@shidesheng0218/agentguard 0.8.0 → 0.9.0

package/dist/chunk-SACTXNYK.js

@@ -0,0 +1,1450 @@
+#!/usr/bin/env node
+
+// src/paths.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+function guardHome() {
+  const env = process.env.AGENT_GUARD_HOME ?? process.env.KIMI_GUARD_HOME;
+  if (env && env.trim()) return path.resolve(env);
+  const fresh = path.join(os.homedir(), ".agent-guard");
+  const legacy = path.join(os.homedir(), ".kimi-guard");
+  if (!fs.existsSync(fresh) && fs.existsSync(legacy)) return legacy;
+  return fresh;
+}
+function claudeSettingsPath() {
+  const env = process.env.CLAUDE_SETTINGS_PATH;
+  if (env && env.trim()) return path.resolve(env);
+  return path.join(os.homedir(), ".claude", "settings.json");
+}
+function claudeDetected() {
+  return fs.existsSync(claudeSettingsPath()) || fs.existsSync(path.join(os.homedir(), ".claude"));
+}
+function codexHooksPath() {
+  const env = process.env.CODEX_HOOKS_PATH;
+  if (env && env.trim()) return path.resolve(env);
+  return path.join(os.homedir(), ".codex", "hooks.json");
+}
+function codexDetected() {
+  return fs.existsSync(path.join(os.homedir(), ".codex"));
+}
+function stateDbPath() {
+  return path.join(guardHome(), "state.db");
+}
+function probeLogPath() {
+  return path.join(guardHome(), "probe.jsonl");
+}
+function userConfigPath() {
+  return path.join(guardHome(), "config.toml");
+}
+function detectKimiConfig() {
+  const env = process.env.KIMI_CONFIG_PATH;
+  if (env && env.trim()) {
+    const p = path.resolve(env);
+    return { path: p, exists: fs.existsSync(p) };
+  }
+  const candidates = [
+    path.join(os.homedir(), ".kimi-code", "config.toml"),
+    path.join(os.homedir(), ".kimi", "config.toml")
+  ];
+  for (const p of candidates) {
+    if (fs.existsSync(p)) return { path: p, exists: true };
+  }
+  return { path: candidates[0], exists: false };
+}
+
+// src/config.ts
+import fs2 from "fs";
+import { parse as parseToml } from "smol-toml";
+
+// src/toolsets.ts
+var DEFAULT_EDIT_TOOLS = ["WriteFile", "StrReplaceFile", "Edit", "Write", "MultiEdit", "NotebookEdit"];
+var DEFAULT_READ_TOOLS = ["ReadFile", "Read"];
+var DEFAULT_SEARCH_TOOLS = ["Grep", "Glob"];
+var DEFAULT_SHELL_TOOLS = ["Shell", "Bash"];
+var CLAUDE_EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
+var CLAUDE_READ_TOOLS = ["Read"];
+var CLAUDE_SEARCH_TOOLS = ["Grep", "Glob"];
+var CLAUDE_SHELL_TOOLS = ["Bash"];
+var CODEX_EDIT_TOOLS = ["apply_patch", "Edit", "Write"];
+var CODEX_READ_TOOLS = [];
+var CODEX_SEARCH_TOOLS = [];
+var CODEX_SHELL_TOOLS = ["Bash"];
+function toolDefaultsFor(harness) {
+  if (harness === "claude")
+    return { edit: [...CLAUDE_EDIT_TOOLS], read: [...CLAUDE_READ_TOOLS], search: [...CLAUDE_SEARCH_TOOLS], shell: [...CLAUDE_SHELL_TOOLS] };
+  if (harness === "codex")
+    return { edit: [...CODEX_EDIT_TOOLS], read: [...CODEX_READ_TOOLS], search: [...CODEX_SEARCH_TOOLS], shell: [...CODEX_SHELL_TOOLS] };
+  return { edit: [...DEFAULT_EDIT_TOOLS], read: [...DEFAULT_READ_TOOLS], search: [...DEFAULT_SEARCH_TOOLS], shell: [...DEFAULT_SHELL_TOOLS] };
+}
+function resolve(list) {
+  return new Set(list);
+}
+function editTools(cfg) {
+  return resolve(cfg.tools.edit);
+}
+function readTools(cfg) {
+  return resolve(cfg.tools.read);
+}
+function searchTools(cfg) {
+  return resolve(cfg.tools.search);
+}
+function shellTools(cfg) {
+  return resolve(cfg.tools.shell);
+}
+
+// src/config.ts
+var defaultConfig = {
+  harness: "kimi",
+  tools: toolDefaultsFor("kimi"),
+  repeat: {
+    enabled: true,
+    maxRepeats: 3,
+    warnAt: 2,
+    windowMinutes: 30,
+    watch: ["Grep", "Glob", "Shell", "Bash", "FetchURL", "SearchWeb", "ReadFile"],
+    thresholds: { ReadFile: 5 },
+    exemptPatterns: []
+  },
+  cycle: { enabled: true, windowMinutes: 30 },
+  noProgress: { enabled: true, windowMinutes: 30, warnAt: 15, blockAt: 25 },
+  nearRepeat: { enabled: true, windowMinutes: 30, warnAt: 6, blockAt: 10 },
+  explore: { enabled: true, windowMinutes: 30, warnAt: 10, blockAt: 15 },
+  verify: {
+    enabled: true,
+    blockOnNoEvidence: false,
+    evidenceWindowMinutes: 60,
+    claimPatterns: [],
+    evidencePatterns: [],
+    shellTools: ["Shell", "Bash"],
+    veto: {
+      enabled: false,
+      model: "kimi-k3",
+      baseUrl: "https://api.moonshot.cn/v1",
+      maxCallsPerSession: 3,
+      timeoutMs: 1e4
+    }
+  },
+  thinking: { enabled: true, minThinkChars: 2e4, maxTextRatio: 0.1 },
+  anchor: { enabled: true, everyNPrompts: 5, maxChars: 1e3 },
+  context: { enabled: true, warnPercent: 85 },
+  noGain: { enabled: true, windowMinutes: 30, warnAt: 3, blockAt: 4, fuzzyEnabled: true, fuzzySimilarity: 0.85, fuzzyWarnAt: 4, fuzzyBlockAt: 6 },
+  churn: {
+    enabled: true,
+    windowMinutes: 30,
+    warnAt: 5,
+    blockAt: 10,
+    tools: ["WriteFile", "StrReplaceFile", "Edit", "Write", "MultiEdit", "NotebookEdit"]
+  },
+  policy: { killSwitch: true, maxBlocksPerSession: 5, blockWindowMinutes: 60 },
+  budget: {
+    enabled: true,
+    plan: "tier1",
+    weekly: 0,
+    fiveHour: 0,
+    dispatchTools: ["Task", "Agent"],
+    reservePercent: 10,
+    subagentWeight: 5,
+    warnPercent: 80,
+    precise: false,
+    preciseUrl: "",
+    preciseCacheSeconds: 300
+  },
+  probe: false
+};
+var CONFIG_TEMPLATE = `# agent-guard configuration
+# Docs: https://github.com/shidesheng0218/kimi-guard
+
+[tools]                   # canonical tool-name taxonomy \u2014 if your CLI version renames tools, fix it HERE
+edit = ["WriteFile", "StrReplaceFile", "Edit", "Write", "MultiEdit", "NotebookEdit"]
+read = ["ReadFile", "Read"]
+search = ["Grep", "Glob"]
+shell = ["Shell", "Bash"]
+
+[repeat]
+enabled = true
+maxRepeats = 3            # identical (tool, args) calls allowed per window
