@rulemetric/cli 0.7.3 → 0.7.5

package/dist/chunk-37LN5O7M.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/active-org-refresh.ts"],
-  "sourcesContent": ["import { apiGet } from './api-client.js';\nimport {\n  readActiveOrg,\n  writeActiveOrg,\n  clearActiveOrg,\n  isStale,\n} from './active-org.js';\n\ninterface ProfileResponse {\n  id: string;\n  email: string | null;\n  displayName: string | null;\n  activeOrgId: string | null;\n}\n\ninterface OrgListItem {\n  id: string;\n  name: string;\n  slug: string;\n  role: string;\n}\n\n/**\n * Module-level guard so we only refresh once per CLI invocation, even if\n * `BaseCommand.init` runs multiple times across nested commands or tests.\n */\nlet attempted = false;\n\n/**\n * Opportunistically reconcile the local active-org cache with the server.\n *\n * Runs in three cases:\n *   1. Cache file is ABSENT (bootstrap) \u2014 populate from `/api/profile`. This\n *      branch is load-bearing: without it, a user who never explicitly ran\n *      `rulemetric org switch` would have hook captures with `org_id=NULL`\n *      forever, even when the server already has `profiles.active_org_id`\n *      set (e.g. switched via the web UI, or auto-set by the handle_new_user\n *      trigger from migration 00067). Caught 2026-05-25 after an audit found\n *      244 hook sessions over 14 days all missing org_id.\n *   2. Cache file exists but is stale (>5min) \u2014 re-sync from the server.\n *   3. Env override is set OR cache is fresh \u2014 no-op, zero network.\n *\n * Failures are intentionally swallowed: this is a background nicety, not a\n * gating step. The next API call the user actually invoked will surface\n * any auth/network errors with clearer messaging than a refresh failure\n * could. Capture-time fallback to `profiles.active_org_id` at\n * `apps/api/src/routes/sessions.ts:48` is the final safety net.\n */\n/**\n * Internal: fetch profile + (if needed) orgs, then write/clear the cache.\n * Shared body for both `maybeRefreshActiveOrg` (guarded, used by every CLI\n * command via BaseCommand) and `bootstrapActiveOrg` (unguarded, used by\n * lifecycle commands that just wrote auth/install state and want the cache\n * to reflect it before they exit).\n */\nasync function syncActiveOrgFromServer(): Promise<void> {\n  // Env override: caller has explicitly chosen the org. Don't write the\n  // file \u2014 env should be ephemeral.\n  if (process.env.RULEMETRIC_ORG_ID) return;\n\n  const cached = readActiveOrg();\n  // Only skip when we have a fresh cache. Missing cache (cached === null)\n  // and stale cache both fall through to the refresh path below.\n  if (cached && !isStale(cached)) return;\n\n  try {\n    const profile = await apiGet<ProfileResponse>('/api/profile');\n\n    if (!profile.activeOrgId) {\n      // Server has no active org \u2014 drop the local cache (if any).\n      clearActiveOrg();\n      return;\n    }\n\n    if (cached && profile.activeOrgId === cached.orgId) {\n      // Same id \u2014 just bump syncedAt so we don't re-fetch every command.\n      writeActiveOrg({\n        orgId: cached.orgId,\n        orgSlug: cached.orgSlug,\n        syncedAt: Date.now(),\n      });\n      return;\n    }\n\n    // Either bootstrapping fresh (no cache) OR the server changed the active\n    // org out from under us (e.g. via web UI). Look up the slug for the id\n    // and (re)write the cache.\n    const orgs = await apiGet<OrgListItem[]>('/api/orgs');\n    const match = orgs.find((o) => o.id === profile.activeOrgId);\n    writeActiveOrg({\n      orgId: profile.activeOrgId,\n      orgSlug: match?.slug,\n      syncedAt: Date.now(),\n    });\n  } catch {\n    // Swallow \u2014 leave the old cache intact. The user's actual command will\n    // surface the real error if any.\n  }\n}\n\nexport async function maybeRefreshActiveOrg(): Promise<void> {\n  if (attempted) return;\n  attempted = true;\n  await syncActiveOrgFromServer();\n}\n\n/**\n * Explicit, guard-bypassing version of the refresh. Use ONLY from commands\n * where the user just took an action that changes auth/install state and we\n * want the cache to reflect it before the command exits:\n *\n *   - After `auth login`: BaseCommand.init fired the guarded refresh BEFORE\n *     credentials existed and got a 401; we need to retry post-login.\n *   - After `hooks install` / `service install`: belt-and-suspenders so the\n *     first Claude Code session after install has a populated cache, even\n *     if BaseCommand's earlier refresh hit a transient error.\n *\n * Marks `attempted = true` after running so a redundant `maybeRefreshActiveOrg`\n * call later in the same process is a no-op.\n */\nexport async function bootstrapActiveOrg(): Promise<void> {\n  attempted = true;\n  await syncActiveOrgFromServer();\n}\n\n/**\n * Test hook \u2014 reset the once-per-process guard so each test can exercise\n * the refresh logic.\n */\nexport function _resetRefreshAttempt(): void {\n  attempted = false;\n}\n"],
-  "mappings": ";;;;;;;;;;;AA0BA,IAAI,YAAY;AA6BhB,eAAe,0BAAyC;AAGtD,MAAI,QAAQ,IAAI,kBAAmB;AAEnC,QAAM,SAAS,cAAc;AAG7B,MAAI,UAAU,CAAC,QAAQ,MAAM,EAAG;AAEhC,MAAI;AACF,UAAM,UAAU,MAAM,OAAwB,cAAc;AAE5D,QAAI,CAAC,QAAQ,aAAa;AAExB,qBAAe;AACf;AAAA,IACF;AAEA,QAAI,UAAU,QAAQ,gBAAgB,OAAO,OAAO;AAElD,qBAAe;AAAA,QACb,OAAO,OAAO;AAAA,QACd,SAAS,OAAO;AAAA,QAChB,UAAU,KAAK,IAAI;AAAA,MACrB,CAAC;AACD;AAAA,IACF;AAKA,UAAM,OAAO,MAAM,OAAsB,WAAW;AACpD,UAAM,QAAQ,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ,WAAW;AAC3D,mBAAe;AAAA,MACb,OAAO,QAAQ;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,UAAU,KAAK,IAAI;AAAA,IACrB,CAAC;AAAA,EACH,QAAQ;AAAA,EAGR;AACF;AAEA,eAAsB,wBAAuC;AAC3D,MAAI,UAAW;AACf,cAAY;AACZ,QAAM,wBAAwB;AAChC;AAgBA,eAAsB,qBAAoC;AACxD,cAAY;AACZ,QAAM,wBAAwB;AAChC;AAMO,SAAS,uBAA6B;AAC3C,cAAY;AACd;",
-  "names": []
-}

package/dist/chunk-3S7223UR.js

@@ -1,81 +0,0 @@
-import {
-  getCursorUserSettingsPath,
-  getVSCodeUserSettingsPath
-} from "./chunk-LXKPNATC.js";
-
-// src/lib/editor-proxy-pins.ts
-import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-function defaultEditorPinPaths() {
-  return {
-    vscode: getVSCodeUserSettingsPath(),
-    cursor: getCursorUserSettingsPath(),
-    marker: join(homedir(), ".config", "rulemetric", "editor-proxy-unpinned.json")
-  };
-}
-function isOurProxyValue(value, gatewayPort) {
-  return value === `http://localhost:${gatewayPort}` || value === `http://127.0.0.1:${gatewayPort}`;
-}
-function readSettings(path) {
-  if (!existsSync(path)) return null;
-  try {
-    return JSON.parse(readFileSync(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function unpinEditorProxies(gatewayPort, paths = defaultEditorPinPaths()) {
-  const unpinned = [];
-  for (const editor of ["vscode", "cursor"]) {
-    const path = paths[editor];
-    const settings = readSettings(path);
-    if (!settings || !isOurProxyValue(settings["http.proxy"], gatewayPort)) continue;
-    delete settings["http.proxy"];
-    if (settings["http.proxyStrictSSL"] === false) {
-      delete settings["http.proxyStrictSSL"];
-    }
-    try {
-      writeFileSync(path, JSON.stringify(settings, null, 2) + "\n");
-      unpinned.push(editor);
-    } catch {
-    }
-  }
-  if (unpinned.length > 0) {
-    const prior = readSettings(paths.marker);
-    const editors = [.../* @__PURE__ */ new Set([...prior?.editors ?? [], ...unpinned])];
-    try {
-      writeFileSync(
-        paths.marker,
-        JSON.stringify({ editors, gatewayPort, unpinnedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n"
-      );
-    } catch {
-    }
-  }
-  return unpinned;
-}
-function repinEditorProxies(writePin, paths = defaultEditorPinPaths()) {
-  const marker = readSettings(paths.marker);
-  if (!marker || !Array.isArray(marker.editors)) return [];
-  const repinned = [];
-  for (const editor of marker.editors) {
-    if (editor !== "vscode" && editor !== "cursor") continue;
-    try {
-      writePin(editor);
-      repinned.push(editor);
-    } catch {
-    }
-  }
-  try {
-    unlinkSync(paths.marker);
-  } catch {
-  }
-  return repinned;
-}
-
-export {
-  defaultEditorPinPaths,
-  unpinEditorProxies,
-  repinEditorProxies
-};
-//# sourceMappingURL=chunk-3S7223UR.js.map

