@red-codes/agentguard 1.0.0 → 1.1.2

package/dist/commands/trust.js

@@ -0,0 +1,129 @@
+// CLI command: agentguard trust — interactive policy trust flow.
+//
+// Usage:
+//   agentguard trust <policy-file>        Interactive trust flow with risk review
+//   agentguard trust <policy-file> --yes  Skip confirmation prompt (for scripts/CI)
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { createInterface } from 'node:readline';
+import { FG, RESET, DIM, BOLD } from '../colors.js';
+const MAX_DISPLAY_LINES = 40;
+function printUsage() {
+    process.stderr.write('\n  Usage: agentguard trust <policy-file> [flags]\n');
+    process.stderr.write('\n  Flags:\n');
+    process.stderr.write('    --yes, -y   Skip confirmation prompt\n');
+    process.stderr.write('\n  Examples:\n');
+    process.stderr.write('    agentguard trust agentguard.yaml\n');
+    process.stderr.write('    agentguard trust .agentguard/policy.yaml --yes\n\n');
+}
+/**
+ * Interactive policy trust command.
+ * Reads the policy file, analyzes risks, prompts for confirmation, then records trust.
+ */
+export async function trust(args) {
+    // Parse flags
+    const yes = args.includes('--yes') || args.includes('-y');
+    // Get policy path (first non-flag argument)
+    const policyPath = args.find((a) => !a.startsWith('-'));
+    if (!policyPath) {
+        process.stderr.write(`\n  ${FG.red}Error: No policy file specified.${RESET}\n`);
+        printUsage();
+        return 1;
+    }
+    const absPath = resolve(policyPath);
+    if (!existsSync(absPath)) {
+        process.stderr.write(`\n  ${FG.red}Error: File not found: ${absPath}${RESET}\n\n`);
+        return 1;
+    }
+    // Read policy content
+    let content;
+    try {
+        content = readFileSync(absPath, 'utf8');
+    }
+    catch (e) {
+        process.stderr.write(`\n  ${FG.red}Error: Cannot read file: ${e instanceof Error ? e.message : String(e)}${RESET}\n\n`);
+        return 1;
+    }
+    // Display policy content (truncated if large)
+    const lines = content.split('\n');
+    const truncated = lines.length > MAX_DISPLAY_LINES;
+    process.stderr.write(`\n  ${BOLD}Policy file:${RESET} ${DIM}${absPath}${RESET}\n`);
+    process.stderr.write(`  ${DIM}${'─'.repeat(60)}${RESET}\n`);
+    const displayLines = truncated ? lines.slice(0, MAX_DISPLAY_LINES) : lines;
+    for (const line of displayLines) {
+        process.stderr.write(`  ${DIM}${line}${RESET}\n`);
+    }
+    if (truncated) {
+        process.stderr.write(`  ${DIM}... (${lines.length - MAX_DISPLAY_LINES} more lines)${RESET}\n`);
+    }
+    process.stderr.write(`  ${DIM}${'─'.repeat(60)}${RESET}\n\n`);
+    // Analyze policy risk
+    const { analyzePolicyRisk } = await import('@red-codes/policy');
+    const riskFlags = analyzePolicyRisk(content);
+    const hasDanger = riskFlags.some((f) => f.level === 'danger');
+    const hasWarning = riskFlags.some((f) => f.level === 'warning');
+    if (riskFlags.length === 0) {
+        process.stderr.write(`  ${FG.green}✓ No risk flags detected.${RESET}\n\n`);
+    }
+    else {
+        process.stderr.write(`  ${BOLD}Risk analysis:${RESET}\n`);
+        for (const flag of riskFlags) {
+            let icon;
+            let colorCode;
+            if (flag.level === 'danger') {
+                icon = '✗';
+                colorCode = FG.red;
+            }
+            else if (flag.level === 'warning') {
+                icon = '!';
+                colorCode = FG.yellow;
+            }
+            else {
+                icon = 'i';
+                colorCode = DIM;
+            }
+            process.stderr.write(`    ${colorCode}${icon} [${flag.level.toUpperCase()}] ${flag.message}${RESET}\n`);
+            process.stderr.write(`      ${DIM}Pattern: ${flag.pattern}${RESET}\n`);
+        }
+        process.stderr.write('\n');
+    }
+    // Non-TTY auto-deny (unless --yes)
+    const isTTY = process.stdin.isTTY;
+    if (!isTTY && !yes) {
+        process.stderr.write(`  ${FG.red}✗ Non-interactive environment detected. Use --yes to trust non-interactively.${RESET}\n\n`);
+        return 1;
+    }
+    // If danger risks without --yes, warn strongly
+    if (hasDanger && !yes) {
+        process.stderr.write(`  ${FG.red}${BOLD}WARNING: This policy contains dangerous configurations.${RESET}\n`);
+        process.stderr.write(`  ${FG.red}You must explicitly confirm to trust it.${RESET}\n\n`);
+    }
+    if (hasWarning && !hasDanger && !yes) {
+        process.stderr.write(`  ${FG.yellow}This policy contains warnings. Review carefully before trusting.${RESET}\n\n`);
+    }
+    // Prompt for confirmation (if not --yes)
+    if (!yes) {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        const answer = await new Promise((resolve) => {
+            rl.question(`  Trust this policy? [y/N] `, resolve);
+        });
+        rl.close();
+        const confirmed = answer.trim().toLowerCase() === 'y';
+        if (!confirmed) {
+            process.stderr.write(`\n  ${FG.yellow}Trust cancelled.${RESET}\n\n`);
+            return 1;
+        }
+    }
+    else {
+        process.stderr.write(`  ${DIM}--yes flag set, skipping confirmation.${RESET}\n\n`);
+    }
+    // Record trust
+    const { trustFile } = await import('@red-codes/core');
+    const entry = await trustFile(absPath);
+    process.stderr.write(`  ${FG.green}✓ Policy trusted.${RESET}\n`);
+    process.stderr.write(`  ${DIM}Path:       ${entry.path}${RESET}\n`);
+    process.stderr.write(`  ${DIM}Hash:       ${entry.hash}${RESET}\n`);
+    process.stderr.write(`  ${DIM}Trusted at: ${entry.trustedAt}${RESET}\n\n`);
+    return 0;
+}
+//# sourceMappingURL=trust.js.map