+warnAt = 2                # soft context warning before the hard block
+windowMinutes = 30
+watch = ["Grep", "Glob", "Shell", "Bash", "FetchURL", "SearchWeb", "ReadFile"]
+# exemptPatterns = ["git status"]  # regexes over JSON-serialized args; matching calls are never repeat-blocked (polling commands like git status, sleep)
+
+[repeat.thresholds]       # per-tool overrides
+ReadFile = 5
+
+[cycle]                   # A->B->A->B oscillation detection
+enabled = true
+windowMinutes = 30
+
+[noProgress]              # long stretch of calls with no successful edit
+enabled = true
+windowMinutes = 30
+warnAt = 15
+blockAt = 25
+
+[nearRepeat]              # fuzzy near-duplicates (punctuation/case/order differences)
+enabled = true
+windowMinutes = 30
+warnAt = 6
+blockAt = 10
+
+[explore]                 # pure-exploration streak: reads/searches with no action in between
+enabled = true
+windowMinutes = 30
+warnAt = 10
+blockAt = 15
+
+[verify]                  # completion-claim gate: "tests pass" must be backed by a real run
+enabled = true
+blockOnNoEvidence = false # hooks path: block Stop when edits landed but nothing was verified
+evidenceWindowMinutes = 60
+# deprecated: shell tool names now live in [tools] shell (this key still works)
+
+[verify.veto]             # optional LLM veto vote to suppress false positives (self-critic style)
+enabled = false           # requires KIMI_GUARD_VETO_API_KEY in the environment
+model = "kimi-k3"         # use a cheap fast model \u2014 the LLM only votes, never authors
+baseUrl = "https://api.moonshot.cn/v1"
+maxCallsPerSession = 3    # anti "vote-laundering" cap: the model cannot retry its way out
+timeoutMs = 10000
+
+[thinking]                # thinking-dominance (pure-reasoning turns), Wire mode only
+enabled = true
+minThinkChars = 20000
+maxTextRatio = 0.1
+
+[anchor]                  # goal anchoring: re-inject the original task periodically
+enabled = true
+everyNPrompts = 5         # re-inject the goal every N prompts / steps
+maxChars = 1000
+
+[context]                 # context-fill gate (Wire mode reads StatusUpdate.context_usage)
+enabled = true
+warnPercent = 85          # steer a wrap-up warning when context is this full
+
+[noGain]                  # different args, byte-identical output
+enabled = true
+windowMinutes = 30
+warnAt = 3
+blockAt = 4
+fuzzyEnabled = true       # also catch near-identical outputs (similarity, not identity)
+fuzzySimilarity = 0.85    # trigram Jaccard threshold (0..1); higher = stricter
+fuzzyWarnAt = 4
+fuzzyBlockAt = 6
+
+[churn]                   # same file edited over and over
+enabled = true
+windowMinutes = 30
+warnAt = 5
+blockAt = 10
+# deprecated: edit tool names now live in [tools] edit (this key still works)
+
+[policy]
+killSwitch = true         # after maxBlocksPerSession interventions, block ALL tools
+maxBlocksPerSession = 5
+blockWindowMinutes = 60
+
+[budget]                  # request accounting for Kimi Coding Plans
+enabled = true
+plan = "tier1"            # tier1: 1024/week | tier2: 2048 | tier3: 7168 (200 per 5h)
+weekly = 0                # override weekly requests (0 = use plan preset)
+fiveHour = 0              # override 5h requests (0 = use plan preset)
+dispatchTools = ["Task", "Agent"]
+reservePercent = 10       # keep this much headroom for you, not the agent
+subagentWeight = 5        # ~requests each dispatched subagent costs
+warnPercent = 80
+precise = false           # poll the official Kimi usage API for exact windows (needs KIMI_API_KEY, sk-kimi-...)
+preciseUrl = ""           # default https://api.kimi.com/coding/v1
+preciseCacheSeconds = 300 # the API is rate-limited; cache aggressively. Falls back to event-based on any error
+
+[probe]
+enabled = false
+`;
+function applyClaudeDefaults(cfg) {
+  cfg.tools = toolDefaultsFor("claude");
+  cfg.repeat.watch = ["Grep", "Glob", "Bash", "Read", "WebFetch", "WebSearch"];
+  cfg.repeat.thresholds = { Read: 5 };
+  cfg.budget.dispatchTools = ["Task"];
+}
+function applyCodexDefaults(cfg) {
+  cfg.tools = toolDefaultsFor("codex");
+  cfg.repeat.watch = ["Bash", "apply_patch"];
+  cfg.repeat.thresholds = {};
+  cfg.budget.dispatchTools = ["Agent", "spawn_agent"];
+}
+function num(v, fallback) {
+  return typeof v === "number" && Number.isFinite(v) ? v : fallback;
+}
+function bool(v, fallback) {
+  return typeof v === "boolean" ? v : fallback;
+}
+function strArr(v, fallback) {
+  return Array.isArray(v) && v.every((x) => typeof x === "string") && v.length > 0 ? v : fallback;
+}
+function strArrOrNull(v) {
+  return Array.isArray(v) && v.every((x) => typeof x === "string") && v.length > 0 ? v : null;
+}
+function loadConfig(configPath = userConfigPath(), harness = "kimi") {
+  const cfg = structuredClone(defaultConfig);
+  cfg.harness = harness;
+  if (harness === "claude") applyClaudeDefaults(cfg);
+  if (harness === "codex") applyCodexDefaults(cfg);
+  let raw;
+  try {
+    raw = fs2.readFileSync(configPath, "utf8");
+  } catch {
+    return cfg;
+  }
+  let data;
+  try {
+    data = parseToml(raw);
+  } catch (err) {
+    process.stderr.write(`[agent-guard] failed to parse ${configPath}: ${err.message}
+`);
+    return cfg;
+  }
+  const section = (name) => data[name] ?? {};
+  const tools = section("tools");
+  const toolsEdit = strArrOrNull(tools["edit"]);
+  const toolsRead = strArrOrNull(tools["read"]);
+  const toolsSearch = strArrOrNull(tools["search"]);
+  const toolsShell = strArrOrNull(tools["shell"]);
+  if (toolsEdit) cfg.tools.edit = toolsEdit;
+  if (toolsRead) cfg.tools.read = toolsRead;
+  if (toolsSearch) cfg.tools.search = toolsSearch;
+  if (toolsShell) cfg.tools.shell = toolsShell;
+  const repeat = section("repeat");
+  cfg.repeat.enabled = bool(repeat["enabled"], cfg.repeat.enabled);
