@praxis.guard/auditor-cli 0.0.62 → 0.0.64

package/dist/codex/config-toml.js

@@ -62,4 +62,54 @@ export function isPraxisMcpConfigured(config) {
 export function isUnifiedExecDisabled(config) {
     return /^\s*unified_exec\s*=\s*false\s*(?:#.*)?$/m.test(config);
 }
+const FEATURES_HEADER_RE = /^\s*\[features\]\s*(?:#.*)?$/;
+const UNIFIED_EXEC_FALSE_RE = /^\s*unified_exec\s*=\s*false\s*(?:#.*)?$/;
+/** Split a TOML document into a leading section (header=null) plus one per table header. */
+function splitSections(source) {
+    const sections = [];
+    let current = { header: null, body: [] };
+    for (const line of source.split(/\r?\n/)) {
+        if (isTableHeader(line)) {
+            sections.push(current);
+            current = { header: line, body: [] };
+        }
+        else {
+            current.body.push(line);
+        }
+    }
+    sections.push(current);
+    return sections;
+}
+function bodyIsBlank(body) {
+    return body.every((line) => line.trim() === "" || line.trim().startsWith("#"));
+}
+/**
+ * Inverse of mergeCodexConfigToml: strip the Praxis MCP tables and the
+ * Praxis-added `[features] unified_exec = false`. A `[features]` table that
+ * holds nothing but that flag is removed entirely; one with other keys keeps
+ * them. Returns "" when the document is left empty (caller deletes the file).
+ */
+export function removePraxisCodexConfig(source) {
+    if (!source.trim())
+        return "";
+    const kept = [];
+    for (const section of splitSections(source)) {
+        if (section.header && isPraxisMcpHeader(section.header))
+            continue;
+        if (section.header && FEATURES_HEADER_RE.test(section.header)) {
+            const body = section.body.filter((line) => !UNIFIED_EXEC_FALSE_RE.test(line));
+            if (bodyIsBlank(body))
+                continue;
+            kept.push({ header: section.header, body });
+            continue;
+        }
+        kept.push(section);
+    }
+    const rebuilt = kept
+        .map((s) => (s.header ? [s.header, ...s.body].join("\n") : s.body.join("\n")))
+        .join("\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+    return rebuilt ? `${rebuilt}\n` : "";
+}
 //# sourceMappingURL=config-toml.js.map

package/dist/codex/config-toml.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-toml.js","sourceRoot":"","sources":["../../src/codex/config-toml.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAClD,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAE1D,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,2FAA2F,CAAC,IAAI,CACrG,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;QACL,UAAU;QACV,qBAAqB;QACrB,gBAAgB;QAChB,EAAE;QACF,cAAc;QACd,iCAAiC;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,kCAAkC,CAAC;IACxE,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClC,QAAQ,GAAG,CAAC,CAAC;YACb,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAC9B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,aAAa,IAAI,KAAK,GAAG,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAChG,CAAC;IACF,IAAI,QAAQ,IAAI,CAAC;QAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,sBAAsB,CAAC;;QACvD,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,qBAAqB,EAAE,IAAI,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;WAC7B,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;WACtC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,2CAA2C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"config-toml.js","sourceRoot":"","sources":["../../src/codex/config-toml.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAClD,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAE1D,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,2FAA2F,CAAC,IAAI,CACrG,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;QACL,UAAU;QACV,qBAAqB;QACrB,gBAAgB;QAChB,EAAE;QACF,cAAc;QACd,iCAAiC;KAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,kCAAkC,CAAC;IACxE,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClC,QAAQ,GAAG,CAAC,CAAC;YACb,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAC9B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,aAAa,IAAI,KAAK,GAAG,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAChG,CAAC;IACF,IAAI,QAAQ,IAAI,CAAC;QAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,sBAAsB,CAAC;;QACvD,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,qBAAqB,EAAE,IAAI,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;WAC7B,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;WACtC,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,2CAA2C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAC1D,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AAIzE,4FAA4F;AAC5F,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,OAAO,GAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAc;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QAClE,IAAI,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9E,IAAI,WAAW,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAC7E,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;IACV,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACvC,CAAC"}

