@praxis.guard/auditor-cli 0.0.58 → 0.0.60

package/dist/bridge/execution-ticket-record.js

@@ -8,44 +8,45 @@ import { shellApprovalId } from "./execution-ticket-match.js";
 function executionTicketDir(storageRoot) {
     return guardSubpath("tickets", storageRoot);
 }
+function ticketExpiryMs(ticket) {
+    const claims = verifyExecutionTicket(ticket);
+    return claims ? claims.exp * 1000 : Date.now() + 10 * 60 * 1000;
+}
+function buildTicketRecord(ticket, argv, expMs, resolvedRoot, opts, claims, includeFingerprint) {
+    return JSON.stringify({
+        exp: expMs,
+        argv: [...argv],
+        fingerprint: includeFingerprint ? (opts?.approval_fingerprint ?? undefined) : undefined,
+        ticket,
+        kind: opts?.kind ?? claims?.kind ?? "shell",
+        storage_root: resolvedRoot,
+        request_id: opts?.request_id ?? claims?.request_id,
+        argv_sha256: opts?.argv_sha256 ?? claims?.argv_sha256,
+    });
+}
+async function writeTicketFile(dir, id, content) {
+    await writeFile(path.join(dir, `${id}_${randomUUID()}.json`), content, "utf8");
+}
+async function writeArgvAliasTicket(dir, argv, primaryId, aliasContent) {
+    const argvId = shellArgvApprovalId(argv);
+    if (argvId === primaryId)
+        return;
+    await writeTicketFile(dir, argvId, aliasContent);
+}
 /**
  * After redeem, persist a signed execution ticket for hook verification (dual-write with bridge).
- *
- * When a fingerprint is provided the primary file is indexed by the fingerprint hash.
- * We also write an argv-hash alias so hooks that lack fingerprint context (e.g. the
- * Claude Code PreToolUse hook) can find and consume the ticket by argv alone.
  */
 export async function recordExecutionTicket(ticket, argv, opts) {
     const id = shellApprovalId(argv, opts?.approval_fingerprint);
-    const dir = executionTicketDir(opts?.storageRoot);
+    const resolvedRoot = opts?.storageRoot ? path.resolve(opts.storageRoot) : undefined;
+    const dir = executionTicketDir(resolvedRoot);
     await mkdir(dir, { recursive: true });
     const claims = verifyExecutionTicket(ticket);
-    const expMs = claims ? claims.exp * 1000 : Date.now() + 10 * 60 * 1000;
-    const content = JSON.stringify({
-        exp: expMs,
-        argv: [...argv],
-        fingerprint: opts?.approval_fingerprint ?? undefined,
-        ticket,
-        kind: opts?.kind ?? claims?.kind ?? "shell",
-    });
-    const file = path.join(dir, `${id}_${randomUUID()}.json`);
-    await writeFile(file, content, "utf8");
-    // When stored by fingerprint hash, also write an argv-hash alias so hooks
-    // without fingerprint context (e.g. claude-code PreToolUse) can find it.
-    // The alias omits the fingerprint so tryConsumeTicketToken hashes by argv,
-    // matching the argv_sha256 the server put in the JWT.
-    if (opts?.approval_fingerprint && (opts?.kind ?? claims?.kind ?? "shell") === "shell") {
-        const argvId = shellArgvApprovalId(argv);
-        if (argvId !== id) {
-            const aliasContent = JSON.stringify({
-                exp: expMs,
-                argv: [...argv],
-                ticket,
-                kind: opts?.kind ?? claims?.kind ?? "shell",
-            });
-            const aliasFile = path.join(dir, `${argvId}_${randomUUID()}.json`);
-            await writeFile(aliasFile, aliasContent, "utf8");
-        }
+    const expMs = ticketExpiryMs(ticket);
+    const kind = opts?.kind ?? claims?.kind ?? "shell";
+    await writeTicketFile(dir, id, buildTicketRecord(ticket, argv, expMs, resolvedRoot, opts, claims, true));
+    if (opts?.approval_fingerprint && kind === "shell") {
+        await writeArgvAliasTicket(dir, argv, id, buildTicketRecord(ticket, argv, expMs, resolvedRoot, opts, claims, false));
     }
 }
 //# sourceMappingURL=execution-ticket-record.js.map