+  cfg.repeat.maxRepeats = num(repeat["maxRepeats"], cfg.repeat.maxRepeats);
+  cfg.repeat.warnAt = num(repeat["warnAt"], cfg.repeat.warnAt);
+  cfg.repeat.windowMinutes = num(repeat["windowMinutes"], cfg.repeat.windowMinutes);
+  cfg.repeat.watch = strArr(repeat["watch"], cfg.repeat.watch);
+  const exempt = repeat["exemptPatterns"];
+  if (Array.isArray(exempt)) cfg.repeat.exemptPatterns = exempt.filter((p) => typeof p === "string");
+  const th = repeat["thresholds"];
+  if (th) {
+    for (const [k, v] of Object.entries(th)) if (typeof v === "number") cfg.repeat.thresholds[k] = v;
+  }
+  const cycle = section("cycle");
+  cfg.cycle.enabled = bool(cycle["enabled"], cfg.cycle.enabled);
+  cfg.cycle.windowMinutes = num(cycle["windowMinutes"], cfg.cycle.windowMinutes);
+  const noProgress = section("noProgress");
+  cfg.noProgress.enabled = bool(noProgress["enabled"], cfg.noProgress.enabled);
+  cfg.noProgress.windowMinutes = num(noProgress["windowMinutes"], cfg.noProgress.windowMinutes);
+  cfg.noProgress.warnAt = num(noProgress["warnAt"], cfg.noProgress.warnAt);
+  cfg.noProgress.blockAt = num(noProgress["blockAt"], cfg.noProgress.blockAt);
+  const nearRepeat = section("nearRepeat");
+  cfg.nearRepeat.enabled = bool(nearRepeat["enabled"], cfg.nearRepeat.enabled);
+  cfg.nearRepeat.windowMinutes = num(nearRepeat["windowMinutes"], cfg.nearRepeat.windowMinutes);
+  cfg.nearRepeat.warnAt = num(nearRepeat["warnAt"], cfg.nearRepeat.warnAt);
+  cfg.nearRepeat.blockAt = num(nearRepeat["blockAt"], cfg.nearRepeat.blockAt);
+  const explore = section("explore");
+  cfg.explore.enabled = bool(explore["enabled"], cfg.explore.enabled);
+  cfg.explore.windowMinutes = num(explore["windowMinutes"], cfg.explore.windowMinutes);
+  cfg.explore.warnAt = num(explore["warnAt"], cfg.explore.warnAt);
+  cfg.explore.blockAt = num(explore["blockAt"], cfg.explore.blockAt);
+  const verify = section("verify");
+  cfg.verify.enabled = bool(verify["enabled"], cfg.verify.enabled);
+  cfg.verify.blockOnNoEvidence = bool(verify["blockOnNoEvidence"], cfg.verify.blockOnNoEvidence);
+  cfg.verify.evidenceWindowMinutes = num(verify["evidenceWindowMinutes"], cfg.verify.evidenceWindowMinutes);
+  const claims = verify["claimPatterns"];
+  if (Array.isArray(claims)) cfg.verify.claimPatterns = claims.filter((c) => typeof c === "string");
+  const evidence = verify["evidencePatterns"];
+  if (Array.isArray(evidence)) cfg.verify.evidencePatterns = evidence.filter((c) => typeof c === "string");
+  cfg.verify.shellTools = strArr(verify["shellTools"], cfg.verify.shellTools);
+  const legacyShellTools = strArrOrNull(verify["shellTools"]);
+  if (legacyShellTools && !toolsShell) cfg.tools.shell = legacyShellTools;
+  const veto = verify["veto"];
+  if (veto) {
+    cfg.verify.veto.enabled = bool(veto["enabled"], cfg.verify.veto.enabled);
+    cfg.verify.veto.model = typeof veto["model"] === "string" ? veto["model"] : cfg.verify.veto.model;
+    cfg.verify.veto.baseUrl = typeof veto["baseUrl"] === "string" ? veto["baseUrl"] : cfg.verify.veto.baseUrl;
+    cfg.verify.veto.maxCallsPerSession = num(veto["maxCallsPerSession"], cfg.verify.veto.maxCallsPerSession);
+    cfg.verify.veto.timeoutMs = num(veto["timeoutMs"], cfg.verify.veto.timeoutMs);
+  }
+  const thinking = section("thinking");
+  cfg.thinking.enabled = bool(thinking["enabled"], cfg.thinking.enabled);
+  cfg.thinking.minThinkChars = num(thinking["minThinkChars"], cfg.thinking.minThinkChars);
+  cfg.thinking.maxTextRatio = num(thinking["maxTextRatio"], cfg.thinking.maxTextRatio);
+  const anchor = section("anchor");
+  cfg.anchor.enabled = bool(anchor["enabled"], cfg.anchor.enabled);
+  cfg.anchor.everyNPrompts = num(anchor["everyNPrompts"], cfg.anchor.everyNPrompts);
+  cfg.anchor.maxChars = num(anchor["maxChars"], cfg.anchor.maxChars);
+  const context = section("context");
+  cfg.context.enabled = bool(context["enabled"], cfg.context.enabled);
+  cfg.context.warnPercent = num(context["warnPercent"], cfg.context.warnPercent);
+  const noGain = section("noGain");
+  cfg.noGain.enabled = bool(noGain["enabled"], cfg.noGain.enabled);
+  cfg.noGain.windowMinutes = num(noGain["windowMinutes"], cfg.noGain.windowMinutes);
+  cfg.noGain.warnAt = num(noGain["warnAt"], cfg.noGain.warnAt);
+  cfg.noGain.blockAt = num(noGain["blockAt"], cfg.noGain.blockAt);
+  cfg.noGain.fuzzyEnabled = bool(noGain["fuzzyEnabled"], cfg.noGain.fuzzyEnabled);
+  cfg.noGain.fuzzySimilarity = Math.max(0.5, Math.min(1, num(noGain["fuzzySimilarity"], cfg.noGain.fuzzySimilarity)));
+  cfg.noGain.fuzzyWarnAt = num(noGain["fuzzyWarnAt"], cfg.noGain.fuzzyWarnAt);
+  cfg.noGain.fuzzyBlockAt = num(noGain["fuzzyBlockAt"], cfg.noGain.fuzzyBlockAt);
+  const churn = section("churn");
+  cfg.churn.enabled = bool(churn["enabled"], cfg.churn.enabled);
+  cfg.churn.windowMinutes = num(churn["windowMinutes"], cfg.churn.windowMinutes);
+  cfg.churn.warnAt = num(churn["warnAt"], cfg.churn.warnAt);
+  cfg.churn.blockAt = num(churn["blockAt"], cfg.churn.blockAt);
+  cfg.churn.tools = strArr(churn["tools"], cfg.churn.tools);
+  const legacyChurnTools = strArrOrNull(churn["tools"]);
+  if (legacyChurnTools && !toolsEdit) cfg.tools.edit = legacyChurnTools;
+  const policy = section("policy");
+  cfg.policy.killSwitch = bool(policy["killSwitch"], cfg.policy.killSwitch);
+  cfg.policy.maxBlocksPerSession = num(policy["maxBlocksPerSession"], cfg.policy.maxBlocksPerSession);
+  cfg.policy.blockWindowMinutes = num(policy["blockWindowMinutes"], cfg.policy.blockWindowMinutes);
+  const budget = section("budget");
+  cfg.budget.enabled = bool(budget["enabled"], cfg.budget.enabled);
+  cfg.budget.plan = typeof budget["plan"] === "string" ? budget["plan"] : cfg.budget.plan;
+  cfg.budget.weekly = num(budget["weekly"], cfg.budget.weekly);