package/dist/codex/config.d.ts

@@ -17,5 +17,7 @@ export declare function codexHooksPath(projectDir: string): string;
 export { mergeCodexConfigToml } from "./config-toml.js";
 export declare function upsertCodexConfig(projectDir: string, dryRun?: boolean): Promise<CodexSetupResult>;
 export declare function upsertCodexHooks(projectDir: string, dryRun?: boolean): Promise<CodexSetupResult>;
+export declare function removeCodexConfig(projectDir: string, dryRun?: boolean): Promise<CodexSetupResult>;
+export declare function removeCodexHooks(projectDir: string, dryRun?: boolean): Promise<CodexSetupResult>;
 export declare function readCodexSetupStatus(projectDir: string): Promise<CodexSetupStatus>;
 //# sourceMappingURL=config.d.ts.map

package/dist/codex/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,2BAA2B,EAAE,OAAO,CAAC;IACrC,qBAAqB,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAWrG;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYpG;AAED,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAcxF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,2BAA2B,EAAE,OAAO,CAAC;IACrC,qBAAqB,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAWrG;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYpG;AAED,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmBrG;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsBpG;AAED,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAcxF"}

package/dist/codex/config.js

@@ -1,8 +1,8 @@
 import { existsSync } from "node:fs";
 import path from "node:path";
-import { CODEX_PERMISSION_COMMAND, CODEX_PRE_TOOL_COMMAND, hooksContainCommand, mergeCodexHooks, } from "./config-hooks.js";
-import { readJson, readText, writeAtomic } from "./config-io.js";
-import { isPraxisMcpConfigured, isUnifiedExecDisabled, mergeCodexConfigToml, } from "./config-toml.js";
+import { CODEX_PERMISSION_COMMAND, CODEX_PRE_TOOL_COMMAND, hooksContainCommand, mergeCodexHooks, removePraxisCodexHooks, } from "./config-hooks.js";
+import { readJson, readText, removeFile, writeAtomic } from "./config-io.js";
+import { isPraxisMcpConfigured, isUnifiedExecDisabled, mergeCodexConfigToml, removePraxisCodexConfig, } from "./config-toml.js";
 const CODEX_DIR = ".codex";
 export function codexConfigPath(projectDir) {
     return path.join(projectDir, CODEX_DIR, "config.toml");
@@ -38,6 +38,55 @@ export async function upsertCodexHooks(projectDir, dryRun = false) {
         message: changed ? (dryRun ? "would update Codex hooks" : "updated Codex hooks") : "Codex hooks already up to date",
     };
 }
+export async function removeCodexConfig(projectDir, dryRun = false) {
+    const pathname = codexConfigPath(projectDir);
+    const before = await readText(pathname);
+    if (!before)
+        return { path: pathname, changed: false, message: "no Codex MCP config to remove" };
+    const after = removePraxisCodexConfig(before);
+    const changed = before !== after;
+    if (changed && !dryRun) {
+        if (after.trim() === "")
+            await removeFile(pathname);
+        else
+            await writeAtomic(pathname, after);
+    }
+    return {
+        path: pathname,
+        changed,
+        message: changed
+            ? dryRun
+                ? "would remove Codex MCP config"
+                : "removed Codex MCP config"
+            : "no Codex MCP config to remove",
+    };
+}
+export async function removeCodexHooks(projectDir, dryRun = false) {
+    const pathname = codexHooksPath(projectDir);
+    const existing = await readJson(pathname);
+    if (!existing)
+        return { path: pathname, changed: false, message: "no Codex hooks to remove" };
+    const before = `${JSON.stringify(existing, null, 2)}\n`;
+    const next = removePraxisCodexHooks(existing);
+    const isEmpty = !next || Object.keys(next).length === 0;
+    const after = isEmpty ? "" : `${JSON.stringify(next, null, 2)}\n`;
+    const changed = before !== after;
+    if (changed && !dryRun) {
+        if (isEmpty)
+            await removeFile(pathname);
+        else
+            await writeAtomic(pathname, after);
+    }
+    return {
+        path: pathname,
+        changed,
+        message: changed
+            ? dryRun
+                ? "would remove Codex hooks"
+                : "removed Codex hooks"
+            : "no Codex hooks to remove",
+    };
+}
 export async function readCodexSetupStatus(projectDir) {
     const configPath = codexConfigPath(projectDir);
     const hooksPath = codexHooksPath(projectDir);