package/dist/chunk-3S7223UR.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/editor-proxy-pins.ts"],
-  "sourcesContent": ["import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { getVSCodeUserSettingsPath, getCursorUserSettingsPath } from './hooks-config.js';\n\n/**\n * Editor proxy pin lifecycle for a DEAD/unownable gateway.\n *\n * `hooks install` pins `http.proxy` (+ `http.proxyStrictSSL: false`) into\n * VS Code and Cursor USER-level settings so Copilot/Cursor traffic routes\n * through the capture gateway. Those pins outlive the gateway: after a crash\n * that can't self-heal \u2014 most importantly a FOREIGN process owning :8787 \u2014\n * the editors keep routing HTTP at a port we don't control, with strictSSL\n * off. `gateway ensure` (run on every session start) calls `unpin` in that\n * state and `repin` once the gateway is verifiably ours again.\n *\n * Ownership predicate is strict: `http.proxy` is only ever removed when it\n * points at OUR gateway port on localhost \u2014 a user-owned corporate proxy is\n * never touched (same discipline as removeRulemetricProxyEnv). What was\n * unpinned is recorded in a marker file so repin restores exactly that set,\n * and never manufactures a pin the user removed themselves.\n */\n\nexport interface EditorPinPaths {\n  vscode: string;\n  cursor: string;\n  marker: string;\n}\n\nexport function defaultEditorPinPaths(): EditorPinPaths {\n  return {\n    vscode: getVSCodeUserSettingsPath(),\n    cursor: getCursorUserSettingsPath(),\n    marker: join(homedir(), '.config', 'rulemetric', 'editor-proxy-unpinned.json'),\n  };\n}\n\nfunction isOurProxyValue(value: unknown, gatewayPort: number): boolean {\n  return (\n    value === `http://localhost:${gatewayPort}` ||\n    value === `http://127.0.0.1:${gatewayPort}`\n  );\n}\n\nfunction readSettings(path: string): Record<string, unknown> | null {\n  if (!existsSync(path)) return null;\n  try {\n    return JSON.parse(readFileSync(path, 'utf-8')) as Record<string, unknown>;\n  } catch {\n    return null; // JSONC/corrupt \u2014 never risk clobbering a user's editor config\n  }\n}\n\n/**\n * Remove our gateway pin from each editor's user settings. Returns the list\n * of editors actually unpinned and records them in the marker (merging with\n * a prior marker so repeated unpins don't lose state).\n */\nexport function unpinEditorProxies(\n  gatewayPort: number,\n  paths: EditorPinPaths = defaultEditorPinPaths(),\n): Array<'vscode' | 'cursor'> {\n  const unpinned: Array<'vscode' | 'cursor'> = [];\n  for (const editor of ['vscode', 'cursor'] as const) {\n    const path = paths[editor];\n    const settings = readSettings(path);\n    if (!settings || !isOurProxyValue(settings['http.proxy'], gatewayPort)) continue;\n    delete settings['http.proxy'];\n    // strictSSL rides along with our pin; only strip it when the pin was ours\n    // (checked above) AND it holds the value we wrote.\n    if (settings['http.proxyStrictSSL'] === false) {\n      delete settings['http.proxyStrictSSL'];\n    }\n    try {\n      writeFileSync(path, JSON.stringify(settings, null, 2) + '\\n');\n      unpinned.push(editor);\n    } catch {\n      /* editor settings not writable \u2014 leave as-is */\n    }\n  }\n  if (unpinned.length > 0) {\n    const prior = readSettings(paths.marker) as { editors?: string[] } | null;\n    const editors = [...new Set([...(prior?.editors ?? []), ...unpinned])];\n    try {\n      writeFileSync(\n        paths.marker,\n        JSON.stringify({ editors, gatewayPort, unpinnedAt: new Date().toISOString() }, null, 2) + '\\n',\n      );\n    } catch {\n      /* marker write failure only costs a future auto-repin */\n    }\n  }\n  return unpinned;\n}\n\n/**\n * Restore pins for exactly the editors a previous unpin removed (per the\n * marker), then clear the marker. `writePin` is injected by the caller\n * (writeVSCodeUserProxyConfig / writeCursorUserProxyConfig) \u2014 those writers\n * already refuse to overwrite a user-owned non-localhost proxy.\n */\nexport function repinEditorProxies(\n  writePin: (editor: 'vscode' | 'cursor') => void,\n  paths: EditorPinPaths = defaultEditorPinPaths(),\n): Array<'vscode' | 'cursor'> {\n  const marker = readSettings(paths.marker) as { editors?: unknown } | null;\n  if (!marker || !Array.isArray(marker.editors)) return [];\n  const repinned: Array<'vscode' | 'cursor'> = [];\n  for (const editor of marker.editors) {\n    if (editor !== 'vscode' && editor !== 'cursor') continue;\n    try {\n      writePin(editor);\n      repinned.push(editor);\n    } catch {\n      /* best-effort \u2014 a failed repin keeps the marker below */\n    }\n  }\n  try {\n    unlinkSync(paths.marker);\n  } catch {\n    /* already gone */\n  }\n  return repinned;\n}\n"],
-  "mappings": ";;;;;;AAAA,SAAS,YAAY,cAAc,YAAY,qBAAqB;AACpE,SAAS,eAAe;AACxB,SAAS,YAAY;AA2Bd,SAAS,wBAAwC;AACtD,SAAO;AAAA,IACL,QAAQ,0BAA0B;AAAA,IAClC,QAAQ,0BAA0B;AAAA,IAClC,QAAQ,KAAK,QAAQ,GAAG,WAAW,cAAc,4BAA4B;AAAA,EAC/E;AACF;AAEA,SAAS,gBAAgB,OAAgB,aAA8B;AACrE,SACE,UAAU,oBAAoB,WAAW,MACzC,UAAU,oBAAoB,WAAW;AAE7C;AAEA,SAAS,aAAa,MAA8C;AAClE,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,mBACd,aACA,QAAwB,sBAAsB,GAClB;AAC5B,QAAM,WAAuC,CAAC;AAC9C,aAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,UAAM,OAAO,MAAM,MAAM;AACzB,UAAM,WAAW,aAAa,IAAI;AAClC,QAAI,CAAC,YAAY,CAAC,gBAAgB,SAAS,YAAY,GAAG,WAAW,EAAG;AACxE,WAAO,SAAS,YAAY;AAG5B,QAAI,SAAS,qBAAqB,MAAM,OAAO;AAC7C,aAAO,SAAS,qBAAqB;AAAA,IACvC;AACA,QAAI;AACF,oBAAc,MAAM,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAC5D,eAAS,KAAK,MAAM;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,QAAQ,aAAa,MAAM,MAAM;AACvC,UAAM,UAAU,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAI,OAAO,WAAW,CAAC,GAAI,GAAG,QAAQ,CAAC,CAAC;AACrE,QAAI;AACF;AAAA,QACE,MAAM;AAAA,QACN,KAAK,UAAU,EAAE,SAAS,aAAa,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,GAAG,MAAM,CAAC,IAAI;AAAA,MAC5F;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAQO,SAAS,mBACd,UACA,QAAwB,sBAAsB,GAClB;AAC5B,QAAM,SAAS,aAAa,MAAM,MAAM;AACxC,MAAI,CAAC,UAAU,CAAC,MAAM,QAAQ,OAAO,OAAO,EAAG,QAAO,CAAC;AACvD,QAAM,WAAuC,CAAC;AAC9C,aAAW,UAAU,OAAO,SAAS;AACnC,QAAI,WAAW,YAAY,WAAW,SAAU;AAChD,QAAI;AACF,eAAS,MAAM;AACf,eAAS,KAAK,MAAM;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACA,MAAI;AACF,eAAW,MAAM,MAAM;AAAA,EACzB,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
-  "names": []
-}