+  cfg.budget.fiveHour = num(budget["fiveHour"], cfg.budget.fiveHour);
+  cfg.budget.dispatchTools = strArr(budget["dispatchTools"], cfg.budget.dispatchTools);
+  cfg.budget.reservePercent = num(budget["reservePercent"], cfg.budget.reservePercent);
+  cfg.budget.subagentWeight = num(budget["subagentWeight"], cfg.budget.subagentWeight);
+  cfg.budget.warnPercent = num(budget["warnPercent"], cfg.budget.warnPercent);
+  cfg.budget.precise = bool(budget["precise"], cfg.budget.precise);
+  cfg.budget.preciseUrl = typeof budget["preciseUrl"] === "string" ? budget["preciseUrl"] : cfg.budget.preciseUrl;
+  cfg.budget.preciseCacheSeconds = num(budget["preciseCacheSeconds"], cfg.budget.preciseCacheSeconds);
+  cfg.probe = bool(section("probe")["enabled"], cfg.probe);
+  cfg.verify.shellTools = cfg.tools.shell;
+  cfg.churn.tools = cfg.tools.edit;
+  return cfg;
+}
+function writeConfigTemplate(configPath = userConfigPath()) {
+  if (fs2.existsSync(configPath)) return false;
+  fs2.mkdirSync(configPath.replace(/[/\\][^/\\]+$/, ""), { recursive: true });
+  fs2.writeFileSync(configPath, CONFIG_TEMPLATE, "utf8");
+  return true;
+}
+
+// src/harness/claude.ts
+import fs3 from "fs";
+import path2 from "path";
+var CLAUDE_COMMAND_MARKER = "agentguard hook";
+var CLAUDE_EVENTS = [
+  "PreToolUse",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "UserPromptSubmit",
+  "Stop",
+  "SubagentStart",
+  "SessionStart",
+  "SessionEnd",
+  "PreCompact",
+  "PostCompact",
+  "StopFailure"
+];
+var CLAUDE_EVENTS_COMPAT = ["PreToolUse", "PostToolUse", "PostToolUseFailure"];
+function isOurs(group) {
+  return (group.hooks ?? []).some((h) => typeof h.command === "string" && h.command.includes(CLAUDE_COMMAND_MARKER));
+}
+function ourGroup(event, bin) {
+  return {
+    matcher: "",
+    hooks: [{ type: "command", command: `${bin} hook ${event} --harness claude`, timeout: 5 }]
+  };
+}
+function installClaudeHooks(bin = "agentguard", compat = false) {
+  const configPath = claudeSettingsPath();
+  const created = !fs3.existsSync(configPath);
+  let settings = {};
+  let backupPath;
+  if (!created) {
+    const raw = fs3.readFileSync(configPath, "utf8");
+    try {
+      settings = JSON.parse(raw);
+    } catch {
+      backupPath = `${configPath}.agentguard.bak`;
+      fs3.copyFileSync(configPath, backupPath);
+      settings = {};
+    }
+    if (!backupPath) {
+      backupPath = `${configPath}.agentguard.bak`;
+      fs3.writeFileSync(backupPath, raw, "utf8");
+    }
+  }
+  const events = compat ? CLAUDE_EVENTS_COMPAT : CLAUDE_EVENTS;
+  const hooks = settings.hooks ??= {};
+  let updated = false;
+  for (const event of events) {
+    const groups = (hooks[event] ?? []).filter((g) => !isOurs(g));
+    const before = JSON.stringify(hooks[event] ?? []);
+    groups.push(ourGroup(event, bin));
+    hooks[event] = groups;
+    if (JSON.stringify(groups) !== before) updated = true;
+  }
+  fs3.mkdirSync(path2.dirname(configPath), { recursive: true });
+  fs3.writeFileSync(configPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  return { configPath, created, updated: updated || created, backupPath: created ? void 0 : backupPath };
+}
+function uninstallClaudeHooks() {
+  const configPath = claudeSettingsPath();
+  if (!fs3.existsSync(configPath)) return { configPath, removed: false };
+  let settings;
+  try {
+    settings = JSON.parse(fs3.readFileSync(configPath, "utf8"));
+  } catch {
+    return { configPath, removed: false };
+  }
+  const hooks = settings.hooks;
+  if (!hooks) return { configPath, removed: false };
+  let removed = false;
+  for (const event of Object.keys(hooks)) {
+    const kept = hooks[event].filter((g) => !isOurs(g));
+    if (kept.length !== hooks[event].length) removed = true;
+    if (kept.length === 0) delete hooks[event];
+    else hooks[event] = kept;
+  }
+  if (removed) fs3.writeFileSync(configPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  return { configPath, removed };
+}
+function claudeHooksInstalled(configPath = claudeSettingsPath()) {
+  try {
+    const settings = JSON.parse(fs3.readFileSync(configPath, "utf8"));
+    return Object.values(settings.hooks ?? {}).some((groups) => groups.some(isOurs));
+  } catch {
+    return false;
+  }
+}
+
+// src/store.ts
+import fs4 from "fs";
+import path3 from "path";
+import { createRequire } from "module";
+var nodeRequire = createRequire(import.meta.url);
+function sqliteCtor() {
+  return nodeRequire("node:sqlite").DatabaseSync;
+}
+var SCHEMA_VERSION = 4;
+var SCHEMA = `
+CREATE TABLE IF NOT EXISTS calls (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  session_id TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  args_hash TEXT NOT NULL,
+  args_json TEXT NOT NULL,
+  output_hash TEXT,
+  output_sample TEXT,
+  file_path TEXT,
+  status TEXT NOT NULL,
+  ts INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_calls_session ON calls(session_id, ts);
+CREATE INDEX IF NOT EXISTS idx_calls_sig ON calls(session_id, tool_name, args_hash, ts);
+CREATE INDEX IF NOT EXISTS idx_calls_out ON calls(session_id, tool_name, output_hash, ts);
+CREATE INDEX IF NOT EXISTS idx_calls_time ON calls(ts);
+CREATE TABLE IF NOT EXISTS events (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  session_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  meta_json TEXT NOT NULL,
+  ts INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_events_kind ON events(session_id, kind, ts);
+CREATE INDEX IF NOT EXISTS idx_events_time ON events(ts);
+CREATE TABLE IF NOT EXISTS blocks (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  session_id TEXT NOT NULL,
+  tool_name TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  ts INTEGER NOT NULL,
+  feedback TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_blocks_session ON blocks(session_id, ts);