package/dist/codex/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,SAAS,GAAG,QAAQ,CAAC;AAkB3B,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB,EAAE,MAAM,GAAG,KAAK;IACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,qCAAqC;KACnI,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAAM,GAAG,KAAK;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,gCAAgC;KACpH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO;QACL,UAAU;QACV,SAAS;QACT,aAAa,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAC5C,mBAAmB,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAClD,oBAAoB,EAAE,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,sBAAsB,CAAC;QACtF,2BAA2B,EAAE,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,EAAE,wBAAwB,CAAC;QACtG,qBAAqB,EACnB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;KAClG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/codex/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,SAAS,GAAG,QAAQ,CAAC;AAkB3B,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB,EAAE,MAAM,GAAG,KAAK;IACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,qCAAqC;KACnI,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAAM,GAAG,KAAK;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,gCAAgC;KACpH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB,EAAE,MAAM,GAAG,KAAK;IACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;;YAC/C,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,OAAO;YACd,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,0BAA0B;YAC9B,CAAC,CAAC,+BAA+B;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAAM,GAAG,KAAK;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,OAAO;YAAE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;;YACnC,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,OAAO,EAAE,OAAO;YACd,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,qBAAqB;YACzB,CAAC,CAAC,0BAA0B;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO;QACL,UAAU;QACV,SAAS;QACT,aAAa,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAC5C,mBAAmB,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAClD,oBAAoB,EAAE,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,sBAAsB,CAAC;QACtF,2BAA2B,EAAE,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,EAAE,wBAAwB,CAAC;QACtG,qBAAqB,EACnB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;KAClG,CAAC;AACJ,CAAC"}

package/dist/mcp/evaluate-guard-approval.d.ts

@@ -0,0 +1,47 @@
+import type { ApprovalBlock } from "./guard-approval-block.js";
+import { applyGuardMode, type GuardDecision } from "./guard-mode.js";
+import type { GuardInput } from "./guard-schemas.js";
+import type { Tier } from "../policy/index.js";
+import type { ShellAnalysis } from "../shell/analyze-command.js";
+import type { GuardEvaluation } from "../shell/guard-eval.js";
+export declare function shouldResolveMutateApproval(input: {
+    skipped: boolean;
+    tier: Tier;
+    mode: GuardInput["mode"];
+    hookApprovalRequestId: string | null;
+    hookWaitMs: number;
+}): boolean;
+export declare function resolveGuardMutateApproval(input: {
+    guardInput: GuardInput;
+    argv: string[];
+    storageRoot: string;
+    eventId: string;
+    policyRevision: number | null;
+    reasons: {
+        code: string;
+        message: string;
+        details?: unknown;
+    }[];
+    analysis?: ShellAnalysis;
+}): Promise<{
+    enforceDecision: GuardDecision;
+    approvalBlock: ApprovalBlock;
+    approvalRequestId: string | null;
+}>;
+export declare function resolveGuardEnforcement(input: {
+    guardInput: GuardInput;
+    skipped: boolean;
+    tier: Tier;
+    reasons: GuardEvaluation["reasons"];
+    argv: string[];
+    storageRoot: string;
+    eventId: string;
+    policyRevision: number | null;
+    analysis?: ShellAnalysis;
+}): Promise<{
+    decision: GuardDecision;
+    shadow: ReturnType<typeof applyGuardMode>["shadow"];
+    approvalBlock: ApprovalBlock;
+    approvalRequestId: string | null;
+}>;
+//# sourceMappingURL=evaluate-guard-approval.d.ts.map

package/dist/mcp/evaluate-guard-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-approval.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-approval.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAWV;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAChE,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,OAAO,CAAC;IACV,eAAe,EAAE,aAAa,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC,CAUD;AA+CD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC,CA+BD"}

