@praxis.guard/auditor-cli 0.0.62 → 0.0.63

package/dist/cli/doctor-adapter-lines.js

@@ -0,0 +1,47 @@
+function pushHookScopeLines(lines, scope, entry) {
+    const ready = entry.shell && entry.mcp;
+    lines.push(`    hook (${scope}): ${ready ? "configured" : `missing (run \`auditor setup hook${scope === "project" ? " --project" : ""}\`)`} (${entry.path})`);
+    lines.push(`      ${entry.shellLabel ?? "beforeShell"}: ${entry.shell ? "ok" : "missing"} | ${entry.mcpLabel ?? "beforeMCP"}: ${entry.mcp ? "ok" : "missing"}`);
+}
+function pushHookLines(lines, adapter, status) {
+    const globalEntry = status.hook?.global;
+    const projectEntry = status.hook?.project;
+    if (globalEntry && adapter.preferredHookScope !== "project") {
+        pushHookScopeLines(lines, "global", globalEntry);
+    }
+    if (projectEntry) {
+        pushHookScopeLines(lines, "project", projectEntry);
+    }
+    else if (adapter.preferredHookScope !== "project") {
+        lines.push("    hook (project): none");
+    }
+}
+export function adapterReady(adapter, status) {
+    if (status.ready === false)
+        return false;
+    const hookStatus = adapter.preferredHookScope === "project" ? status.hook?.project : status.hook?.global;
+    const hookReady = status.hookReady ?? Boolean(hookStatus?.shell && hookStatus.mcp);
+    if (adapter.upsertHook && !hookReady)
+        return false;
+    if (!status.mcp?.configured)
+        return false;
+    if (adapter.upsertCloud && !status.cloud?.configured)
+        return false;
+    return true;
+}
+export function pushAdapterLines(lines, adapter, status) {
+    const installedTag = status.installed ? "installed" : "not installed";
+    lines.push(`  ${adapter.label} (${installedTag}):`);
+    if (adapter.upsertHook)
+        pushHookLines(lines, adapter, status);
+    const m = status.mcp ?? { configured: false, path: "" };
+    lines.push(`    mcp: ${m.configured ? "configured" : "missing (run \`auditor setup mcp\`)"} (${m.path})`);
+    if (adapter.upsertCloud) {
+        const c = status.cloud ?? { configured: false, path: "" };
+        lines.push(`    cloud (project): ${c.configured ? "configured" : "missing (run \`auditor setup cloud\`)"} (${c.path})`);
+    }
+    for (const w of status.warnings) {
+        lines.push(`    warn: ${w}`);
+    }
+}
+//# sourceMappingURL=doctor-adapter-lines.js.map

package/dist/cli/doctor-adapter-lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-adapter-lines.js","sourceRoot":"","sources":["../../src/cli/doctor-adapter-lines.ts"],"names":[],"mappings":"AAIA,SAAS,kBAAkB,CACzB,KAAe,EACf,KAA2B,EAC3B,KAAgB;IAEhB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC;IACvC,KAAK,CAAC,IAAI,CACR,aAAa,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oCAAoC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,IAAI,GAAG,CAClJ,CAAC;IACF,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,CAAC,UAAU,IAAI,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,KAAK,CAAC,QAAQ,IAAI,WAAW,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CACpJ,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAe,EAAE,OAAqB,EAAE,MAAmB;IAChF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;IAC1C,IAAI,WAAW,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5D,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;SAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAE,MAAmB;IACrE,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,UAAU,GACd,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;IACxF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAe,EACf,OAAqB,EACrB,MAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,UAAU;QAAE,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qCAAqC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC9F,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,wBAAwB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/cli/doctor-notifications.d.ts

@@ -0,0 +1,5 @@
+export declare function formatNotificationsLine(push: {
+    enabled?: boolean;
+    devices?: number;
+} | undefined): string;
+//# sourceMappingURL=doctor-notifications.d.ts.map

package/dist/cli/doctor-notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-notifications.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-notifications.ts"],"names":[],"mappings":"AAAA,wBAAgB,uBAAuB,CACrC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACxD,MAAM,CAQR"}