package/dist/chunk-3TIMQ3O6.js

@@ -1,96 +0,0 @@
-import {
-  executeEval
-} from "./chunk-QN34TGD3.js";
-
-// src/lib/eval-analyzer.ts
-var ANALYZER_SYSTEM_PROMPT = `You are an expert at improving AI coding instructions, skills, and prompts. You receive eval results showing how well the current content performs, and your job is to propose specific improvements.
-
-You will receive:
-1. The current content of the eval target
-2. Eval results: for each eval, the prompt, expectations, pass/fail results, and grader feedback
-3. The pass rate and areas of weakness
-
-Analyze the failures and propose concrete edits to improve the content. Focus on:
-- Expectations that consistently fail \u2014 what's missing from the content?
-- Grader feedback suggesting new assertions \u2014 what outcomes aren't being tested?
-- Patterns across failures \u2014 is there a systemic gap?
-
-Your proposed content should be a complete replacement, not a diff. Keep what works, fix what doesn't.
-
-You MUST respond with ONLY a valid JSON object:
-
-{
-  "suggestions": [
-    {
-      "section": "which part of the content",
-      "current": "brief quote of current text",
-      "proposed": "what it should say instead",
-      "reasoning": "why this change helps"
-    }
-  ],
-  "overallAssessment": "brief summary of what's working and what's not",
-  "proposedContent": "the full improved content"
-}`;
-async function analyzeEvalResults(options) {
-  const { content, evalResults, model, timeout = 12e4, userFeedback } = options;
-  const resultsText = evalResults.map((r) => {
-    const grading = r.grading;
-    const expectations = grading?.expectations ?? [];
-    const passRate = grading?.summary?.pass_rate ?? "N/A";
-    const feedback = grading?.eval_feedback?.overall ?? "";
-    return `## Eval: ${r.evalName}
-Prompt: ${r.prompt}
-Pass rate: ${typeof passRate === "number" ? (passRate * 100).toFixed(0) + "%" : passRate}
-
-Expectations:
-${expectations.map((e) => `  ${e.passed ? "PASS" : "FAIL"} \u2014 ${e.text}: ${e.evidence}`).join("\n")}
-
-Feedback: ${feedback}`;
-  }).join("\n\n---\n\n");
-  const feedbackSection = userFeedback ? `
-
-## User Feedback
-
-${userFeedback}` : "\n\n## User Feedback\n\nNo specific feedback provided.";
-  const analyzerPrompt = `## Current Content
-
-${content}
-
-## Eval Results
-
-${resultsText}${feedbackSection}
-
-Analyze the results and propose improvements. Respond with ONLY valid JSON.`;
-  const result = await executeEval({
-    prompt: analyzerPrompt,
-    targetContent: ANALYZER_SYSTEM_PROMPT,
-    timeout,
-    model
-  });
-  if (result.error) {
-    return {
-      suggestions: [],
-      overallAssessment: `Analysis failed: ${result.error}`,
-      proposedContent: content
-    };
-  }
-  try {
-    let jsonStr = result.output.trim();
-    const jsonMatch = jsonStr.match(/```(?:json)?\s*([\s\S]*?)```/);
-    if (jsonMatch) jsonStr = jsonMatch[1].trim();
-    const objMatch = jsonStr.match(/\{[\s\S]*\}/);
-    if (objMatch) jsonStr = objMatch[0];
-    return JSON.parse(jsonStr);
-  } catch {
-    return {
-      suggestions: [],
-      overallAssessment: `Analysis returned unparseable output: ${result.output.slice(0, 200)}`,
-      proposedContent: content
-    };
-  }
-}
-
-export {
-  analyzeEvalResults
-};
-//# sourceMappingURL=chunk-3TIMQ3O6.js.map

package/dist/chunk-3TIMQ3O6.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/eval-analyzer.ts"],
-  "sourcesContent": ["import { executeEval } from './eval-executor.js';\n\nexport interface AnalysisResult {\n  suggestions: Array<{\n    section: string;\n    current: string;\n    proposed: string;\n    reasoning: string;\n  }>;\n  overallAssessment: string;\n  proposedContent: string;\n}\n\nconst ANALYZER_SYSTEM_PROMPT = `You are an expert at improving AI coding instructions, skills, and prompts. You receive eval results showing how well the current content performs, and your job is to propose specific improvements.\n\nYou will receive:\n1. The current content of the eval target\n2. Eval results: for each eval, the prompt, expectations, pass/fail results, and grader feedback\n3. The pass rate and areas of weakness\n\nAnalyze the failures and propose concrete edits to improve the content. Focus on:\n- Expectations that consistently fail \u2014 what's missing from the content?\n- Grader feedback suggesting new assertions \u2014 what outcomes aren't being tested?\n- Patterns across failures \u2014 is there a systemic gap?\n\nYour proposed content should be a complete replacement, not a diff. Keep what works, fix what doesn't.\n\nYou MUST respond with ONLY a valid JSON object:\n\n{\n  \"suggestions\": [\n    {\n      \"section\": \"which part of the content\",\n      \"current\": \"brief quote of current text\",\n      \"proposed\": \"what it should say instead\",\n      \"reasoning\": \"why this change helps\"\n    }\n  ],\n  \"overallAssessment\": \"brief summary of what's working and what's not\",\n  \"proposedContent\": \"the full improved content\"\n}`;\n\nexport async function analyzeEvalResults(options: {\n  content: string;\n  evalResults: Array<{\n    evalName: string;\n    prompt: string;\n    expectations: string[];\n    grading: Record<string, unknown>;\n  }>;\n  model?: string;\n  timeout?: number;\n  userFeedback?: string;\n}): Promise<AnalysisResult> {\n  const { content, evalResults, model, timeout = 120_000, userFeedback } = options;\n\n  const resultsText = evalResults.map((r) => {\n    const grading = r.grading as any;\n    const expectations = grading?.expectations ?? [];\n    const passRate = grading?.summary?.pass_rate ?? 'N/A';\n    const feedback = grading?.eval_feedback?.overall ?? '';\n\n    return `## Eval: ${r.evalName}\nPrompt: ${r.prompt}\nPass rate: ${typeof passRate === 'number' ? (passRate * 100).toFixed(0) + '%' : passRate}\n\nExpectations:\n${expectations.map((e: any) => `  ${e.passed ? 'PASS' : 'FAIL'} \u2014 ${e.text}: ${e.evidence}`).join('\\n')}\n\nFeedback: ${feedback}`;\n  }).join('\\n\\n---\\n\\n');\n\n  const feedbackSection = userFeedback\n    ? `\\n\\n## User Feedback\\n\\n${userFeedback}`\n    : '\\n\\n## User Feedback\\n\\nNo specific feedback provided.';\n\n  const analyzerPrompt = `## Current Content\n\n${content}\n\n## Eval Results\n\n${resultsText}${feedbackSection}\n\nAnalyze the results and propose improvements. Respond with ONLY valid JSON.`;\n\n  const result = await executeEval({\n    prompt: analyzerPrompt,\n    targetContent: ANALYZER_SYSTEM_PROMPT,\n    timeout,\n    model,\n  });\n\n  if (result.error) {\n    return {\n      suggestions: [],\n      overallAssessment: `Analysis failed: ${result.error}`,\n      proposedContent: content,\n    };\n  }\n\n  try {\n    let jsonStr = result.output.trim();\n    const jsonMatch = jsonStr.match(/```(?:json)?\\s*([\\s\\S]*?)```/);\n    if (jsonMatch) jsonStr = jsonMatch[1].trim();\n    const objMatch = jsonStr.match(/\\{[\\s\\S]*\\}/);\n    if (objMatch) jsonStr = objMatch[0];\n\n    return JSON.parse(jsonStr) as AnalysisResult;\n  } catch {\n    return {\n      suggestions: [],\n      overallAssessment: `Analysis returned unparseable output: ${result.output.slice(0, 200)}`,\n      proposedContent: content,\n    };\n  }\n}\n"],
-  "mappings": ";;;;;AAaA,IAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6B/B,eAAsB,mBAAmB,SAWb;AAC1B,QAAM,EAAE,SAAS,aAAa,OAAO,UAAU,MAAS,aAAa,IAAI;AAEzE,QAAM,cAAc,YAAY,IAAI,CAAC,MAAM;AACzC,UAAM,UAAU,EAAE;AAClB,UAAM,eAAe,SAAS,gBAAgB,CAAC;AAC/C,UAAM,WAAW,SAAS,SAAS,aAAa;AAChD,UAAM,WAAW,SAAS,eAAe,WAAW;AAEpD,WAAO,YAAY,EAAE,QAAQ;AAAA,UACvB,EAAE,MAAM;AAAA,aACL,OAAO,aAAa,YAAY,WAAW,KAAK,QAAQ,CAAC,IAAI,MAAM,QAAQ;AAAA;AAAA;AAAA,EAGtF,aAAa,IAAI,CAAC,MAAW,KAAK,EAAE,SAAS,SAAS,MAAM,WAAM,EAAE,IAAI,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,YAE3F,QAAQ;AAAA,EAClB,CAAC,EAAE,KAAK,aAAa;AAErB,QAAM,kBAAkB,eACpB;AAAA;AAAA;AAAA;AAAA,EAA2B,YAAY,KACvC;AAEJ,QAAM,iBAAiB;AAAA;AAAA,EAEvB,OAAO;AAAA;AAAA;AAAA;AAAA,EAIP,WAAW,GAAG,eAAe;AAAA;AAAA;AAI7B,QAAM,SAAS,MAAM,YAAY;AAAA,IAC/B,QAAQ;AAAA,IACR,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,OAAO,OAAO;AAChB,WAAO;AAAA,MACL,aAAa,CAAC;AAAA,MACd,mBAAmB,oBAAoB,OAAO,KAAK;AAAA,MACnD,iBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,MAAI;AACF,QAAI,UAAU,OAAO,OAAO,KAAK;AACjC,UAAM,YAAY,QAAQ,MAAM,8BAA8B;AAC9D,QAAI,UAAW,WAAU,UAAU,CAAC,EAAE,KAAK;AAC3C,UAAM,WAAW,QAAQ,MAAM,aAAa;AAC5C,QAAI,SAAU,WAAU,SAAS,CAAC;AAElC,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,MACL,aAAa,CAAC;AAAA,MACd,mBAAmB,yCAAyC,OAAO,OAAO,MAAM,GAAG,GAAG,CAAC;AAAA,MACvF,iBAAiB;AAAA,IACnB;AAAA,EACF;AACF;",
-  "names": []
-}