package/dist/mcp/evaluate-guard-approval.js

@@ -0,0 +1,80 @@
+import { resolveEnforceMutateApproval } from "./guard-approval-block.js";
+import { applyGuardMode } from "./guard-mode.js";
+import { resolveTierDecision } from "./evaluate-guard-tier.js";
+export function shouldResolveMutateApproval(input) {
+    const redeemHookApproval = !input.skipped &&
+        input.tier !== "DESTRUCTIVE" &&
+        input.mode === "enforce" &&
+        input.hookApprovalRequestId !== null &&
+        input.hookWaitMs > 0;
+    return (redeemHookApproval ||
+        (!input.skipped && input.tier !== "DESTRUCTIVE" && input.tier !== "READ" && input.mode === "enforce"));
+}
+export async function resolveGuardMutateApproval(input) {
+    return resolveEnforceMutateApproval({
+        guardInput: input.guardInput,
+        argv: input.argv,
+        storageRoot: input.storageRoot,
+        eventId: input.eventId,
+        policyRevision: input.policyRevision,
+        reasons: input.reasons,
+        approval_fingerprint: input.analysis?.approval_fingerprint_payload ?? null,
+    });
+}
+async function applyMutateApprovalIfNeeded(input) {
+    const hookApprovalRequestId = input.guardInput.context?.approval?.request_id?.trim() || null;
+    const hookWaitMs = input.guardInput.context?.wait_ms ?? 0;
+    if (!shouldResolveMutateApproval({
+        skipped: input.skipped,
+        tier: input.tier,
+        mode: input.guardInput.mode,
+        hookApprovalRequestId,
+        hookWaitMs,
+    })) {
+        return {
+            enforceDecision: input.enforceDecision,
+            approvalBlock: input.approvalBlock,
+            approvalRequestId: null,
+        };
+    }
+    return resolveGuardMutateApproval({
+        guardInput: input.guardInput,
+        argv: input.argv,
+        storageRoot: input.storageRoot,
+        eventId: input.eventId,
+        policyRevision: input.policyRevision,
+        reasons: input.reasons,
+        analysis: input.analysis,
+    });
+}
+export async function resolveGuardEnforcement(input) {
+    let { enforceDecision, approvalBlock } = resolveTierDecision({
+        mode: input.guardInput.mode,
+        skipped: input.skipped,
+        tier: input.tier,
+    });
+    const mutate = await applyMutateApprovalIfNeeded({
+        guardInput: input.guardInput,
+        skipped: input.skipped,
+        tier: input.tier,
+        reasons: input.reasons,
+        argv: input.argv,
+        storageRoot: input.storageRoot,
+        eventId: input.eventId,
+        policyRevision: input.policyRevision,
+        analysis: input.analysis,
+        enforceDecision,
+        approvalBlock,
+    });
+    enforceDecision = mutate.enforceDecision;
+    approvalBlock = mutate.approvalBlock;
+    const { decision, shadow } = applyGuardMode({
+        mode: input.guardInput.mode,
+        skipped: input.skipped,
+        tier: input.tier,
+        policyReasons: input.reasons,
+        enforceDecision,
+    });
+    return { decision, shadow, approvalBlock, approvalRequestId: mutate.approvalRequestId };
+}
+//# sourceMappingURL=evaluate-guard-approval.js.map

package/dist/mcp/evaluate-guard-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-approval.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,MAAM,UAAU,2BAA2B,CAAC,KAM3C;IACC,MAAM,kBAAkB,GACtB,CAAC,KAAK,CAAC,OAAO;QACd,KAAK,CAAC,IAAI,KAAK,aAAa;QAC5B,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,KAAK,CAAC,qBAAqB,KAAK,IAAI;QACpC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;IACvB,OAAO,CACL,kBAAkB;QAClB,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CACtG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAQhD;IAKC,OAAO,4BAA4B,CAAC;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,QAAQ,EAAE,4BAA4B,IAAI,IAAI;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAY1C;IAKC,MAAM,qBAAqB,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7F,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC;IAC1D,IACE,CAAC,2BAA2B,CAAC;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,qBAAqB;QACrB,UAAU;KACX,CAAC,EACF,CAAC;QACD,OAAO;YACL,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,iBAAiB,EAAE,IAAI;SACxB,CAAC;IACJ,CAAC;IACD,OAAO,0BAA0B,CAAC;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAU7C;IAMC,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC;QAC3D,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;QAC/C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe;QACf,aAAa;KACd,CAAC,CAAC;IACH,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IACzC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAErC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,OAAO;QAC5B,eAAe;KAChB,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;AAC1F,CAAC"}

