv, opts?.approval_fingerprint);
-    const dir = executionTicketDir(opts?.storageRoot);
+    const resolvedRoot = opts?.storageRoot ? path.resolve(opts.storageRoot) : undefined;
+    const dir = executionTicketDir(resolvedRoot);
     await mkdir(dir, { recursive: true });
     const claims = verifyExecutionTicket(ticket);
-    const expMs = claims ? claims.exp * 1000 : Date.now() + 10 * 60 * 1000;
-    const content = JSON.stringify({
-        exp: expMs,
-        argv: [...argv],
-        fingerprint: opts?.approval_fingerprint ?? undefined,
-        ticket,
-        kind: opts?.kind ?? claims?.kind ?? "shell",
-    });
-    const file = path.join(dir, `${id}_${randomUUID()}.json`);
-    await writeFile(file, content, "utf8");
-    // When stored by fingerprint hash, also write an argv-hash alias so hooks
-    // without fingerprint context (e.g. claude-code PreToolUse) can find it.
-    // The alias omits the fingerprint so tryConsumeTicketToken hashes by argv,
-    // matching the argv_sha256 the server put in the JWT.
-    if (opts?.approval_fingerprint && (opts?.kind ?? claims?.kind ?? "shell") === "shell") {
-        const argvId = shellArgvApprovalId(argv);
-        if (argvId !== id) {
-            const aliasContent = JSON.stringify({
-                exp: expMs,
-                argv: [...argv],
-                ticket,
-                kind: opts?.kind ?? claims?.kind ?? "shell",
-            });
-            const aliasFile = path.join(dir, `${argvId}_${randomUUID()}.json`);
-            await writeFile(aliasFile, aliasContent, "utf8");
-        }
+    const expMs = ticketExpiryMs(ticket);
+    const kind = opts?.kind ?? claims?.kind ?? "shell";
+    await writeTicketFile(dir, id, buildTicketRecord(ticket, argv, expMs, resolvedRoot, opts, claims, true));
+    if (opts?.approval_fingerprint && kind === "shell") {
+        await writeArgvAliasTicket(dir, argv, id, buildTicketRecord(ticket, argv, expMs, resolvedRoot, opts, claims, false));
     }
 }
 //# sourceMappingURL=execution-ticket-record.js.map

package/dist/bridge/execution-ticket-record.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-ticket-record.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,SAAS,kBAAkB,CAAC,WAAoB;IAC9C,OAAO,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAuB,EACvB,IAIC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,IAAI,EAAE,oBAAoB,IAAI,SAAS;QACpD,MAAM;QACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvC,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClC,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,MAAM;gBACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;aAC5C,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"execution-ticket-record.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAU9D,SAAS,kBAAkB,CAAC,WAAoB;IAC9C,OAAO,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,IAAuB,EACvB,KAAa,EACb,YAAgC,EAChC,IAA2C,EAC3C,MAAgD,EAChD,kBAA2B;IAE3B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,oBAAoB,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QACvF,MAAM;QACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;QAC3C,YAAY,EAAE,YAAY;QAC1B,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU;QAClD,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,MAAM,EAAE,WAAW;KACtD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,EAAU,EAAE,OAAe;IACrE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAAW,EACX,IAAuB,EACvB,SAAiB,EACjB,YAAoB;IAEpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAuB,EACvB,IAAgC;IAEhC,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC;IAEnD,MAAM,eAAe,CACnB,GAAG,EACH,EAAE,EACF,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CACzE,CAAC;IAEF,IAAI,IAAI,EAAE,oBAAoB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,oBAAoB,CACxB,GAAG,EACH,IAAI,EACJ,EAAE,EACF,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/bridge/execution-ticket-scan.d.ts