+CREATE TABLE IF NOT EXISTS meta (
+  k TEXT PRIMARY KEY,
+  v TEXT NOT NULL
+);
+`;
+var db = null;
+function openDb() {
+  if (db) return db;
+  const file = stateDbPath();
+  fs4.mkdirSync(path3.dirname(file), { recursive: true });
+  const d = new (sqliteCtor())(file);
+  d.exec("PRAGMA journal_mode = WAL;");
+  migrate(d);
+  db = d;
+  return db;
+}
+function migrate(d) {
+  d.exec("CREATE TABLE IF NOT EXISTS meta (k TEXT PRIMARY KEY, v TEXT NOT NULL);");
+  const row = d.prepare("SELECT v FROM meta WHERE k = 'schema_version'").get();
+  const version = row ? Number(row.v) : 0;
+  if (version === SCHEMA_VERSION) {
+    d.exec(SCHEMA);
+    return;
+  }
+  if (version >= 2) {
+    d.exec(SCHEMA);
+    if (version < 3) {
+      try {
+        d.exec("ALTER TABLE blocks ADD COLUMN feedback TEXT");
+      } catch {
+      }
+    }
+    if (version < 4) {
+      try {
+        d.exec("ALTER TABLE calls ADD COLUMN output_sample TEXT");
+      } catch {
+      }
+    }
+  } else {
+    d.exec("DROP TABLE IF EXISTS calls; DROP TABLE IF EXISTS events; DROP TABLE IF EXISTS blocks;");
+    d.exec(SCHEMA);
+  }
+  d.prepare(
+    "INSERT INTO meta (k, v) VALUES ('schema_version', ?) ON CONFLICT(k) DO UPDATE SET v = excluded.v"
+  ).run(String(SCHEMA_VERSION));
+}
+function recordCall(call) {
+  openDb().prepare(
+    "INSERT INTO calls (session_id, tool_name, args_hash, args_json, output_hash, output_sample, file_path, status, ts) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
+  ).run(
+    call.sessionId,
+    call.toolName,
+    call.argsHash,
+    call.argsJson,
+    call.outputHash,
+    call.outputSample ?? null,
+    call.filePath,
+    call.status,
+    call.ts ?? Date.now()
+  );
+}
+function callsSince(sessionId, sinceTs, limit = 500) {
+  return openDb().prepare(
+    "SELECT tool_name, args_hash, args_json, output_hash, output_sample, file_path, status, ts FROM calls WHERE session_id = ? AND ts >= ? ORDER BY ts ASC LIMIT ?"
+  ).all(sessionId, sinceTs, limit);
+}
+function recordEvent(sessionId, kind, meta, ts = Date.now()) {
+  openDb().prepare("INSERT INTO events (session_id, kind, meta_json, ts) VALUES (?, ?, ?, ?)").run(sessionId, kind, JSON.stringify(meta), ts);
+}
+function countEvents(sessionId, kinds, sinceTs) {
+  const placeholders = kinds.map(() => "?").join(",");
+  const row = openDb().prepare(
+    `SELECT COUNT(*) AS n FROM events WHERE session_id = ? AND kind IN (${placeholders}) AND ts >= ?`
+  ).get(sessionId, ...kinds, sinceTs);
+  return Number(row?.n ?? 0);
+}
+function oldestEventTs(sessionId, kinds, sinceTs) {
+  const placeholders = kinds.map(() => "?").join(",");
+  const row = openDb().prepare(
+    `SELECT MIN(ts) AS m FROM events WHERE session_id = ? AND kind IN (${placeholders}) AND ts >= ?`
+  ).get(sessionId, ...kinds, sinceTs);
+  return row?.m ?? null;
+}
+function recordBlock(sessionId, toolName, kind, ts = Date.now()) {
+  const info = openDb().prepare("INSERT INTO blocks (session_id, tool_name, kind, ts) VALUES (?, ?, ?, ?)").run(sessionId, toolName, kind, ts);
+  return Number(info.lastInsertRowid);
+}
+function listBlocks(limit = 20) {
+  return openDb().prepare("SELECT id, session_id, tool_name, kind, ts, feedback FROM blocks ORDER BY id DESC LIMIT ?").all(limit);
+}
+function setBlockFeedback(id, verdict) {
+  const info = openDb().prepare("UPDATE blocks SET feedback = ? WHERE id = ?").run(verdict, id);
+  return Number(info.changes) > 0;
+}
+function blockKindStats() {
+  const rows = openDb().prepare(
+    `SELECT kind, COUNT(*) AS n,
+              SUM(CASE WHEN feedback = 'fp' THEN 1 ELSE 0 END) AS fp,
+              SUM(CASE WHEN feedback = 'tp' THEN 1 ELSE 0 END) AS tp
+       FROM blocks GROUP BY kind ORDER BY n DESC`
+  ).all();
+  return rows.map((r) => ({ kind: r.kind, n: Number(r.n), fp: Number(r.fp), tp: Number(r.tp) }));
+}
+function countBlocks(sessionId, sinceTs) {
+  const row = openDb().prepare("SELECT COUNT(*) AS n FROM blocks WHERE session_id = ? AND ts >= ?").get(sessionId, sinceTs);
+  return Number(row?.n ?? 0);
+}
+function getMeta(key) {
+  const row = openDb().prepare("SELECT v FROM meta WHERE k = ?").get(key);
+  return row?.v;
+}
+function setMeta(key, value) {
+  openDb().prepare("INSERT INTO meta (k, v) VALUES (?, ?) ON CONFLICT(k) DO UPDATE SET v = excluded.v").run(key, value);
+}
+function knownSessions(limit = 5) {
+  return openDb().prepare(
+    `SELECT session_id, MAX(last_ts) AS last_ts, SUM(n) AS n FROM (
+         SELECT session_id, MAX(ts) AS last_ts, COUNT(*) AS n FROM calls GROUP BY session_id
+         UNION ALL
+         SELECT session_id, MAX(ts) AS last_ts, COUNT(*) AS n FROM events GROUP BY session_id
+       ) GROUP BY session_id ORDER BY last_ts DESC LIMIT ?`
+  ).all(limit);
+}
+function buildStatus() {
+  const d = openDb();
+  const now = Date.now();
+  const day = now - 864e5;
+  const calls24h = Number(d.prepare("SELECT COUNT(*) AS n FROM calls WHERE ts >= ?").get(day).n);
+  const blocks24h = d.prepare("SELECT kind, COUNT(*) AS n FROM blocks WHERE ts >= ? GROUP BY kind").all(day).map((r) => ({ kind: r.kind, n: Number(r.n) }));
+  const topRepeated = d.prepare(
+    "SELECT tool_name, args_hash, COUNT(*) AS n FROM calls WHERE ts >= ? GROUP BY session_id, tool_name, args_hash ORDER BY n DESC LIMIT 5"
+  ).all(day).map((r) => ({ tool_name: r.tool_name, args_hash: r.args_hash, n: Number(r.n) }));
+  const noGainPairs = d.prepare(
+    "SELECT tool_name, COUNT(DISTINCT session_id || ':' || output_hash) AS n FROM calls WHERE ts >= ? AND output_hash IS NOT NULL GROUP BY tool_name ORDER BY n DESC LIMIT 5"
+  ).all(day).map((r) => ({ tool_name: r.tool_name, n: Number(r.n) }));
+  const events24h = d.prepare("SELECT kind, COUNT(*) AS n FROM events WHERE ts >= ? GROUP BY kind").all(day).map((r) => ({ kind: r.kind, n: Number(r.n) }));