package/dist/chunk-42GFSAJP.js

@@ -1,32 +0,0 @@
-// src/lib/which.ts
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, delimiter } from "node:path";
-function wellKnownBinDirs(platform, home) {
-  if (platform === "darwin") {
-    return ["/opt/homebrew/bin", "/opt/homebrew/sbin", "/usr/local/bin", join(home, ".local/bin")];
-  }
-  if (platform === "linux") {
-    return ["/usr/local/bin", "/usr/bin", join(home, ".local/bin")];
-  }
-  return [];
-}
-function findBinary(name, opts = {}) {
-  const platform = opts.platform ?? process.platform;
-  const home = opts.home ?? homedir();
-  const pathDirs = (opts.pathEnv ?? process.env.PATH ?? "").split(delimiter).filter(Boolean);
-  const dirs = [.../* @__PURE__ */ new Set([...pathDirs, ...wellKnownBinDirs(platform, home)])];
-  const exts = platform === "win32" ? ["", ...(process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean)] : [""];
-  for (const dir of dirs) {
-    for (const ext of exts) {
-      const candidate = join(dir, name + ext);
-      if (existsSync(candidate)) return candidate;
-    }
-  }
-  return null;
-}
-
-export {
-  findBinary
-};
-//# sourceMappingURL=chunk-42GFSAJP.js.map

package/dist/chunk-42GFSAJP.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/which.ts"],
-  "sourcesContent": ["import { existsSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, delimiter } from 'node:path';\n\ninterface FindBinaryOptions {\n  /** Override the platform (defaults to process.platform). Used in tests. */\n  platform?: NodeJS.Platform;\n  /** Override $PATH (defaults to process.env.PATH). Used in tests. */\n  pathEnv?: string;\n  /** Override the home dir (for the well-known-dir fallback). Used in tests. */\n  home?: string;\n}\n\n/**\n * Standard install locations to probe IN ADDITION to $PATH \u2014 GUI/agent-launched\n * processes (and Claude Code's minimal-PATH hook shells) often omit these, so a\n * brew/pipx/mitmdump that's plainly installed reads as \"not found\". This is the\n * same minimal-PATH class as the hook-command PATH prefixing (PR #111); here it\n * makes mitmproxy auto-install actually fire on a Mac with Homebrew. Real $PATH\n * entries are searched first, so this only ever ADDS reach, never overrides.\n */\nfunction wellKnownBinDirs(platform: NodeJS.Platform, home: string): string[] {\n  if (platform === 'darwin') {\n    return ['/opt/homebrew/bin', '/opt/homebrew/sbin', '/usr/local/bin', join(home, '.local/bin')];\n  }\n  if (platform === 'linux') {\n    return ['/usr/local/bin', '/usr/bin', join(home, '.local/bin')];\n  }\n  return [];\n}\n\n/**\n * Cross-platform executable lookup \u2014 the portable replacement for `which`/`where`.\n *\n * Scans the directories on `$PATH` for an executable named `name`, returning the\n * first full path that exists or `null`. On Windows it also probes the\n * `PATHEXT` extensions (`.EXE`, `.CMD`, ...) so `findBinary('mitmdump')` resolves\n * `mitmdump.exe`. Pure filesystem reads \u2014 no subprocess \u2014 so it works identically\n * on macOS, Linux, and Windows (the old `execSync('which \u2026')` path threw on\n * Windows, which has no `which`, silently breaking mitmproxy detection there).\n */\nexport function findBinary(name: string, opts: FindBinaryOptions = {}): string | null {\n  const platform = opts.platform ?? process.platform;\n  const home = opts.home ?? homedir();\n  const pathDirs = (opts.pathEnv ?? process.env.PATH ?? '').split(delimiter).filter(Boolean);\n  // $PATH first (a real entry wins), then the well-known install dirs \u2014 deduped.\n  const dirs = [...new Set([...pathDirs, ...wellKnownBinDirs(platform, home)])];\n\n  // On Windows, try the bare name first (in case it already carries an extension),\n  // then each PATHEXT suffix. Elsewhere, only the bare name is meaningful.\n  const exts =\n    platform === 'win32'\n      ? ['', ...(process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM').split(';').filter(Boolean)]\n      : [''];\n\n  for (const dir of dirs) {\n    for (const ext of exts) {\n      const candidate = join(dir, name + ext);\n      if (existsSync(candidate)) return candidate;\n    }\n  }\n  return null;\n}\n"],
-  "mappings": ";AAAA,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,MAAM,iBAAiB;AAmBhC,SAAS,iBAAiB,UAA2B,MAAwB;AAC3E,MAAI,aAAa,UAAU;AACzB,WAAO,CAAC,qBAAqB,sBAAsB,kBAAkB,KAAK,MAAM,YAAY,CAAC;AAAA,EAC/F;AACA,MAAI,aAAa,SAAS;AACxB,WAAO,CAAC,kBAAkB,YAAY,KAAK,MAAM,YAAY,CAAC;AAAA,EAChE;AACA,SAAO,CAAC;AACV;AAYO,SAAS,WAAW,MAAc,OAA0B,CAAC,GAAkB;AACpF,QAAM,WAAW,KAAK,YAAY,QAAQ;AAC1C,QAAM,OAAO,KAAK,QAAQ,QAAQ;AAClC,QAAM,YAAY,KAAK,WAAW,QAAQ,IAAI,QAAQ,IAAI,MAAM,SAAS,EAAE,OAAO,OAAO;AAEzF,QAAM,OAAO,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,UAAU,GAAG,iBAAiB,UAAU,IAAI,CAAC,CAAC,CAAC;AAI5E,QAAM,OACJ,aAAa,UACT,CAAC,IAAI,IAAI,QAAQ,IAAI,WAAW,uBAAuB,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC,IACjF,CAAC,EAAE;AAET,aAAW,OAAO,MAAM;AACtB,eAAW,OAAO,MAAM;AACtB,YAAM,YAAY,KAAK,KAAK,OAAO,GAAG;AACtC,UAAI,WAAW,SAAS,EAAG,QAAO;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;",
-  "names": []
-}