@@ -0,0 +1,7 @@
+/** Scan bound repo tickets after already_redeemed when JWT is unavailable. */
+export declare function findExistingExecutionTicket(input: {
+    storageRoot: string;
+    request_id: string;
+    argv_sha256: string;
+}): Promise<boolean>;
+//# sourceMappingURL=execution-ticket-scan.d.ts.map

package/dist/bridge/execution-ticket-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-scan.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket-scan.ts"],"names":[],"mappings":"AAMA,8EAA8E;AAC9E,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCnB"}

package/dist/bridge/execution-ticket-scan.js

@@ -0,0 +1,43 @@
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { verifyExecutionTicket } from "../approval/grant.js";
+import { guardSubpath } from "./guard-storage-root.js";
+/** Scan bound repo tickets after already_redeemed when JWT is unavailable. */
+export async function findExistingExecutionTicket(input) {
+    const dir = guardSubpath("tickets", input.storageRoot);
+    let names = [];
+    try {
+        names = await readdir(dir);
+    }
+    catch {
+        return false;
+    }
+    const now = Date.now();
+    for (const name of names) {
+        if (!name.endsWith(".json"))
+            continue;
+        const file = path.join(dir, name);
+        try {
+            const raw = await readFile(file, "utf8");
+            const row = JSON.parse(raw);
+            if (typeof row.exp !== "number" || row.exp < now)
+                continue;
+            const matchesRequest = row.request_id === input.request_id;
+            const matchesHash = row.argv_sha256 === input.argv_sha256;
+            if (!matchesRequest && !matchesHash)
+                continue;
+            const ticket = typeof row.ticket === "string" ? row.ticket.trim() : "";
+            if (!ticket)
+                continue;
+            if (verifyExecutionTicket(ticket))
+                return true;
+            if (matchesRequest || matchesHash)
+                return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=execution-ticket-scan.js.map

package/dist/bridge/execution-ticket-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-scan.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAKzB,CAAC;YACF,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG;gBAAE,SAAS;YAC3D,MAAM,cAAc,GAAG,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;YAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;YAC1D,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC9C,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,qBAAqB,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,cAAc,IAAI,WAAW;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/bridge/execution-ticket-token.d.ts

@@ -0,0 +1,10 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+export type TicketTokenConsumeOpts = {
+    kind?: "shell" | "mcp";
+    tool_input_sha256?: string | null;
+    approved_argv?: readonly string[];
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+    approved_fingerprint?: ShellApprovalFingerprintPayload | null;
+};
+export declare function tryConsumeTicketToken(ticket: string, argv: readonly string[], opts?: TicketTokenConsumeOpts): boolean;
+//# sourceMappingURL=execution-ticket-token.d.ts.map

package/dist/bridge/execution-ticket-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-token.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket-token.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAGnF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC9D,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,CAAC;AA8EF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAST"}

package/dist/bridge/execution-ticket-token.js

@@ -0,0 +1,57 @@
+import { getInstallId } from "../cli/install-id.js";
+import { verifyExecutionTicket } from "../approval/grant.js";
+import { resolveShellApprovalHash } from "../approval/argv-fingerprint.js";
+import { argvMatchesApproval } from "./execution-ticket-match.js";
+function verifyTicketToolInputHash(opts, claims) {
+    const expectedToolHash = opts?.tool_input_sha256?.trim() || null;
+    const claimToolHash = typeof claims.tool_input_sha256 === "string" ? claims.tool_input_sha256.trim() : null;
+    if (claimToolHash && expectedToolHash && claimToolHash !== expectedToolHash)
+        return false;
+    if (claimToolHash && !expectedToolHash)
+        return false;
+    return true;
+}
+function verifyClaimsInstallAndKind(claims, opts) {
+    if (claims.install_id !== getInstallId())
+        return false;
+    if (opts?.kind && claims.kind !== opts.kind)
+        return false;
+    return verifyTicketToolInputHash(opts, claims);
+}
+function verifyWithoutJwtClaims(argv, opts) {
+    return argvMatchesApproval(opts?.approved_argv, argv, opts?.kind, opts?.approved_fingerprint, opts?.approval_fingerprint);
+}
+function verifyApprovedArgvClaims(claims, argv, approvedArgv, opts) {
+    const approvedHash = resolveShellApprovalHash({
+        kind: opts?.kind ?? claims.kind ?? "shell",
+        argv: approvedArgv,
+        approval_fingerprint: opts?.approved_fingerprint ?? opts?.approval_fingerprint,
+    });
+    if (claims.argv_sha256 !== approvedHash)
+        return false;
+    if (!argvMatchesApproval(approvedArgv, argv, opts?.kind ?? claims.kind, opts?.approved_fingerprint, opts?.approval_fingerprint)) {
+        return false;
+    }
+    return verifyClaimsInstallAndKind(claims, opts);
+}
+function verifyDirectArgvClaims(claims, argv, opts) {
+    const expectedHash = resolveShellApprovalHash({
+        kind: opts?.kind ?? "shell",
+        argv,
+        approval_fingerprint: opts?.approval_fingerprint,
+    });
+    if (claims.argv_sha256 !== expectedHash)
+        return false;
+    return verifyClaimsInstallAndKind(claims, opts);
+}
+export function tryConsumeTicketToken(ticket, argv, opts) {
+    const claims = verifyExecutionTicket(ticket);
+    if (!claims)
+        return verifyWithoutJwtClaims(argv, opts);
+    const approvedArgv = opts?.approved_argv;
+    if (approvedArgv) {
+        return verifyApprovedArgvClaims(claims, argv, approvedArgv, opts);
+    }
+    return verifyDirectArgvClaims(claims, argv, opts);
+}
+//# sourceMappingURL=execution-ticket-token.js.map