package/dist/mcp/evaluate-guard-policy.d.ts

@@ -0,0 +1,3 @@
+import type { PolicyState } from "./evaluate-guard-tier.js";
+export declare function loadGuardPolicyState(policyState: PolicyState): Promise<void>;
+//# sourceMappingURL=evaluate-guard-policy.d.ts.map

package/dist/mcp/evaluate-guard-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-policy.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlF"}

package/dist/mcp/evaluate-guard-policy.js

@@ -0,0 +1,6 @@
+import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
+export async function loadGuardPolicyState(policyState) {
+    policyState.policy = await loadPoliciesV1();
+    policyState.policyRevision = await readPoliciesV1Revision();
+}
+//# sourceMappingURL=evaluate-guard-policy.js.map

package/dist/mcp/evaluate-guard-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-policy.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAwB;IACjE,WAAW,CAAC,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;AAC9D,CAAC"}

package/dist/mcp/evaluate-guard-proposal.d.ts

@@ -0,0 +1,16 @@
+import type { GuardEvaluation } from "../shell/guard-eval.js";
+import type { ShellAnalysis } from "../shell/analyze-command.js";
+import type { GuardInput } from "./guard-schemas.js";
+import type { PoliciesV1 } from "../policy/index.js";
+export type GuardProposalEvaluation = {
+    skipped: boolean;
+    evaluation: GuardEvaluation;
+    analysis?: ShellAnalysis;
+    shellCommand: string | null;
+};
+export declare function evaluateGuardProposal(input: GuardInput, policy: PoliciesV1): GuardProposalEvaluation;
+export declare function applyDaemonEvaluation(argv: string[], evaluation: GuardEvaluation): Promise<{
+    skipped: boolean;
+    evaluation: GuardEvaluation;
+}>;
+//# sourceMappingURL=evaluate-guard-proposal.d.ts.map

package/dist/mcp/evaluate-guard-proposal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-proposal.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-proposal.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,UAAU,GACjB,uBAAuB,CAoBzB;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EAAE,EACd,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,CAAC,CAiC5D"}

package/dist/mcp/evaluate-guard-proposal.js

@@ -0,0 +1,57 @@
+import { evaluatePolicyWithDaemon } from "../daemon/client.js";
+import { daemonModeEnabled } from "../daemon/paths.js";
+import { evaluateMcpProposal, evaluateShellProposal } from "../shell/evaluate.js";
+export function evaluateGuardProposal(input, policy) {
+    const shellCommand = input.proposal.kind === "shell"
+        ? input.proposal.raw_command ?? input.proposal.argv.join(" ")
+        : null;
+    const shellResult = input.proposal.kind === "shell" && shellCommand
+        ? evaluateShellProposal(policy, shellCommand)
+        : null;
+    const mcpResult = input.proposal.kind === "mcp"
+        ? evaluateMcpProposal(policy, input.proposal.argv)
+        : null;
+    return {
+        skipped: shellResult?.skipped ?? mcpResult?.skipped ?? true,
+        evaluation: shellResult?.evaluation ?? mcpResult.evaluation,
+        analysis: shellResult?.analysis,
+        shellCommand,
+    };
+}
+export async function applyDaemonEvaluation(argv, evaluation) {
+    if (!daemonModeEnabled()) {
+        return { skipped: true, evaluation };
+    }
+    try {
+        const daemonEvaluation = await evaluatePolicyWithDaemon(argv);
+        return {
+            skipped: daemonEvaluation.skipped,
+            evaluation: {
+                ...evaluation,
+                tier: daemonEvaluation.tier,
+                classification: daemonEvaluation.classification,
+                flags: daemonEvaluation.flags,
+                reasons: daemonEvaluation.skipped
+                    ? [{ code: "skipped", message: "No policy entry matched in the native daemon." }]
+                    : [
+                        {
+                            code: "policy_match",
+                            message: "Matched policy entry in the native daemon.",
+                            details: {
+                                tool: daemonEvaluation.classification.tool,
+                                command_path: daemonEvaluation.classification.command_path,
+                                verb: daemonEvaluation.classification.verb,
+                                tier: daemonEvaluation.tier,
+                            },
+                        },
+                    ],
+            },
+        };
+    }
+    catch (error) {
+        if (process.env.PRAXIS_GUARD_SPAWN_FALLBACK !== "1")
+            throw error;
+        return { skipped: true, evaluation };
+    }
+}
+//# sourceMappingURL=evaluate-guard-proposal.js.map