package/dist/commands/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../../src/commands/trust.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,SAAS;AACT,kFAAkF;AAClF,oFAAoF;AAEpF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,SAAS,UAAU;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAc;IACxC,cAAc;IACd,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE1D,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,mCAAmC,KAAK,IAAI,CAAC,CAAC;QAChF,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEpC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,0BAA0B,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,OAAO,EAAE,CAAC,GAAG,4BAA4B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAClG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,8CAA8C;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC;IAEnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,eAAe,KAAK,IAAI,GAAG,GAAG,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC;IACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,QAAQ,KAAK,CAAC,MAAM,GAAG,iBAAiB,eAAe,KAAK,IAAI,CAAC,CAAC;IACjG,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;IAE9D,sBAAsB;IACtB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAEhE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,4BAA4B,KAAK,MAAM,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,iBAAiB,KAAK,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,IAAY,CAAC;YACjB,IAAI,SAAiB,CAAC;YAEtB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,GAAG,GAAG,CAAC;gBACX,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,GAAG,GAAG,CAAC;gBACX,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,GAAG,CAAC;gBACX,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,OAAO,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,GAAG,KAAK,IAAI,CAClF,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,YAAY,IAAI,CAAC,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,mCAAmC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,GAAG,gFAAgF,KAAK,MAAM,CACvG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,+CAA+C;IAC/C,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,GAAG,GAAG,IAAI,0DAA0D,KAAK,IAAI,CACtF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,2CAA2C,KAAK,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,MAAM,mEAAmE,KAAK,MAAM,CAC7F,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACnD,EAAE,CAAC,QAAQ,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,KAAK,EAAE,CAAC;QAEX,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,mBAAmB,KAAK,MAAM,CAAC,CAAC;YACrE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,yCAAyC,KAAK,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,eAAe;IACf,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IAEvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,oBAAoB,KAAK,IAAI,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,KAAK,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,KAAK,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,KAAK,CAAC,SAAS,GAAG,KAAK,MAAM,CAAC,CAAC;IAE3E,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/evidence-summary.d.ts