package/dist/bridge/execution-ticket-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-token.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAYlE,SAAS,yBAAyB,CAChC,IAAwC,EACxC,MAA6B;IAE7B,MAAM,gBAAgB,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACjE,MAAM,aAAa,GACjB,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,aAAa,IAAI,gBAAgB,IAAI,aAAa,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,MAA6B,EAC7B,IAAwC;IAExC,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAuB,EACvB,IAAwC;IAExC,OAAO,mBAAmB,CACxB,IAAI,EAAE,aAAa,EACnB,IAAI,EACJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,oBAAoB,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAA6B,EAC7B,IAAuB,EACvB,YAA+B,EAC/B,IAAwC;IAExC,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;QAC1C,IAAI,EAAE,YAAY;QAClB,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,IAAI,IAAI,EAAE,oBAAoB;KAC/E,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACtD,IACE,CAAC,mBAAmB,CAClB,YAAY,EACZ,IAAI,EACJ,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EACzB,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,oBAAoB,CAC3B,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAA6B,EAC7B,IAAuB,EACvB,IAAwC;IAExC,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO;QAC3B,IAAI;QACJ,oBAAoB,EAAE,IAAI,EAAE,oBAAoB;KACjD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,IAAuB,EACvB,IAA6B;IAE7B,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;IACzC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/dist/bridge/guard-storage-root.d.ts

@@ -1,4 +1,5 @@
 import { type WorkspaceHints } from "./guard-workspace-session.js";
+export { isEphemeralWorkspacePath, isReliableWorkspaceRoot, readActiveWorkspaceFromSession, } from "./guard-workspace-session.js";
 /** Canonical (IDE-neutral) subdir for guard runtime state under a workspace root. */
 export declare const GUARD_DIR = ".praxis/guard";
 /** Legacy Cursor-only subdir. Read for back-compat; new writes go to GUARD_DIR. */
@@ -17,6 +18,8 @@ export declare const LEGACY_GUARD_DIR = ".cursor/guard";
 export declare function resolveGuardStorageRoot(preferredCwd?: string): string;
 /** Resolve guard storage from hook/MCP workspace hints (shared by hooks and guard MCP). */
 export declare function resolveGuardStorageRootFromHints(hints?: WorkspaceHints): string;
+/** Persist a resolved repo root so MCP guard writes tickets where hooks read them. */
+export declare function rememberResolvedWorkspaceRoot(resolvedRoot: string): void;
 /** Persist the active workspace so MCP guard can align tickets with hook cwd. */
 export declare function rememberActiveWorkspace(hints?: WorkspaceHints): void;
 /** Absolute path to the guard storage dir for a given preferred cwd. */

package/dist/bridge/guard-storage-root.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-storage-root.d.ts","sourceRoot":"","sources":["../../src/bridge/guard-storage-root.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAWhD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBrE;AAED,2FAA2F;AAC3F,wBAAgB,gCAAgC,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,CAE/E;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,CAQpE;AA4BD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"guard-storage-root.d.ts","sourceRoot":"","sources":["../../src/bridge/guard-storage-root.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAWhD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAsBrE;AAED,2FAA2F;AAC3F,wBAAgB,gCAAgC,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,CAE/E;AAED,sFAAsF;AACtF,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAGxE;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,CAKpE;AA4BD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/bridge/guard-storage-root.js