package/dist/mcp/evaluate-guard-proposal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-proposal.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-proposal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAalF,MAAM,UAAU,qBAAqB,CACnC,KAAiB,EACjB,MAAkB;IAElB,MAAM,YAAY,GAChB,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC7B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY;QAC7C,CAAC,CAAC,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;QAC3B,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,OAAO,EAAE,WAAW,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,IAAI;QAC3D,UAAU,EAAE,WAAW,EAAE,UAAU,IAAI,SAAU,CAAC,UAAU;QAC5D,QAAQ,EAAE,WAAW,EAAE,QAAQ;QAC/B,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAc,EACd,UAA2B;IAE3B,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO;YACL,OAAO,EAAE,gBAAgB,CAAC,OAAO;YACjC,UAAU,EAAE;gBACV,GAAG,UAAU;gBACb,IAAI,EAAE,gBAAgB,CAAC,IAAY;gBACnC,cAAc,EAAE,gBAAgB,CAAC,cAAc;gBAC/C,KAAK,EAAE,gBAAgB,CAAC,KAAK;gBAC7B,OAAO,EAAE,gBAAgB,CAAC,OAAO;oBAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;oBACjF,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,4CAA4C;4BACrD,OAAO,EAAE;gCACP,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,YAAY,EAAE,gBAAgB,CAAC,cAAc,CAAC,YAAY;gCAC1D,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,IAAI,EAAE,gBAAgB,CAAC,IAAI;6BAC5B;yBACF;qBACF;aACN;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG;YAAE,MAAM,KAAK,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/mcp/evaluate-guard-run.d.ts

@@ -0,0 +1,23 @@
+import type { Tier } from "../policy/index.js";
+import type { GuardEvaluation } from "../shell/guard-eval.js";
+import type { ApprovalBlock } from "./guard-approval-block.js";
+import type { GuardInput } from "./guard-schemas.js";
+import { applyGuardMode, type GuardDecision } from "./guard-mode.js";
+import { type PolicyState } from "./evaluate-guard-tier.js";
+import { type GuardProposalEvaluation } from "./evaluate-guard-proposal.js";
+export type GuardEvaluationResult = {
+    startedAt: number;
+    eventId: string;
+    proposal: GuardProposalEvaluation;
+    skipped: boolean;
+    evaluation: GuardEvaluation;
+    tier: Tier;
+    reasons: GuardEvaluation["reasons"];
+    decision: GuardDecision;
+    shadow: ReturnType<typeof applyGuardMode>["shadow"];
+    approvalBlock: ApprovalBlock;
+    approvalRequestId: string | null;
+};
+export declare function runGuardEvaluation(input: GuardInput, policyState: PolicyState): Promise<GuardEvaluationResult>;
+export declare function buildGuardResponse(input: GuardInput, result: GuardEvaluationResult): Record<string, unknown>;
+//# sourceMappingURL=evaluate-guard-run.d.ts.map

package/dist/mcp/evaluate-guard-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-run.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-run.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AAgBtC,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACpC,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,aAAa,EAAE,aAAa,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,qBAAqB,CAAC,CA2ChC;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,qBAAqB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB"}