package/dist/cli/doctor-notifications.js

@@ -0,0 +1,10 @@
+export function formatNotificationsLine(push) {
+    const enabled = push?.enabled === true;
+    const devices = push?.devices ?? 0;
+    if (enabled && devices > 0) {
+        return `Notifications: ready (push on, ${devices} device${devices === 1 ? "" : "s"}).`;
+    }
+    const reason = !enabled ? "push routing off" : "no enabled device";
+    return `Notifications: not set up (${reason}). Enable at https://app.usepraxis.tech/app/account so you get approval alerts.`;
+}
+//# sourceMappingURL=doctor-notifications.js.map

package/dist/cli/doctor-notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-notifications.js","sourceRoot":"","sources":["../../src/cli/doctor-notifications.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,uBAAuB,CACrC,IAAyD;IAEzD,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,kCAAkC,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACnE,OAAO,8BAA8B,MAAM,iFAAiF,CAAC;AAC/H,CAAC"}

package/dist/cli/doctor-remote.d.ts

@@ -0,0 +1,3 @@
+import type { PoliciesMetaFile } from "./policies-meta.js";
+export declare function appendDoctorRemoteLines(lines: string[], token: string | undefined, meta: PoliciesMetaFile | null): Promise<void>;
+//# sourceMappingURL=doctor-remote.d.ts.map

package/dist/cli/doctor-remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-remote.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-remote.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EAAE,EACf,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,EAAE,gBAAgB,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,CAAC,CA0Cf"}

package/dist/cli/doctor-remote.js

@@ -0,0 +1,48 @@
+import { fetchJson } from "./http-fetch.js";
+import { functionsHttpUrl } from "./policies-callable-url.js";
+import { formatNotificationsLine } from "./doctor-notifications.js";
+export async function appendDoctorRemoteLines(lines, token, meta) {
+    const revisionHttpUrl = functionsHttpUrl("policiesGetRevisionHttp");
+    if (token) {
+        try {
+            const rev = await fetchJson({
+                url: revisionHttpUrl,
+                bearerToken: token,
+            });
+            const remote = rev.revision;
+            lines.push(`Remote Firestore revision: ${remote}`);
+            if (meta) {
+                lines.push(meta.revision === remote
+                    ? "Policies: in sync with Firestore revision."
+                    : `Policies: update available (local ${meta.revision} vs remote ${remote}).`);
+            }
+            else {
+                lines.push(`Policies: remote revision ${remote} (no local sync meta).`);
+            }
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            lines.push(`Remote revision check failed: ${msg}`);
+        }
+    }
+    else {
+        lines.push("Remote revision: (skip — not authenticated; run `auditor login`)");
+    }
+    if (token) {
+        try {
+            const who = await fetchJson({
+                url: functionsHttpUrl("guardWhoAmIHttp"),
+                bearerToken: token,
+            });
+            lines.push(formatNotificationsLine(who.push));
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            lines.push(`Notifications: check failed (${msg})`);
+        }
+    }
+    else {
+        lines.push("Notifications: (skip, not authenticated)");
+    }
+}
+//# sourceMappingURL=doctor-remote.js.map

package/dist/cli/doctor-remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-remote.js","sourceRoot":"","sources":["../../src/cli/doctor-remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAe,EACf,KAAyB,EACzB,IAA6B;IAE7B,MAAM,eAAe,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IAEpE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAuB;gBAChD,GAAG,EAAE,eAAe;gBACpB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACtB,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,qCAAqC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,CAC/E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,wBAAwB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAqD;gBAC9E,GAAG,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;gBACxC,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/cli/doctor.d.ts

@@ -4,31 +4,10 @@ export type Readiness = {
     readySetup: boolean;
     enforced: boolean;
 };
-/**
- * Compute doctor readiness from adapter statuses + auth.
- *
- *   readySetup : at least one adapter has every declared surface configured.
- *   enforced   : at least one READY adapter declares a pre-tool hook (Cursor /
- *                Claude Code / Codex). adapterReady already requires that hook to
- *                be configured, so a ready hook-adapter is genuinely enforcing.
- *                If the only ready adapters lack upsertHook (Claude Desktop is
- *                MCP-only), governance is advisory: the model must choose to call
- *                guard and can be bypassed.
- *   ready      : readySetup AND authenticated.
- */
 export declare function resolveReadiness(adapterStatuses: {
     adapter: AgentAdapter;
     status: AgentStatus;
 }[], hasAuth: boolean): Readiness;
-/**
- * Doctor line for push-notification readiness. Pure so it can be unit tested;
- * the data comes from guardWhoAmIHttp. Ready means push routing is on AND at
- * least one device is enabled, which is what the server requires to actually
- * send an approval push.
- */
-export declare function formatNotificationsLine(push: {
-    enabled?: boolean;
-    devices?: number;
-} | undefined): string;
+export { formatNotificationsLine } from "./doctor-notifications.js";
 export declare function runDoctor(): Promise<void>;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWtE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,EAAE,EACjE,OAAO,EAAE,OAAO,GACf,SAAS,CAOX;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACxD,MAAM,CAQR;AA6DD,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA6H/C"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWtE,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnF,wBAAgB,gBAAgB,CAC9B,eAAe,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,EAAE,EACjE,OAAO,EAAE,OAAO,GACf,SAAS,CAOX;AAED,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAiFpE,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB/C"}