@@ -1,7 +1,8 @@
 import { existsSync, mkdirSync, renameSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { pickWorkspaceHint, resolvePreferredWorkspaceCwd, writeActiveWorkspaceSession, } from "./guard-workspace-session.js";
+import { pickWorkspaceHint, readActiveWorkspaceFromSession, resolvePreferredWorkspaceCwd, isReliableWorkspaceRoot, writeActiveWorkspaceSession, } from "./guard-workspace-session.js";
+export { isEphemeralWorkspacePath, isReliableWorkspaceRoot, readActiveWorkspaceFromSession, } from "./guard-workspace-session.js";
 /** Canonical (IDE-neutral) subdir for guard runtime state under a workspace root. */
 export const GUARD_DIR = ".praxis/guard";
 /** Legacy Cursor-only subdir. Read for back-compat; new writes go to GUARD_DIR. */
@@ -41,21 +42,30 @@ export function resolveGuardStorageRoot(preferredCwd) {
             break;
         dir = path.dirname(dir);
     }
-    return preferredCwd?.trim() ? path.resolve(preferredCwd.trim()) : process.cwd();
+    const fallback = preferredCwd?.trim() ? path.resolve(preferredCwd.trim()) : process.cwd();
+    if (isReliableWorkspaceRoot(fallback))
+        return fallback;
+    const cached = readActiveWorkspaceFromSession();
+    if (cached)
+        return cached;
+    return fallback;
 }
 /** Resolve guard storage from hook/MCP workspace hints (shared by hooks and guard MCP). */
 export function resolveGuardStorageRootFromHints(hints) {
     return resolveGuardStorageRoot(resolvePreferredWorkspaceCwd(hints));
 }
+/** Persist a resolved repo root so MCP guard writes tickets where hooks read them. */
+export function rememberResolvedWorkspaceRoot(resolvedRoot) {
+    if (!isReliableWorkspaceRoot(resolvedRoot))
+        return;
+    writeActiveWorkspaceSession(resolvedRoot);
+}
 /** Persist the active workspace so MCP guard can align tickets with hook cwd. */
 export function rememberActiveWorkspace(hints) {
     const preferred = pickWorkspaceHint(hints);
     if (!preferred)
         return;
-    const root = resolveGuardStorageRoot(preferred);
-    if (isGlobalHomePraxisMarker(root))
-        return;
-    writeActiveWorkspaceSession(root);
+    rememberResolvedWorkspaceRoot(resolveGuardStorageRoot(preferred));
 }
 const migratedRoots = new Set();
 /**

package/dist/bridge/guard-storage-root.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-storage-root.js","sourceRoot":"","sources":["../../src/bridge/guard-storage-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,2BAA2B,GAE5B,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,uFAAuF;AACvF,SAAS,wBAAwB,CAAC,GAAW;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAqB;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,GAAG,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAEpC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACxF,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACpE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACnD,IAAI,GAAG,KAAK,MAAM;YAAE,MAAM;QAC1B,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AAClF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gCAAgC,CAAC,KAAsB;IACrE,OAAO,uBAAuB,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,wBAAwB,CAAC,IAAI,CAAC;QAAE,OAAO;IAE3C,2BAA2B,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IACpC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAChC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAE7B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,GAAG,KAAK,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,YAAqB;IACnD,MAAM,IAAI,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACnD,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,YAAqB;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAGD,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"guard-storage-root.js","sourceRoot":"","sources":["../../src/bridge/guard-storage-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,uFAAuF;AACvF,SAAS,wBAAwB,CAAC,GAAW;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAqB;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,GAAG,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAEpC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACxF,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACpE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACnD,IAAI,GAAG,KAAK,MAAM;YAAE,MAAM;QAC1B,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1F,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvD,MAAM,MAAM,GAAG,8BAA8B,EAAE,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gCAAgC,CAAC,KAAsB;IACrE,OAAO,uBAAuB,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC;QAAE,OAAO;IACnD,2BAA2B,CAAC,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,6BAA6B,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IACpC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAChC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAE7B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,GAAG,KAAK,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,YAAqB;IACnD,MAAM,IAAI,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACnD,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,YAAqB;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAGD,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/bridge/guard-workspace-session.d.ts

