@red-codes/agentguard 1.0.0

package/dist/cli/colors.d.ts

@@ -0,0 +1,11 @@
+export declare const RESET: string;
+export declare const BOLD: string;
+export declare const DIM: string;
+export declare const FG: Record<string, string>;
+export declare const TYPE_COLORS: Record<string, string>;
+export declare function color(text: string, fg: string): string;
+export declare function bold(text: string): string;
+export declare function dim(text: string): string;
+export declare function visLen(str: string): number;
+export declare function padVis(str: string, width: number): string;
+//# sourceMappingURL=colors.d.ts.map

package/dist/cli/colors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"colors.d.ts","sourceRoot":"","sources":["../../src/cli/colors.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,KAAK,QAA4B,CAAC;AAC/C,eAAO,MAAM,IAAI,QAA4B,CAAC;AAC9C,eAAO,MAAM,GAAG,QAA4B,CAAC;AAE7C,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAUrC,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAQ9C,CAAC;AAEF,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExC;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGzD"}

package/dist/cli/colors.js

@@ -0,0 +1,44 @@
+// Shared ANSI color constants for CLI output
+// Respects NO_COLOR convention (https://no-color.org/)
+const enabled = !process.env.NO_COLOR;
+const ESC = '\x1b[';
+export const RESET = enabled ? `${ESC}0m` : '';
+export const BOLD = enabled ? `${ESC}1m` : '';
+export const DIM = enabled ? `${ESC}2m` : '';
+export const FG = {
+    black: enabled ? `${ESC}30m` : '',
+    red: enabled ? `${ESC}31m` : '',
+    green: enabled ? `${ESC}32m` : '',
+    yellow: enabled ? `${ESC}33m` : '',
+    blue: enabled ? `${ESC}34m` : '',
+    magenta: enabled ? `${ESC}35m` : '',
+    cyan: enabled ? `${ESC}36m` : '',
+    white: enabled ? `${ESC}37m` : '',
+    gray: enabled ? `${ESC}90m` : '',
+};
+export const TYPE_COLORS = {
+    frontend: 'blue',
+    backend: 'red',
+    devops: 'yellow',
+    testing: 'green',
+    architecture: 'magenta',
+    security: 'red',
+    ai: 'cyan',
+};
+export function color(text, fg) {
+    return `${FG[fg] || ''}${text}${RESET}`;
+}
+export function bold(text) {
+    return `${BOLD}${text}${RESET}`;
+}
+export function dim(text) {
+    return `${DIM}${text}${RESET}`;
+}
+export function visLen(str) {
+    return str.replace(/\x1b\[[0-9;]*m/g, '').length;
+}
+export function padVis(str, width) {
+    const diff = width - visLen(str);
+    return diff > 0 ? str + ' '.repeat(diff) : str;
+}
+//# sourceMappingURL=colors.js.map

package/dist/cli/colors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"colors.js","sourceRoot":"","sources":["../../src/cli/colors.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,uDAAuD;AAEvD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAEtC,MAAM,GAAG,GAAG,OAAO,CAAC;AACpB,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAE7C,MAAM,CAAC,MAAM,EAAE,GAA2B;IACxC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;IACjC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;IAC/B,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;IACjC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;IAClC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;IAChC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;IACnC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;IAChC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;IACjC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAA2B;IACjD,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,OAAO;IAChB,YAAY,EAAE,SAAS;IACvB,QAAQ,EAAE,KAAK;IACf,EAAE,EAAE,MAAM;CACX,CAAC;AAEF,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,EAAU;IAC5C,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,OAAO,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY;IAC9B,OAAO,GAAG,GAAG,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,KAAa;IAC/C,MAAM,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACjD,CAAC"}

package/dist/cli/commands/claude-hook.d.ts

@@ -0,0 +1,2 @@
+export declare function claudeHook(hookType?: string): Promise<void>;
+//# sourceMappingURL=claude-hook.d.ts.map

package/dist/cli/commands/claude-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-hook.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/claude-hook.ts"],"names":[],"mappings":"AAOA,wBAAsB,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BjE"}

