@scopebond/hook 0.2.0 → 0.3.0

package/README.md

@@ -32,14 +32,19 @@ as `scopebond-enrollment.json`, then:
 npx @scopebond/hook connect https://<your-workspace> scopebond-enrollment.json
 ```
 
-`connect` scaffolds `.scopebond/` if needed, enrolls this machine's countersigning
-key with the workspace, and stores a scoped machine credential in
-`.scopebond/cloud.json` (a secret — never commit it). From then on every receipt is
-mirrored to the workspace through a **durable outbox**: delivery is best-effort and
-never blocks a tool call, and receipts are retained locally and retried if the
-workspace is unreachable. `scopebond-hook flush` delivers anything still queued —
-run it on a session-end hook (and set `SCOPEBOND_HOOK_FLUSH_MS=0`) if you want zero
-per-call latency.
+`connect` does the whole setup in one command: it scaffolds `.scopebond/` if needed,
+enrolls this machine's countersigning key, stores a scoped machine credential in
+`.scopebond/cloud.json` (a secret — never commit it), **and configures Claude Code
+for you** (it merges the hook into `.claude/settings.json`, preserving anything
+already there — pass `--no-install` to skip, or `--cursor` for Cursor). The
+enrollment argument can be a file, an inline blob, or JSON on stdin, so the portal
+can hand you a single copy-paste command with nothing to save.
+
+From then on every receipt is mirrored to the workspace through a **durable outbox**:
+delivery is best-effort and never blocks a tool call, and receipts are retained
+locally and retried if the workspace is unreachable. `scopebond-hook flush` delivers
+anything still queued — run it on a session-end hook (and set
+`SCOPEBOND_HOOK_FLUSH_MS=0`) if you want zero per-call latency.
 
 ## How it works
 

package/dist/cli.js

@@ -4,19 +4,59 @@
 //
 //   scopebond-hook claude                     evaluate a Claude Code PreToolUse call (stdin JSON)
 //   scopebond-hook cursor                     evaluate a Cursor hook event (stdin JSON)
-//   scopebond-hook init [--cursor]            scaffold keys + starter policy, print the config
+//   scopebond-hook init [--cursor] [--no-install]  scaffold keys + starter policy and configure the agent
 //   scopebond-hook connect <url> <bundle.json> [--cursor]
 //                                             enroll with a Cloud workspace and start exporting
+//   scopebond-hook log [-n N]                 show the most recent local receipts
+//   scopebond-hook verify                     verify every local receipt offline against the attester key
+//   scopebond-hook test "<shell command>"     show the decision for a command without recording it
 //   scopebond-hook flush                      deliver any queued receipts to Cloud now
 //
 // Config dir: $SCOPEBOND_HOOK_DIR, else ./.scopebond
 // Fail-closed: any error denies the action with a repair message.
-import { readFileSync } from "node:fs";
+import { readFileSync, existsSync, mkdtempSync, rmSync } from "node:fs";
 import { join } from "node:path";
-import { mapClaudeToolUse, mapCursorEvent } from "./map.js";
+import { tmpdir } from "node:os";
+import { execFileSync } from "node:child_process";
+import { verifyReceipt } from "@scopebond/gateway";
+import { openReceiptStore, loadOrCreateAttester } from "@scopebond/gateway/node";
+import { mapClaudeToolUse, mapCursorEvent, fillPushBranch } from "./map.js";
 import { createHookRuntime } from "./runtime.js";
-import { scaffold, harnessSnippet } from "./init.js";
-import { connectCloud, loadConnection, connectionPath } from "./cloud.js";
+import { scaffold, harnessSnippet, installHarness } from "./init.js";
+import { connectCloud, loadConnection } from "./cloud.js";
+/** The current git branch in `cwd` (best-effort). A bare `git push` pushes it, so
+ *  the runtime fills it in before evaluating; on failure the ref stays absent and
+ *  the starter policy fails closed. */
+function currentBranch(cwd) {
+    try {
+        return execFileSync("git", ["-C", cwd, "symbolic-ref", "--quiet", "--short", "HEAD"], {
+            encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
+        }).trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read an enrollment bundle from a file path, an inline base64 blob, or inline raw
+ *  JSON (the portal hands out a base64 blob so it is one clean argument). */
+function readBundleArg(bundleArg, stdin) {
+    let text;
+    if (!bundleArg)
+        text = stdin();
+    else if (existsSync(bundleArg))
+        text = readFileSync(bundleArg, "utf8");
+    else if (bundleArg.trim().startsWith("{"))
+        text = bundleArg;
+    else {
+        try {
+            text = Buffer.from(bundleArg, "base64").toString("utf8");
+        }
+        catch {
+            text = bundleArg;
+        }
+    }
+    return JSON.parse(text);
+}
 function configDir() {
     return process.env.SCOPEBOND_HOOK_DIR ?? join(process.cwd(), ".scopebond");
 }
@@ -59,18 +99,15 @@ async function runClaude() {
         denyClaude("hook received invalid JSON on stdin");
     }
     try {
+        const cwd = input?.cwd ? String(input.cwd) : process.cwd();
         const runtime = createHookRuntime(runtimePaths(configDir()));
-        const decision = await runtime.evaluate(mapClaudeToolUse(input));
+        const decision = await runtime.evaluate(fillPushBranch(mapClaudeToolUse(input), currentBranch(cwd)));
         await runtime.flush();
         if (decision.decision === "deny")
             denyClaude(decision.reason);
-        if (decision.decision === "allow") {
-            process.stdout.write(JSON.stringify({
-                hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", permissionDecisionReason: decision.reason },
-            }) + "\n");
-            process.exit(0);
-        }
-        // not_evaluated: defer to the harness default (grant nothing, block nothing).
+        // allow and not_evaluated both DEFER to Claude Code's own permission flow: the
+        // hook records the receipt but never returns permissionDecision:"allow", which
+        // would suppress the user's normal review. Scopebond blocks; it does not approve.
         process.exit(0);
     }
     catch (error) {
@@ -87,10 +124,13 @@ async function runCursor() {
     let permission = "deny";
     let message = "Scopebond hook failed closed";
     try {
+        const cwd = input?.cwd ? String(input.cwd) : process.cwd();
         const runtime = createHookRuntime(runtimePaths(configDir()));
-        const decision = await runtime.evaluate(mapCursorEvent(event, input));
+        const decision = await runtime.evaluate(fillPushBranch(mapCursorEvent(event, input), currentBranch(cwd)));
         await runtime.flush();
-        permission = decision.decision === "deny" ? "deny" : decision.decision === "allow" ? "allow" : "ask";
+        // Only an out-of-policy action is denied outright; an allowed or unevaluated
+        // action defers to Cursor's own prompt ("ask"), never a silent auto-allow.
+        permission = decision.decision === "deny" ? "deny" : "ask";
         message = decision.reason;
     }
     catch (error) {
@@ -108,52 +148,164 @@ function runInit(args) {
     console.log(`  machine key    ${agentKid}`);
     console.log(`  policy         ${policyPath} (starter — edit the limits)`);
     console.log("");
-    console.log(`Add this to your ${harness === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
-    console.log(harnessSnippet(harness));
+    // Configure the agent automatically by default (idempotent), so there is no
+    // hand-editing step; --no-install prints the snippet instead.