@@ -1,8 +1,17 @@
+/**
+ * Hook/MCP scratch dirs under tmp (e.g. auditor-hook-*) must not anchor tickets.
+ * Nested project paths under tmp (…/Projects/Praxis) remain valid for tests and CI.
+ */
+export declare function isEphemeralWorkspacePath(resolved: string): boolean;
+/** Repo-like roots where hooks and MCP should read/write guard state. */
+export declare function isReliableWorkspaceRoot(resolved: string): boolean;
 export type WorkspaceHints = {
     cwd?: string | null;
     workspaceRoot?: string | null;
     workspaceRoots?: readonly string[] | null;
 };
+/** Last hook-fired workspace; ignored when ephemeral or no longer on disk. */
+export declare function readActiveWorkspaceFromSession(): string | undefined;
 export declare function pickWorkspaceHint(hints?: WorkspaceHints): string | undefined;
 /** Best cwd hint for workspace-scoped guard state (hooks, MCP guard, tickets). */
 export declare function resolvePreferredWorkspaceCwd(hints?: WorkspaceHints): string | undefined;

package/dist/bridge/guard-workspace-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-workspace-session.d.ts","sourceRoot":"","sources":["../../src/bridge/guard-workspace-session.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3C,CAAC;AA4CF,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAE5E;AAED,kFAAkF;AAClF,wBAAgB,4BAA4B,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAEvF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAavE"}
+{"version":3,"file":"guard-workspace-session.d.ts","sourceRoot":"","sources":["../../src/bridge/guard-workspace-session.ts"],"names":[],"mappings":"AAYA;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAYlE;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CASjE;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3C,CAAC;AAsBF,8EAA8E;AAC9E,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,SAAS,CAcnE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAE5E;AAED,kFAAkF;AAClF,wBAAgB,4BAA4B,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAEvF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAavE"}

package/dist/bridge/guard-workspace-session.js

@@ -4,6 +4,39 @@ import path from "node:path";
 function activeWorkspaceFile() {
     return path.join(os.homedir(), ".praxis", "guard", "active-workspace.json");
 }
+function isUserHomeDir(dir) {
+    return path.resolve(dir) === path.resolve(os.homedir());
+}
+/**
+ * Hook/MCP scratch dirs under tmp (e.g. auditor-hook-*) must not anchor tickets.
+ * Nested project paths under tmp (…/Projects/Praxis) remain valid for tests and CI.
+ */
+export function isEphemeralWorkspacePath(resolved) {
+    const normalized = path.resolve(resolved);
+    const base = path.basename(normalized);
+    if (/^auditor-hook-/.test(base))
+        return true;
+    const tmp = path.resolve(os.tmpdir());
+    if (normalized !== tmp && !normalized.startsWith(`${tmp}${path.sep}`))
+        return false;
+    const relative = path.relative(tmp, normalized);
+    if (!relative || relative.startsWith(".."))
+        return false;
+    if (relative.includes(path.sep))
+        return false;
+    return !existsSync(path.join(normalized, ".git"));
+}
+/** Repo-like roots where hooks and MCP should read/write guard state. */
+export function isReliableWorkspaceRoot(resolved) {
+    const normalized = path.resolve(resolved);
+    if (isEphemeralWorkspacePath(normalized))
+        return false;
+    if (isUserHomeDir(normalized) && existsSync(path.join(normalized, ".praxis")))
+        return false;
+    return (existsSync(path.join(normalized, ".git")) ||
+        existsSync(path.join(normalized, ".praxis")) ||
+        existsSync(path.join(normalized, ".cursor", "hooks.json")));
+}
 function pickExplicitWorkspaceHint(hints) {
     const envRoot = process.env.PRAXIS_GUARD_WORKSPACE_ROOT?.trim();
     if (envRoot)
@@ -23,7 +56,8 @@ function pickExplicitWorkspaceHint(hints) {
     }
     return undefined;
 }
-function readActiveWorkspaceFromSession() {
+/** Last hook-fired workspace; ignored when ephemeral or no longer on disk. */
+export function readActiveWorkspaceFromSession() {
     try {
         const raw = readFileSync(activeWorkspaceFile(), "utf8");
         const parsed = JSON.parse(raw);
@@ -33,16 +67,13 @@ function readActiveWorkspaceFromSession() {
         const root = path.resolve(parsed.workspace_root.trim());
         if (!existsSync(root))
             return undefined;
-        if (existsSync(path.join(root, ".git")) ||
-            existsSync(path.join(root, ".praxis")) ||
-            existsSync(path.join(root, ".cursor", "hooks.json"))) {
-            return root;
-        }
+        if (!isReliableWorkspaceRoot(root))
+            return undefined;
+        return root;
     }
     catch {
         return undefined;
     }
-    return undefined;
 }
 export function pickWorkspaceHint(hints) {
     return pickExplicitWorkspaceHint(hints);