@@ -0,0 +1,35 @@
+import type { DomainEvent } from '@red-codes/core';
+/** Aggregated governance metrics from a session's events. */
+export interface EvidenceSummary {
+    readonly totalEvents: number;
+    readonly actionsAllowed: number;
+    readonly actionsDenied: number;
+    readonly policyDenials: number;
+    readonly invariantViolations: number;
+    readonly escalations: number;
+    readonly blastRadiusExceeded: number;
+    readonly evidencePacksGenerated: number;
+    readonly maxEscalationLevel: string;
+    readonly actionTypeBreakdown: Record<string, {
+        allowed: number;
+        denied: number;
+    }>;
+    readonly denialReasons: string[];
+    readonly violationDetails: string[];
+    readonly runIds: string[];
+}
+/** Options for formatting the evidence markdown report. */
+export interface EvidenceMarkdownOptions {
+    /** URL to the full session artifact (e.g., GitHub Actions artifact link). */
+    readonly artifactUrl?: string;
+}
+/**
+ * Aggregate raw governance events into a structured summary.
+ * Only counts governance-related events in the metrics.
+ */
+export declare function aggregateEvents(events: DomainEvent[]): EvidenceSummary;
+/**
+ * Format an evidence summary as PR-ready markdown.
+ */
+export declare function formatEvidenceMarkdown(summary: EvidenceSummary, options?: EvidenceMarkdownOptions): string;
+//# sourceMappingURL=evidence-summary.d.ts.map

package/dist/evidence-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-summary.d.ts","sourceRoot":"","sources":["../src/evidence-summary.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAwBD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,CAoGtE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,uBAAuB,GAChC,MAAM,CAwFR"}