+  const lastActivity = d.prepare("SELECT MAX(m) AS m FROM (SELECT MAX(ts) AS m FROM calls UNION ALL SELECT MAX(ts) AS m FROM events)").get();
+  return {
+    calls24h,
+    blocks24h,
+    topRepeated,
+    noGainPairs,
+    events24h,
+    lastActivityTs: lastActivity?.m ?? null
+  };
+}
+
+// src/events.ts
+import { createHash } from "crypto";
+function pickString(payload, keys) {
+  for (const k of keys) {
+    const v = payload[k];
+    if (typeof v === "string" && v) return v;
+  }
+  return "";
+}
+function pickField(payload, keys) {
+  for (const k of keys) {
+    if (payload[k] !== void 0) return payload[k];
+  }
+  return void 0;
+}
+function collapseWs(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function sortDeep(value, collapseStrings) {
+  if (Array.isArray(value)) return value.map((x) => sortDeep(x, collapseStrings));
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const k of Object.keys(value).sort()) {
+      out[k] = sortDeep(value[k], collapseStrings);
+    }
+    return out;
+  }
+  if (value === void 0) return null;
+  if (typeof value === "string") return collapseStrings ? collapseWs(value) : value;
+  return value;
+}
+var WHITESPACE_SENSITIVE = /* @__PURE__ */ new Set(["Shell", "Bash", "Grep", "Glob", "FetchURL", "SearchWeb", "ReadFile", "WriteFile", "StrReplaceFile", "Edit", "Write", "MultiEdit"]);
+function fingerprint(tool, args) {
+  let v = args ?? {};
+  if (v === null || typeof v !== "object") v = { value: v ?? null };
+  const normalized = sortDeep(v, !WHITESPACE_SENSITIVE.has(tool));
+  return createHash("sha256").update(JSON.stringify(normalized)).digest("hex").slice(0, 16);
+}
+function hashOutput(output) {
+  if (output === void 0 || output === null) return null;
+  let s;
+  if (typeof output === "string") s = output;
+  else {
+    try {
+      s = JSON.stringify(sortDeep(output, false));
+    } catch {
+      s = String(output);
+    }
+  }
+  s = collapseWs(s).slice(0, 4096);
+  if (!s) return null;
+  return createHash("sha256").update(s).digest("hex").slice(0, 16);
+}
+function outputSampleOf(output) {
+  if (output === void 0 || output === null) return null;
+  let s;
+  if (typeof output === "string") s = output;
+  else {
+    try {
+      s = JSON.stringify(output);
+    } catch {
+      s = String(output);
+    }
+  }
+  s = collapseWs(s).slice(0, 1024);
+  return s || null;
+}
+var FILE_KEYS = ["file_path", "filePath", "path", "file", "filename", "notebook_path", "target"];
+function extractFile(args) {
+  if (args === null || typeof args !== "object") return null;
+  const obj = args;
+  for (const k of FILE_KEYS) {
+    const v = obj[k];
+    if (typeof v === "string" && v) return v;
+  }
+  return null;
+}
+function normalizeCall(payload, event, ts = Date.now()) {
+  const sessionId = pickString(payload, ["session_id", "sessionId", "session", "sessionID"]) || "unknown";
+  const tool = pickString(payload, ["tool_name", "toolName", "tool"]);
+  if (!tool) return null;
+  const args = pickField(payload, ["tool_input", "toolInput", "input"]) ?? {};
+  const outputKeys = ["tool_output", "toolOutput", "tool_response", "output", "result"];
+  const output = event === "PostToolUse" ? pickField(payload, outputKeys) : event === "PostToolUseFailure" ? pickField(payload, ["error", "error_message", ...outputKeys]) : void 0;
+  const argsJson = JSON.stringify(args).slice(0, 2048);
+  return {
+    sessionId,
+    tool,
+    args,
+    argsHash: fingerprint(tool, args),
+    argsJson,
+    outputHash: output !== void 0 ? hashOutput(output) : null,
+    outputSample: output !== void 0 ? outputSampleOf(output) : null,
+    filePath: extractFile(args),
+    status: event === "PostToolUseFailure" ? "failure" : "ok",
+    ts
+  };
+}
+
+// src/analysis.ts
+var allow = [];
+function isRepeatExempt(proposed, cfg) {
+  if (cfg.repeat.exemptPatterns.length === 0) return false;
+  let text;
+  try {
+    text = JSON.stringify(proposed.args ?? {});
+  } catch {
+    text = String(proposed.args);
+  }
+  for (const p of cfg.repeat.exemptPatterns) {
+    try {
+      if (new RegExp(p).test(text)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function analyzeRepetition(history, proposed, cfg, now) {
+  if (!cfg.repeat.enabled) return allow;
+  const watched = cfg.repeat.watch.includes(proposed.tool) || proposed.tool in cfg.repeat.thresholds;
+  if (!watched) return allow;
+  if (isRepeatExempt(proposed, cfg)) return allow;
+  const threshold = cfg.repeat.thresholds[proposed.tool] ?? cfg.repeat.maxRepeats;
+  const since = now - cfg.repeat.windowMinutes * 6e4;
+  const n = history.filter(
+    (r) => r.tool_name === proposed.tool && r.args_hash === proposed.argsHash && r.ts >= since
+  ).length;
+  if (n >= threshold) {
+    return [
+      {
+        kind: "repeat",
+        severity: "block",
+        tool: proposed.tool,
+        message: `"${proposed.tool}" has already been called ${n} times with identical arguments in the last ${cfg.repeat.windowMinutes} minutes. The previous results are already in context \u2014 use them instead of re-running. If a retry is genuinely required, change the arguments or state why the previous result is insufficient.`,
+        evidence: `signature count=${n}, threshold=${threshold}`
+      }
+    ];
+  }
+  if (cfg.repeat.warnAt > 0 && n >= cfg.repeat.warnAt) {
+    return [
+      {
+        kind: "repeat",
+        severity: "warn",
+        tool: proposed.tool,
+        message: `"${proposed.tool}" has been called ${n} times with identical arguments \u2014 the result is already in context. Identical calls are blocked at ${threshold}; make sure any retry adds new information.`,
+        evidence: `signature count=${n}, warnAt=${cfg.repeat.warnAt}`