package/dist/cli/doctor.js

@@ -6,109 +6,38 @@ import { inspectRequestBindingIndex } from "../bridge/request-binding-index.js";
 import { executionTicketDir } from "../bridge/execution-ticket.js";
 import { shellBridgeDir } from "../bridge/shell-approval-bridge.js";
 import { guardSubpath } from "../bridge/guard-storage-root.js";
-import { fetchJson } from "./http-fetch.js";
 import { credentialsPath, readCredentialsFileMode, resolveGuardToken } from "./credentials.js";
 import { getInstallId } from "./install-id.js";
-import { functionsHttpUrl } from "./policies-callable-url.js";
 import { readPoliciesMetaFile } from "./policies-meta.js";
-/**
- * Compute doctor readiness from adapter statuses + auth.
- *
- *   readySetup : at least one adapter has every declared surface configured.
- *   enforced   : at least one READY adapter declares a pre-tool hook (Cursor /
- *                Claude Code / Codex). adapterReady already requires that hook to
- *                be configured, so a ready hook-adapter is genuinely enforcing.
- *                If the only ready adapters lack upsertHook (Claude Desktop is
- *                MCP-only), governance is advisory: the model must choose to call
- *                guard and can be bypassed.
- *   ready      : readySetup AND authenticated.
- */
+import { adapterReady, pushAdapterLines } from "./doctor-adapter-lines.js";
+import { appendDoctorRemoteLines } from "./doctor-remote.js";
 export function resolveReadiness(adapterStatuses, hasAuth) {
     const readyAdapters = adapterStatuses.filter(({ adapter, status }) => adapterReady(adapter, status));
     const readySetup = readyAdapters.length > 0;
     const enforced = readyAdapters.some(({ adapter }) => typeof adapter.upsertHook === "function");
     return { ready: readySetup && hasAuth, readySetup, enforced };
 }
-/**
- * Doctor line for push-notification readiness. Pure so it can be unit tested;
- * the data comes from guardWhoAmIHttp. Ready means push routing is on AND at
- * least one device is enabled, which is what the server requires to actually
- * send an approval push.
- */
-export function formatNotificationsLine(push) {
-    const enabled = push?.enabled === true;
-    const devices = push?.devices ?? 0;
-    if (enabled && devices > 0) {
-        return `Notifications: ready (push on, ${devices} device${devices === 1 ? "" : "s"}).`;
-    }
-    const reason = !enabled ? "push routing off" : "no enabled device";
-    return `Notifications: not set up (${reason}). Enable at https://app.usepraxis.tech/app/account so you get approval alerts.`;
-}
-function adapterReady(adapter, status) {
-    if (status.ready === false)
-        return false;
-    // For an adapter to count as "ready", every surface it declares MUST be configured.
-    // Cursor (hook + mcp + cloud) requires all three; Claude Desktop (mcp only) just needs MCP.
-    const hookStatus = adapter.preferredHookScope === "project" ? status.hook?.project : status.hook?.global;
-    const hookReady = status.hookReady ?? Boolean(hookStatus?.shell && hookStatus.mcp);
-    if (adapter.upsertHook && !hookReady)
-        return false;
-    if (!status.mcp?.configured)
-        return false;
-    if (adapter.upsertCloud && !status.cloud?.configured)
-        return false;
-    return true;
-}
-function pushAdapterLines(lines, adapter, status) {
-    const installedTag = status.installed ? "installed" : "not installed";
-    lines.push(`  ${adapter.label} (${installedTag}):`);
-    if (adapter.upsertHook) {
-        const globalEntry = status.hook?.global;
-        const projectEntry = status.hook?.project;
-        if (globalEntry && adapter.preferredHookScope !== "project") {
-            const ready = globalEntry.shell && globalEntry.mcp;
-            lines.push(`    hook (global): ${ready ? "configured" : "missing (run \`auditor setup hook\`)"} (${globalEntry.path})`);