+    if (!args.includes("--no-install")) {
+        const file = installHarness(harness);
+        console.log(`✓ ${harness === "cursor" ? "Cursor" : "Claude Code"} configured in ${file}`);
+    }
+    else {
+        console.log(`Add this to your ${harness === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
+        console.log(harnessSnippet(harness));
+    }
     console.log("");
-    console.log("Then run one safe command in the agent and see the receipt in .scopebond/receipts.db.");
-    console.log("To send receipts to your workspace, run: scopebond-hook connect <workspace-url> scopebond-enrollment.json");
+    console.log("Next: run one command in the agent, then `scopebond-hook log` to see the receipt");
+    console.log("and `scopebond-hook verify` to check it offline. Try `scopebond-hook test \"rm -rf /\"`.");
+    console.log("To send receipts to a workspace: scopebond-hook connect <workspace-url> <enrollment>");
+}
+function decisionOf(payload) {
+    const rr = String(payload.realtime_result ?? "");
+    const state = String(payload.execution?.state ?? "");
+    if (state === "observed_not_evaluated")
+        return "not_evaluated";
+    if (rr === "deny")
+        return state === "cooperative_allow" || state === "executed" ? "monitor" : "deny";
+    return "allow";
+}
+function describeIntent(payload) {
+    const intent = (payload.intent ?? {});
+    const p = (intent.params ?? {});
+    const bits = intent.action_type === "shell.exec" ? String(p.program ?? "")
+        : intent.action_type === "git.push" ? `${p.remote ?? ""} ${p.ref ?? ""}`.trim()
+            : intent.action_type === "file.write" || intent.action_type === "file.read" ? String(p.path ?? "")
+                : intent.action_type === "mcp.tool.call" ? `${p.server ?? ""}/${p.tool ?? ""}`
+                    : intent.action_type === "net.fetch" ? String(p.host ?? "") : "";
+    return `${String(intent.action_type ?? "?")}${bits ? ` ${bits}` : ""}`;
+}
+async function runLog(args) {
+    const dir = configDir();
+    const dbPath = join(dir, "receipts.db");
+    if (!existsSync(dbPath)) {
+        console.log("no receipts yet — run a command in the agent first.");
+        process.exit(0);
+    }
+    const nIdx = args.indexOf("-n");
+    const n = nIdx >= 0 ? Math.max(1, Number(args[nIdx + 1]) || 20) : 20;
+    const { store } = openReceiptStore({ db: dbPath });
+    const all = await Promise.resolve(store.list());
+    const recent = all.slice(-n);
+    if (recent.length === 0) {
+        console.log("no receipts yet.");
+        process.exit(0);
+    }
+    for (const r of recent) {
+        const p = r.payload;
+        console.log(`${String(p.timestamp ?? "")}  ${decisionOf(p).padEnd(13)}  ${describeIntent(p)}`);
+    }
+    console.log(`\n${recent.length} of ${all.length} receipt(s). Verify them: scopebond-hook verify`);
+}
+async function runVerify() {
+    const dir = configDir();
+    const dbPath = join(dir, "receipts.db");
+    const attesterPath = join(dir, "attester.key");
+    if (!existsSync(dbPath) || !existsSync(attesterPath)) {
+        console.log("nothing to verify yet (no receipts or no attester key).");
+        process.exit(0);
+    }
+    const { attester } = loadOrCreateAttester({ file: attesterPath });
+    const { store } = openReceiptStore({ db: dbPath });
+    const all = await Promise.resolve(store.list());
+    let ok = 0;
+    const bad = [];
+    for (const r of all) {
+        const result = verifyReceipt(r, attester.publicKeyPem);
+        if (result.valid)
+            ok += 1;
+        else {
+            const failed = Object.entries(result).filter(([k, v]) => k.endsWith("_valid") && v === false).map(([k]) => k);
+            bad.push(`${String(r.payload.timestamp ?? "")}: ${failed.join(", ") || "invalid"}`);
+        }
+    }
+    console.log(`${ok}/${all.length} receipt(s) verify offline against ${attesterPath}.`);
+    if (bad.length) {
+        for (const b of bad)
+            console.error(`  ✗ ${b}`);
+        process.exit(1);
+    }
+    process.exit(0);
+}
+async function runTest(args) {
+    const command = args.find((a) => !a.startsWith("-"));
+    if (!command) {
+        console.error('usage: scopebond-hook test "<shell command>"');
+        process.exit(1);
+    }
+    const dir = configDir();
+    if (!existsSync(join(dir, "policy.json"))) {
+        console.error("no policy yet — run `scopebond-hook init` first.");
+        process.exit(1);
+    }
+    // Evaluate against the real policy and keys, but a throwaway store, so `test`
+    // never records a receipt or exports anything.
+    const tmp = mkdtempSync(join(tmpdir(), "sb-hook-test-"));
+    try {
+        const runtime = createHookRuntime({
+            policyPath: join(dir, "policy.json"), keyPath: join(dir, "agent.key"),
+            attesterPath: join(dir, "attester.key"), dbPath: join(tmp, "receipts.db"),
+            strict: process.argv.includes("--strict"),
+        });
+        const mapped = fillPushBranch(mapClaudeToolUse({ tool_name: "Bash", tool_input: { command } }), currentBranch(process.cwd()));
+        console.log(`command: ${command}`);
+        for (const m of mapped) {
+            const d = await runtime.evaluateOne(m);
+            console.log(`  ${describeIntent({ intent: m.intent }).padEnd(28)} → ${d.decision}${d.reason ? `  (${d.reason})` : ""}`);
+        }
+        const overall = await runtime.evaluate(mapped);
+        console.log(`\noverall: ${overall.decision}${overall.reason ? `  · ${overall.reason}` : ""}`);
+        process.exit(overall.decision === "deny" ? 2 : 0);
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
 }
 async function runConnect(args) {
     const positional = args.filter((a) => !a.startsWith("--"));
     const url = positional[0];
-    const bundleFile = positional[1];
+    const bundleArg = positional[1];
+    const harness = args.includes("--cursor") ? "cursor" : "claude";
     if (!url) {
-        console.error("usage: scopebond-hook connect <workspace-url> <enrollment-bundle.json> [--cursor]");
+        console.error("usage: scopebond-hook connect <workspace-url> <enrollment> [--cursor] [--no-install]");
         process.exit(1);
     }
     const dir = configDir();
     // One command sets everything up: scaffold the key, attester and starter policy if
-    // they do not exist, then enroll and persist the scoped machine credential.