package/dist/chunk-4BHDHHKL.js

@@ -1,48 +0,0 @@
-import {
-  __require
-} from "./chunk-NSBPE2FW.js";
-
-// src/lib/skills-loader.ts
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as os from "node:os";
-import { SkillCatalog } from "@rulemetric/skills-registry";
-var CACHE_PATH = path.join(os.homedir(), ".config", "rulemetric", "skills-registry.json");
-function findBundledRegistry() {
-  try {
-    const pkgDir = path.dirname(__require.resolve("@rulemetric/skills-registry/package.json"));
-    const bundled = path.join(pkgDir, "registry.json");
-    if (fs.existsSync(bundled)) return bundled;
-  } catch {
-    const monorepo = path.resolve(process.cwd(), "packages", "skills-registry", "registry.json");
-    if (fs.existsSync(monorepo)) return monorepo;
-  }
-  return null;
-}
-async function loadRegistry(ctx) {
-  const catalog = new SkillCatalog();
-  if (fs.existsSync(CACHE_PATH)) {
-    try {
-      const data = JSON.parse(fs.readFileSync(CACHE_PATH, "utf-8"));
-      catalog.load(data);
-      return catalog;
-    } catch {
-    }
-  }
-  const bundled = findBundledRegistry();
-  if (bundled) {
-    try {
-      const data = JSON.parse(fs.readFileSync(bundled, "utf-8"));
-      catalog.load(data);
-      return catalog;
-    } catch {
-    }
-  }
-  ctx.log("No local registry found. Run: rulemetric skills update");
-  return catalog;
-}
-
-export {
-  loadRegistry
-};
-//# sourceMappingURL=chunk-4BHDHHKL.js.map

package/dist/chunk-4BHDHHKL.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/skills-loader.ts"],
-  "sourcesContent": ["import * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport * as os from 'node:os';\nimport { SkillCatalog } from '@rulemetric/skills-registry';\nimport type { SkillRegistry } from '@rulemetric/skills-registry';\n\nconst CACHE_PATH = path.join(os.homedir(), '.config', 'rulemetric', 'skills-registry.json');\n\n// Also check for a bundled registry.json next to the skills-registry package\nfunction findBundledRegistry(): string | null {\n  try {\n    const pkgDir = path.dirname(require.resolve('@rulemetric/skills-registry/package.json'));\n    const bundled = path.join(pkgDir, 'registry.json');\n    if (fs.existsSync(bundled)) return bundled;\n  } catch {\n    // resolve can fail in ESM, try a known relative path\n    const monorepo = path.resolve(process.cwd(), 'packages', 'skills-registry', 'registry.json');\n    if (fs.existsSync(monorepo)) return monorepo;\n  }\n  return null;\n}\n\n/** Load the skills registry, preferring local cache > bundled > empty. */\nexport async function loadRegistry(ctx: { log: (msg: string) => void }): Promise<SkillCatalog> {\n  const catalog = new SkillCatalog();\n\n  // Try cached registry first (from `skills update`)\n  if (fs.existsSync(CACHE_PATH)) {\n    try {\n      const data = JSON.parse(fs.readFileSync(CACHE_PATH, 'utf-8')) as SkillRegistry;\n      catalog.load(data);\n      return catalog;\n    } catch {\n      // Corrupted cache \u2014 fall through\n    }\n  }\n\n  // Try bundled registry\n  const bundled = findBundledRegistry();\n  if (bundled) {\n    try {\n      const data = JSON.parse(fs.readFileSync(bundled, 'utf-8')) as SkillRegistry;\n      catalog.load(data);\n      return catalog;\n    } catch {\n      // Fall through\n    }\n  }\n\n  ctx.log('No local registry found. Run: rulemetric skills update');\n  return catalog;\n}\n"],
-  "mappings": ";;;;;AAAA,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,YAAY,QAAQ;AACpB,SAAS,oBAAoB;AAG7B,IAAM,aAAkB,UAAQ,WAAQ,GAAG,WAAW,cAAc,sBAAsB;AAG1F,SAAS,sBAAqC;AAC5C,MAAI;AACF,UAAM,SAAc,aAAQ,UAAQ,QAAQ,0CAA0C,CAAC;AACvF,UAAM,UAAe,UAAK,QAAQ,eAAe;AACjD,QAAO,cAAW,OAAO,EAAG,QAAO;AAAA,EACrC,QAAQ;AAEN,UAAM,WAAgB,aAAQ,QAAQ,IAAI,GAAG,YAAY,mBAAmB,eAAe;AAC3F,QAAO,cAAW,QAAQ,EAAG,QAAO;AAAA,EACtC;AACA,SAAO;AACT;AAGA,eAAsB,aAAa,KAA4D;AAC7F,QAAM,UAAU,IAAI,aAAa;AAGjC,MAAO,cAAW,UAAU,GAAG;AAC7B,QAAI;AACF,YAAM,OAAO,KAAK,MAAS,gBAAa,YAAY,OAAO,CAAC;AAC5D,cAAQ,KAAK,IAAI;AACjB,aAAO;AAAA,IACT,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,QAAM,UAAU,oBAAoB;AACpC,MAAI,SAAS;AACX,QAAI;AACF,YAAM,OAAO,KAAK,MAAS,gBAAa,SAAS,OAAO,CAAC;AACzD,cAAQ,KAAK,IAAI;AACjB,aAAO;AAAA,IACT,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,IAAI,wDAAwD;AAChE,SAAO;AACT;",
-  "names": []
-}

package/dist/chunk-4D537GXE.js

@@ -1,99 +0,0 @@
-import {
-  executeEval
-} from "./chunk-QN34TGD3.js";
-
-// src/lib/eval-trigger-tester.ts
-var TRIGGER_DETECTOR_PROMPT = `You are determining whether an AI assistant's response shows evidence of using a specific skill/instruction.
-
-You will receive:
-1. The skill name and description
-2. Key content from the skill (to know what it teaches)
-3. The user's query
-4. The AI's response
-
-Determine if the response shows clear signs of the skill being used:
-- Does the response follow patterns/approaches described in the skill?
-- Does it use terminology or structures specific to the skill?
-- Would the response be noticeably different without the skill?
-
-Respond with ONLY a valid JSON object:
-
-{
-  "triggered": true,
-  "confidence": 0.85,
-  "evidence": "The response follows the X pattern described in the skill..."
-}`;
-async function testTrigger(options) {
-  const { query, shouldTrigger, skillName, skillDescription, skillContent, model, timeout = 12e4 } = options;
-  const execResult = await executeEval({
-    prompt: query,
-    targetContent: skillContent,
-    timeout,
-    model
-  });
-  if (execResult.error) {
-    return {
-      query,
-      shouldTrigger,
-      didTrigger: false,
-      correct: !shouldTrigger,
-      confidence: 0,
-      evidence: `Execution failed: ${execResult.error}`
-    };
-  }
-  const detectorPrompt = `## Skill
-Name: ${skillName}
-Description: ${skillDescription}
-
-## Key Skill Content (first 500 chars)
-${skillContent.slice(0, 500)}
-
-## User Query
-${query}
-
-## AI Response
-${execResult.output}
-
-Did the AI's response show evidence of using this skill? Respond with ONLY valid JSON.`;
-  const detectorResult = await executeEval({
-    prompt: detectorPrompt,
-    targetContent: TRIGGER_DETECTOR_PROMPT,
-    timeout: 6e4,
-    model
-  });
-  let didTrigger = false;
-  let confidence = 0;
-  let evidence = "";
-  try {
-    let jsonStr = detectorResult.output.trim();
-    const jsonMatch = jsonStr.match(/```(?:json)?\s*([\s\S]*?)```/);
-    if (jsonMatch) jsonStr = jsonMatch[1].trim();
-    const objMatch = jsonStr.match(/\{[\s\S]*\}/);
-    if (objMatch) jsonStr = objMatch[0];
-    const parsed = JSON.parse(jsonStr);
-    didTrigger = parsed.triggered === true;
-    confidence = parsed.confidence ?? 0;
-    evidence = parsed.evidence ?? "";
-  } catch {
-    evidence = `Detector returned unparseable output: ${detectorResult.output.slice(0, 200)}`;
-  }
-  return {
-    query,
-    shouldTrigger,
-    didTrigger,
-    correct: didTrigger === shouldTrigger,
-    confidence,
-    evidence
-  };
-}
-function computeTriggerScore(results) {
-  if (results.length === 0) return 0;
-  const correct = results.filter((r) => r.correct).length;
-  return correct / results.length;
-}
-
-export {
-  testTrigger,
-  computeTriggerScore
-};
-//# sourceMappingURL=chunk-4D537GXE.js.map