package/dist/bridge/guard-workspace-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-workspace-session.js","sourceRoot":"","sources":["../../src/bridge/guard-workspace-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,mBAAmB;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;AAC9E,CAAC;AAQD,SAAS,yBAAyB,CAAC,KAAsB;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,aAAa,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,EAAE,cAAc,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,CAAC;QAC/D,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IACE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACnC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,EACpD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,4BAA4B,CAAC,KAAsB;IACjE,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,8BAA8B,EAAE,CAAC;AAC9E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAC1C,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CACX,WAAW,EACX,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,GAAG,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}
+{"version":3,"file":"guard-workspace-session.js","sourceRoot":"","sources":["../../src/bridge/guard-workspace-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,mBAAmB;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,IAAI,UAAU,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,wBAAwB,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,OAAO,CACL,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAQD,SAAS,yBAAyB,CAAC,KAAsB;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,aAAa,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,EAAE,cAAc,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,8BAA8B;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,CAAC;QAC/D,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,4BAA4B,CAAC,KAAsB;IACjE,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,8BAA8B,EAAE,CAAC;AAC9E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAC1C,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CACX,WAAW,EACX,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,GAAG,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/bridge/request-binding-index.d.ts

@@ -0,0 +1,20 @@
+export type RequestBindingRecord = {
+    request_id: string;
+    storage_root: string;
+    argv_sha256: string;
+    argv: string[];
+    kind: "shell" | "mcp";
+    install_id: string;
+    created_at: string;
+    expires_at: string;
+};
+export type RequestBindingIndexHealth = {
+    bindingCount: number;
+    lastBinding: RequestBindingRecord | null;
+    legacyHomeTicketsDir: boolean;
+};
+export declare function writeRequestBinding(entry: RequestBindingRecord): void;
+export declare function readRequestBinding(requestId: string): RequestBindingRecord | null;
+export declare function deleteRequestBinding(requestId: string): void;
+export declare function inspectRequestBindingIndex(): RequestBindingIndexHealth;
+//# sourceMappingURL=request-binding-index.d.ts.map

package/dist/bridge/request-binding-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding-index.d.ts","sourceRoot":"","sources":["../../src/bridge/request-binding-index.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,oBAAoB,EAAE,OAAO,CAAC;CAC/B,CAAC;AAyCF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAOrE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAajF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAM5D;AAED,wBAAgB,0BAA0B,IAAI,yBAAyB,CA6BtE"}