package/dist/bridge/execution-ticket-record.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-ticket-record.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,SAAS,kBAAkB,CAAC,WAAoB;IAC9C,OAAO,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAuB,EACvB,IAIC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,IAAI,EAAE,oBAAoB,IAAI,SAAS;QACpD,MAAM;QACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;KAC5C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvC,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClC,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;gBACf,MAAM;gBACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;aAC5C,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"execution-ticket-record.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAU9D,SAAS,kBAAkB,CAAC,WAAoB;IAC9C,OAAO,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,IAAuB,EACvB,KAAa,EACb,YAAgC,EAChC,IAA2C,EAC3C,MAAgD,EAChD,kBAA2B;IAE3B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,oBAAoB,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QACvF,MAAM;QACN,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO;QAC3C,YAAY,EAAE,YAAY;QAC1B,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU;QAClD,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,MAAM,EAAE,WAAW;KACtD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,EAAU,EAAE,OAAe;IACrE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAAW,EACX,IAAuB,EACvB,SAAiB,EACjB,YAAoB;IAEpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,IAAuB,EACvB,IAAgC;IAEhC,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC;IAEnD,MAAM,eAAe,CACnB,GAAG,EACH,EAAE,EACF,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CACzE,CAAC;IAEF,IAAI,IAAI,EAAE,oBAAoB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,oBAAoB,CACxB,GAAG,EACH,IAAI,EACJ,EAAE,EACF,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/bridge/execution-ticket-scan.d.ts

@@ -0,0 +1,7 @@
+/** Scan bound repo tickets after already_redeemed when JWT is unavailable. */
+export declare function findExistingExecutionTicket(input: {
+    storageRoot: string;
+    request_id: string;
+    argv_sha256: string;
+}): Promise<boolean>;
+//# sourceMappingURL=execution-ticket-scan.d.ts.map

package/dist/bridge/execution-ticket-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-scan.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket-scan.ts"],"names":[],"mappings":"AAMA,8EAA8E;AAC9E,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkCnB"}

package/dist/bridge/execution-ticket-scan.js

@@ -0,0 +1,43 @@
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { verifyExecutionTicket } from "../approval/grant.js";
+import { guardSubpath } from "./guard-storage-root.js";
+/** Scan bound repo tickets after already_redeemed when JWT is unavailable. */
+export async function findExistingExecutionTicket(input) {
+    const dir = guardSubpath("tickets", input.storageRoot);
+    let names = [];
+    try {
+        names = await readdir(dir);
+    }
+    catch {
+        return false;
+    }
+    const now = Date.now();
+    for (const name of names) {
+        if (!name.endsWith(".json"))
+            continue;
+        const file = path.join(dir, name);
+        try {
+            const raw = await readFile(file, "utf8");
+            const row = JSON.parse(raw);
+            if (typeof row.exp !== "number" || row.exp < now)
+                continue;
+            const matchesRequest = row.request_id === input.request_id;
+            const matchesHash = row.argv_sha256 === input.argv_sha256;
+            if (!matchesRequest && !matchesHash)
+                continue;
+            const ticket = typeof row.ticket === "string" ? row.ticket.trim() : "";
+            if (!ticket)
+                continue;
+            if (verifyExecutionTicket(ticket))
+                return true;
+            if (matchesRequest || matchesHash)
+                return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=execution-ticket-scan.js.map

package/dist/bridge/execution-ticket-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-scan.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAKzB,CAAC;YACF,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG;gBAAE,SAAS;YAC3D,MAAM,cAAc,GAAG,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;YAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;YAC1D,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC9C,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,qBAAqB,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,cAAc,IAAI,WAAW;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/bridge/execution-ticket-token.d.ts

@@ -0,0 +1,10 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+export type TicketTokenConsumeOpts = {
+    kind?: "shell" | "mcp";
+    tool_input_sha256?: string | null;
+    approved_argv?: readonly string[];
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+    approved_fingerprint?: ShellApprovalFingerprintPayload | null;
+};
+export declare function tryConsumeTicketToken(ticket: string, argv: readonly string[], opts?: TicketTokenConsumeOpts): boolean;
+//# sourceMappingURL=execution-ticket-token.d.ts.map

package/dist/bridge/execution-ticket-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-token.d.ts","sourceRoot":"","sources":["../../src/bridge/execution-ticket-token.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAGnF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC9D,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,CAAC;AA8EF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAST"}