+    // they do not exist, then enroll and persist the scoped machine credential. The
+    // enrollment can be a file, an inline base64 blob (what the portal hands out) or
+    // raw JSON — the user never has to save or open a JSON file.
     scaffold(dir, {});
-    let bundleText;
-    try {
-        bundleText = bundleFile ? readFileSync(bundleFile, "utf8") : readStdin();
-    }
-    catch {
-        console.error(`could not read the enrollment bundle${bundleFile ? ` from ${bundleFile}` : " on stdin"}`);
-        process.exit(1);
-    }
     let bundle;
     try {
-        bundle = JSON.parse(bundleText);
+        bundle = readBundleArg(bundleArg, readStdin);
     }
     catch {
-        console.error("the enrollment bundle is not valid JSON");
+        console.error("could not read the enrollment (expected a file, inline blob, or JSON on stdin)");
         process.exit(1);
     }
     try {
         const c = await connectCloud(dir, url, bundle);
-        console.log(`Connected to ${c.url}`);
-        console.log(`  workspace     org ${c.organization_id} · env ${c.environment_id}`);
-        console.log(`  gateway id    ${c.gateway_id}`);
-        console.log(`  attester kid  ${c.attester_kid}`);
-        console.log(`  credential    stored in ${connectionPath(dir)} — a secret, do not commit`);
-        console.log("");
-        console.log(`Add this to your ${args.includes("--cursor") ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
-        console.log(harnessSnippet(args.includes("--cursor") ? "cursor" : "claude"));
+        console.log(`✓ Connected to ${c.url}`);
+        // Configure the agent automatically (merges into the existing config), unless the
+        // caller opts out. This removes the "paste this snippet" step.
+        if (!args.includes("--no-install")) {
+            const file = installHarness(harness);
+            console.log(`✓ ${harness === "cursor" ? "Cursor" : "Claude Code"} configured in ${file}`);
+        }
+        else {
+            console.log(`Add this to your ${harness === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
+            console.log(harnessSnippet(harness));
+        }
         console.log("");
-        console.log("Run one safe command in the agent; the receipt appears in your workspace within seconds.");
+        console.log("Run your agent — the first action appears in your workspace within seconds.");
     }
     catch (error) {
         console.error(`connect failed: ${error.message}`);
@@ -185,11 +337,20 @@ else if (cmd === "init") {
 else if (cmd === "connect") {
     await runConnect(rest);
 }
+else if (cmd === "log") {
+    await runLog(rest);
+}
+else if (cmd === "verify") {
+    await runVerify();
+}
+else if (cmd === "test") {
+    await runTest(rest);
+}
 else if (cmd === "flush") {
     await runFlush();
 }
 else {
-    console.error("usage: scopebond-hook <claude|cursor|init|connect|flush> [--cursor] [--force] [--strict]");
+    console.error("usage: scopebond-hook <claude|cursor|init|connect|log|verify|test|flush> [--cursor] [--force] [--strict] [--no-install]");
     process.exit(1);
 }
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,+EAA+E;AAC/E,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,wFAAwF;AACxF,+FAA+F;AAC/F,0DAA0D;AAC1D,gGAAgG;AAChG,uFAAuF;AACvF,EAAE;AACF,qDAAqD;AACrD,kEAAkE;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1E,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;AAC7E,CAAC;AACD,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QACpC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QACvC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QAChC,kEAAkE;QAClE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG;QACtF,iFAAiF;QACjF,+EAA+E;QAC/E,+DAA+D;QAC/D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrH,CAAC;AACJ,CAAC;AACD,SAAS,SAAS;IAChB,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAClC,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE;KAClH,CAAC,GAAG,IAAI,CAAC,CAAC;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,IAAI,CAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,UAAU,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAM,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;YAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAClC,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,CAAC,MAAM,EAAE;aAC5H,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,iCAAkC,KAAe,CAAC,OAAO,wCAAwC,CAAC,CAAC;IAChH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,IAAI,KAAK,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,eAAe,IAAI,KAAK,EAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,IAAI,UAAU,GAA6B,MAAM,CAAC;IAClD,IAAI,OAAO,GAAG,8BAA8B,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,UAAU,GAAG,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACrG,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,GAAG,MAAM,CAAC;QACpB,OAAO,GAAG,iCAAkC,KAAe,CAAC,OAAO,wCAAwC,CAAC;IAC9G,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,IAAc;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,8BAA8B,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,2GAA2G,CAAC,CAAC;AAC3H,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,mFAAmF;IACnF,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAAC,CAAC;IACjF,MAAM,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,uCAAuC,UAAU,CAAC,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACpI,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA0B,CAAC;IAAC,CAAC;IACjE,MAAM,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,eAAe,UAAU,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,cAAc,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC;QAC/G,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;IAC1G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mBAAoB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjI,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,OAAO,IAAI,CAAC,4BAA4B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7C,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;IAAC,MAAM,SAAS,EAAE,CAAC;AAAC,CAAC;KACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;IAAC,MAAM,SAAS,EAAE,CAAC;AAAC,CAAC;KAC5C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAAC,CAAC;KACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;IAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AAAC,CAAC;KAClD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;IAAC,MAAM,QAAQ,EAAE,CAAC;AAAC,CAAC;KAC1C,CAAC;IACJ,OAAO,CAAC,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["#!/usr/bin/env node\n// scopebond-hook — govern a coding agent's tool calls against policy, in-path,\n// before they run, with a signed local receipt.\n//\n//   scopebond-hook claude                     evaluate a Claude Code PreToolUse call (stdin JSON)\n//   scopebond-hook cursor                     evaluate a Cursor hook event (stdin JSON)\n//   scopebond-hook init [--cursor]            scaffold keys + starter policy, print the config\n//   scopebond-hook connect <url> <bundle.json> [--cursor]\n//                                             enroll with a Cloud workspace and start exporting\n//   scopebond-hook flush                      deliver any queued receipts to Cloud now\n//\n// Config dir: $SCOPEBOND_HOOK_DIR, else ./.scopebond\n// Fail-closed: any error denies the action with a repair message.