-            lines.push(`      ${globalEntry.shellLabel ?? "beforeShell"}: ${globalEntry.shell ? "ok" : "missing"} | ${globalEntry.mcpLabel ?? "beforeMCP"}: ${globalEntry.mcp ? "ok" : "missing"}`);
-        }
-        if (projectEntry) {
-            const ready = projectEntry.shell && projectEntry.mcp;
-            lines.push(`    hook (project): ${ready ? "configured" : "missing (run \`auditor setup hook --project\`)"} (${projectEntry.path})`);
-            lines.push(`      ${projectEntry.shellLabel ?? "beforeShell"}: ${projectEntry.shell ? "ok" : "missing"} | ${projectEntry.mcpLabel ?? "beforeMCP"}: ${projectEntry.mcp ? "ok" : "missing"}`);
-        }
-        else if (adapter.preferredHookScope !== "project") {
-            lines.push("    hook (project): none");
-        }
-    }
-    const m = status.mcp ?? { configured: false, path: "" };
-    lines.push(`    mcp: ${m.configured ? "configured" : "missing (run \`auditor setup mcp\`)"} (${m.path})`);
-    if (adapter.upsertCloud) {
-        const c = status.cloud ?? { configured: false, path: "" };
-        lines.push(`    cloud (project): ${c.configured ? "configured" : "missing (run \`auditor setup cloud\`)"} (${c.path})`);
-    }
-    for (const w of status.warnings) {
-        lines.push(`    warn: ${w}`);
-    }
+export { formatNotificationsLine } from "./doctor-notifications.js";
+function policySourceLabel(meta, policyPath) {
+    if (process.env.PRAXIS_POLICIES_V1_PATH?.trim())
+        return "env:PRAXIS_POLICIES_V1_PATH";
+    if (meta?.source === "bundled-bootstrap")
+        return "~/.praxis (bootstrapped from bundled policy)";
+    if (existsSync(policyPath))
+        return "~/.praxis (local canonical file)";
+    return "missing (will bootstrap from bundled on first load)";
 }
-export async function runDoctor() {
-    const cwd = process.cwd();
-    const auditPath = process.env.PRAXIS_GUARD_AUDIT_LOG ?? guardSubpath("audit.jsonl", cwd);
+function buildDoctorHeaderLines(cwd, meta) {
     const policyPath = process.env.PRAXIS_POLICIES_V1_PATH?.trim() || defaultPoliciesV1Path();
     const metaPath = process.env.PRAXIS_POLICIES_META_PATH?.trim() || defaultPoliciesMetaPath();
-    const meta = await readPoliciesMetaFile(metaPath);
-    const policySource = process.env.PRAXIS_POLICIES_V1_PATH?.trim()
-        ? "env:PRAXIS_POLICIES_V1_PATH"
-        : meta?.source === "bundled-bootstrap"
-            ? "~/.praxis (bootstrapped from bundled policy)"
-            : existsSync(policyPath)
-                ? "~/.praxis (local canonical file)"
-                : "missing (will bootstrap from bundled on first load)";
-    const lines = [
+    const auditPath = process.env.PRAXIS_GUARD_AUDIT_LOG ?? guardSubpath("audit.jsonl", cwd);
+    return [
         `auditor doctor`,
         `Install ID: ${getInstallId()}`,
         `MCP stdio: auditor mcp   (Cursor/Codex: command auditor, args [mcp])`,
         `Node: ${process.version}`,
         `Policy file: ${policyPath}`,
-        `Policy source: ${policySource}`,
+        `Policy source: ${policySourceLabel(meta, policyPath)}`,
         `Policies meta: ${metaPath}`,
         meta
             ? `  Local synced revision: ${meta.revision}${meta.syncedAt ? ` (at ${meta.syncedAt})` : ""}`
@@ -118,6 +47,8 @@ export async function runDoctor() {
         `Audit log: ${auditPath}`,
         `PRAXIS_GUARD_AUDIT_LOG: ${process.env.PRAXIS_GUARD_AUDIT_LOG ?? "(unset; default above)"}`,
     ];
+}
+function appendBindingHealthLines(lines) {
     const bindingHealth = inspectRequestBindingIndex();
     lines.push(`Request bindings: ${bindingHealth.bindingCount} under ~/.praxis/guard/request-bindings/`);
     if (bindingHealth.lastBinding) {
@@ -126,16 +57,8 @@ export async function runDoctor() {
     if (bindingHealth.legacyHomeTicketsDir) {
         lines.push("  warn: ~/.praxis/guard/tickets exists (legacy misroute). Tickets belong under <repo>/.praxis/guard/tickets/.");
     }
-    lines.push("Agents:");
-    const adapterStatuses = [];