package/dist/bridge/execution-ticket-token.js

@@ -0,0 +1,57 @@
+import { getInstallId } from "../cli/install-id.js";
+import { verifyExecutionTicket } from "../approval/grant.js";
+import { resolveShellApprovalHash } from "../approval/argv-fingerprint.js";
+import { argvMatchesApproval } from "./execution-ticket-match.js";
+function verifyTicketToolInputHash(opts, claims) {
+    const expectedToolHash = opts?.tool_input_sha256?.trim() || null;
+    const claimToolHash = typeof claims.tool_input_sha256 === "string" ? claims.tool_input_sha256.trim() : null;
+    if (claimToolHash && expectedToolHash && claimToolHash !== expectedToolHash)
+        return false;
+    if (claimToolHash && !expectedToolHash)
+        return false;
+    return true;
+}
+function verifyClaimsInstallAndKind(claims, opts) {
+    if (claims.install_id !== getInstallId())
+        return false;
+    if (opts?.kind && claims.kind !== opts.kind)
+        return false;
+    return verifyTicketToolInputHash(opts, claims);
+}
+function verifyWithoutJwtClaims(argv, opts) {
+    return argvMatchesApproval(opts?.approved_argv, argv, opts?.kind, opts?.approved_fingerprint, opts?.approval_fingerprint);
+}
+function verifyApprovedArgvClaims(claims, argv, approvedArgv, opts) {
+    const approvedHash = resolveShellApprovalHash({
+        kind: opts?.kind ?? claims.kind ?? "shell",
+        argv: approvedArgv,
+        approval_fingerprint: opts?.approved_fingerprint ?? opts?.approval_fingerprint,
+    });
+    if (claims.argv_sha256 !== approvedHash)
+        return false;
+    if (!argvMatchesApproval(approvedArgv, argv, opts?.kind ?? claims.kind, opts?.approved_fingerprint, opts?.approval_fingerprint)) {
+        return false;
+    }
+    return verifyClaimsInstallAndKind(claims, opts);
+}
+function verifyDirectArgvClaims(claims, argv, opts) {
+    const expectedHash = resolveShellApprovalHash({
+        kind: opts?.kind ?? "shell",
+        argv,
+        approval_fingerprint: opts?.approval_fingerprint,
+    });
+    if (claims.argv_sha256 !== expectedHash)
+        return false;
+    return verifyClaimsInstallAndKind(claims, opts);
+}
+export function tryConsumeTicketToken(ticket, argv, opts) {
+    const claims = verifyExecutionTicket(ticket);
+    if (!claims)
+        return verifyWithoutJwtClaims(argv, opts);
+    const approvedArgv = opts?.approved_argv;
+    if (approvedArgv) {
+        return verifyApprovedArgvClaims(claims, argv, approvedArgv, opts);
+    }
+    return verifyDirectArgvClaims(claims, argv, opts);
+}
+//# sourceMappingURL=execution-ticket-token.js.map

package/dist/bridge/execution-ticket-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-ticket-token.js","sourceRoot":"","sources":["../../src/bridge/execution-ticket-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAYlE,SAAS,yBAAyB,CAChC,IAAwC,EACxC,MAA6B;IAE7B,MAAM,gBAAgB,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACjE,MAAM,aAAa,GACjB,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,aAAa,IAAI,gBAAgB,IAAI,aAAa,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,aAAa,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CACjC,MAA6B,EAC7B,IAAwC;IAExC,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAuB,EACvB,IAAwC;IAExC,OAAO,mBAAmB,CACxB,IAAI,EAAE,aAAa,EACnB,IAAI,EACJ,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,oBAAoB,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAA6B,EAC7B,IAAuB,EACvB,YAA+B,EAC/B,IAAwC;IAExC,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;QAC1C,IAAI,EAAE,YAAY;QAClB,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,IAAI,IAAI,EAAE,oBAAoB;KAC/E,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACtD,IACE,CAAC,mBAAmB,CAClB,YAAY,EACZ,IAAI,EACJ,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EACzB,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,oBAAoB,CAC3B,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAA6B,EAC7B,IAAuB,EACvB,IAAwC;IAExC,MAAM,YAAY,GAAG,wBAAwB,CAAC;QAC5C,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO;QAC3B,IAAI;QACJ,oBAAoB,EAAE,IAAI,EAAE,oBAAoB;KACjD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,IAAuB,EACvB,IAA6B;IAE7B,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;IACzC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/dist/bridge/request-binding-index.d.ts

@@ -0,0 +1,20 @@
+export type RequestBindingRecord = {
+    request_id: string;
+    storage_root: string;
+    argv_sha256: string;
+    argv: string[];
+    kind: "shell" | "mcp";
+    install_id: string;
+    created_at: string;
+    expires_at: string;
+};
+export type RequestBindingIndexHealth = {
+    bindingCount: number;
+    lastBinding: RequestBindingRecord | null;
+    legacyHomeTicketsDir: boolean;
+};
+export declare function writeRequestBinding(entry: RequestBindingRecord): void;
+export declare function readRequestBinding(requestId: string): RequestBindingRecord | null;
+export declare function deleteRequestBinding(requestId: string): void;
+export declare function inspectRequestBindingIndex(): RequestBindingIndexHealth;
+//# sourceMappingURL=request-binding-index.d.ts.map

package/dist/bridge/request-binding-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding-index.d.ts","sourceRoot":"","sources":["../../src/bridge/request-binding-index.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,oBAAoB,EAAE,OAAO,CAAC;CAC/B,CAAC;AAyCF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAOrE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAajF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAM5D;AAED,wBAAgB,0BAA0B,IAAI,yBAAyB,CA6BtE"}