package/dist/cli/commands/claude-hook.js

@@ -0,0 +1,110 @@
+// AgentGuard Claude Code hook — PreToolUse governance + PostToolUse error monitoring.
+// PreToolUse: routes actions through the kernel for policy/invariant enforcement.
+// PostToolUse: reports Bash stderr errors (informational only).
+// Always exits 0 — hooks must never fail.
+export async function claudeHook(hookType) {
+    try {
+        const input = await readStdin();
+        if (!input)
+            process.exit(0);
+        let data;
+        try {
+            data = JSON.parse(input);
+        }
+        catch {
+            process.exit(0);
+            return;
+        }
+        // Determine hook type: explicit CLI arg > payload field > inference from tool_output
+        const isPreToolUse = hookType === 'pre' || data.hook === 'PreToolUse' || (!hookType && !data.tool_output);
+        if (isPreToolUse) {
+            // Resolve session_id: payload field > environment variable > undefined
+            const sessionId = data.session_id || process.env.CLAUDE_SESSION_ID || undefined;
+            const payload = { ...data, session_id: sessionId };
+            await handlePreToolUse(payload);
+        }
+        else {
+            handlePostToolUse(data);
+        }
+    }
+    catch {
+        // Swallow all errors — hooks must never fail
+    }
+    process.exit(0);
+}
+async function handlePreToolUse(payload) {
+    const { processClaudeCodeHook, formatHookResponse } = await import('../../adapters/claude-code.js');
+    const { createKernel } = await import('../../kernel/kernel.js');
+    const { createJsonlSink } = await import('../../events/jsonl.js');
+    const { createDecisionJsonlSink } = await import('../../events/decision-jsonl.js');
+    const { createTelemetryDecisionSink } = await import('../../telemetry/runtimeLogger.js');
+    const { loadPolicyDefs } = await import('../policy-resolver.js');
+    // Ensure hook field is set
+    const normalizedPayload = {
+        ...payload,
+        hook: 'PreToolUse',
+    };
+    // Load policy (fail-open: empty policy if none found)
+    let policyDefs = [];
+    try {
+        policyDefs = loadPolicyDefs();
+    }
+    catch {
+        // Policy loading failure is non-fatal — continue with no policy (allow all)
+    }
+    // Generate run ID
+    const runId = `hook_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+    // Create sinks (swallow errors — directories may not exist yet)
+    let jsonlSink, decisionSink, telemetrySink;
+    try {
+        jsonlSink = createJsonlSink({ runId });
+        decisionSink = createDecisionJsonlSink({ runId });
+        telemetrySink = createTelemetryDecisionSink();
+    }
+    catch {
+        // Sink creation failure is non-fatal
+    }
+    // Build kernel — dryRun: true because Claude Code handles execution
+    const kernel = createKernel({
+        runId,
+        policyDefs,
+        dryRun: true,
+        sinks: jsonlSink ? [jsonlSink] : [],
+        decisionSinks: [decisionSink, telemetrySink].filter(Boolean),
+    });
+    const result = await processClaudeCodeHook(kernel, normalizedPayload);
+    kernel.shutdown();
+    // If denied, output to stdout — this tells Claude Code to block the action
+    if (!result.allowed) {
+        const response = formatHookResponse(result);
+        if (response) {
+            process.stdout.write(response);
+        }
+    }
+}
+function handlePostToolUse(data) {
+    if (data.tool_name !== 'Bash')
+        return;
+    const output = (data.tool_output || {});
+    const exitCode = (output.exit_code ?? output.exitCode ?? 0);
+    const stderr = (output.stderr || '');
+    if (exitCode !== 0 && stderr.trim()) {
+        process.stdout.write('\n');
+        process.stdout.write(`  \x1b[1m\x1b[31mError detected:\x1b[0m ${stderr.trim().split('\n')[0].slice(0, 80)}\n`);
+        process.stdout.write('\n');
+    }
+}
+function readStdin() {
+    return new Promise((resolve) => {
+        let input = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', (chunk) => {
+            input += chunk;
+        });
+        process.stdin.on('end', () => resolve(input));
+        process.stdin.on('error', () => resolve(''));
+        if (process.stdin.isTTY)
+            resolve('');
+    });
+}
+//# sourceMappingURL=claude-hook.js.map