\n\nimport { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { CloudEnrollmentBundle } from \"@scopebond/gateway\";\nimport { mapClaudeToolUse, mapCursorEvent } from \"./map.js\";\nimport { createHookRuntime } from \"./runtime.js\";\nimport { scaffold, harnessSnippet } from \"./init.js\";\nimport { connectCloud, loadConnection, connectionPath } from \"./cloud.js\";\n\nfunction configDir(): string {\n  return process.env.SCOPEBOND_HOOK_DIR ?? join(process.cwd(), \".scopebond\");\n}\nfunction runtimePaths(dir: string) {\n  const connection = loadConnection(dir);\n  return {\n    policyPath: join(dir, \"policy.json\"),\n    keyPath: join(dir, \"agent.key\"),\n    attesterPath: join(dir, \"attester.key\"),\n    dbPath: join(dir, \"receipts.db\"),\n    // Strict: deny (not just observe) tools with no taxonomy mapping.\n    strict: process.argv.includes(\"--strict\") || process.env.SCOPEBOND_HOOK_STRICT === \"1\",\n    // When connected, auto-export receipts. A short bounded flush keeps the hot path\n    // fast; undelivered receipts persist in the durable outbox and flush next time\n    // (or via `scopebond-hook flush`, e.g. on a session-end hook).\n    ...(connection ? { cloud: { connection, flushTimeoutMs: Number(process.env.SCOPEBOND_HOOK_FLUSH_MS ?? 800) } } : {}),\n  };\n}\nfunction readStdin(): string {\n  try { return readFileSync(0, \"utf8\"); } catch { return \"\"; }\n}\n\nfunction denyClaude(reason: string): never {\n  process.stdout.write(JSON.stringify({\n    hookSpecificOutput: { hookEventName: \"PreToolUse\", permissionDecision: \"deny\", permissionDecisionReason: reason },\n  }) + \"\\n\");\n  process.stderr.write(`Scopebond: ${reason}\\n`);\n  process.exit(2);\n}\n\nasync function runClaude(): Promise<void> {\n  let input: Record<string, unknown>;\n  try { input = JSON.parse(readStdin()); } catch { denyClaude(\"hook received invalid JSON on stdin\"); }\n  try {\n    const runtime = createHookRuntime(runtimePaths(configDir()));\n    const decision = await runtime.evaluate(mapClaudeToolUse(input!));\n    await runtime.flush();\n    if (decision.decision === \"deny\") denyClaude(decision.reason);\n    if (decision.decision === \"allow\") {\n      process.stdout.write(JSON.stringify({\n        hookSpecificOutput: { hookEventName: \"PreToolUse\", permissionDecision: \"allow\", permissionDecisionReason: decision.reason },\n      }) + \"\\n\");\n      process.exit(0);\n    }\n    // not_evaluated: defer to the harness default (grant nothing, block nothing).\n    process.exit(0);\n  } catch (error) {\n    denyClaude(`Scopebond hook failed closed: ${(error as Error).message}. Repair: run \\`scopebond-hook init\\`.`);\n  }\n}\n\nasync function runCursor(): Promise<void> {\n  let input: Record<string, unknown> = {};\n  try { input = JSON.parse(readStdin()); } catch { /* fall through to fail-closed deny below */ }\n  const event = String(input?.hook_event_name ?? input?.event ?? process.argv[3] ?? \"\");\n  let permission: \"allow\" | \"deny\" | \"ask\" = \"deny\";\n  let message = \"Scopebond hook failed closed\";\n  try {\n    const runtime = createHookRuntime(runtimePaths(configDir()));\n    const decision = await runtime.evaluate(mapCursorEvent(event, input));\n    await runtime.flush();\n    permission = decision.decision === \"deny\" ? \"deny\" : decision.decision === \"allow\" ? \"allow\" : \"ask\";\n    message = decision.reason;\n  } catch (error) {\n    permission = \"deny\";\n    message = `Scopebond hook failed closed: ${(error as Error).message}. Repair: run \\`scopebond-hook init\\`.`;\n  }\n  process.stdout.write(JSON.stringify({ permission, agentMessage: message }) + \"\\n\");\n  process.exit(0);\n}\n\nfunction runInit(args: string[]): void {\n  const harness = args.includes(\"--cursor\") ? \"cursor\" : \"claude\";\n  const dir = configDir();\n  const { agentKid, policyPath } = scaffold(dir, { force: args.includes(\"--force\") });\n  console.log(`Scopebond hook enrolled in ${dir}`);\n  console.log(`  machine key    ${agentKid}`);\n  console.log(`  policy         ${policyPath} (starter — edit the limits)`);\n  console.log(\"\");\n  console.log(`Add this to your ${harness === \"cursor\" ? \".cursor/hooks.json\" : \".claude/settings.json\"}:`);\n  console.log(harnessSnippet(harness));\n  console.log(\"\");\n  console.log(\"Then run one safe command in the agent and see the receipt in .scopebond/receipts.db.\");\n  console.log(\"To send receipts to your workspace, run: scopebond-hook connect <workspace-url> scopebond-enrollment.json\");\n}\n\nasync function runConnect(args: string[]): Promise<void> {\n  const positional = args.filter((a) => !a.startsWith(\"--\"));\n  const url = positional[0];\n  const bundleFile = positional[1];\n  if (!url) {\n    console.error(\"usage: scopebond-hook connect <workspace-url> <enrollment-bundle.json> [--cursor]\");\n    process.exit(1);\n  }\n  const dir = configDir();\n  // One command sets everything up: scaffold the key, attester and starter policy if\n  // they do not exist, then enroll and persist the scoped machine credential.\n  scaffold(dir, {});\n  let bundleText: string;\n  try { bundleText = bundleFile ? readFileSync(bundleFile, \"utf8\") : readStdin(); }\n  catch { console.error(`could not read the enrollment bundle${bundleFile ? ` from ${bundleFile}` : \" on stdin\"}`); process.exit(1); }\n  let bundle: CloudEnrollmentBundle;\n  try { bundle = JSON.parse(bundleText) as CloudEnrollmentBundle; }\n  catch { console.error(\"the enrollment bundle is not valid JSON\"); process.exit(1); }\n  try {\n    const c = await connectCloud(dir, url, bundle);\n    console.log(`Connected to ${c.url}`);\n    console.log(`  workspace     org ${c.organization_id} · env ${c.environment_id}`);\n    console.log(`  gateway id    ${c.gateway_id}`);\n    console.log(`  attester kid  ${c.attester_kid}`);\n    console.log(`  credential    stored in ${connectionPath(dir)} — a secret, do not commit`);\n    console.log(\"\");\n    console.log(`Add this to your ${args.includes(\"--cursor\") ? \".cursor/hooks.json\" : \".claude/settings.json\"}:`);\n    console.log(harnessSnippet(args.includes(\"--cursor\") ? \"cursor\" : \"claude\"));\n    console.log(\"\");\n    console.log(\"Run one safe command in the agent; the receipt appears in your workspace within seconds.\");\n  } catch (error) {\n    console.error(`connect failed: ${(error as Error).message}`);\n    process.exit(1);\n  }\n}\n\nasync function runFlush(): Promise<void> {\n  const dir = configDir();\n  if (!loadConnection(dir)) { console.error(\"not connected to a workspace; run `scopebond-hook connect` first\"); process.exit(1); }\n  const runtime = createHookRuntime(runtimePaths(dir));\n  await runtime.exporter?.flush();\n  const status = runtime.exporter?.status();\n  console.log(`flushed; ${status?.pending ?? 0} receipt(s) still pending${status?.lastError ? ` (last error: ${status.lastError})` : \"\"}`);\n  process.exit(status && status.pending > 0 ? 