package/dist/bridge/request-binding-index.js

@@ -0,0 +1,100 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+function requestBindingsDir() {
+    return path.join(os.homedir(), ".praxis", "guard", "request-bindings");
+}
+function bindingPath(requestId) {
+    return path.join(requestBindingsDir(), `${requestId}.json`);
+}
+function isBindingExpired(record) {
+    const expires = Date.parse(record.expires_at);
+    return Number.isFinite(expires) && expires < Date.now();
+}
+function nonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function hasValidBindingShape(record) {
+    return (nonEmptyString(record.storage_root) &&
+        nonEmptyString(record.argv_sha256) &&
+        Array.isArray(record.argv) &&
+        (record.kind === "shell" || record.kind === "mcp") &&
+        nonEmptyString(record.install_id) &&
+        nonEmptyString(record.expires_at));
+}
+function parseValidBindingRecord(parsed, requestId) {
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const record = parsed;
+    if (record.request_id !== requestId || !hasValidBindingShape(record))
+        return null;
+    if (isBindingExpired(record))
+        return null;
+    return {
+        ...record,
+        storage_root: path.resolve(record.storage_root.trim()),
+    };
+}
+export function writeRequestBinding(entry) {
+    const dir = requestBindingsDir();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(bindingPath(entry.request_id), `${JSON.stringify(entry, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+export function readRequestBinding(requestId) {
+    try {
+        const raw = readFileSync(bindingPath(requestId), "utf8");
+        const parsed = JSON.parse(raw);
+        const record = parseValidBindingRecord(parsed, requestId);
+        if (record)
+            return record;
+        if (parsed && typeof parsed === "object" && isBindingExpired(parsed)) {
+            deleteRequestBinding(requestId);
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function deleteRequestBinding(requestId) {
+    try {
+        unlinkSync(bindingPath(requestId));
+    }
+    catch {
+        // best-effort
+    }
+}
+export function inspectRequestBindingIndex() {
+    const dir = requestBindingsDir();
+    const legacyHomeTicketsDir = existsSync(path.join(os.homedir(), ".praxis", "guard", "tickets"));
+    let bindingCount = 0;
+    let lastBinding = null;
+    let lastMtime = 0;
+    if (!existsSync(dir)) {
+        return { bindingCount: 0, lastBinding: null, legacyHomeTicketsDir };
+    }
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith(".json"))
+            continue;
+        const requestId = name.slice(0, -".json".length);
+        const record = readRequestBinding(requestId);
+        if (!record)
+            continue;
+        bindingCount += 1;
+        try {
+            const mtime = statSync(bindingPath(requestId)).mtimeMs;
+            if (mtime >= lastMtime) {
+                lastMtime = mtime;
+                lastBinding = record;
+            }
+        }
+        catch {
+            lastBinding = record;
+        }
+    }
+    return { bindingCount, lastBinding, legacyHomeTicketsDir };
+}
+//# sourceMappingURL=request-binding-index.js.map

package/dist/bridge/request-binding-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding-index.js","sourceRoot":"","sources":["../../src/bridge/request-binding-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA4B;IACxD,OAAO,CACL,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;QACnC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;QAClD,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;QACjC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAe,EAAE,SAAiB;IACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,MAA8B,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC7D,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClF,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC,MAA8B,CAAC,EAAE,CAAC;YAC7F,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,IAAI,CAAC;QACH,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAChG,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,WAAW,GAAgC,IAAI,CAAC;IACpD,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;gBACvB,SAAS,GAAG,KAAK,CAAC;gBAClB,WAAW,GAAG,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;AAC7D,CAAC"}

package/dist/bridge/request-binding-write.d.ts

@@ -0,0 +1,10 @@
+import type { ShellApprovalFingerprintPayload } from "../shell/analyze-command.js";
+export declare function recordRequestBinding(input: {
+    request_id: string;
+    storage_root: string;
+    argv: readonly string[];
+    kind: "shell" | "mcp";
+    expires_at: string;
+    approval_fingerprint?: ShellApprovalFingerprintPayload | null;
+}): void;
+//# sourceMappingURL=request-binding-write.d.ts.map

package/dist/bridge/request-binding-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding-write.d.ts","sourceRoot":"","sources":["../../src/bridge/request-binding-write.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAGnF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D,GAAG,IAAI,CAgBP"}