package/dist/cli/commands/claude-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-hook.js","sourceRoot":"","sources":["../../../src/cli/commands/claude-hook.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,kFAAkF;AAClF,gEAAgE;AAChE,0CAA0C;AAI1C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAiB;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4B,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,qFAAqF;QACrF,MAAM,YAAY,GAChB,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvF,IAAI,YAAY,EAAE,CAAC;YACjB,uEAAuE;YACvE,MAAM,SAAS,GACZ,IAAI,CAAC,UAAiC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC;YACxF,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAsC,CAAC;YACvF,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAA8B;IAC5D,MAAM,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,GACjD,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;IAChD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAChE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAClE,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;IACnF,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACzF,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAEjE,2BAA2B;IAC3B,MAAM,iBAAiB,GAA0B;QAC/C,GAAG,OAAO;QACV,IAAI,EAAE,YAAY;KACnB,CAAC;IAEF,sDAAsD;IACtD,IAAI,UAAU,GAAc,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,UAAU,GAAG,cAAc,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IAED,kBAAkB;IAClB,MAAM,KAAK,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAE7E,gEAAgE;IAChE,IAAI,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC;IAC3C,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACvC,YAAY,GAAG,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,aAAa,GAAG,2BAA2B,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,KAAK;QACL,UAAU;QACV,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;QACnC,aAAa,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,MAAM,CACjD,OAAO,CACoD;KAC9D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAElB,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM;QAAE,OAAO;IAEtC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;IACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAW,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAW,CAAC;IAE/C,IAAI,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CACzF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,KAAK,IAAI,KAAK,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/claude-init.d.ts

@@ -0,0 +1,2 @@
+export declare function claudeInit(args?: string[]): Promise<void>;
+//# sourceMappingURL=claude-init.d.ts.map

package/dist/cli/commands/claude-init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-init.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/claude-init.ts"],"names":[],"mappings":"AA6BA,wBAAsB,UAAU,CAAC,IAAI,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAgHnE"}