1 : 0);\n}\n\nconst [cmd, ...rest] = process.argv.slice(2);\nif (cmd === \"claude\") { await runClaude(); }\nelse if (cmd === \"cursor\") { await runCursor(); }\nelse if (cmd === \"init\") { runInit(rest); }\nelse if (cmd === \"connect\") { await runConnect(rest); }\nelse if (cmd === \"flush\") { await runFlush(); }\nelse {\n  console.error(\"usage: scopebond-hook <claude|cursor|init|connect|flush> [--cursor] [--force] [--strict]\");\n  process.exit(1);\n}\n"]}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,+EAA+E;AAC/E,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,wFAAwF;AACxF,0GAA0G;AAC1G,0DAA0D;AAC1D,gGAAgG;AAChG,kFAAkF;AAClF,0GAA0G;AAC1G,mGAAmG;AACnG,uFAAuF;AACvF,EAAE;AACF,qDAAqD;AACrD,kEAAkE;AAElE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAkB,MAAM,YAAY,CAAC;AAE1E;;uCAEuC;AACvC,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;YACpF,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACtD,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED;6EAC6E;AAC7E,SAAS,aAAa,CAAC,SAA6B,EAAE,KAAmB;IACvE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC,SAAS;QAAE,IAAI,GAAG,KAAK,EAAE,CAAC;SAC1B,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;SAClE,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,SAAS,CAAC;SACvD,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,GAAG,SAAS,CAAC;QAAC,CAAC;IAAC,CAAC;IACtG,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;AACnD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;AAC7E,CAAC;AACD,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QACpC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QACvC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QAChC,kEAAkE;QAClE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG;QACtF,iFAAiF;QACjF,+EAA+E;QAC/E,+DAA+D;QAC/D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrH,CAAC;AACJ,CAAC;AACD,SAAS,SAAS;IAChB,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAClC,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE;KAClH,CAAC,GAAG,IAAI,CAAC,CAAC;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,IAAI,CAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,UAAU,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAM,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;YAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,+EAA+E;QAC/E,+EAA+E;QAC/E,kFAAkF;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,iCAAkC,KAAe,CAAC,OAAO,wCAAwC,CAAC,CAAC;IAChH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,IAAI,KAAK,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,eAAe,IAAI,KAAK,EAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,IAAI,UAAU,GAA6B,MAAM,CAAC;IAClD,IAAI,OAAO,GAAG,8BAA8B,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1G,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,6EAA6E;QAC7E,2EAA2E;QAC3E,UAAU,GAAG,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,GAAG,MAAM,CAAC;QACpB,OAAO,GAAG,iCAAkC,KAAe,CAAC,OAAO,wCAAwC,CAAC;IAC9G,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,IAAc;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,8BAA8B,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC;QAC1G,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;IACxG,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,UAAU,CAAC,OAAgC;IAClD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAE,OAAO,CAAC,SAAiD,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC9F,IAAI,KAAK,KAAK,wBAAwB;QAAE,OAAO,eAAe,CAAC;IAC/D,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACrG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,OAAgC;IACtD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QACxE,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YAC/E,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,YAAY,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;gBAClG,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE;oBAC9E,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAc;IAClC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,OAA6C,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAM,iDAAiD,CAAC,CAAC;AACpG,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAClJ,MAAM,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,YAAY,CAAuC,CAAC;QAC7F,IAAI,MAAM,CAAC,KAAK;YAAE,EAAE,IAAI,CAAC,CAAC;aACrB,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9G,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAE,CAAC,CAAC,OAA8C,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;QAC9H,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,sCAAsC,YAAY,GAAG,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAAC,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAc;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjG,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAClI,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;YACrE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;YACzE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9H,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,mFAAmF;IACnF,gFAAgF;IAChF,iFAAiF;IACjF,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClB,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QAAC,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IACrD,MAAM,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC3H,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,kFAAkF;QAClF,+DAA+D;QAC/D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC;YAC1G,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mBAAoB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjI,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,OAAO,IAAI,CAAC,4BAA4B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7C,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;IAAC,MAAM,SAAS,EAAE,CAAC;AAAC,CAAC;KACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;IAAC,MAAM,SAAS,EAAE,CAAC;AAAC,CAAC;KAC5C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAAC,CAAC;KACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;IAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AAAC,CAAC;KAClD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;IAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;AAAC,CAAC;KAC1C,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;IAAC,MAAM,SAAS,EAAE,CAAC;AAAC,CAAC;KAC5C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;IAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAAC,CAAC;KAC5C,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;IAAC,MAAM,QAAQ,EAAE,CAAC;AAAC,CAAC;KAC1C,CAAC;IACJ,OAAO,CAAC,KAAK,CAAC,yHAAyH,CAAC,CAAC;IACzI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["#!/usr/bin/env node\n// scopebond-hook — govern a coding agent's tool calls against policy, in-path,\n// before they run, with a signed local receipt.\n//\n//   scopebond-hook claude                     evaluate a Claude Code PreToolUse call (stdin JSON)\n//   scopebond-hook cursor                     evaluate a Cursor hook event (stdin JSON)\n//   scopebond-hook init [--cursor] [--no-install]  scaffold keys + starter policy and configure the agent\n//   scopebond-hook connect <url> <bundle.json> [--cursor]\n//                                             enroll with a Cloud workspace and start exporting\n//   scopebond-hook log [-n N]                 show the most recent local receipts\n//   scopebond-hook verify                     verify every local receipt offline against the attester key\n//   scopebond-hook test \"<shell command>\"     show the decision for a command without recording it\n//   scopebond-hook flush                      deliver any queued receipts to Cloud now\n//\n// Config dir: $SCOPEBOND_HOOK_DIR, else ./.scopebond\n// Fail-closed: any error denies the action with a repair message.