package/dist/evidence-summary.js

@@ -0,0 +1,202 @@
+// Evidence summary generator — aggregates governance events into a PR-ready report.
+// Pure domain logic. No Node.js I/O, no side effects.
+const GOVERNANCE_KINDS = new Set([
+    'ActionRequested',
+    'ActionAllowed',
+    'ActionDenied',
+    'ActionEscalated',
+    'ActionExecuted',
+    'ActionFailed',
+    'PolicyDenied',
+    'InvariantViolation',
+    'BlastRadiusExceeded',
+    'EvidencePackGenerated',
+    'DecisionRecorded',
+    'SimulationCompleted',
+]);
+const ESCALATION_ORDER = {
+    NORMAL: 0,
+    ELEVATED: 1,
+    HIGH: 2,
+    LOCKDOWN: 3,
+};
+/**
+ * Aggregate raw governance events into a structured summary.
+ * Only counts governance-related events in the metrics.
+ */
+export function aggregateEvents(events) {
+    let actionsAllowed = 0;
+    let actionsDenied = 0;
+    let policyDenials = 0;
+    let invariantViolations = 0;
+    let escalations = 0;
+    let blastRadiusExceeded = 0;
+    let evidencePacksGenerated = 0;
+    let maxEscalationOrdinal = 0;
+    const actionTypeBreakdown = {};
+    const denialReasons = [];
+    const violationDetails = [];
+    const runIds = new Set();
+    const governanceEvents = events.filter((e) => GOVERNANCE_KINDS.has(e.kind));
+    for (const event of events) {
+        // Track runIds from RunStarted events
+        if (event.kind === 'RunStarted' && event.runId) {
+            runIds.add(event.runId);
+        }
+        switch (event.kind) {
+            case 'ActionAllowed': {
+                actionsAllowed++;
+                const actionType = event.actionType || 'unknown';
+                if (!actionTypeBreakdown[actionType]) {
+                    actionTypeBreakdown[actionType] = { allowed: 0, denied: 0 };
+                }
+                actionTypeBreakdown[actionType].allowed++;
+                break;
+            }
+            case 'ActionDenied': {
+                actionsDenied++;
+                const actionType = event.actionType || 'unknown';
+                if (!actionTypeBreakdown[actionType]) {
+                    actionTypeBreakdown[actionType] = { allowed: 0, denied: 0 };
+                }
+                actionTypeBreakdown[actionType].denied++;
+                const reason = event.reason || 'no reason provided';
+                denialReasons.push(`${actionType}: ${reason}`);
+                break;
+            }
+            case 'PolicyDenied': {
+                policyDenials++;
+                const action = event.action || 'unknown';
+                const reason = event.reason || 'no reason provided';
+                denialReasons.push(`Policy denied ${action}: ${reason}`);
+                break;
+            }
+            case 'InvariantViolation': {
+                invariantViolations++;
+                const invariant = event.invariant || 'unknown';
+                const expected = event.expected || '';
+                const actual = event.actual || '';
+                violationDetails.push(`${invariant}: expected ${expected}, got ${actual}`);
+                break;
+            }
+            case 'ActionEscalated': {
+                escalations++;
+                break;
+            }
+            case 'BlastRadiusExceeded': {
+                blastRadiusExceeded++;
+                break;
+            }
+            case 'EvidencePackGenerated': {
+                evidencePacksGenerated++;
+                break;
+            }
+            case 'StateChanged': {
+                const to = event.to || '';
+                const ordinal = ESCALATION_ORDER[to] ?? 0;
+                if (ordinal > maxEscalationOrdinal) {
+                    maxEscalationOrdinal = ordinal;
+                }
+                break;
+            }
+        }
+    }
+    const escalationNames = Object.entries(ESCALATION_ORDER);
+    const maxEscalationLevel = escalationNames.find(([, v]) => v === maxEscalationOrdinal)?.[0] ?? 'NORMAL';
+    return {
+        totalEvents: governanceEvents.length,
+        actionsAllowed,
+        actionsDenied,
+        policyDenials,
+        invariantViolations,
+        escalations,
+        blastRadiusExceeded,
+        evidencePacksGenerated,
+        maxEscalationLevel,
+        actionTypeBreakdown,
+        denialReasons,
+        violationDetails,
+        runIds: [...runIds],
+    };
+}
+/**
+ * Format an evidence summary as PR-ready markdown.
+ */
+export function formatEvidenceMarkdown(summary, options) {
+    const lines = [];
+    lines.push('## Governance Evidence Report');
+    lines.push('');
+    lines.push('| Metric | Value |');
+    lines.push('|--------|-------|');
+    lines.push(`| Total governance events | ${summary.totalEvents} |`);
+    lines.push(`| Actions allowed | ${summary.actionsAllowed} |`);
+    lines.push(`| Actions denied | ${summary.actionsDenied} |`);
+    lines.push(`| Policy denials | ${summary.policyDenials} |`);
+    lines.push(`| Invariant violations | ${summary.invariantViolations} |`);
+    lines.push(`| Escalations | ${summary.escalations} |`);
+    lines.push(`| Blast radius exceeded | ${summary.blastRadiusExceeded} |`);
+    lines.push(`| Escalation level | ${summary.maxEscalationLevel} |`);
+    // Verdict line
+    if (summary.actionsDenied === 0 && summary.invariantViolations === 0) {
+        lines.push('');
+        lines.push('**Verdict:** All actions passed governance checks.');
+    }
+    else {
+        lines.push('');
+        lines.push(`**Verdict:** ${summary.actionsDenied + summary.invariantViolations} governance issue(s) detected.`);
+    }
+    // Action type breakdown (if any)
+    const actionTypes = Object.keys(summary.actionTypeBreakdown);
+    if (actionTypes.length > 0) {
+        lines.push('');
+        lines.push('<details>');
+        lines.push('<summary>Action type breakdown</summary>');
+        lines.push('');
+        lines.push('| Action Type | Allowed | Denied |');
+        lines.push('|-------------|---------|--------|');
+        for (const actionType of actionTypes.sort()) {
+            const counts = summary.actionTypeBreakdown[actionType];
+            lines.push(`| \`${actionType}\` | ${counts.allowed} | ${counts.denied} |`);
+        }
+        lines.push('');
+        lines.push('</details>');
+    }
+    // Denial details (if any)
+    if (summary.denialReasons.length > 0) {
+        lines.push('');
+        lines.push('<details>');
+        lines.push('<summary>Denial details</summary>');
+        lines.push('');
+        for (const reason of summary.denialReasons) {
+            lines.push(`- ${reason}`);
+        }
+        lines.push('');
+        lines.push('</details>');
+    }
+    // Violation details (if any)
+    if (summary.violationDetails.length > 0) {
+        lines.push('');
+        lines.push('<details>');
+        lines.push('<summary>Invariant violation details</summary>');
+        lines.push('');
+        for (const detail of summary.violationDetails) {
+            lines.push(`- ${detail}`);
+        }
+        lines.push('');
+        lines.push('</details>');
+    }
+    // Session info
+    if (summary.runIds.length > 0) {
+        lines.push('');
+        lines.push(`*Sessions: ${summary.runIds.map((id) => `\`${id}\``).join(', ')}*`);
+    }
+    // Link to full session artifact
+    if (options?.artifactUrl) {
+        lines.push('');
+        lines.push(`**Full session data:** [Download governance session](${options.artifactUrl})`);
+    }
+    lines.push('');
+    lines.push('*Generated by [AgentGuard](https://github.com/jpleva91/agent-guard) governance runtime.*');
+    return lines.join('\n');
+}
+//# sourceMappingURL=evidence-summary.js.map