package/dist/chunk-4D537GXE.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/eval-trigger-tester.ts"],
-  "sourcesContent": ["import { executeEval } from './eval-executor.js';\n\nexport interface TriggerTestResult {\n  query: string;\n  shouldTrigger: boolean;\n  didTrigger: boolean;\n  correct: boolean;\n  confidence: number;\n  evidence: string;\n}\n\nconst TRIGGER_DETECTOR_PROMPT = `You are determining whether an AI assistant's response shows evidence of using a specific skill/instruction.\n\nYou will receive:\n1. The skill name and description\n2. Key content from the skill (to know what it teaches)\n3. The user's query\n4. The AI's response\n\nDetermine if the response shows clear signs of the skill being used:\n- Does the response follow patterns/approaches described in the skill?\n- Does it use terminology or structures specific to the skill?\n- Would the response be noticeably different without the skill?\n\nRespond with ONLY a valid JSON object:\n\n{\n  \"triggered\": true,\n  \"confidence\": 0.85,\n  \"evidence\": \"The response follows the X pattern described in the skill...\"\n}`;\n\nexport async function testTrigger(options: {\n  query: string;\n  shouldTrigger: boolean;\n  skillName: string;\n  skillDescription: string;\n  skillContent: string;\n  model?: string;\n  timeout?: number;\n}): Promise<TriggerTestResult> {\n  const { query, shouldTrigger, skillName, skillDescription, skillContent, model, timeout = 120_000 } = options;\n\n  // Run the query with the skill as system prompt\n  const execResult = await executeEval({\n    prompt: query,\n    targetContent: skillContent,\n    timeout,\n    model,\n  });\n\n  if (execResult.error) {\n    return {\n      query,\n      shouldTrigger,\n      didTrigger: false,\n      correct: !shouldTrigger,\n      confidence: 0,\n      evidence: `Execution failed: ${execResult.error}`,\n    };\n  }\n\n  // Use LLM to detect if the skill influenced the response\n  const detectorPrompt = `## Skill\nName: ${skillName}\nDescription: ${skillDescription}\n\n## Key Skill Content (first 500 chars)\n${skillContent.slice(0, 500)}\n\n## User Query\n${query}\n\n## AI Response\n${execResult.output}\n\nDid the AI's response show evidence of using this skill? Respond with ONLY valid JSON.`;\n\n  const detectorResult = await executeEval({\n    prompt: detectorPrompt,\n    targetContent: TRIGGER_DETECTOR_PROMPT,\n    timeout: 60_000,\n    model,\n  });\n\n  let didTrigger = false;\n  let confidence = 0;\n  let evidence = '';\n\n  try {\n    let jsonStr = detectorResult.output.trim();\n    const jsonMatch = jsonStr.match(/```(?:json)?\\s*([\\s\\S]*?)```/);\n    if (jsonMatch) jsonStr = jsonMatch[1].trim();\n    const objMatch = jsonStr.match(/\\{[\\s\\S]*\\}/);\n    if (objMatch) jsonStr = objMatch[0];\n\n    const parsed = JSON.parse(jsonStr);\n    didTrigger = parsed.triggered === true;\n    confidence = parsed.confidence ?? 0;\n    evidence = parsed.evidence ?? '';\n  } catch {\n    evidence = `Detector returned unparseable output: ${detectorResult.output.slice(0, 200)}`;\n  }\n\n  return {\n    query,\n    shouldTrigger,\n    didTrigger,\n    correct: didTrigger === shouldTrigger,\n    confidence,\n    evidence,\n  };\n}\n\nexport function computeTriggerScore(results: TriggerTestResult[]): number {\n  if (results.length === 0) return 0;\n  const correct = results.filter((r) => r.correct).length;\n  return correct / results.length;\n}\n"],
-  "mappings": ";;;;;AAWA,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBhC,eAAsB,YAAY,SAQH;AAC7B,QAAM,EAAE,OAAO,eAAe,WAAW,kBAAkB,cAAc,OAAO,UAAU,KAAQ,IAAI;AAGtG,QAAM,aAAa,MAAM,YAAY;AAAA,IACnC,QAAQ;AAAA,IACR,eAAe;AAAA,IACf;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,WAAW,OAAO;AACpB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,SAAS,CAAC;AAAA,MACV,YAAY;AAAA,MACZ,UAAU,qBAAqB,WAAW,KAAK;AAAA,IACjD;AAAA,EACF;AAGA,QAAM,iBAAiB;AAAA,QACjB,SAAS;AAAA,eACF,gBAAgB;AAAA;AAAA;AAAA,EAG7B,aAAa,MAAM,GAAG,GAAG,CAAC;AAAA;AAAA;AAAA,EAG1B,KAAK;AAAA;AAAA;AAAA,EAGL,WAAW,MAAM;AAAA;AAAA;AAIjB,QAAM,iBAAiB,MAAM,YAAY;AAAA,IACvC,QAAQ;AAAA,IACR,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AAED,MAAI,aAAa;AACjB,MAAI,aAAa;AACjB,MAAI,WAAW;AAEf,MAAI;AACF,QAAI,UAAU,eAAe,OAAO,KAAK;AACzC,UAAM,YAAY,QAAQ,MAAM,8BAA8B;AAC9D,QAAI,UAAW,WAAU,UAAU,CAAC,EAAE,KAAK;AAC3C,UAAM,WAAW,QAAQ,MAAM,aAAa;AAC5C,QAAI,SAAU,WAAU,SAAS,CAAC;AAElC,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,iBAAa,OAAO,cAAc;AAClC,iBAAa,OAAO,cAAc;AAClC,eAAW,OAAO,YAAY;AAAA,EAChC,QAAQ;AACN,eAAW,yCAAyC,eAAe,OAAO,MAAM,GAAG,GAAG,CAAC;AAAA,EACzF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,eAAe;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,oBAAoB,SAAsC;AACxE,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;AACjD,SAAO,UAAU,QAAQ;AAC3B;",
-  "names": []
-}

package/dist/chunk-4LYCDS2N.js

@@ -1,139 +0,0 @@
-import {
-  probeGatewayIdentity,
-  waitForGatewayIdentity
-} from "./chunk-7LVVKQMZ.js";
-import {
-  GATEWAY_ENTRY_COMMAND_PATTERN,
-  isPidLiveAndMatching
-} from "./chunk-5EDMGK3W.js";
-
-// src/lib/gateway-lifecycle.ts
-import { spawn } from "node:child_process";
-import { createConnection } from "node:net";
-import { existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-var MODULE_DIR = dirname(fileURLToPath(import.meta.url));
-var CONFIG_DIR = join(homedir(), ".config", "rulemetric");
-var GATEWAY_PID_FILE = join(CONFIG_DIR, "gateway.pid");
-var GATEWAY_LOG_FILE = join(CONFIG_DIR, "gateway.log");
-var GATEWAY_PORT = 8787;
-var MITMPROXY_PORT = 8788;
-function isGatewayListening(port = GATEWAY_PORT, timeoutMs = 1500) {
-  return new Promise((resolveProbe) => {
-    const socket = createConnection({ host: "127.0.0.1", port });
-    const finish = (result) => {
-      socket.destroy();
-      resolveProbe(result);
-    };
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => finish(true));
-    socket.once("timeout", () => finish(false));
-    socket.once("error", () => finish(false));
-  });
-}
-async function waitForGatewayListening(port = GATEWAY_PORT, { timeoutMs = 3e3, intervalMs = 150 } = {}) {
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    if (await isGatewayListening(port, Math.min(1500, timeoutMs))) return true;
-    if (Date.now() >= deadline) return false;
-    await new Promise((resolve2) => setTimeout(resolve2, intervalMs));
-  }
-}
-function isRulemetricGatewayListening(port = GATEWAY_PORT, timeoutMs = 1500) {
-  return probeGatewayIdentity(port, timeoutMs);
-}
-function waitForRulemetricGateway(port = GATEWAY_PORT, opts = {}) {
-  return waitForGatewayIdentity(port, opts);
-}
-function isGatewayRunning(pidOpts = {}) {
-  const pid = getGatewayPid();
-  if (pid === null) return false;
-  return isPidLiveAndMatching(pid, GATEWAY_ENTRY_COMMAND_PATTERN, pidOpts);
-}
-function getGatewayPid() {
-  if (!existsSync(GATEWAY_PID_FILE)) return null;
-  const content = readFileSync(GATEWAY_PID_FILE, "utf-8").trim();
-  const pid = parseInt(content, 10);
-  return isNaN(pid) ? null : pid;
-}
-function findGatewayEntry() {
-  const candidates = [
-    resolve(MODULE_DIR, "./gateway-entry.js"),
-    // sibling (unbundled)
-    resolve(MODULE_DIR, "./lib/gateway-entry.js"),
-    // bundled chunk at dist root
-    resolve(MODULE_DIR, "../lib/gateway-entry.js"),
-    // nested command dir → dist/lib
-    resolve(MODULE_DIR, "../../lib/gateway-entry.js")
-  ];
-  for (const p of candidates) {
-    if (existsSync(p)) return p;
-  }
-  throw new Error(
-    "Could not find gateway-entry.js. Is the CLI built?\nSearched:\n" + candidates.map((c) => `  ${c}`).join("\n")
-  );
-}
-function spawnGateway(cliVersion) {
-  if (isGatewayRunning()) {
-    const pid = getGatewayPid();
-    if (pid) return pid;
-  }
-  mkdirSync(CONFIG_DIR, { recursive: true });
-  const entryPath = findGatewayEntry();
-  const logFd = openSync(GATEWAY_LOG_FILE, "a");
-  const child = spawn(process.execPath, [entryPath], {
-    detached: true,
-    stdio: ["ignore", logFd, logFd],
-    // The gateway inherits the spawning CLI's env. RULEMETRIC_CLI_VERSION
-    // identifies the CLI version that started this gateway — used to
-    // detect drift when a newer CLI starts mitmproxy with a different
-    // version. RULEMETRIC_CLI_ENTRY is the path to the oclif entry point
-    // (process.argv[1]) so the gateway can re-invoke the CLI for
-    // `proxy restart` without needing the binary in PATH. Falls back to
-    // "unknown" if the caller didn't pass them.
-    env: {
-      ...process.env,
-      RULEMETRIC_CLI_VERSION: cliVersion ?? "unknown",
-      RULEMETRIC_CLI_ENTRY: process.argv[1] ?? ""
-    }
-  });
-  child.unref();
-  if (!child.pid) {
-    throw new Error("Failed to spawn gateway process");
-  }
-  writeFileSync(GATEWAY_PID_FILE, String(child.pid));
-  return child.pid;
-}
-function stopGateway(pidOpts = {}) {
-  const pid = getGatewayPid();
-  if (pid === null) return false;
-  if (isPidLiveAndMatching(pid, GATEWAY_ENTRY_COMMAND_PATTERN, pidOpts)) {
-    try {
-      process.kill(pid, "SIGTERM");
-    } catch {
-    }
-  }
-  try {
-    unlinkSync(GATEWAY_PID_FILE);
-  } catch {
-  }
-  return true;
-}
-
-export {
-  GATEWAY_PID_FILE,
-  GATEWAY_LOG_FILE,
-  GATEWAY_PORT,
-  MITMPROXY_PORT,
-  isGatewayListening,
-  waitForGatewayListening,
-  isRulemetricGatewayListening,
-  waitForRulemetricGateway,
-  isGatewayRunning,
-  getGatewayPid,
-  spawnGateway,
-  stopGateway
-};
-//# sourceMappingURL=chunk-4LYCDS2N.js.map