package/dist/bridge/request-binding-write.js

@@ -0,0 +1,21 @@
+import { getInstallId } from "../cli/install-id.js";
+import { resolveShellApprovalHash } from "../approval/argv-fingerprint.js";
+import { writeRequestBinding } from "./request-binding-index.js";
+export function recordRequestBinding(input) {
+    const entry = {
+        request_id: input.request_id,
+        storage_root: input.storage_root,
+        argv_sha256: resolveShellApprovalHash({
+            kind: input.kind,
+            argv: input.argv,
+            approval_fingerprint: input.approval_fingerprint,
+        }),
+        argv: [...input.argv],
+        kind: input.kind,
+        install_id: getInstallId(),
+        created_at: new Date().toISOString(),
+        expires_at: input.expires_at,
+    };
+    writeRequestBinding(entry);
+}
+//# sourceMappingURL=request-binding-write.js.map

package/dist/bridge/request-binding-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-binding-write.js","sourceRoot":"","sources":["../../src/bridge/request-binding-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAA6B,MAAM,4BAA4B,CAAC;AAE5F,MAAM,UAAU,oBAAoB,CAAC,KAOpC;IACC,MAAM,KAAK,GAAyB;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,wBAAwB,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC;QACF,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,YAAY,EAAE;QAC1B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IACF,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAUtE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,EAAE,EACjE,OAAO,EAAE,OAAO,GACf,SAAS,CAOX;AA6DD,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAiG/C"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWtE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,EAAE,EACjE,OAAO,EAAE,OAAO,GACf,SAAS,CAOX;AA6DD,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA8G/C"}

package/dist/cli/doctor.js

@@ -2,6 +2,7 @@ import process from "node:process";
 import { existsSync } from "node:fs";
 import { defaultPoliciesMetaPath, defaultPoliciesV1Path } from "../policy/index.js";
 import { ALL_ADAPTERS } from "../adapters/registry.js";
+import { inspectRequestBindingIndex } from "../bridge/request-binding-index.js";
 import { executionTicketDir } from "../bridge/execution-ticket.js";
 import { shellBridgeDir } from "../bridge/shell-approval-bridge.js";
 import { guardSubpath } from "../bridge/guard-storage-root.js";
@@ -102,6 +103,14 @@ export async function runDoctor() {
         `Audit log: ${auditPath}`,
         `PRAXIS_GUARD_AUDIT_LOG: ${process.env.PRAXIS_GUARD_AUDIT_LOG ?? "(unset; default above)"}`,
     ];
+    const bindingHealth = inspectRequestBindingIndex();
+    lines.push(`Request bindings: ${bindingHealth.bindingCount} under ~/.praxis/guard/request-bindings/`);
+    if (bindingHealth.lastBinding) {
+        lines.push(`  Last binding: request_id=${bindingHealth.lastBinding.request_id} storage_root=${bindingHealth.lastBinding.storage_root}`);
+    }
+    if (bindingHealth.legacyHomeTicketsDir) {
+        lines.push("  warn: ~/.praxis/guard/tickets exists (legacy misroute). Tickets belong under <repo>/.praxis/guard/tickets/.");
+    }
     lines.push("Agents:");
     const adapterStatuses = [];
     for (const adapter of ALL_ADAPTERS) {