package/dist/evidence-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-summary.js","sourceRoot":"","sources":["../src/evidence-summary.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,sDAAsD;AA2BtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,oBAAoB;IACpB,qBAAqB;IACrB,uBAAuB;IACvB,kBAAkB;IAClB,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAA2B;IAC/C,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,sBAAsB,GAAG,CAAC,CAAC;IAC/B,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,MAAM,mBAAmB,GAAwD,EAAE,CAAC;IACpF,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,sCAAsC;QACtC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAe,CAAC,CAAC;QACpC,CAAC;QAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,cAAc,EAAE,CAAC;gBACjB,MAAM,UAAU,GAAI,KAAK,CAAC,UAAqB,IAAI,SAAS,CAAC;gBAC7D,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACrC,mBAAmB,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC9D,CAAC;gBACD,mBAAmB,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1C,MAAM;YACR,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,aAAa,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAI,KAAK,CAAC,UAAqB,IAAI,SAAS,CAAC;gBAC7D,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACrC,mBAAmB,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC9D,CAAC;gBACD,mBAAmB,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAI,KAAK,CAAC,MAAiB,IAAI,oBAAoB,CAAC;gBAChE,aAAa,CAAC,IAAI,CAAC,GAAG,UAAU,KAAK,MAAM,EAAE,CAAC,CAAC;gBAC/C,MAAM;YACR,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,aAAa,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAI,KAAK,CAAC,MAAiB,IAAI,SAAS,CAAC;gBACrD,MAAM,MAAM,GAAI,KAAK,CAAC,MAAiB,IAAI,oBAAoB,CAAC;gBAChE,aAAa,CAAC,IAAI,CAAC,iBAAiB,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;gBACzD,MAAM;YACR,CAAC;YACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;gBAC1B,mBAAmB,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAI,KAAK,CAAC,SAAoB,IAAI,SAAS,CAAC;gBAC3D,MAAM,QAAQ,GAAI,KAAK,CAAC,QAAmB,IAAI,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAI,KAAK,CAAC,MAAiB,IAAI,EAAE,CAAC;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,GAAG,SAAS,cAAc,QAAQ,SAAS,MAAM,EAAE,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,WAAW,EAAE,CAAC;gBACd,MAAM;YACR,CAAC;YACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,mBAAmB,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;YACD,KAAK,uBAAuB,CAAC,CAAC,CAAC;gBAC7B,sBAAsB,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,EAAE,GAAI,KAAK,CAAC,EAAa,IAAI,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,OAAO,GAAG,oBAAoB,EAAE,CAAC;oBACnC,oBAAoB,GAAG,OAAO,CAAC;gBACjC,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzD,MAAM,kBAAkB,GACtB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IAE/E,OAAO;QACL,WAAW,EAAE,gBAAgB,CAAC,MAAM;QACpC,cAAc;QACd,aAAa;QACb,aAAa;QACb,mBAAmB;QACnB,WAAW;QACX,mBAAmB;QACnB,sBAAsB;QACtB,kBAAkB;QAClB,mBAAmB;QACnB,aAAa;QACb,gBAAgB;QAChB,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,OAAiC;IAEjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,+BAA+B,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,4BAA4B,OAAO,CAAC,mBAAmB,IAAI,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,mBAAmB,IAAI,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC;IAEnE,eAAe;IACf,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,mBAAmB,KAAK,CAAC,EAAE,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,gBAAgB,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,mBAAmB,gCAAgC,CACpG,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACjD,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,OAAO,UAAU,QAAQ,MAAM,CAAC,OAAO,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,0BAA0B;IAC1B,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,6BAA6B;IAC7B,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IAED,eAAe;IACf,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,wDAAwD,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,0FAA0F,CAC3F,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/{cli/file-event-store.d.ts → file-event-store.d.ts}