package/dist/chunk-4LYCDS2N.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/gateway-lifecycle.ts"],
-  "sourcesContent": ["/**\n * Gateway process lifecycle helpers \u2014 spawn, stop, check status.\n * Used by hooks install/uninstall, session-start hook, and proxy status.\n */\nimport { spawn } from 'node:child_process';\nimport { createConnection } from 'node:net';\nimport { existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport {\n  probeGatewayIdentity,\n  waitForGatewayIdentity,\n  type GatewayIdentity,\n} from './gateway-identity.js';\nimport {\n  isPidLiveAndMatching,\n  GATEWAY_ENTRY_COMMAND_PATTERN,\n  type PidIdentityOptions,\n} from './pid-identity.js';\n\n// `import.meta.dirname` only exists on Node >= 20.11 \u2014 on Node 18.x/\u226420.10 it is\n// `undefined`, and `resolve(undefined, \u2026)` throws, surfacing as a spurious\n// \"Could not find gateway-entry.js\" on fresh npm installs (the launchd gateway\n// masks it in dev). Derive the dir portably instead. See onboarding field report\n// 2026-07-07 F1.\nconst MODULE_DIR = dirname(fileURLToPath(import.meta.url));\n\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nexport const GATEWAY_PID_FILE = join(CONFIG_DIR, 'gateway.pid');\nexport const GATEWAY_LOG_FILE = join(CONFIG_DIR, 'gateway.log');\nexport const GATEWAY_PORT = 8787;\nexport const MITMPROXY_PORT = 8788;\n\n/**\n * TCP liveness probe: does something actually ACCEPT a connection on the port?\n * Distinct from isGatewayRunning() (which only checks the PID is alive) \u2014 a\n * process can be \"running\" per its pidfile while :8787 accepts nothing. This is\n * the check that must gate writing HTTPS_PROXY: never pin Claude Code's proxy\n * at a port with nothing behind it (the fresh-laptop ConnectionRefused footgun).\n */\nexport function isGatewayListening(port: number = GATEWAY_PORT, timeoutMs = 1500): Promise<boolean> {\n  return new Promise((resolveProbe) => {\n    const socket = createConnection({ host: '127.0.0.1', port });\n    const finish = (result: boolean) => {\n      socket.destroy();\n      resolveProbe(result);\n    };\n    socket.setTimeout(timeoutMs);\n    socket.once('connect', () => finish(true));\n    socket.once('timeout', () => finish(false));\n    socket.once('error', () => finish(false));\n  });\n}\n\n/**\n * Poll isGatewayListening() until it's true or the window elapses. spawnGateway()\n * returns as soon as it writes the PID file \u2014 the detached child hasn't bound\n * :8787 yet (Node bootstrap + module load). A one-shot probe microseconds later\n * fails-closed on every fresh install, so the proxy/deep-capture layer silently\n * never turns on. This tolerates a normal cold-start bind delay.\n */\nexport async function waitForGatewayListening(\n  port: number = GATEWAY_PORT,\n  { timeoutMs = 3000, intervalMs = 150 }: { timeoutMs?: number; intervalMs?: number } = {},\n): Promise<boolean> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    if (await isGatewayListening(port, Math.min(1500, timeoutMs))) return true;\n    if (Date.now() >= deadline) return false;\n    await new Promise((resolve) => setTimeout(resolve, intervalMs));\n  }\n}\n\n/**\n * Identity-aware liveness probe on :GATEWAY_PORT \u2014 connects, requests the\n * identity marker, and distinguishes ours-live / foreign / dead. This (not\n * the raw TCP probe above) is what HTTPS_PROXY-pinning decisions must use: a\n * foreign process accepting on :8787 passes isGatewayListening() but would\n * brick every HTTPS request Claude Code makes.\n */\nexport function isRulemetricGatewayListening(\n  port: number = GATEWAY_PORT,\n  timeoutMs = 1500,\n): Promise<GatewayIdentity> {\n  return probeGatewayIdentity(port, timeoutMs);\n}\n\n/**\n * Poll the identity probe through a cold-start bind delay. 'dead' retries\n * until the window elapses; 'ours-live' and 'foreign' return immediately\n * (waiting can't change what owns the port).\n */\nexport function waitForRulemetricGateway(\n  port: number = GATEWAY_PORT,\n  opts: { timeoutMs?: number; intervalMs?: number } = {},\n): Promise<GatewayIdentity> {\n  return waitForGatewayIdentity(port, opts);\n}\n\n/**\n * PID-file liveness WITH identity validation. PID files survive reboots, and\n * `kill -0` on a reused PID reports \"alive\" for an unrelated process \u2014 which\n * permanently defeats the session-start self-heal. The recorded PID only\n * counts as \"running\" when its command line is actually gateway-entry.\n */\nexport function isGatewayRunning(pidOpts: PidIdentityOptions = {}): boolean {\n  const pid = getGatewayPid();\n  if (pid === null) return false;\n  return isPidLiveAndMatching(pid, GATEWAY_ENTRY_COMMAND_PATTERN, pidOpts);\n}\n\nexport function getGatewayPid(): number | null {\n  if (!existsSync(GATEWAY_PID_FILE)) return null;\n  const content = readFileSync(GATEWAY_PID_FILE, 'utf-8').trim();\n  const pid = parseInt(content, 10);\n  return isNaN(pid) ? null : pid;\n}\n\nfunction findGatewayEntry(): string {\n  // Resolve the compiled gateway-entry.js across BOTH layouts:\n  //  - unbundled (dev/tsx, or tsc output): this module sits in dist/lib, so\n  //    gateway-entry.js is a sibling (`./gateway-entry.js`).\n  //  - BUNDLED (published build): esbuild flattens this module into\n  //    dist/chunk-*.js at the dist ROOT, so MODULE_DIR is dist/ and the entry\n  //    (kept as a separate build entry) is at dist/lib/gateway-entry.js\n  //    (`./lib/gateway-entry.js`). Without this candidate the gateway never\n  //    spawns on a clean npm install \u2014 masked in dev by the launchd gateway\n  //    short-circuiting before this runs. See onboarding field report F1.