package/dist/cli/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAI1D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,eAAiE,EACjE,OAAgB;IAEhB,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CACnE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAC9B,CAAC;IACF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC/F,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB,EAAE,MAAmB;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,oFAAoF;IACpF,4FAA4F;IAC5F,MAAM,UAAU,GACd,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;IACxF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAe,EACf,OAAqB,EACrB,MAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;QAC1C,IAAI,WAAW,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC;YACnD,KAAK,CAAC,IAAI,CACR,sBAAsB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sCAAsC,KAAK,WAAW,CAAC,IAAI,GAAG,CAC5G,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,WAAW,CAAC,UAAU,IAAI,aAAa,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,WAAW,CAAC,QAAQ,IAAI,WAAW,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAC5K,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC;YACrD,KAAK,CAAC,IAAI,CACR,uBAAuB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gDAAgD,KAAK,YAAY,CAAC,IAAI,GAAG,CACxH,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,YAAY,CAAC,UAAU,IAAI,aAAa,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,CAAC,QAAQ,IAAI,WAAW,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAChL,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qCAAqC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC9F,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,wBAAwB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC9D,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,mBAAmB;YACpC,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,qDAAqD,CAAC;IAE9D,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,eAAe,YAAY,EAAE,EAAE;QAC/B,sEAAsE;QACtE,SAAS,OAAO,CAAC,OAAO,EAAE;QAC1B,gBAAgB,UAAU,EAAE;QAC5B,kBAAkB,YAAY,EAAE;QAChC,kBAAkB,QAAQ,EAAE;QAC5B,IAAI;YACF,CAAC,CAAC,4BAA4B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,uEAAuE;QAC3E,eAAe,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE;QACnD,cAAc,SAAS,EAAE;QACzB,2BAA2B,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,EAAE;KAC5F,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,eAAe,GAAqD,EAAE,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACxD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,QAAQ,eAAe,EAAE,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,CAAC,IAAI,CACR,WAAW;QACT,CAAC,CAAC,SAAS,WAAW,YAAY,KAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACF,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,KAAK;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IAEpE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAuB;gBAChD,GAAG,EAAE,eAAe;gBACpB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACtB,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,qCAAqC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,CAC/E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,wBAAwB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,KAAK,CAAC,IAAI,CACR,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,UAAU,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAC7H,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAI1D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,eAAiE,EACjE,OAAgB;IAEhB,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CACnE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAC9B,CAAC;IACF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC/F,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB,EAAE,MAAmB;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,oFAAoF;IACpF,4FAA4F;IAC5F,MAAM,UAAU,GACd,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;IACxF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAe,EACf,OAAqB,EACrB,MAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;QAC1C,IAAI,WAAW,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC;YACnD,KAAK,CAAC,IAAI,CACR,sBAAsB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sCAAsC,KAAK,WAAW,CAAC,IAAI,GAAG,CAC5G,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,WAAW,CAAC,UAAU,IAAI,aAAa,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,WAAW,CAAC,QAAQ,IAAI,WAAW,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAC5K,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC;YACrD,KAAK,CAAC,IAAI,CACR,uBAAuB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gDAAgD,KAAK,YAAY,CAAC,IAAI,GAAG,CACxH,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,YAAY,CAAC,UAAU,IAAI,aAAa,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,CAAC,QAAQ,IAAI,WAAW,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAChL,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qCAAqC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC9F,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,wBAAwB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC9D,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,mBAAmB;YACpC,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,qDAAqD,CAAC;IAE9D,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,eAAe,YAAY,EAAE,EAAE;QAC/B,sEAAsE;QACtE,SAAS,OAAO,CAAC,OAAO,EAAE;QAC1B,gBAAgB,UAAU,EAAE;QAC5B,kBAAkB,YAAY,EAAE;QAChC,kBAAkB,QAAQ,EAAE;QAC5B,IAAI;YACF,CAAC,CAAC,4BAA4B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,uEAAuE;QAC3E,eAAe,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE;QACnD,cAAc,SAAS,EAAE;QACzB,2BAA2B,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,EAAE;KAC5F,CAAC;IAEF,MAAM,aAAa,GAAG,0BAA0B,EAAE,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,YAAY,0CAA0C,CAAC,CAAC;IACtG,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,8BAA8B,aAAa,CAAC,WAAW,CAAC,UAAU,iBAAiB,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,oBAAoB,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,+GAA+G,CAChH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,eAAe,GAAqD,EAAE,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACxD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,QAAQ,eAAe,EAAE,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,CAAC,IAAI,CACR,WAAW;QACT,CAAC,CAAC,SAAS,WAAW,YAAY,KAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACF,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,KAAK;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IAEpE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAuB;gBAChD,GAAG,EAAE,eAAe;gBACpB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACtB,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,qCAAqC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,CAC/E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,wBAAwB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,KAAK,CAAC,IAAI,CACR,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,UAAU,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAC7H,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/hooks/agent-message.d.ts

@@ -6,6 +6,8 @@ export type FormatHookDenyMessagesInput = {
     argv: readonly string[];
     reasons: readonly string[];
     toolName?: string | null;
+    /** Hook-resolved workspace root for guard_wait proposal.cwd. */
+    storageRoot?: string | null;
     /** When hook-inline approval created a request on deny. */
     inlineApproval?: {
         request_id: string;

package/dist/hooks/agent-message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-message.d.ts","sourceRoot":"","sources":["../../src/hooks/agent-message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,MAAM,QAAQ,GAAG,sBAAsB,GAAG,oBAAoB,CAAC;AAErE,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2DAA2D;IAC3D,cAAc,CAAC,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAkCF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAgE3F;AAED,wBAAgB,mCAAmC,CAAC,IAAI,EAAE;IACxD,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,MAAM,GAAG,SAAS,CAKrB"}
+{"version":3,"file":"agent-message.d.ts","sourceRoot":"","sources":["../../src/hooks/agent-message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,MAAM,QAAQ,GAAG,sBAAsB,GAAG,oBAAoB,CAAC;AAErE,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,2DAA2D;IAC3D,cAAc,CAAC,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAMF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAyC3F;AAED,wBAAgB,mCAAmC,CAAC,IAAI,EAAE;IACxD,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,MAAM,GAAG,SAAS,CAKrB"}