@@ -1,4 +1,4 @@
-import type { DomainEvent, EventStore } from '../core/types.js';
+import type { DomainEvent, EventStore } from '@red-codes/core';
 /**
  * Create a file-based event store.
  * Events are persisted as newline-delimited JSON (JSONL) files.

package/dist/file-event-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-event-store.d.ts","sourceRoot":"","sources":["../src/file-event-store.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAe,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgB5E;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAwE3F;AA+BD;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAKvC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,EAAE,CAe5D;AAED,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAiB3E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,MAAM,GACvB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAoD3C"}

package/dist/{cli/file-event-store.js → file-event-store.js}

@@ -4,7 +4,7 @@
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, appendFileSync, } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { validateEvent } from '../events/schema.js';
+import { validateEvent } from '@red-codes/events';
 const EVENTS_DIR = join(homedir(), '.agentguard', 'events');
 function ensureDir() {
     if (!existsSync(EVENTS_DIR)) {

package/dist/file-event-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-event-store.js","sourceRoot":"","sources":["../src/file-event-store.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,qEAAqE;AACrE,yEAAyE;AAEzE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,SAAS,EACT,UAAU,EACV,WAAW,EACX,cAAc,GACf,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;AAE5D,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO,IAAI,CAAC,UAAU,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAkB;IACrD,MAAM,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC;IAEZ,OAAO;QACL,SAAS,EAAE,GAAG;QAEd,MAAM,CAAC,KAAkB;YACvB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,CACrC,KAA2C,CACxB,CAAC;YACtB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,SAAS,EAAE,CAAC;YACZ,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7E,CAAC;QAED,KAAK,CAAC,SAAsB,EAAE;YAC5B,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;YAClC,IAAI,MAAM,GAAG,SAAS,CAAC;YACvB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,KAAM,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,KAAM,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,MAAe;YACpB,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,KAAK;YACH,OAAO,aAAa,EAAE,CAAC,MAAM,CAAC;QAChC,CAAC;QAED,KAAK;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,QAAQ;YACN,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;QAED,UAAU,CAAC,MAAc;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1E,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,SAAS,EAAE,CAAC;YACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;gBAC/C,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC5E,MAAM,EAAE,CAAC;YACX,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,SAAS,EAAE,CAAC;IACZ,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAC3B,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC,CAAC;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,SAAS,EAAE,CAAC;IACZ,OAAO,WAAW,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAkB;IACjE,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,YAAY,SAAS,2BAA2B,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAiB;QAC3B,mBAAmB,EAAE,IAAI;QACzB,OAAO,EAAE,CAAC;QACV,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,UAAU,EAAE,MAAM,CAAC,MAAM;KAC1B,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,eAAwB;IAExB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,yCAAyC;IACzC,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAA4B,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,IAAK,MAAM,CAAC,SAAoB,CAAC;IAClE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,iDAAiD;IACjD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAA4B,CAAC;YAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,MAAM,CAAqB,CAAC;YAC5D,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,MAAgC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,0CAA0C;IAC1C,SAAS,EAAE,CAAC;IACZ,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1E,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC"}

package/{hooks → dist/hooks}/post-commit

@@ -3,7 +3,9 @@
 # Tracks git commits for developer activity events
 # Install: cp hooks/post-commit .git/hooks/post-commit && chmod +x .git/hooks/post-commit
 
-EVENTS_FILE="$(git rev-parse --show-toplevel)/.events.json"
+# Use main repo root (not worktree root) so all worktrees share the same events file
+MAIN_ROOT="$(git worktree list --porcelain | head -1 | sed 's/^worktree //')"
+EVENTS_FILE="$MAIN_ROOT/.events.json"
 