\n\nimport { readFileSync, existsSync, mkdtempSync, rmSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { tmpdir } from \"node:os\";\nimport { execFileSync } from \"node:child_process\";\nimport type { CloudEnrollmentBundle } from \"@scopebond/gateway\";\nimport { verifyReceipt } from \"@scopebond/gateway\";\nimport { openReceiptStore, loadOrCreateAttester } from \"@scopebond/gateway/node\";\nimport { mapClaudeToolUse, mapCursorEvent, fillPushBranch } from \"./map.js\";\nimport { createHookRuntime } from \"./runtime.js\";\nimport { scaffold, harnessSnippet, installHarness } from \"./init.js\";\nimport { connectCloud, loadConnection, connectionPath } from \"./cloud.js\";\n\n/** The current git branch in `cwd` (best-effort). A bare `git push` pushes it, so\n *  the runtime fills it in before evaluating; on failure the ref stays absent and\n *  the starter policy fails closed. */\nfunction currentBranch(cwd: string): string | null {\n  try {\n    return execFileSync(\"git\", [\"-C\", cwd, \"symbolic-ref\", \"--quiet\", \"--short\", \"HEAD\"], {\n      encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"],\n    }).trim() || null;\n  } catch { return null; }\n}\n\n/** Read an enrollment bundle from a file path, an inline base64 blob, or inline raw\n *  JSON (the portal hands out a base64 blob so it is one clean argument). */\nfunction readBundleArg(bundleArg: string | undefined, stdin: () => string): CloudEnrollmentBundle {\n  let text: string;\n  if (!bundleArg) text = stdin();\n  else if (existsSync(bundleArg)) text = readFileSync(bundleArg, \"utf8\");\n  else if (bundleArg.trim().startsWith(\"{\")) text = bundleArg;\n  else { try { text = Buffer.from(bundleArg, \"base64\").toString(\"utf8\"); } catch { text = bundleArg; } }\n  return JSON.parse(text) as CloudEnrollmentBundle;\n}\n\nfunction configDir(): string {\n  return process.env.SCOPEBOND_HOOK_DIR ?? join(process.cwd(), \".scopebond\");\n}\nfunction runtimePaths(dir: string) {\n  const connection = loadConnection(dir);\n  return {\n    policyPath: join(dir, \"policy.json\"),\n    keyPath: join(dir, \"agent.key\"),\n    attesterPath: join(dir, \"attester.key\"),\n    dbPath: join(dir, \"receipts.db\"),\n    // Strict: deny (not just observe) tools with no taxonomy mapping.\n    strict: process.argv.includes(\"--strict\") || process.env.SCOPEBOND_HOOK_STRICT === \"1\",\n    // When connected, auto-export receipts. A short bounded flush keeps the hot path\n    // fast; undelivered receipts persist in the durable outbox and flush next time\n    // (or via `scopebond-hook flush`, e.g. on a session-end hook).\n    ...(connection ? { cloud: { connection, flushTimeoutMs: Number(process.env.SCOPEBOND_HOOK_FLUSH_MS ?? 800) } } : {}),\n  };\n}\nfunction readStdin(): string {\n  try { return readFileSync(0, \"utf8\"); } catch { return \"\"; }\n}\n\nfunction denyClaude(reason: string): never {\n  process.stdout.write(JSON.stringify({\n    hookSpecificOutput: { hookEventName: \"PreToolUse\", permissionDecision: \"deny\", permissionDecisionReason: reason },\n  }) + \"\\n\");\n  process.stderr.write(`Scopebond: ${reason}\\n`);\n  process.exit(2);\n}\n\nasync function runClaude(): Promise<void> {\n  let input: Record<string, unknown>;\n  try { input = JSON.parse(readStdin()); } catch { denyClaude(\"hook received invalid JSON on stdin\"); }\n  try {\n    const cwd = input?.cwd ? String(input.cwd) : process.cwd();\n    const runtime = createHookRuntime(runtimePaths(configDir()));\n    const decision = await runtime.evaluate(fillPushBranch(mapClaudeToolUse(input!), currentBranch(cwd)));\n    await runtime.flush();\n    if (decision.decision === \"deny\") denyClaude(decision.reason);\n    // allow and not_evaluated both DEFER to Claude Code's own permission flow: the\n    // hook records the receipt but never returns permissionDecision:\"allow\", which\n    // would suppress the user's normal review. Scopebond blocks; it does not approve.\n    process.exit(0);\n  } catch (error) {\n    denyClaude(`Scopebond hook failed closed: ${(error as Error).message}. Repair: run \\`scopebond-hook init\\`.`);\n  }\n}\n\nasync function runCursor(): Promise<void> {\n  let input: Record<string, unknown> = {};\n  try { input = JSON.parse(readStdin()); } catch { /* fall through to fail-closed deny below */ }\n  const event = String(input?.hook_event_name ?? input?.event ?? process.argv[3] ?? \"\");\n  let permission: \"allow\" | \"deny\" | \"ask\" = \"deny\";\n  let message = \"Scopebond hook failed closed\";\n  try {\n    const cwd = input?.cwd ? String(input.cwd) : process.cwd();\n    const runtime = createHookRuntime(runtimePaths(configDir()));\n    const decision = await runtime.evaluate(fillPushBranch(mapCursorEvent(event, input), currentBranch(cwd)));\n    await runtime.flush();\n    // Only an out-of-policy action is denied outright; an allowed or unevaluated\n    // action defers to Cursor's own prompt (\"ask\"), never a silent auto-allow.\n    permission = decision.decision === \"deny\" ? \"deny\" : \"ask\";\n    message = decision.reason;\n  } catch (error) {\n    permission = \"deny\";\n    message = `Scopebond hook failed closed: ${(error as Error).message}. Repair: run \\`scopebond-hook init\\`.`;\n  }\n  process.stdout.write(JSON.stringify({ permission, agentMessage: message }) + \"\\n\");\n  process.exit(0);\n}\n\nfunction runInit(args: string[]): void {\n  const harness = args.includes(\"--cursor\") ? \"cursor\" : \"claude\";\n  const dir = configDir();\n  const { agentKid, policyPath } = scaffold(dir, { force: args.includes(\"--force\") });\n  console.log(`Scopebond hook enrolled in ${dir}`);\n  console.log(`  machine key    ${agentKid}`);\n  console.log(`  policy         ${policyPath} (starter — edit the limits)`);\n  console.log(\"\");\n  // Configure the agent automatically by default (idempotent), so there is no\n  // hand-editing step; --no-install prints the snippet instead.\n  if (!args.includes(\"--no-install\")) {\n    const file = installHarness(harness);\n    console.log(`✓ ${harness === \"cursor\" ? \"Cursor\" : \"Claude Code\"} configured in ${file}`);\n  } else {\n    console.log(`Add this to your ${harness === \"cursor\" ? \".cursor/hooks.json\" : \".claude/settings.json\"}:`);\n    console.log(harnessSnippet(harness));\n  }\n  console.log(\"\");\n  console.log(\"Next: run one command in the agent, then `scopebond-hook log` to see the receipt\");\n  console.log(\"and `scopebond-hook verify` to check it offline. Try `scopebond-hook test \\\"rm -rf /\\\"`.\");\n  console.log(\"To send receipts to a workspace: scopebond-hook connect <workspace-url> <enrollment>\");\n}\n\nfunction decisionOf(payload: Record<string, unknown>): string {\n  const rr = String(payload.realtime_result ?? \"\");\n  const state = String((payload.execution as Record<string, unknown> | undefined)?.state ?? \"\");\n  if (state === \"observed_not_evaluated\") return \"not_evaluated\";\n  if (rr === \"deny\") return state === \"cooperative_allow\" || state === \"executed\" ? \"monitor\" : \"deny\";\n  return \"allow\";\n}\n\nfunction describeIntent(payload: Record<string, unknown>): string {\n  const intent = (payload.intent ?? {}) as Record<string, unknown>;\n  const p = (intent.params ?? {}) as Record<string, unknown>;\n  const bits = intent.action_type === \"shell.exec\" ? String(p.program ?? \"\")\n    : intent.action_type === \"git.push\" ? `${p.remote ?? \"\"} ${p.ref ?? \"\"}`.trim()\n    : intent.action_type === \"file.write\" || intent.action_type === \"file.read\" ? String(p.path ?? \"\")\n    : intent.action_type === \"mcp.tool.call\" ? `${p.server ?? \"\"}/${p.tool ?? \"\"}`\n    : intent.action_type === \"net.fetch\" ? String(p.host ?? \"\") : \"\";\n  return `${String(intent.action_type ?? \"?\")}${bits ? ` ${bits}` : \"\"}`;\n}\n\nasync function runLog(args: string[]): Promise<void> {\n  const dir = configDir();\n  const dbPath = join(dir, \"receipts.db\");\n  if (!existsSync(dbPath)) { console.log(\"no receipts yet — run a command in the agent first.\"); process.exit(0); }\n  const nIdx = args.indexOf(\"-n\");\n  const n = nIdx >= 0 ? Math.max(1, Number(args[nIdx + 1]) || 20) : 20;\n  const { store } = openReceiptStore({ db: dbPath });\n  const all = await Promise.resolve(store.list());\n  const recent = all.slice(-n);\n  if (recent.length === 0) { console.log(\"no receipts yet.