-    for (const adapter of ALL_ADAPTERS) {
-        const status = await adapter.status({ projectDir: cwd }).catch(() => null);
-        if (!status)
-            continue;
-        adapterStatuses.push({ adapter, status });
-        pushAdapterLines(lines, adapter, status);
-    }
-    const token = resolveGuardToken() || process.env.PRAXIS_FIREBASE_ID_TOKEN?.trim();
+}
+function appendAuthLines(lines, token) {
     const tokenSource = process.env.PRAXIS_GUARD_TOKEN?.trim()
         ? "env:PRAXIS_GUARD_TOKEN"
         : token
@@ -145,53 +68,34 @@ export async function runDoctor() {
         ? `Auth: ${tokenSource} (token: ${token.slice(0, 6)}...${token.slice(-3)})`
         : "Auth: (none — run `auditor login`)");
     const credsMode = readCredentialsFileMode();
-    if (credsMode !== null) {
-        lines.push(credsMode === 0o600
-            ? `Credentials mode: 0${credsMode.toString(8)}`
-            : `Credentials mode: 0${credsMode.toString(8)} (expected 0600)`);
-    }
-    const revisionHttpUrl = functionsHttpUrl("policiesGetRevisionHttp");
-    if (token) {
-        try {
-            const rev = await fetchJson({
-                url: revisionHttpUrl,
-                bearerToken: token,
-            });
-            const remote = rev.revision;
-            lines.push(`Remote Firestore revision: ${remote}`);
-            if (meta) {
-                lines.push(meta.revision === remote
-                    ? "Policies: in sync with Firestore revision."
-                    : `Policies: update available (local ${meta.revision} vs remote ${remote}).`);
-            }
-            else {
-                lines.push(`Policies: remote revision ${remote} (no local sync meta).`);
-            }
-        }
-        catch (e) {
-            const msg = e instanceof Error ? e.message : String(e);
-            lines.push(`Remote revision check failed: ${msg}`);
-        }
-    }
-    else {
-        lines.push("Remote revision: (skip — not authenticated; run `auditor login`)");
-    }
-    if (token) {
-        try {
-            const who = await fetchJson({
-                url: functionsHttpUrl("guardWhoAmIHttp"),
-                bearerToken: token,
-            });
-            lines.push(formatNotificationsLine(who.push));
-        }
-        catch (e) {
-            const msg = e instanceof Error ? e.message : String(e);
-            lines.push(`Notifications: check failed (${msg})`);
-        }
-    }
-    else {
-        lines.push("Notifications: (skip, not authenticated)");
+    if (credsMode === null)
+        return;
+    lines.push(credsMode === 0o600
+        ? `Credentials mode: 0${credsMode.toString(8)}`
+        : `Credentials mode: 0${credsMode.toString(8)} (expected 0600)`);
+}
+async function collectAdapterStatuses(cwd, lines) {
+    lines.push("Agents:");
+    const adapterStatuses = [];
+    for (const adapter of ALL_ADAPTERS) {
+        const status = await adapter.status({ projectDir: cwd }).catch(() => null);
+        if (!status)
+            continue;
+        adapterStatuses.push({ adapter, status });
+        pushAdapterLines(lines, adapter, status);
     }
+    return adapterStatuses;
+}
+export async function runDoctor() {
+    const cwd = process.cwd();
+    const metaPath = process.env.PRAXIS_POLICIES_META_PATH?.trim() || defaultPoliciesMetaPath();
+    const meta = await readPoliciesMetaFile(metaPath);
+    const lines = buildDoctorHeaderLines(cwd, meta);
+    appendBindingHealthLines(lines);
+    const adapterStatuses = await collectAdapterStatuses(cwd, lines);
+    const token = resolveGuardToken() || process.env.PRAXIS_FIREBASE_ID_TOKEN?.trim();
+    appendAuthLines(lines, token);
+    await appendDoctorRemoteLines(lines, token, meta);
     const readyAuth = !!token;
     const { ready, readySetup, enforced } = resolveReadiness(adapterStatuses, readyAuth);
     const modeSuffix = ready ? (enforced ? " (enforced)" : " (advisory only)") : "";