package/dist/mcp/evaluate-guard-run.js

@@ -0,0 +1,75 @@
+import { v4 as uuidv4 } from "uuid";
+import { rememberResolvedWorkspaceRoot, resolveGuardStorageRootFromHints, } from "../bridge/guard-storage-root.js";
+import { daemonModeEnabled } from "../daemon/paths.js";
+import { riskScore } from "./evaluate-guard-tier.js";
+import { applyDaemonEvaluation, evaluateGuardProposal, } from "./evaluate-guard-proposal.js";
+import { resolveGuardEnforcement, } from "./evaluate-guard-approval.js";
+import { loadGuardPolicyState } from "./evaluate-guard-policy.js";
+function rememberGuardWorkspace(input) {
+    const storageRoot = resolveGuardStorageRootFromHints({
+        cwd: input.proposal.cwd,
+        workspaceRoot: input.context?.workspace_root,
+        workspaceRoots: input.context?.workspace_roots,
+    });
+    rememberResolvedWorkspaceRoot(storageRoot);
+    return storageRoot;
+}
+export async function runGuardEvaluation(input, policyState) {
+    const startedAt = performance.now();
+    const eventId = uuidv4();
+    await loadGuardPolicyState(policyState);
+    const storageRoot = rememberGuardWorkspace(input);
+    const proposal = evaluateGuardProposal(input, policyState.policy);
+    let skipped = proposal.skipped;
+    let evaluation = proposal.evaluation;
+    if (daemonModeEnabled()) {
+        const daemon = await applyDaemonEvaluation(evaluation.argv, evaluation);
+        skipped = daemon.skipped;
+        evaluation = daemon.evaluation;
+    }
+    const tier = evaluation.tier;
+    const reasons = [...evaluation.reasons];
+    const enforcement = await resolveGuardEnforcement({
+        guardInput: input,
+        skipped,
+        tier,
+        reasons,
+        argv: evaluation.argv,
+        storageRoot,
+        eventId,
+        policyRevision: policyState.policyRevision,
+        analysis: proposal.analysis,
+    });
+    return {
+        startedAt,
+        eventId,
+        proposal,
+        skipped,
+        evaluation,
+        tier,
+        reasons,
+        decision: enforcement.decision,
+        shadow: enforcement.shadow,
+        approvalBlock: enforcement.approvalBlock,
+        approvalRequestId: enforcement.approvalRequestId,
+    };
+}
+export function buildGuardResponse(input, result) {
+    return {
+        mode: input.mode,
+        decision: result.decision,
+        skipped: result.skipped,
+        tier: result.tier,
+        risk_score: riskScore(result.skipped, result.tier),
+        reasons: result.reasons,
+        shadow: result.shadow,
+        approval: result.approvalBlock,
+        audit: {
+            event_id: result.eventId,
+            timestamp: new Date().toISOString(),
+            latency_ms: performance.now() - result.startedAt,
+        },
+        execution: { attempted: false, result: null },
+    };
+}
+//# sourceMappingURL=evaluate-guard-run.js.map

package/dist/mcp/evaluate-guard-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-run.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAMvD,OAAO,EAAE,SAAS,EAAoB,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,SAAS,sBAAsB,CAAC,KAAiB;IAC/C,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;QACvB,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc;QAC5C,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe;KAC/C,CAAC,CAAC;IACH,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,WAAW,CAAC;AACrB,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAiB,EACjB,WAAwB;IAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;IACzB,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAExC,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC/B,IAAI,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACrC,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC;QAChD,UAAU,EAAE,KAAK;QACjB,OAAO;QACP,IAAI;QACJ,OAAO;QACP,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,WAAW;QACX,OAAO;QACP,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,OAAO;QACP,QAAQ;QACR,OAAO;QACP,UAAU;QACV,IAAI;QACJ,OAAO;QACP,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,MAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC;QAClD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,aAAa;QAC9B,KAAK,EAAE;YACL,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;SACjD;QACD,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC"}

package/dist/mcp/evaluate-guard-telemetry.d.ts

@@ -0,0 +1,22 @@
+import type { Tier } from "../policy/index.js";
+import type { GuardDecision } from "./guard-mode.js";
+import type { GuardInput } from "./guard-schemas.js";
+import type { PolicyState } from "./evaluate-guard-tier.js";
+export declare function emitGuardEvaluationTelemetry(input: {
+    guardInput: GuardInput;
+    policyState: PolicyState;
+    startedAt: number;
+    eventId: string;
+    skipped: boolean;
+    tier: Tier;
+    decision: GuardDecision;
+    argv: string[];
+    shellCommand: string | null;
+    reasons: {
+        message?: string;
+        code?: string;
+    }[];
+    approvalRequestId: string | null;
+    invocationCount: number | null;
+}): void;
+//# sourceMappingURL=evaluate-guard-telemetry.d.ts.map