\"); process.exit(0); }\n  for (const r of recent) {\n    const p = r.payload as unknown as Record<string, unknown>;\n    console.log(`${String(p.timestamp ?? \"\")}  ${decisionOf(p).padEnd(13)}  ${describeIntent(p)}`);\n  }\n  console.log(`\\n${recent.length} of ${all.length} receipt(s). Verify them: scopebond-hook verify`);\n}\n\nasync function runVerify(): Promise<void> {\n  const dir = configDir();\n  const dbPath = join(dir, \"receipts.db\");\n  const attesterPath = join(dir, \"attester.key\");\n  if (!existsSync(dbPath) || !existsSync(attesterPath)) { console.log(\"nothing to verify yet (no receipts or no attester key).\"); process.exit(0); }\n  const { attester } = loadOrCreateAttester({ file: attesterPath });\n  const { store } = openReceiptStore({ db: dbPath });\n  const all = await Promise.resolve(store.list());\n  let ok = 0;\n  const bad: string[] = [];\n  for (const r of all) {\n    const result = verifyReceipt(r, attester.publicKeyPem) as unknown as Record<string, boolean>;\n    if (result.valid) ok += 1;\n    else {\n      const failed = Object.entries(result).filter(([k, v]) => k.endsWith(\"_valid\") && v === false).map(([k]) => k);\n      bad.push(`${String((r.payload as unknown as Record<string, unknown>).timestamp ?? \"\")}: ${failed.join(\", \") || \"invalid\"}`);\n    }\n  }\n  console.log(`${ok}/${all.length} receipt(s) verify offline against ${attesterPath}.`);\n  if (bad.length) { for (const b of bad) console.error(`  ✗ ${b}`); process.exit(1); }\n  process.exit(0);\n}\n\nasync function runTest(args: string[]): Promise<void> {\n  const command = args.find((a) => !a.startsWith(\"-\"));\n  if (!command) { console.error('usage: scopebond-hook test \"<shell command>\"'); process.exit(1); }\n  const dir = configDir();\n  if (!existsSync(join(dir, \"policy.json\"))) { console.error(\"no policy yet — run `scopebond-hook init` first.\"); process.exit(1); }\n  // Evaluate against the real policy and keys, but a throwaway store, so `test`\n  // never records a receipt or exports anything.\n  const tmp = mkdtempSync(join(tmpdir(), \"sb-hook-test-\"));\n  try {\n    const runtime = createHookRuntime({\n      policyPath: join(dir, \"policy.json\"), keyPath: join(dir, \"agent.key\"),\n      attesterPath: join(dir, \"attester.key\"), dbPath: join(tmp, \"receipts.db\"),\n      strict: process.argv.includes(\"--strict\"),\n    });\n    const mapped = fillPushBranch(mapClaudeToolUse({ tool_name: \"Bash\", tool_input: { command } }), currentBranch(process.cwd()));\n    console.log(`command: ${command}`);\n    for (const m of mapped) {\n      const d = await runtime.evaluateOne(m);\n      console.log(`  ${describeIntent({ intent: m.intent }).padEnd(28)} → ${d.decision}${d.reason ? `  (${d.reason})` : \"\"}`);\n    }\n    const overall = await runtime.evaluate(mapped);\n    console.log(`\\noverall: ${overall.decision}${overall.reason ? `  · ${overall.reason}` : \"\"}`);\n    process.exit(overall.decision === \"deny\" ? 2 : 0);\n  } finally {\n    rmSync(tmp, { recursive: true, force: true });\n  }\n}\n\nasync function runConnect(args: string[]): Promise<void> {\n  const positional = args.filter((a) => !a.startsWith(\"--\"));\n  const url = positional[0];\n  const bundleArg = positional[1];\n  const harness = args.includes(\"--cursor\") ? \"cursor\" : \"claude\";\n  if (!url) {\n    console.error(\"usage: scopebond-hook connect <workspace-url> <enrollment> [--cursor] [--no-install]\");\n    process.exit(1);\n  }\n  const dir = configDir();\n  // One command sets everything up: scaffold the key, attester and starter policy if\n  // they do not exist, then enroll and persist the scoped machine credential. The\n  // enrollment can be a file, an inline base64 blob (what the portal hands out) or\n  // raw JSON — the user never has to save or open a JSON file.\n  scaffold(dir, {});\n  let bundle: CloudEnrollmentBundle;\n  try { bundle = readBundleArg(bundleArg, readStdin); }\n  catch { console.error(\"could not read the enrollment (expected a file, inline blob, or JSON on stdin)\"); process.exit(1); }\n  try {\n    const c = await connectCloud(dir, url, bundle);\n    console.log(`✓ Connected to ${c.url}`);\n    // Configure the agent automatically (merges into the existing config), unless the\n    // caller opts out. This removes the \"paste this snippet\" step.\n    if (!args.includes(\"--no-install\")) {\n      const file = installHarness(harness);\n      console.log(`✓ ${harness === \"cursor\" ? \"Cursor\" : \"Claude Code\"} configured in ${file}`);\n    } else {\n      console.log(`Add this to your ${harness === \"cursor\" ? \".cursor/hooks.json\" : \".claude/settings.json\"}:`);\n      console.log(harnessSnippet(harness));\n    }\n    console.log(\"\");\n    console.log(\"Run your agent — the first action appears in your workspace within seconds.\");\n  } catch (error) {\n    console.error(`connect failed: ${(error as Error).message}`);\n    process.exit(1);\n  }\n}\n\nasync function runFlush(): Promise<void> {\n  const dir = configDir();\n  if (!loadConnection(dir)) { console.error(\"not connected to a workspace; run `scopebond-hook connect` first\"); process.exit(1); }\n  const runtime = createHookRuntime(runtimePaths(dir));\n  await runtime.exporter?.flush();\n  const status = runtime.exporter?.status();\n  console.log(`flushed; ${status?.pending ?? 0} receipt(s) still pending${status?.lastError ? ` (last error: ${status.lastError})` : \"\"}`);\n  process.exit(status && status.pending > 0 ? 1 : 0);\n}\n\nconst [cmd, ...rest] = process.argv.slice(2);\nif (cmd === \"claude\") { await runClaude(); }\nelse if (cmd === \"cursor\") { await runCursor(); }\nelse if (cmd === \"init\") { runInit(rest); }\nelse if (cmd === \"connect\") { await runConnect(rest); }\nelse if (cmd === \"log\") { await runLog(rest); }\nelse if (cmd === \"verify\") { await runVerify(); }\nelse if (cmd === \"test\") { await runTest(rest); }\nelse if (cmd === \"flush\") { await runFlush(); }\nelse {\n  console.error(\"usage: scopebond-hook <claude|cursor|init|connect|log|verify|test|flush> [--cursor] [--force] [--strict] [--no-install]\");\n  process.exit(1);\n}\n"]}

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-export { mapClaudeToolUse, mapCursorEvent } from "./map.js";
+export { mapClaudeToolUse, mapCursorEvent, fillPushBranch } from "./map.js";
 export type { Mapped, NormalizedIntent } from "./map.js";
 export { createHookRuntime, starterPolicy } from "./runtime.js";
 export type { RuntimeConfig, Decision } from "./runtime.js";
-export { scaffold, harnessSnippet } from "./init.js";
+export { scaffold, harnessSnippet, installHarness } from "./init.js";
 export { connectCloud, loadConnection, attachExporter, flushBounded, connectionPath } from "./cloud.js";
 export type { HookConnection } from "./cloud.js";
-export { scrubSecrets, redactCommand, digest, sha256 } from "./minimize.js";
+export { scrubSecrets, scrubParam, redactCommand, digest, sha256 } from "./minimize.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5D,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACxG,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5E,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACxG,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,9 +1,9 @@
 // @scopebond/hook — the Claude Code + Cursor connector. The library surface is
 // the deterministic mapper and the check-only runtime; the `scopebond-hook`
 // binary is the thin harness adapter over them.