package/dist/cli/commands/claude-init.js

@@ -0,0 +1,150 @@
+// agentguard claude-init — set up Claude Code integration
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { RESET, BOLD, DIM, FG } from '../colors.js';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const HOOK_MARKER = 'claude-hook';
+export async function claudeInit(args = []) {
+    const isGlobal = args.includes('--global') || args.includes('-g');
+    const isRemove = args.includes('--remove') || args.includes('--uninstall');
+    const hookScript = resolve(__dirname, 'claude-hook.js');
+    const settingsDir = isGlobal ? join(homedir(), '.claude') : join(process.cwd(), '.claude');
+    const settingsPath = join(settingsDir, 'settings.json');
+    const settingsLabel = isGlobal ? '~/.claude/settings.json' : '.claude/settings.json';
+    process.stderr.write('\n');
+    process.stderr.write(`  ${BOLD}AgentGuard Claude Code Integration${RESET}\n\n`);
+    if (isRemove) {
+        removeHook(settingsPath, settingsLabel);
+        return;
+    }
+    if (!existsSync(settingsDir)) {
+        mkdirSync(settingsDir, { recursive: true });
+    }
+    let settings = {};
+    if (existsSync(settingsPath)) {
+        try {
+            settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+        }
+        catch {
+            process.stderr.write(`  ${FG.yellow}Warning:${RESET} Could not parse ${settingsLabel}, creating fresh config.\n`);
+            settings = {};
+        }
+    }
+    if (hasAgentGuardHook(settings)) {
+        process.stderr.write(`  ${FG.yellow}Already configured.${RESET} AgentGuard hook found in ${settingsLabel}.\n`);
+        process.stderr.write(`  ${DIM}Use --remove to uninstall.${RESET}\n\n`);
+        return;
+    }
+    if (!settings.hooks)
+        settings.hooks = {};
+    // PreToolUse — governance enforcement (routes all tool calls through the kernel)
+    if (!settings.hooks.PreToolUse)
+        settings.hooks.PreToolUse = [];
+    settings.hooks.PreToolUse.push({
+        hooks: [
+            {
+                type: 'command',
+                command: `node ${hookScript} pre`,
+            },
+        ],
+    });
+    // PostToolUse — error monitoring (Bash stderr reporting)
+    if (!settings.hooks.PostToolUse)
+        settings.hooks.PostToolUse = [];
+    settings.hooks.PostToolUse.push({
+        matcher: 'Bash',
+        hooks: [
+            {
+                type: 'command',
+                command: `node ${hookScript} post`,
+            },
+        ],
+    });
+    writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');
+    process.stderr.write(`  ${FG.green}✓${RESET}  Hooks installed in ${FG.cyan}${settingsLabel}${RESET}\n`);
+    process.stderr.write(`  ${DIM}PreToolUse:  governance enforcement (all tools)${RESET}\n`);
+    process.stderr.write(`  ${DIM}PostToolUse: error monitoring (Bash)${RESET}\n\n`);
+    // Set core.hooksPath so git uses the repo's hooks/ directory
+    // (pre-commit auto-stages telemetry, post-commit tracks dev activity)
+    try {
+        const currentHooksPath = execSync('git config core.hooksPath', { encoding: 'utf8' }).trim();
+        if (currentHooksPath !== 'hooks') {
+            execSync('git config core.hooksPath hooks');
+            process.stderr.write(`  ${FG.green}✓${RESET}  Git hooks path set to ${FG.cyan}hooks/${RESET}\n`);
+        }
+    }
+    catch {
+        // Not in a git repo, or no hooksPath set yet
+        try {
+            execSync('git config core.hooksPath hooks');
+            process.stderr.write(`  ${FG.green}✓${RESET}  Git hooks path set to ${FG.cyan}hooks/${RESET}\n`);
+        }
+        catch {
+            process.stderr.write(`  ${FG.yellow}Warning:${RESET} Could not set git hooks path. Run: git config core.hooksPath hooks\n`);
+        }
+    }
+    // Ensure telemetry directories exist
+    const dirs = ['.agentguard/events', '.agentguard/decisions', 'logs'];
+    for (const dir of dirs) {
+        const dirPath = join(process.cwd(), dir);
+        if (!existsSync(dirPath)) {
+            mkdirSync(dirPath, { recursive: true });
+        }
+    }
+    process.stderr.write(`  ${FG.green}${BOLD}Done!${RESET} AgentGuard governance will enforce policies on all Claude Code actions.\n`);
+    process.stderr.write(`  ${DIM}Run "agentguard inspect --last" to view action history.${RESET}\n`);
+    process.stderr.write(`  ${DIM}Use "agentguard claude-init --remove" to uninstall.${RESET}\n\n`);
+}
+function removeHook(settingsPath, settingsLabel) {
+    if (!existsSync(settingsPath)) {
+        process.stderr.write(`  ${DIM}No settings file found at ${settingsLabel}. Nothing to remove.${RESET}\n\n`);
+        return;
+    }
+    let settings;
+    try {
+        settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+    }
+    catch {
+        process.stderr.write(`  ${FG.red}Error:${RESET} Could not parse ${settingsLabel}.\n\n`);
+        return;
+    }
+    if (!hasAgentGuardHook(settings)) {
+        process.stderr.write(`  ${DIM}No AgentGuard hook found in ${settingsLabel}. Nothing to remove.${RESET}\n\n`);
+        return;
+    }
+    const filterAgentGuard = (entries) => entries.filter((entry) => {
+        const hooks = entry.hooks || [];
+        return !hooks.some((h) => h.command && h.command.includes(HOOK_MARKER));
+    });
+    const preToolUse = settings.hooks?.PreToolUse || [];
+    settings.hooks.PreToolUse = filterAgentGuard(preToolUse);
+    if (settings.hooks.PreToolUse.length === 0) {
+        delete settings.hooks.PreToolUse;
+    }
+    const postToolUse = settings.hooks?.PostToolUse || [];
+    settings.hooks.PostToolUse = filterAgentGuard(postToolUse);
+    if (settings.hooks.PostToolUse.length === 0) {
+        delete settings.hooks.PostToolUse;
+    }
+    if (Object.keys(settings.hooks).length === 0) {
+        delete settings.hooks;
+    }
+    writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');
+    process.stderr.write(`  ${FG.green}✓${RESET}  Hook removed from ${FG.cyan}${settingsLabel}${RESET}\n`);
+    process.stderr.write(`  ${DIM}AgentGuard governance will no longer monitor in Claude Code.${RESET}\n\n`);
+}
+function hasAgentGuardHook(settings) {
+    const preToolUse = settings?.hooks?.PreToolUse || [];
+    const postToolUse = settings?.hooks?.PostToolUse || [];
+    const allEntries = [...preToolUse, ...postToolUse];
+    return allEntries.some((entry) => {
+        const hooks = entry.hooks || [];
+        return hooks.some((h) => h.command && h.command.includes(HOOK_MARKER));
+    });
+}
+//# sourceMappingURL=claude-init.js.map