+      }
+    ];
+  }
+  return allow;
+}
+function analyzeCycles(history, cfg, now) {
+  if (!cfg.cycle.enabled) return allow;
+  const since = now - cfg.cycle.windowMinutes * 6e4;
+  const recent = history.filter((r) => r.ts >= since).slice(-16).map((r) => `${r.tool_name}:${r.args_hash}`);
+  if (recent.length < 8) return allow;
+  const findings = [];
+  for (let period = 1; period <= 3; period++) {
+    const minReps = period === 1 ? 5 : 3;
+    const needed = period * minReps;
+    const tail = recent.slice(-needed);
+    if (tail.length < needed) continue;
+    const base = tail.slice(0, period);
+    let isCycle = true;
+    for (let i = period; i < tail.length; i++) {
+      if (tail[i] !== base[i % period]) {
+        isCycle = false;
+        break;
+      }
+    }
+    if (isCycle) {
+      const desc = period === 1 ? `the same call (${base[0]})` : `a ${period}-step cycle (${base.map((s) => s.split(":")[0]).join(" \u2192 ")})`;
+      findings.push({
+        kind: "cycle",
+        severity: "block",
+        tool: base[0]?.split(":")[0],
+        message: `Loop detected: the agent has repeated ${desc} ${minReps}+ times in a row without progress. Stop re-running this sequence. Re-read the results already in context, reassess the approach, and either proceed differently or end the turn with a summary.`,
+        evidence: `period=${period}, reps>=${minReps}`
+      });
+      break;
+    }
+  }
+  return findings;
+}
+function analyzeNoGain(history, cfg, now) {
+  if (!cfg.noGain.enabled) return allow;
+  const since = now - cfg.noGain.windowMinutes * 6e4;
+  const byPair = /* @__PURE__ */ new Map();
+  for (const r of history) {
+    if (r.ts < since || !r.output_hash) continue;
+    const key = `${r.tool_name}:${r.output_hash}`;
+    byPair.set(key, (byPair.get(key) ?? 0) + 1);
+  }
+  const findings = [];
+  for (const [key, n] of byPair) {
+    if (n < cfg.noGain.warnAt) continue;
+    const tool = key.split(":")[0];
+    if (n >= cfg.noGain.blockAt) {
+      findings.push({
+        kind: "noGain",
+        severity: "block",
+        tool,
+        message: `No-progress loop: ${tool} returned the exact same output ${n} times despite different arguments. You are not gaining new information. Stop calling ${tool}, analyze the result you already have, change strategy, or report your findings.`,
+        evidence: `tool=${tool} identical_output_count=${n}`
+      });
+    } else {
+      findings.push({
+        kind: "noGain",
+        severity: "warn",
+        tool,
+        message: `${tool} has returned the same output ${n} times \u2014 verify you are not repeating work.`,
+        evidence: `tool=${tool} identical_output_count=${n}`
+      });
+    }
+  }
+  return findings.slice(0, 2);
+}
+function editToolSet(cfg) {
+  return editTools(cfg);
+}
+function analyzeNoProgress(history, proposed, cfg, now) {
+  if (!cfg.noProgress.enabled) return allow;
+  if (editToolSet(cfg).has(proposed.tool)) return allow;
+  const since = now - cfg.noProgress.windowMinutes * 6e4;
+  const tools = editToolSet(cfg);
+  let lastEditTs = -1;
+  for (const r of history) {
+    if (r.ts < since) continue;
+    if (tools.has(r.tool_name) && r.status === "ok") lastEditTs = Math.max(lastEditTs, r.ts);
+  }
+  const stretch = history.filter((r) => r.ts >= since && r.ts > lastEditTs).length;
+  if (stretch < cfg.noProgress.warnAt) return allow;
+  if (stretch >= cfg.noProgress.blockAt) {
+    return [
+      {
+        kind: "noProgress",
+        severity: "block",
+        tool: proposed.tool,
+        message: `No progress: ${stretch} tool calls in the last ${cfg.noProgress.windowMinutes} minutes with no successful file edit landing. You are circling, not converging. Stop, pick the single most valuable next change, make it deliberately, or report what is blocking you.`,
+        evidence: `stretch=${stretch} warnAt=${cfg.noProgress.warnAt} blockAt=${cfg.noProgress.blockAt}`
+      }
+    ];
+  }
+  return [
+    {
+      kind: "noProgress",
+      severity: "warn",
+      tool: proposed.tool,
+      message: `${stretch} calls without a landed edit recently \u2014 make sure the next step actually produces a change.`,
+      evidence: `stretch=${stretch}`
+    }
+  ];
+}
+function analyzeChurn(history, cfg, now) {
+  if (!cfg.churn.enabled) return allow;
+  const since = now - cfg.churn.windowMinutes * 6e4;
+  const tools = editTools(cfg);
+  const byFile = /* @__PURE__ */ new Map();
+  for (const r of history) {
+    if (r.ts < since || !r.file_path || !tools.has(r.tool_name)) continue;
+    byFile.set(r.file_path, (byFile.get(r.file_path) ?? 0) + 1);
+  }
+  const findings = [];
+  for (const [file, n] of byFile) {
+    if (n >= cfg.churn.blockAt) {
+      findings.push({
+        kind: "churn",
+        severity: "block",
+        tool: "edit",
+        message: `Edit churn: ${file} has been modified ${n} times in the last ${cfg.churn.windowMinutes} minutes without converging. Stop editing. Re-read the file and the error output, form an explicit hypothesis about why previous fixes failed, then make a single deliberate change \u2014 or ask the user for help.`,
+        evidence: `file=${file} edits=${n}`
+      });
+    } else if (n >= cfg.churn.warnAt) {
+      findings.push({
+        kind: "churn",
+        severity: "warn",
+        tool: "edit",
+        message: `${file} has been edited ${n} times recently \u2014 step back and verify your approach before editing again.`,
+        evidence: `file=${file} edits=${n}`
+      });
+    }
+  }
+  return findings.sort((a, b) => a.severity === b.severity ? 0 : a.severity === "block" ? -1 : 1).slice(0, 1);
+}
+function trigrams(s) {
+  const out = /* @__PURE__ */ new Set();
+  if (s.length < 3) {
+    if (s.length > 0) out.add(s);