-export { mapClaudeToolUse, mapCursorEvent } from "./map.js";
+export { mapClaudeToolUse, mapCursorEvent, fillPushBranch } from "./map.js";
 export { createHookRuntime, starterPolicy } from "./runtime.js";
-export { scaffold, harnessSnippet } from "./init.js";
+export { scaffold, harnessSnippet, installHarness } from "./init.js";
 export { connectCloud, loadConnection, attachExporter, flushBounded, connectionPath } from "./cloud.js";
-export { scrubSecrets, redactCommand, digest, sha256 } from "./minimize.js";
+export { scrubSecrets, scrubParam, redactCommand, digest, sha256 } from "./minimize.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4EAA4E;AAC5E,gDAAgD;AAEhD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAExG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC","sourcesContent":["// @scopebond/hook — the Claude Code + Cursor connector. The library surface is\n// the deterministic mapper and the check-only runtime; the `scopebond-hook`\n// binary is the thin harness adapter over them.\n\nexport { mapClaudeToolUse, mapCursorEvent } from \"./map.js\";\nexport type { Mapped, NormalizedIntent } from \"./map.js\";\nexport { createHookRuntime, starterPolicy } from \"./runtime.js\";\nexport type { RuntimeConfig, Decision } from \"./runtime.js\";\nexport { scaffold, harnessSnippet } from \"./init.js\";\nexport { connectCloud, loadConnection, attachExporter, flushBounded, connectionPath } from \"./cloud.js\";\nexport type { HookConnection } from \"./cloud.js\";\nexport { scrubSecrets, redactCommand, digest, sha256 } from \"./minimize.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4EAA4E;AAC5E,gDAAgD;AAEhD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE5E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAExG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC","sourcesContent":["// @scopebond/hook — the Claude Code + Cursor connector. The library surface is\n// the deterministic mapper and the check-only runtime; the `scopebond-hook`\n// binary is the thin harness adapter over them.\n\nexport { mapClaudeToolUse, mapCursorEvent, fillPushBranch } from \"./map.js\";\nexport type { Mapped, NormalizedIntent } from \"./map.js\";\nexport { createHookRuntime, starterPolicy } from \"./runtime.js\";\nexport type { RuntimeConfig, Decision } from \"./runtime.js\";\nexport { scaffold, harnessSnippet, installHarness } from \"./init.js\";\nexport { connectCloud, loadConnection, attachExporter, flushBounded, connectionPath } from \"./cloud.js\";\nexport type { HookConnection } from \"./cloud.js\";\nexport { scrubSecrets, scrubParam, redactCommand, digest, sha256 } from \"./minimize.js\";\n"]}

package/dist/init.d.ts

@@ -4,6 +4,11 @@ export declare function scaffold(dir: string, opts?: {
     agentKid: string;
     policyPath: string;
 };
-/** The harness configuration snippet to install the hook. */
+/** Install the hook into the agent's own config file, merging with anything already
+ *  there (idempotent — safe to run twice). Returns the file it wrote. This is what
+ *  lets `connect` finish setup without the user hand-editing JSON.
+ *  `cwd` defaults to the current directory (the project root the user runs it in). */
+export declare function installHarness(harness: "claude" | "cursor", cwd?: string): string;
+/** The harness configuration snippet to install the hook (version-pinned npx). */
 export declare function harnessSnippet(harness: "claude" | "cursor"): string;
 //# sourceMappingURL=init.d.ts.map

package/dist/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAUA,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAgB9G;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAiBnE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAWA,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAgB9G;AAED;;;sFAGsF;AACtF,wBAAgB,cAAc,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,CA6BhG;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAkBnE"}

package/dist/init.js

@@ -2,10 +2,11 @@
 // gateway countersigning key and a starter policy. Keys and receipts stay on the
 // machine; no credentials are handled.
 import { mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { loadOrCreateAttester } from "@scopebond/gateway/node";
 import { createSigner } from "@scopebond/sdk";
 import { starterPolicy } from "./runtime.js";
+import { hookCommand } from "./version.js";
 export function scaffold(dir, opts = {}) {
     mkdirSync(dir, { recursive: true });
     const keyPath = join(dir, "agent.key");
@@ -24,22 +25,70 @@ export function scaffold(dir, opts = {}) {
     }
     return { agentKid: agent.kid, policyPath };
 }
-/** The harness configuration snippet to install the hook. */
+/** Install the hook into the agent's own config file, merging with anything already
+ *  there (idempotent — safe to run twice). Returns the file it wrote. This is what
+ *  lets `connect` finish setup without the user hand-editing JSON.
+ *  `cwd` defaults to the current directory (the project root the user runs it in). */
+export function installHarness(harness, cwd = process.cwd()) {
+    const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    const file = harness === "cursor" ? join(cwd, ".cursor", "hooks.json") : join(cwd, ".claude", "settings.json");
+    mkdirSync(dirname(file), { recursive: true });
+    let config = {};
+    if (existsSync(file)) {
+        try {
+            const p = JSON.parse(readFileSync(file, "utf8"));
+            if (isRecord(p))
+                config = p;
+        }
+        catch { /* start fresh on unreadable */ }
+    }
+    const hooks = isRecord(config.hooks) ? config.hooks : (config.hooks = {});
+    const cursorCmd = hookCommand("cursor");
+    const claudeCmd = hookCommand("claude");
+    // Match any existing Scopebond hook entry (pinned or a legacy bare `scopebond-hook`)
+    // so re-running never appends a duplicate and an old bare command is replaced.
+    const isScopebond = (cmd) => typeof cmd === "string" && /(^|\s)(npx\s+.*)?@scopebond\/hook|(^|\s)scopebond-hook(\s|$)/.test(cmd);
+    const entryMatches = (e) => isRecord(e) && (isScopebond(e.command) || (Array.isArray(e.hooks) && e.hooks.some((h) => isRecord(h) && isScopebond(h.command))));
+    if (harness === "cursor") {
+        config.version = config.version ?? 1;
+        for (const event of ["beforeShellExecution", "beforeMCPExecution", "beforeReadFile", "afterFileEdit"]) {
+            const list = Array.isArray(hooks[event]) ? hooks[event] : (hooks[event] = []);
+            const existing = list.findIndex(entryMatches);
+            if (existing >= 0)
+                list[existing] = { command: cursorCmd };
+            else
+                list.push({ command: cursorCmd });
+        }
+    }
+    else {
+        const list = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : (hooks.PreToolUse = []);
+        const existing = list.findIndex(entryMatches);
+        const entry = { matcher: "*", hooks: [{ type: "command", command: claudeCmd }] };
+        if (existing >= 0)
+            list[existing] = entry;
+        else
+            list.push(entry);
+    }
+    writeFileSync(file, JSON.stringify(config, null, 2) + "\n");
+    return file;
+}
+/** The harness configuration snippet to install the hook (version-pinned npx). */
 export function harnessSnippet(harness) {
     if (harness === "cursor") {
+        const cmd = hookCommand("cursor");
         return JSON.stringify({
             version: 1,
             hooks: {
-                beforeShellExecution: [{ command: "scopebond-hook cursor" }],
-                beforeMCPExecution: [{ command: "scopebond-hook cursor" }],
-                beforeReadFile: [{ command: "scopebond-hook cursor" }],
-                afterFileEdit: [{ command: "scopebond-hook cursor" }],
+                beforeShellExecution: [{ command: cmd }],
+                beforeMCPExecution: [{ command: cmd }],
+                beforeReadFile: [{ command: cmd }],
+                afterFileEdit: [{ command: cmd }],
             },
         }, null, 2);
     }
     return JSON.stringify({
         hooks: {
-            PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: "scopebond-hook claude" }] }],
+            PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: hookCommand("claude") }] }],
         },
     }, null, 2);
 }