package/dist/cli/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAI1D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,eAAiE,EACjE,OAAgB;IAEhB,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CACnE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAC9B,CAAC;IACF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC/F,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAyD;IAEzD,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,kCAAkC,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACnE,OAAO,8BAA8B,MAAM,iFAAiF,CAAC;AAC/H,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB,EAAE,MAAmB;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,oFAAoF;IACpF,4FAA4F;IAC5F,MAAM,UAAU,GACd,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;IACxF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAe,EACf,OAAqB,EACrB,MAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;QAC1C,IAAI,WAAW,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC;YACnD,KAAK,CAAC,IAAI,CACR,sBAAsB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sCAAsC,KAAK,WAAW,CAAC,IAAI,GAAG,CAC5G,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,WAAW,CAAC,UAAU,IAAI,aAAa,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,WAAW,CAAC,QAAQ,IAAI,WAAW,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAC5K,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC;YACrD,KAAK,CAAC,IAAI,CACR,uBAAuB,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gDAAgD,KAAK,YAAY,CAAC,IAAI,GAAG,CACxH,CAAC;YACF,KAAK,CAAC,IAAI,CACR,SAAS,YAAY,CAAC,UAAU,IAAI,aAAa,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,CAAC,QAAQ,IAAI,WAAW,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAChL,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qCAAqC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC9F,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,wBAAwB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC,KAAK,CAAC,CAAC,IAAI,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC9D,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,mBAAmB;YACpC,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtB,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,qDAAqD,CAAC;IAE9D,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,eAAe,YAAY,EAAE,EAAE;QAC/B,sEAAsE;QACtE,SAAS,OAAO,CAAC,OAAO,EAAE;QAC1B,gBAAgB,UAAU,EAAE;QAC5B,kBAAkB,YAAY,EAAE;QAChC,kBAAkB,QAAQ,EAAE;QAC5B,IAAI;YACF,CAAC,CAAC,4BAA4B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,uEAAuE;QAC3E,eAAe,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE;QACnD,cAAc,SAAS,EAAE;QACzB,2BAA2B,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,EAAE;KAC5F,CAAC;IAEF,MAAM,aAAa,GAAG,0BAA0B,EAAE,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,YAAY,0CAA0C,CAAC,CAAC;IACtG,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,8BAA8B,aAAa,CAAC,WAAW,CAAC,UAAU,iBAAiB,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,oBAAoB,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,+GAA+G,CAChH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,eAAe,GAAqD,EAAE,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACxD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,QAAQ,eAAe,EAAE,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,CAAC,IAAI,CACR,WAAW;QACT,CAAC,CAAC,SAAS,WAAW,YAAY,KAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACF,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,KAAK;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;IAEpE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAuB;gBAChD,GAAG,EAAE,eAAe;gBACpB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,QAAQ,KAAK,MAAM;oBACtB,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,qCAAqC,IAAI,CAAC,QAAQ,cAAc,MAAM,IAAI,CAC/E,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,wBAAwB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAqD;gBAC9E,GAAG,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;gBACxC,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,KAAK,CAAC,IAAI,CACR,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,UAAU,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAC7H,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAyB,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAI7D,MAAM,UAAU,gBAAgB,CAC9B,eAAiE,EACjE,OAAgB;IAEhB,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CACnE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAC9B,CAAC;IACF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC/F,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,SAAS,iBAAiB,CAAC,IAA6B,EAAE,UAAkB;IAC1E,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAAE,OAAO,6BAA6B,CAAC;IACtF,IAAI,IAAI,EAAE,MAAM,KAAK,mBAAmB;QAAE,OAAO,8CAA8C,CAAC;IAChG,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,kCAAkC,CAAC;IACtE,OAAO,qDAAqD,CAAC;AAC/D,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW,EAAE,IAA6B;IACxE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACzF,OAAO;QACL,gBAAgB;QAChB,eAAe,YAAY,EAAE,EAAE;QAC/B,sEAAsE;QACtE,SAAS,OAAO,CAAC,OAAO,EAAE;QAC1B,gBAAgB,UAAU,EAAE;QAC5B,kBAAkB,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE;QACvD,kBAAkB,QAAQ,EAAE;QAC5B,IAAI;YACF,CAAC,CAAC,4BAA4B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,uEAAuE;QAC3E,eAAe,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,EAAE;QACnD,cAAc,SAAS,EAAE;QACzB,2BAA2B,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,wBAAwB,EAAE;KAC5F,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAe;IAC/C,MAAM,aAAa,GAAG,0BAA0B,EAAE,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,YAAY,0CAA0C,CAAC,CAAC;IACtG,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,8BAA8B,aAAa,CAAC,WAAW,CAAC,UAAU,iBAAiB,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,oBAAoB,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,+GAA+G,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAe,EAAE,KAAyB;IACjE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACxD,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,QAAQ,eAAe,EAAE,EAAE;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,CAAC,IAAI,CACR,WAAW;QACT,CAAC,CAAC,SAAS,WAAW,YAAY,KAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACF,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO;IAC/B,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,KAAK;QACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC/C,CAAC,CAAC,sBAAsB,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,GAAW,EACX,KAAe;IAEf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,eAAe,GAAqD,EAAE,CAAC;IAC7E,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,uBAAuB,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClF,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,KAAK,CAAC,IAAI,CACR,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,UAAU,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAC7H,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/mcp/evaluate-guard-approval.d.ts