package/dist/bridge/request-binding-index.js

@@ -0,0 +1,100 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+function requestBindingsDir() {
+    return path.join(os.homedir(), ".praxis", "guard", "request-bindings");
+}
+function bindingPath(requestId) {
+    return path.join(requestBindingsDir(), `${requestId}.json`);
+}
+function isBindingExpired(record) {
+    const expires = Date.parse(record.expires_at);
+    return Number.isFinite(expires) && expires < Date.now();
+}
+function nonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function hasValidBindingShape(record) {
+    return (nonEmptyString(record.storage_root) &&
+        nonEmptyString(record.argv_sha256) &&
+        Array.isArray(record.argv) &&
+        (record.kind === "shell" || record.kind === "mcp") &&
+        nonEmptyString(record.install_id) &&
+        nonEmptyString(record.expires_at));
+}
+function parseValidBindingRecord(parsed, requestId) {
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const record = parsed;
+    if (record.request_id !== requestId || !hasValidBindingShape(record))
+        return null;
+    if (isBindingExpired(record))
+        return null;
+    return {
+        ...record,
+        storage_root: path.resolve(record.storage_root.trim()),
+    };
+}
+export function writeRequestBinding(entry) {
+    const dir = requestBindingsDir();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(bindingPath(entry.request_id), `${JSON.stringify(entry, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+export function readRequestBinding(requestId) {
+    try {
+        const raw = readFileSync(bindingPath(requestId), "utf8");
+        const parsed = JSON.parse(raw);
+        const record = parseValidBindingRecord(parsed, requestId);
+        if (record)
+            return record;
+        if (parsed && typeof parsed === "object" && isBindingExpired(parsed)) {
+            deleteRequestBinding(requestId);
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function deleteRequestBinding(requestId) {
+    try {
+        unlinkSync(bindingPath(requestId));
+    }
+    catch {
+        // best-effort
+    }
+}
+export function inspectRequestBindingIndex() {
+    const dir = requestBindingsDir();
+    const legacyHomeTicketsDir = existsSync(path.join(os.homedir(), ".praxis", "guard", "tickets"));
+    let bindingCount = 0;
+    let lastBinding = null;
+    let lastMtime = 0;
+    if (!existsSync(dir)) {
+        return { bindingCount: 0, lastBinding: null, legacyHomeTicketsDir };
+    }
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith(".json"))
+            continue;
+        const requestId = name.slice(0, -".json".length);
+        const record = readRequestBinding(requestId);
+        if (!record)
+            continue;
+        bindingCount += 1;
+        try {
+            const mtime = statSync(bindingPath(requestId)).mtimeMs;
+            if (mtime >= lastMtime) {
+                lastMtime = mtime;
+                lastBinding = record;
+            }
+        }
+        catch {
+            lastBinding = record;
+        }
+    }
+    return { bindingCount, lastBinding, legacyHomeTicketsDir };
+}
+//# sourceMappingURL=request-binding-index.js.map

package/dist/bridge/request-binding-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding-index.js","sourceRoot":"","sources":["../../src/bridge/request-binding-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA4B;IACxD,OAAO,CACL,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;QACnC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;QAClD,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;QACjC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAe,EAAE,SAAiB;IACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,MAA8B,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC7D,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClF,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC,MAA8B,CAAC,EAAE,CAAC;YAC7F,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,IAAI,CAAC;QACH,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAChG,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,WAAW,GAAgC,IAAI,CAAC;IACpD,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;gBACvB,SAAS,GAAG,KAAK,CAAC;gBAClB,WAAW,GAAG,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;AAC7D,CAAC"}

package/dist/bridge/request-binding-write.d.ts

@@ -0,0 +1,10 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+export declare function recordRequestBinding(input: {
+    request_id: string;
+    storage_root: string;
+    argv: readonly string[];
+    kind: "shell" | "mcp";
+    expires_at: string;
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+}): void;
+//# sourceMappingURL=request-binding-write.d.ts.map

package/dist/bridge/request-binding-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding-write.d.ts","sourceRoot":"","sources":["../../src/bridge/request-binding-write.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAGnF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GAAG,IAAI,CAgBP"}

package/dist/bridge/request-binding-write.js

@@ -0,0 +1,21 @@
+import { getInstallId } from "../cli/install-id.js";
+import { resolveShellApprovalHash } from "../approval/argv-fingerprint.js";
+import { writeRequestBinding } from "./request-binding-index.js";
+export function recordRequestBinding(input) {
+    const entry = {
+        request_id: input.request_id,
+        storage_root: input.storage_root,
+        argv_sha256: resolveShellApprovalHash({
+            kind: input.kind,
+            argv: input.argv,
+            approval_fingerprint: input.approval_fingerprint,
+        }),
+        argv: [...input.argv],
+        kind: input.kind,
+        install_id: getInstallId(),
+        created_at: new Date().toISOString(),
+        expires_at: input.expires_at,
+    };
+    writeRequestBinding(entry);
+}
+//# sourceMappingURL=request-binding-write.js.map

package/dist/bridge/request-binding-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding-write.js","sourceRoot":"","sources":["../../src/bridge/request-binding-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAA6B,MAAM,4BAA4B,CAAC;AAE5F,MAAM,UAAU,oBAAoB,CAAC,KAOpC;IACC,MAAM,KAAK,GAAyB;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,wBAAwB,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,YAAY,EAAE;QAC1B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IACF,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAUtE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,EAAE,EACjE,OAAO,EAAE,OAAO,GACf,SAAS,CAOX;AA6DD,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAiG/C"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWtE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,EAAE,EACjE,OAAO,EAAE,OAAO,GACf,SAAS,CAOX;AA6DD,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA8G/C"}