\n  const candidates = [\n    resolve(MODULE_DIR, './gateway-entry.js'),        // sibling (unbundled)\n    resolve(MODULE_DIR, './lib/gateway-entry.js'),    // bundled chunk at dist root\n    resolve(MODULE_DIR, '../lib/gateway-entry.js'),   // nested command dir \u2192 dist/lib\n    resolve(MODULE_DIR, '../../lib/gateway-entry.js'),\n  ];\n  for (const p of candidates) {\n    if (existsSync(p)) return p;\n  }\n  throw new Error(\n    'Could not find gateway-entry.js. Is the CLI built?\\n' +\n    'Searched:\\n' + candidates.map(c => `  ${c}`).join('\\n'),\n  );\n}\n\nexport function spawnGateway(cliVersion?: string): number {\n  if (isGatewayRunning()) {\n    const pid = getGatewayPid();\n    if (pid) return pid;\n  }\n\n  mkdirSync(CONFIG_DIR, { recursive: true });\n\n  const entryPath = findGatewayEntry();\n  const logFd = openSync(GATEWAY_LOG_FILE, 'a');\n\n  const child = spawn(process.execPath, [entryPath], {\n    detached: true,\n    stdio: ['ignore', logFd, logFd],\n    // The gateway inherits the spawning CLI's env. RULEMETRIC_CLI_VERSION\n    // identifies the CLI version that started this gateway \u2014 used to\n    // detect drift when a newer CLI starts mitmproxy with a different\n    // version. RULEMETRIC_CLI_ENTRY is the path to the oclif entry point\n    // (process.argv[1]) so the gateway can re-invoke the CLI for\n    // `proxy restart` without needing the binary in PATH. Falls back to\n    // \"unknown\" if the caller didn't pass them.\n    env: {\n      ...process.env,\n      RULEMETRIC_CLI_VERSION: cliVersion ?? 'unknown',\n      RULEMETRIC_CLI_ENTRY: process.argv[1] ?? '',\n    },\n  });\n\n  child.unref();\n\n  if (!child.pid) {\n    throw new Error('Failed to spawn gateway process');\n  }\n\n  writeFileSync(GATEWAY_PID_FILE, String(child.pid));\n  return child.pid;\n}\n\nexport function stopGateway(pidOpts: PidIdentityOptions = {}): boolean {\n  const pid = getGatewayPid();\n  if (pid === null) return false;\n\n  // Only signal a PID whose command line is actually gateway-entry \u2014 a\n  // reused PID belongs to an unrelated process we must never SIGTERM. Either\n  // way the PID file is stale after this and gets removed.\n  if (isPidLiveAndMatching(pid, GATEWAY_ENTRY_COMMAND_PATTERN, pidOpts)) {\n    try {\n      process.kill(pid, 'SIGTERM');\n    } catch {\n      // Process already gone\n    }\n  }\n\n  try { unlinkSync(GATEWAY_PID_FILE); } catch { /* already gone */ }\n  return true;\n}\n"],
-  "mappings": ";;;;;;;;;;AAIA,SAAS,aAAa;AACtB,SAAS,wBAAwB;AACjC,SAAS,YAAY,WAAW,UAAU,cAAc,YAAY,qBAAqB;AACzF,SAAS,eAAe;AACxB,SAAS,SAAS,MAAM,eAAe;AACvC,SAAS,qBAAqB;AAiB9B,IAAM,aAAa,QAAQ,cAAc,YAAY,GAAG,CAAC;AAEzD,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AACnD,IAAM,mBAAmB,KAAK,YAAY,aAAa;AACvD,IAAM,mBAAmB,KAAK,YAAY,aAAa;AACvD,IAAM,eAAe;AACrB,IAAM,iBAAiB;AASvB,SAAS,mBAAmB,OAAe,cAAc,YAAY,MAAwB;AAClG,SAAO,IAAI,QAAQ,CAAC,iBAAiB;AACnC,UAAM,SAAS,iBAAiB,EAAE,MAAM,aAAa,KAAK,CAAC;AAC3D,UAAM,SAAS,CAAC,WAAoB;AAClC,aAAO,QAAQ;AACf,mBAAa,MAAM;AAAA,IACrB;AACA,WAAO,WAAW,SAAS;AAC3B,WAAO,KAAK,WAAW,MAAM,OAAO,IAAI,CAAC;AACzC,WAAO,KAAK,WAAW,MAAM,OAAO,KAAK,CAAC;AAC1C,WAAO,KAAK,SAAS,MAAM,OAAO,KAAK,CAAC;AAAA,EAC1C,CAAC;AACH;AASA,eAAsB,wBACpB,OAAe,cACf,EAAE,YAAY,KAAM,aAAa,IAAI,IAAiD,CAAC,GACrE;AAClB,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAS;AACP,QAAI,MAAM,mBAAmB,MAAM,KAAK,IAAI,MAAM,SAAS,CAAC,EAAG,QAAO;AACtE,QAAI,KAAK,IAAI,KAAK,SAAU,QAAO;AACnC,UAAM,IAAI,QAAQ,CAACA,aAAY,WAAWA,UAAS,UAAU,CAAC;AAAA,EAChE;AACF;AASO,SAAS,6BACd,OAAe,cACf,YAAY,MACc;AAC1B,SAAO,qBAAqB,MAAM,SAAS;AAC7C;AAOO,SAAS,yBACd,OAAe,cACf,OAAoD,CAAC,GAC3B;AAC1B,SAAO,uBAAuB,MAAM,IAAI;AAC1C;AAQO,SAAS,iBAAiB,UAA8B,CAAC,GAAY;AAC1E,QAAM,MAAM,cAAc;AAC1B,MAAI,QAAQ,KAAM,QAAO;AACzB,SAAO,qBAAqB,KAAK,+BAA+B,OAAO;AACzE;AAEO,SAAS,gBAA+B;AAC7C,MAAI,CAAC,WAAW,gBAAgB,EAAG,QAAO;AAC1C,QAAM,UAAU,aAAa,kBAAkB,OAAO,EAAE,KAAK;AAC7D,QAAM,MAAM,SAAS,SAAS,EAAE;AAChC,SAAO,MAAM,GAAG,IAAI,OAAO;AAC7B;AAEA,SAAS,mBAA2B;AAUlC,QAAM,aAAa;AAAA,IACjB,QAAQ,YAAY,oBAAoB;AAAA;AAAA,IACxC,QAAQ,YAAY,wBAAwB;AAAA;AAAA,IAC5C,QAAQ,YAAY,yBAAyB;AAAA;AAAA,IAC7C,QAAQ,YAAY,4BAA4B;AAAA,EAClD;AACA,aAAW,KAAK,YAAY;AAC1B,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AACA,QAAM,IAAI;AAAA,IACR,oEACgB,WAAW,IAAI,OAAK,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI;AAAA,EACzD;AACF;AAEO,SAAS,aAAa,YAA6B;AACxD,MAAI,iBAAiB,GAAG;AACtB,UAAM,MAAM,cAAc;AAC1B,QAAI,IAAK,QAAO;AAAA,EAClB;AAEA,YAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AAEzC,QAAM,YAAY,iBAAiB;AACnC,QAAM,QAAQ,SAAS,kBAAkB,GAAG;AAE5C,QAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,SAAS,GAAG;AAAA,IACjD,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQ9B,KAAK;AAAA,MACH,GAAG,QAAQ;AAAA,MACX,wBAAwB,cAAc;AAAA,MACtC,sBAAsB,QAAQ,KAAK,CAAC,KAAK;AAAA,IAC3C;AAAA,EACF,CAAC;AAED,QAAM,MAAM;AAEZ,MAAI,CAAC,MAAM,KAAK;AACd,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AAEA,gBAAc,kBAAkB,OAAO,MAAM,GAAG,CAAC;AACjD,SAAO,MAAM;AACf;AAEO,SAAS,YAAY,UAA8B,CAAC,GAAY;AACrE,QAAM,MAAM,cAAc;AAC1B,MAAI,QAAQ,KAAM,QAAO;AAKzB,MAAI,qBAAqB,KAAK,+BAA+B,OAAO,GAAG;AACrE,QAAI;AACF,cAAQ,KAAK,KAAK,SAAS;AAAA,IAC7B,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI;AAAE,eAAW,gBAAgB;AAAA,EAAG,QAAQ;AAAA,EAAqB;AACjE,SAAO;AACT;",
-  "names": ["resolve"]
-}