 # Initialize events file if it doesn't exist
 if [ ! -f "$EVENTS_FILE" ]; then

package/{hooks → dist/hooks}/post-merge

@@ -3,7 +3,9 @@
 # Tracks merges for developer activity events
 # Install: cp hooks/post-merge .git/hooks/post-merge && chmod +x .git/hooks/post-merge
 
-EVENTS_FILE="$(git rev-parse --show-toplevel)/.events.json"
+# Use main repo root (not worktree root) so all worktrees share the same events file
+MAIN_ROOT="$(git worktree list --porcelain | head -1 | sed 's/^worktree //')"
+EVENTS_FILE="$MAIN_ROOT/.events.json"
 
 if [ ! -f "$EVENTS_FILE" ]; then
   echo '{"commits":0,"prs_merged":0,"bugs_fixed":0,"tests_passing":0,"refactors":0,"code_reviews":0,"conflicts_resolved":0,"ci_passes":0,"deploys":0,"docs_written":0}' > "$EVENTS_FILE"

package/dist/hooks/pre-commit

@@ -0,0 +1,29 @@
+#!/bin/sh
+# AgentGuard Git Hook - pre-commit
+# Auto-stages telemetry files so governance data rides with every commit.
+# Without this, telemetry JSONL files accumulate as untracked forever.
+
+# Use main repo root (not worktree root) so governance files are centralized
+REPO_ROOT="$(git worktree list --porcelain | head -1 | sed 's/^worktree //')"
+
+# Stage consolidated telemetry log
+if [ -f "$REPO_ROOT/logs/runtime-events.jsonl" ]; then
+  git add "$REPO_ROOT/logs/runtime-events.jsonl" 2>/dev/null
+fi
+
+# Stage dev activity counters
+if [ -f "$REPO_ROOT/.events.json" ]; then
+  git add "$REPO_ROOT/.events.json" 2>/dev/null
+fi
+
+# Stage governance event JSONL files (bulk add for performance)
+if [ -d "$REPO_ROOT/.agentguard/events" ]; then
+  git add "$REPO_ROOT/.agentguard/events/" 2>/dev/null
+fi
+
+# Stage governance decision records (bulk add for performance)
+if [ -d "$REPO_ROOT/.agentguard/decisions" ]; then
+  git add "$REPO_ROOT/.agentguard/decisions/" 2>/dev/null
+fi
+
+exit 0

package/dist/policy-resolver.d.ts

@@ -0,0 +1,32 @@
+import type { CompositionResult } from '@red-codes/policy';
+import { describeComposition } from '@red-codes/policy';
+export declare function findDefaultPolicy(): string | null;
+/**
+ * Find the user-level policy file in ~/.agentguard/.
+ * Returns null if no user policy exists.
+ */
+export declare function findUserPolicy(): string | null;
+/**
+ * Load a single policy file and resolve its extends chain.
+ * Returns a flat array of LoadedPolicy objects.
+ */
+export declare function loadPolicyFile(policyPath: string): unknown[];
+/**
+ * Load policy definitions from a single path (backwards compatible).
+ */
+export declare function loadPolicyDefs(policyPath?: string): unknown[];
+/**
+ * Load and compose policies from multiple sources with hierarchical discovery.
+ *
+ * Discovery order (lowest to highest precedence):
+ * 1. User-level: ~/.agentguard/policy.yaml
+ * 2. Project-level: ./agentguard.yaml (auto-discovered)
+ * 3. Explicit: --policy flags (in order provided)
+ *
+ * @param policyPaths - Explicit policy file paths (from --policy flags)
+ * @returns CompositionResult with ordered policies and source metadata
+ */
+export declare function loadComposedPolicies(policyPaths?: string[]): CompositionResult;
+export { describeComposition };
+export type { CompositionResult };
+//# sourceMappingURL=policy-resolver.d.ts.map

package/dist/policy-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-resolver.d.ts","sourceRoot":"","sources":["../src/policy-resolver.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAqB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAmB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAgBzE,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAiBjD;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAO9C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,EAAE,CA2C5D;AASD;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,EAAE,CAG7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,iBAAiB,CA0D9E;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,iBAAiB,EAAE,CAAC"}