package/dist/cli/commands/claude-init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-init.js","sourceRoot":"","sources":["../../../src/cli/commands/claude-init.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAE1D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,WAAW,GAAG,aAAa,CAAC;AAgBlC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAiB,EAAE;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAE3E,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAExD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAErF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,qCAAqC,KAAK,MAAM,CAAC,CAAC;IAEhF,IAAI,QAAQ,EAAE,CAAC;QACb,UAAU,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAa,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,MAAM,WAAW,KAAK,oBAAoB,aAAa,4BAA4B,CAC5F,CAAC;YACF,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,MAAM,sBAAsB,KAAK,6BAA6B,aAAa,KAAK,CACzF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,6BAA6B,KAAK,MAAM,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;IAEzC,iFAAiF;IACjF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU;QAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC;IAC/D,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC7B,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,QAAQ,UAAU,MAAM;aAClC;SACF;KACF,CAAC,CAAC;IAEH,yDAAyD;IACzD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW;QAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;QAC9B,OAAO,EAAE,MAAM;QACf,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,QAAQ,UAAU,OAAO;aACnC;SACF;KACF,CAAC,CAAC;IAEH,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,KAAK,IAAI,KAAK,wBAAwB,EAAE,CAAC,IAAI,GAAG,aAAa,GAAG,KAAK,IAAI,CAClF,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,kDAAkD,KAAK,IAAI,CAAC,CAAC;IAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,uCAAuC,KAAK,MAAM,CAAC,CAAC;IACjF,6DAA6D;IAC7D,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,QAAQ,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5F,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACjC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,KAAK,IAAI,KAAK,2BAA2B,EAAE,CAAC,IAAI,SAAS,KAAK,IAAI,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;QAC7C,IAAI,CAAC;YACH,QAAQ,CAAC,iCAAiC,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,KAAK,IAAI,KAAK,2BAA2B,EAAE,CAAC,IAAI,SAAS,KAAK,IAAI,CAC3E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,MAAM,WAAW,KAAK,uEAAuE,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,IAAI,GAAG,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,KAAK,GAAG,IAAI,QAAQ,KAAK,4EAA4E,CAC9G,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,0DAA0D,KAAK,IAAI,CAAC,CAAC;IAClG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,sDAAsD,KAAK,MAAM,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB,EAAE,aAAqB;IAC7D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,6BAA6B,aAAa,uBAAuB,KAAK,MAAM,CACrF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAa,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,KAAK,oBAAoB,aAAa,OAAO,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,+BAA+B,aAAa,uBAAuB,KAAK,MAAM,CACvF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,OAAoB,EAAE,EAAE,CAChD,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEL,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;IACpD,QAAQ,CAAC,KAAM,CAAC,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,KAAM,CAAC,UAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,KAAM,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,CAAC;IACtD,QAAQ,CAAC,KAAM,CAAC,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,KAAM,CAAC,WAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,KAAM,CAAC,WAAW,CAAC;IACrC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,EAAE,CAAC,KAAK,IAAI,KAAK,uBAAuB,EAAE,CAAC,IAAI,GAAG,aAAa,GAAG,KAAK,IAAI,CACjF,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,GAAG,+DAA+D,KAAK,MAAM,CACnF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAkB;IAC3C,MAAM,UAAU,GAAG,QAAQ,EAAE,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,QAAQ,EAAE,KAAK,EAAE,WAAW,IAAI,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/export.d.ts

@@ -0,0 +1,11 @@
+/** Metadata header written as the first line of an exported governance session. */
+export interface GovernanceExportHeader {
+    readonly __agentguard_export: true;
+    readonly version: 1;
+    readonly runId: string;
+    readonly exportedAt: number;
+    readonly eventCount: number;
+    readonly decisionCount: number;
+}
+export declare function exportSession(args: string[]): Promise<void>;
+//# sourceMappingURL=export.d.ts.map

package/dist/cli/commands/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/export.ts"],"names":[],"mappings":"AAaA,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AA+CD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgEjE"}