@@ -0,0 +1,47 @@
+import type { ApprovalBlock } from "./guard-approval-block.js";
+import { applyGuardMode, type GuardDecision } from "./guard-mode.js";
+import type { GuardInput } from "./guard-schemas.js";
+import type { Tier } from "../policy/index.js";
+import type { ShellAnalysis } from "../shell/analyze-command.js";
+import type { GuardEvaluation } from "../shell/guard-eval.js";
+export declare function shouldResolveMutateApproval(input: {
+    skipped: boolean;
+    tier: Tier;
+    mode: GuardInput["mode"];
+    hookApprovalRequestId: string | null;
+    hookWaitMs: number;
+}): boolean;
+export declare function resolveGuardMutateApproval(input: {
+    guardInput: GuardInput;
+    argv: string[];
+    storageRoot: string;
+    eventId: string;
+    policyRevision: number | null;
+    reasons: {
+        code: string;
+        message: string;
+        details?: unknown;
+    }[];
+    analysis?: ShellAnalysis;
+}): Promise<{
+    enforceDecision: GuardDecision;
+    approvalBlock: ApprovalBlock;
+    approvalRequestId: string | null;
+}>;
+export declare function resolveGuardEnforcement(input: {
+    guardInput: GuardInput;
+    skipped: boolean;
+    tier: Tier;
+    reasons: GuardEvaluation["reasons"];
+    argv: string[];
+    storageRoot: string;
+    eventId: string;
+    policyRevision: number | null;
+    analysis?: ShellAnalysis;
+}): Promise<{
+    decision: GuardDecision;
+    shadow: ReturnType<typeof applyGuardMode>["shadow"];
+    approvalBlock: ApprovalBlock;
+    approvalRequestId: string | null;
+}>;
+//# sourceMappingURL=evaluate-guard-approval.d.ts.map