package/dist/hooks/agent-message.js

@@ -1,26 +1,7 @@
+import { formatMutateDenyMessages } from "./mutate-deny-messages.js";
 function reasonsSummary(reasons) {
     return reasons.length > 0 ? reasons.join(",") : "policy";
 }
-/** First lines in user_message — Cursor delivers this on deny, not agent_message. */
-function mutateGuardWaitUserLead() {
-    return ("Required next step: call MCP tool `guard_wait` on the Praxis guard server before retrying this action.\n\n");
-}
-function mutateGuardWaitUserAgentBlock(proposalKind, argvJson, inline) {
-    if (inline) {
-        return (`Agent: MUST call MCP \`guard_wait\` now with \`context.approval.request_id\` = "${inline.request_id}", ` +
-            `\`context.wait_ms\` = 120000, and \`proposal\` matching this block ` +
-            `(\`kind\`: "${proposalKind}", \`argv\`: ${argvJson}). ` +
-            `Do not retry the command until \`guard_wait\` resolves. ` +
-            `Do not call \`guard\` instead of \`guard_wait\`. ` +
-            `Do not suggest running this command in the user's terminal or via another tool.`);
-    }
-    return (`Agent: MUST call MCP \`guard_wait\` now with \`context.wait_ms\` = 120000 and \`proposal\` matching this block ` +
-        `(\`kind\`: "${proposalKind}", \`argv\`: ${argvJson}). ` +
-        `If \`guard_wait\` returns \`require_approval\`, pass \`context.approval.request_id\` from the response and call \`guard_wait\` again until redeemed. ` +
-        `Direct the human to \`approval.open_url\` when shown. After \`guard_wait\` succeeds, retry this exact invocation once. ` +
-        `Do not call \`guard\` instead of \`guard_wait\`. ` +
-        `Do not suggest running this command in the user's terminal or via another tool.`);
-}
 export function formatHookDenyMessages(input) {
     const reasons = reasonsSummary(input.reasons);
     const argvJson = JSON.stringify([...input.argv]);
@@ -41,32 +22,14 @@ export function formatHookDenyMessages(input) {
         };
     }
     if (input.tier === "MUTATE") {
-        const proposalKind = input.hook === "beforeMCPExecution" ? "mcp" : "shell";
-        const inline = input.inlineApproval;
-        const userMessage = mutateGuardWaitUserLead() +
-            `${blockedLabel}. Human approval required (MUTATE policy).\n` +
-            (inline
-                ? `Approval request ${inline.request_id} is pending — human may open ${inline.open_url} while you run \`guard_wait\`.\n\n`
-                : "\n") +
-            mutateGuardWaitUserAgentBlock(proposalKind, argvJson, inline ?? null);
-        const inlineAgent = inline
-            ? ` Pending approval request_id=${inline.request_id} open_url=${inline.open_url}. ` +
-                `MUST call MCP \`guard_wait\` with this request_id, \`context.wait_ms\` (e.g. 120000), and the same proposal before any retry. ` +
-                `Do not call \`guard\` first and do not ask the user to retry until \`guard_wait\` resolves. `
-            : "";
-        return {
-            user_message: userMessage,
-            agent_message: `Blocked by guard (MUTATE). reasons=${reasons}. argv=${argvJson}. ` +
-                `Do not suggest running the same command in the user's terminal, an external shell, or via another tool to circumvent this block. ` +
-                inlineAgent +
-                (inline
-                    ? `Next: call MCP \`guard_wait\` now with the same proposal ` +
-                        `(\`kind\`: "${proposalKind}", same \`argv\`, \`cwd\` / \`raw_command\` as applicable), then retry once on allow. `
-                    : `Next: MCP \`guard_wait\` (preferred) or \`guard\` with \`mode: "enforce"\` and \`proposal\` matching this block ` +
-                        `(\`kind\`: "${proposalKind}", same \`argv\`, \`cwd\` / \`raw_command\` as applicable). ` +
-                        `On \`require_approval\`, send the human to \`approval.open_url\` or Praxis Approvals. ` +
-                        `After approval, retry this exact invocation once (hook consumes execution ticket).`),
-        };
+        return formatMutateDenyMessages({
+            hook: input.hook,
+            blockedLabel,
+            argvJson,
+            reasons,
+            storageRoot: input.storageRoot?.trim() || null,
+            inline: input.inlineApproval ?? null,
+        });
     }
     return {
         user_message: `${blockedLabel}.`,