package/dist/cli/commands/export.js

@@ -0,0 +1,113 @@
+// CLI command: agentguard export — export a governance session to a portable JSONL file.
+import { readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { parseArgs } from '../args.js';
+import { getEventFilePath } from '../../events/jsonl.js';
+import { getDecisionFilePath } from '../../events/decision-jsonl.js';
+const BASE_DIR = '.agentguard';
+const EVENTS_DIR = join(BASE_DIR, 'events');
+function listRuns() {
+    if (!existsSync(EVENTS_DIR))
+        return [];
+    return readdirSync(EVENTS_DIR)
+        .filter((f) => f.endsWith('.jsonl'))
+        .map((f) => f.replace('.jsonl', ''))
+        .sort()
+        .reverse();
+}
+function loadRunEvents(runId) {
+    const filePath = getEventFilePath(runId);
+    if (!existsSync(filePath))
+        return [];
+    const events = [];
+    const content = readFileSync(filePath, 'utf8');
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            events.push(JSON.parse(trimmed));
+        }
+        catch {
+            // Skip malformed lines
+        }
+    }
+    return events;
+}
+function loadRunDecisions(runId) {
+    const filePath = getDecisionFilePath(runId);
+    if (!existsSync(filePath))
+        return [];
+    const records = [];
+    const content = readFileSync(filePath, 'utf8');
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            records.push(JSON.parse(trimmed));
+        }
+        catch {
+            // Skip malformed lines
+        }
+    }
+    return records;
+}
+export async function exportSession(args) {
+    const parsed = parseArgs(args, {
+        boolean: ['--last'],
+        string: ['--output', '-o'],
+        alias: { '-o': '--output' },
+    });
+    // Resolve runId
+    let runId;
+    if (parsed.flags.last) {
+        const runs = listRuns();
+        runId = runs[0];
+        if (!runId) {
+            process.stderr.write('\n  \x1b[31mError:\x1b[0m No runs recorded yet.\n\n');
+            process.exitCode = 1;
+            return;
+        }
+    }
+    else {
+        runId = parsed.positional[0];
+    }
+    if (!runId) {
+        process.stderr.write('\n  Usage: agentguard export <runId> [--output <file>]\n');
+        process.stderr.write('         agentguard export --last\n\n');
+        process.exitCode = 1;
+        return;
+    }
+    // Load events and decisions
+    const events = loadRunEvents(runId);
+    if (events.length === 0) {
+        process.stderr.write(`\n  \x1b[31mError:\x1b[0m Run "${runId}" has no events to export.\n`);
+        process.stderr.write(`  Expected file: ${getEventFilePath(runId)}\n\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const decisions = loadRunDecisions(runId);
+    // Determine output path
+    const outputPath = resolve(parsed.flags.output || `${runId}.agentguard.jsonl`);
+    // Build export file: header + events + decisions
+    const header = {
+        __agentguard_export: true,
+        version: 1,
+        runId,
+        exportedAt: Date.now(),
+        eventCount: events.length,
+        decisionCount: decisions.length,
+    };
+    const lines = [
+        JSON.stringify(header),
+        ...events.map((e) => JSON.stringify(e)),
+        ...decisions.map((d) => JSON.stringify(d)),
+    ];
+    writeFileSync(outputPath, lines.join('\n') + '\n', 'utf8');
+    process.stderr.write(`\n  \x1b[32m\u2713\x1b[0m Exported run \x1b[1m${runId}\x1b[0m\n`);
+    process.stderr.write(`    Events:    ${events.length}\n`);
+    process.stderr.write(`    Decisions: ${decisions.length}\n`);
+    process.stderr.write(`    Output:    ${outputPath}\n\n`);
+}
+//# sourceMappingURL=export.js.map

package/dist/cli/commands/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/cli/commands/export.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAEzF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAY5C,SAAS,QAAQ;IACf,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,WAAW,CAAC,UAAU,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACnC,IAAI,EAAE;SACN,OAAO,EAAE,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6B,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC;QAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;KAC5B,CAAC,CAAC;IAEH,gBAAgB;IAChB,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC5E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,8BAA8B,CAAC,CAAC;QAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE1C,wBAAwB;IACxB,MAAM,UAAU,GAAG,OAAO,CAAE,MAAM,CAAC,KAAK,CAAC,MAAiB,IAAI,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAE3F,iDAAiD;IACjD,MAAM,MAAM,GAA2B;QACrC,mBAAmB,EAAE,IAAI;QACzB,OAAO,EAAE,CAAC;QACV,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,aAAa,EAAE,SAAS,CAAC,MAAM;KAChC,CAAC;IAEF,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACtB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACvC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KAC3C,CAAC;IAEF,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAE3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,KAAK,WAAW,CAAC,CAAC;IACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,UAAU,MAAM,CAAC,CAAC;AAC3D,CAAC"}

package/dist/cli/commands/guard.d.ts

@@ -0,0 +1,12 @@
+import type { RendererRegistry } from '../../renderers/registry.js';
+export interface GuardOptions {
+    policy?: string;
+    dryRun?: boolean;
+    verbose?: boolean;
+    stdin?: boolean;
+    simulate?: boolean;
+    /** Optional pre-configured renderer registry (for custom renderers) */
+    renderers?: RendererRegistry;
+}
+export declare function guard(_args: string[], options?: GuardOptions): Promise<number>;
+//# sourceMappingURL=guard.d.ts.map

package/dist/cli/commands/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/guard.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED,wBAAsB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkExF"}