package/dist/mcp/evaluate-guard-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-approval.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-approval.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAWV;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAChE,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,OAAO,CAAC;IACV,eAAe,EAAE,aAAa,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC,CAUD;AA+CD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC,CA+BD"}

package/dist/mcp/evaluate-guard-approval.js

@@ -0,0 +1,80 @@
+import { resolveEnforceMutateApproval } from "./guard-approval-block.js";
+import { applyGuardMode } from "./guard-mode.js";
+import { resolveTierDecision } from "./evaluate-guard-tier.js";
+export function shouldResolveMutateApproval(input) {
+    const redeemHookApproval = !input.skipped &&
+        input.tier !== "DESTRUCTIVE" &&
+        input.mode === "enforce" &&
+        input.hookApprovalRequestId !== null &&
+        input.hookWaitMs > 0;
+    return (redeemHookApproval ||
+        (!input.skipped && input.tier !== "DESTRUCTIVE" && input.tier !== "READ" && input.mode === "enforce"));
+}
+export async function resolveGuardMutateApproval(input) {
+    return resolveEnforceMutateApproval({
+        guardInput: input.guardInput,
+        argv: input.argv,
+        storageRoot: input.storageRoot,
+        eventId: input.eventId,
+        policyRevision: input.policyRevision,
+        reasons: input.reasons,
+        approval_fingerprint: input.analysis?.approval_fingerprint_payload ?? null,
+    });
+}
+async function applyMutateApprovalIfNeeded(input) {
+    const hookApprovalRequestId = input.guardInput.context?.approval?.request_id?.trim() || null;
+    const hookWaitMs = input.guardInput.context?.wait_ms ?? 0;
+    if (!shouldResolveMutateApproval({
+        skipped: input.skipped,
+        tier: input.tier,
+        mode: input.guardInput.mode,
+        hookApprovalRequestId,
+        hookWaitMs,
+    })) {
+        return {
+            enforceDecision: input.enforceDecision,
+            approvalBlock: input.approvalBlock,
+            approvalRequestId: null,
+        };
+    }
+    return resolveGuardMutateApproval({
+        guardInput: input.guardInput,
+        argv: input.argv,
+        storageRoot: input.storageRoot,
+        eventId: input.eventId,
+        policyRevision: input.policyRevision,
+        reasons: input.reasons,
+        analysis: input.analysis,
+    });
+}
+export async function resolveGuardEnforcement(input) {
+    let { enforceDecision, approvalBlock } = resolveTierDecision({
+        mode: input.guardInput.mode,
+        skipped: input.skipped,
+        tier: input.tier,
+    });
+    const mutate = await applyMutateApprovalIfNeeded({
+        guardInput: input.guardInput,
+        skipped: input.skipped,
+        tier: input.tier,
+        reasons: input.reasons,
+        argv: input.argv,
+        storageRoot: input.storageRoot,
+        eventId: input.eventId,
+        policyRevision: input.policyRevision,
+        analysis: input.analysis,
+        enforceDecision,
+        approvalBlock,
+    });
+    enforceDecision = mutate.enforceDecision;
+    approvalBlock = mutate.approvalBlock;
+    const { decision, shadow } = applyGuardMode({
+        mode: input.guardInput.mode,
+        skipped: input.skipped,
+        tier: input.tier,
+        policyReasons: input.reasons,
+        enforceDecision,
+    });
+    return { decision, shadow, approvalBlock, approvalRequestId: mutate.approvalRequestId };
+}
+//# sourceMappingURL=evaluate-guard-approval.js.map

package/dist/mcp/evaluate-guard-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-approval.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,MAAM,UAAU,2BAA2B,CAAC,KAM3C;IACC,MAAM,kBAAkB,GACtB,CAAC,KAAK,CAAC,OAAO;QACd,KAAK,CAAC,IAAI,KAAK,aAAa;QAC5B,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,KAAK,CAAC,qBAAqB,KAAK,IAAI;QACpC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;IACvB,OAAO,CACL,kBAAkB;QAClB,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CACtG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAQhD;IAKC,OAAO,4BAA4B,CAAC;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,QAAQ,EAAE,4BAA4B,IAAI,IAAI;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAY1C;IAKC,MAAM,qBAAqB,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7F,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC;IAC1D,IACE,CAAC,2BAA2B,CAAC;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,qBAAqB;QACrB,UAAU;KACX,CAAC,EACF,CAAC;QACD,OAAO;YACL,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,iBAAiB,EAAE,IAAI;SACxB,CAAC;IACJ,CAAC;IACD,OAAO,0BAA0B,CAAC;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAU7C;IAMC,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC;QAC3D,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe;QACf,aAAa;KACd,CAAC,CAAC;IACH,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IACzC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAErC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,OAAO;QAC5B,eAAe;KAChB,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;AAC1F,CAAC"}

package/dist/mcp/evaluate-guard-policy.d.ts

@@ -0,0 +1,3 @@
+import type { PolicyState } from "./evaluate-guard-tier.js";
+export declare function loadGuardPolicyState(policyState: PolicyState): Promise<void>;
+//# sourceMappingURL=evaluate-guard-policy.d.ts.map

package/dist/mcp/evaluate-guard-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-policy.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlF"}

package/dist/mcp/evaluate-guard-policy.js

@@ -0,0 +1,6 @@
+import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
+export async function loadGuardPolicyState(policyState) {
+    policyState.policy = await loadPoliciesV1();
+    policyState.policyRevision = await readPoliciesV1Revision();
+}
+//# sourceMappingURL=evaluate-guard-policy.js.map

package/dist/mcp/evaluate-guard-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-policy.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAwB;IACjE,WAAW,CAAC,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;AAC9D,CAAC"}