package/dist/mcp/evaluate-guard-telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-telemetry.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-telemetry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAc5D,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/C,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,IAAI,CAyBP"}

package/dist/mcp/evaluate-guard-telemetry.js

@@ -0,0 +1,38 @@
+import { sendGuardEvent } from "../telemetry/guard-events.js";
+import { getInstallId } from "../cli/install-id.js";
+import { resolveGuardAuditStatus } from "./guard-audit-status.js";
+function firstPolicyReason(reasons) {
+    return (reasons.find((r) => typeof r?.message === "string")?.message ??
+        reasons.find((r) => typeof r?.code === "string")?.code ??
+        null);
+}
+function guardSkipReason(kind) {
+    return kind === "shell" ? "no_governed_invocation" : "mcp_policy_unmatched";
+}
+export function emitGuardEvaluationTelemetry(input) {
+    const status = resolveGuardAuditStatus({ skipped: input.skipped, decision: input.decision });
+    void sendGuardEvent({
+        ts: new Date().toISOString(),
+        status,
+        skipped: input.skipped,
+        ...(input.skipped ? { skip_reason: guardSkipReason(input.guardInput.proposal.kind) } : {}),
+        tool: "auditor-mcp",
+        command_path: input.argv[0] ?? null,
+        verb: input.argv[1] ?? null,
+        resource: input.argv.length > 2 ? input.argv.slice(2).join(" ") : null,
+        reason: firstPolicyReason(input.reasons),
+        cmd: input.shellCommand ?? input.argv.join(" "),
+        tier: input.tier,
+        decision: input.decision,
+        latency_ms: performance.now() - input.startedAt,
+        event_id: input.eventId,
+        installId: getInstallId(),
+        kind: input.guardInput.proposal.kind,
+        ...(input.policyState.policyRevision !== null
+            ? { policy_revision: input.policyState.policyRevision }
+            : {}),
+        ...(input.approvalRequestId ? { approval_request_id: input.approvalRequestId } : {}),
+        meta: { invocation_count: input.invocationCount },
+    });
+}
+//# sourceMappingURL=evaluate-guard-telemetry.js.map

package/dist/mcp/evaluate-guard-telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-telemetry.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,SAAS,iBAAiB,CAAC,OAA8C;IACvE,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;QACtD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAoC;IAC3D,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAa5C;IACC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7F,KAAK,cAAc,CAAC;QAClB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,GAAG,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS;QAC/C,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI;QACpC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,KAAK,IAAI;YAC3C,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE;KAClD,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/evaluate-guard-tier.d.ts

@@ -0,0 +1,18 @@
+import { loadPoliciesV1, type Tier } from "../policy/index.js";
+import { type ApprovalBlock } from "./guard-approval-block.js";
+import { type GuardDecision } from "./guard-mode.js";
+import type { GuardInput } from "./guard-schemas.js";
+export type PolicyState = {
+    policy: Awaited<ReturnType<typeof loadPoliciesV1>>;
+    policyRevision: number | null;
+};
+export declare function riskScore(skipped: boolean, tier: Tier): number;
+export declare function resolveTierDecision(input: {
+    mode: GuardInput["mode"];
+    skipped: boolean;
+    tier: Tier;
+}): {
+    enforceDecision: GuardDecision;
+    approvalBlock: ApprovalBlock;
+};
+//# sourceMappingURL=evaluate-guard-tier.d.ts.map

package/dist/mcp/evaluate-guard-tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-guard-tier.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard-tier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AAEF,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,CAK9D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ,GAAG;IAAE,eAAe,EAAE,aAAa,CAAC;IAAC,aAAa,EAAE,aAAa,CAAA;CAAE,CAgCnE"}