package/dist/hooks/agent-message.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-message.js","sourceRoot":"","sources":["../../src/hooks/agent-message.ts"],"names":[],"mappings":"AAsBA,SAAS,cAAc,CAAC,OAA0B;IAChD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3D,CAAC;AAED,qFAAqF;AACrF,SAAS,uBAAuB;IAC9B,OAAO,CACL,4GAA4G,CAC7G,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,YAAoB,EAAE,QAAgB,EAAE,MAAqC;IAClH,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CACL,mFAAmF,MAAM,CAAC,UAAU,KAAK;YACzG,qEAAqE;YACrE,eAAe,YAAY,gBAAgB,QAAQ,KAAK;YACxD,0DAA0D;YAC1D,mDAAmD;YACnD,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,CACL,iHAAiH;QACjH,eAAe,YAAY,gBAAgB,QAAQ,KAAK;QACxD,uJAAuJ;QACvJ,yHAAyH;QACzH,mDAAmD;QACnD,iFAAiF,CAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,YAAY,GAChB,KAAK,CAAC,IAAI,KAAK,oBAAoB;QACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;YACd,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC5D,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,GAAG;QAC3C,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,GAAG,CAAC;IAE9C,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,OAAO;YACL,YAAY,EACV,GAAG,YAAY,iDAAiD;gBAChE,wFAAwF;gBACxF,6EAA6E;YAC/E,aAAa,EACX,qGAAqG;gBACrG,8EAA8E;gBAC9E,8HAA8H;gBAC9H,WAAW,OAAO,UAAU,QAAQ,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC;QAEpC,MAAM,WAAW,GACf,uBAAuB,EAAE;YACzB,GAAG,YAAY,8CAA8C;YAC7D,CAAC,MAAM;gBACL,CAAC,CAAC,oBAAoB,MAAM,CAAC,UAAU,gCAAgC,MAAM,CAAC,QAAQ,oCAAoC;gBAC1H,CAAC,CAAC,IAAI,CAAC;YACT,6BAA6B,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG,MAAM;YACxB,CAAC,CAAC,gCAAgC,MAAM,CAAC,UAAU,aAAa,MAAM,CAAC,QAAQ,IAAI;gBACjF,gIAAgI;gBAChI,8FAA8F;YAChG,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,aAAa,EACX,sCAAsC,OAAO,UAAU,QAAQ,IAAI;gBACnE,mIAAmI;gBACnI,WAAW;gBACX,CAAC,MAAM;oBACL,CAAC,CAAC,2DAA2D;wBAC3D,eAAe,YAAY,wFAAwF;oBACrH,CAAC,CAAC,kHAAkH;wBAClH,eAAe,YAAY,8DAA8D;wBACzF,wFAAwF;wBACxF,oFAAoF,CAAC;SAC5F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY,EAAE,GAAG,YAAY,GAAG;QAChC,aAAa,EACX,0BAA0B,KAAK,CAAC,IAAI,cAAc,OAAO,UAAU,QAAQ,IAAI;YAC/E,8EAA8E;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,IAEnD;IACC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,2FAA2F,CAAC;IACrG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"agent-message.js","sourceRoot":"","sources":["../../src/hooks/agent-message.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAwBrE,SAAS,cAAc,CAAC,OAA0B;IAChD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,YAAY,GAChB,KAAK,CAAC,IAAI,KAAK,oBAAoB;QACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;YACd,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC5D,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,GAAG;QAC3C,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,GAAG,CAAC;IAE9C,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,OAAO;YACL,YAAY,EACV,GAAG,YAAY,iDAAiD;gBAChE,wFAAwF;gBACxF,6EAA6E;YAC/E,aAAa,EACX,qGAAqG;gBACrG,8EAA8E;gBAC9E,8HAA8H;gBAC9H,WAAW,OAAO,UAAU,QAAQ,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,wBAAwB,CAAC;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY;YACZ,QAAQ;YACR,OAAO;YACP,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI;YAC9C,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,YAAY,EAAE,GAAG,YAAY,GAAG;QAChC,aAAa,EACX,0BAA0B,KAAK,CAAC,IAAI,cAAc,OAAO,UAAU,QAAQ,IAAI;YAC/E,8EAA8E;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,IAEnD;IACC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,2FAA2F,CAAC;IACrG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/hooks/mutate-deny-messages.d.ts

@@ -0,0 +1,17 @@
+/** MCP server key in ~/.cursor/mcp.json (Cursor may expose it as user-praxis-guard). */
+export declare const PRAXIS_GUARD_MCP_SERVER = "praxis-guard";
+export declare function formatMutateDenyMessages(opts: {
+    hook: "beforeShellExecution" | "beforeMCPExecution";
+    blockedLabel: string;
+    argvJson: string;
+    reasons: string;
+    storageRoot: string | null;
+    inline: {
+        request_id: string;
+        open_url: string;
+    } | null;
+}): {
+    user_message: string;
+    agent_message: string;
+};
+//# sourceMappingURL=mutate-deny-messages.d.ts.map

package/dist/hooks/mutate-deny-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutate-deny-messages.d.ts","sourceRoot":"","sources":["../../src/hooks/mutate-deny-messages.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,sBAAsB,GAAG,oBAAoB,CAAC;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzD,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAsClD"}