+    return out;
+  }
+  for (let i = 0; i + 3 <= s.length; i++) out.add(s.slice(i, i + 3));
+  return out;
+}
+function trigramJaccard(a, b) {
+  const A = trigrams(a);
+  const B = trigrams(b);
+  if (A.size === 0 || B.size === 0) return 0;
+  let inter = 0;
+  for (const t of A) if (B.has(t)) inter++;
+  return inter / (A.size + B.size - inter);
+}
+function analyzeNoGainFuzzy(history, proposed, cfg, now) {
+  if (!cfg.noGain.enabled || !cfg.noGain.fuzzyEnabled) return allow;
+  const since = now - cfg.noGain.windowMinutes * 6e4;
+  const outs = history.filter((r) => r.ts >= since && r.tool_name === proposed.tool && r.output_sample);
+  if (outs.length < 2) return allow;
+  let streak = 0;
+  for (let i = outs.length - 1; i > 0; i--) {
+    const cur = outs[i];
+    const prev = outs[i - 1];
+    if (cur.output_hash === prev.output_hash) continue;
+    if (trigramJaccard(cur.output_sample, prev.output_sample) >= cfg.noGain.fuzzySimilarity) streak++;
+    else break;
+  }
+  if (streak < cfg.noGain.fuzzyWarnAt) return allow;
+  if (streak >= cfg.noGain.fuzzyBlockAt) {
+    return [
+      {
+        kind: "noGainFuzzy",
+        severity: "block",
+        tool: proposed.tool,
+        message: `Stagnation: the last ${streak + 1} ${proposed.tool} calls returned outputs that differ only trivially (similarity \u2265 ${cfg.noGain.fuzzySimilarity}). You are re-querying without learning anything new. Work with what you have, or change the query substantially.`,
+        evidence: `similar_streak=${streak} blockAt=${cfg.noGain.fuzzyBlockAt}`
+      }
+    ];
+  }
+  return [
+    {
+      kind: "noGainFuzzy",
+      severity: "warn",
+      tool: proposed.tool,
+      message: `the last ${streak + 1} ${proposed.tool} outputs are near-identical \u2014 verify these calls still return new information.`,
+      evidence: `similar_streak=${streak}`
+    }
+  ];
+}
+function analyzeExplore(history, proposed, cfg, now) {
+  if (!cfg.explore.enabled) return allow;
+  const passive = /* @__PURE__ */ new Set([...readTools(cfg), ...searchTools(cfg)]);
+  if (!passive.has(proposed.tool)) return allow;
+  const since = now - cfg.explore.windowMinutes * 6e4;
+  let streak = 0;
+  for (let i = history.length - 1; i >= 0; i--) {
+    const r = history[i];
+    if (r.ts < since || !passive.has(r.tool_name)) break;
+    streak++;
+  }
+  if (streak < cfg.explore.warnAt) return allow;
+  if (streak >= cfg.explore.blockAt) {
+    return [
+      {
+        kind: "explore",
+        severity: "block",
+        tool: proposed.tool,
+        message: `Exploration without implementation: ${streak} consecutive read/search calls with no action in the last ${cfg.explore.windowMinutes} minutes. You have gathered enough \u2014 pick the most valuable thing you learned and act on it (edit, run, or write). If nothing is actionable, summarize what you found and say so.`,
+        evidence: `streak=${streak} blockAt=${cfg.explore.blockAt}`
+      }
+    ];
+  }
+  return [
+    {
+      kind: "explore",
+      severity: "warn",
+      tool: proposed.tool,
+      message: `${streak} consecutive read/search calls \u2014 make sure the next step acts on what you already learned.`,
+      evidence: `streak=${streak}`
+    }
+  ];
+}
+function fuzzyKey(tool, argsJson) {
+  let text = argsJson;
+  try {
+    const obj = JSON.parse(argsJson);
+    const parts = [];
+    for (const v of Object.values(obj)) {
+      if (typeof v === "string") parts.push(v);
+      else if (v !== null && v !== void 0) parts.push(JSON.stringify(v));
+    }
+    if (parts.length > 0) text = parts.join("|");
+  } catch {
+  }
+  return `${tool}:${text.toLowerCase().replace(/[^a-z0-9\u4e00-\u9fa5]/g, "")}`;
+}
+function analyzeNearRepeat(history, cfg, now = Date.now()) {
+  if (!cfg.nearRepeat.enabled) return allow;
+  const since = now - cfg.nearRepeat.windowMinutes * 6e4;
+  const byKey = /* @__PURE__ */ new Map();
+  for (const r of history) {
+    if (r.ts < since) continue;
+    const key = fuzzyKey(r.tool_name, r.args_json);
+    const cur = byKey.get(key) ?? { n: 0, tool: r.tool_name };
+    cur.n++;
+    byKey.set(key, cur);
+  }
+  const findings = [];
+  for (const [, v] of byKey) {
+    if (v.n >= cfg.nearRepeat.blockAt) {
+      findings.push({
+        kind: "nearRepeat",
+        severity: "block",
+        tool: v.tool,
+        message: `Near-duplicate loop: ${v.tool} has been called ${v.n} times with arguments that differ only trivially (punctuation, case, spacing, order). You are not trying anything new. Use the results already in context or change the approach substantially.`,
+        evidence: `fuzzy_count=${v.n} blockAt=${cfg.nearRepeat.blockAt}`
+      });
+    } else if (v.n >= cfg.nearRepeat.warnAt) {
+      findings.push({
+        kind: "nearRepeat",
+        severity: "warn",
+        tool: v.tool,
+        message: `${v.tool} has ${v.n} near-identical calls recently \u2014 verify these calls differ meaningfully.`,
+        evidence: `fuzzy_count=${v.n}`
+      });
+    }
+  }
+  return findings.sort((a, b) => a.severity === b.severity ? 0 : a.severity === "block" ? -1 : 1).slice(0, 1);
+}
+function analyzeCall(history, proposed, cfg, now = Date.now()) {
+  const findings = [
+    ...analyzeRepetition(history, proposed, cfg, now),
+    ...analyzeCycles(history, cfg, now),
+    ...analyzeNoGain(history, cfg, now),
+    ...analyzeNoGainFuzzy(history, proposed, cfg, now),
+    ...analyzeChurn(history, cfg, now),
+    ...analyzeNoProgress(history, proposed, cfg, now),
+    ...analyzeNearRepeat(history, cfg, now),
+    ...analyzeExplore(history, proposed, cfg, now)
+  ];
+  const rank = { block: 0, warn: 1 };
+  findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
+  return { findings: findings.slice(0, 2) };
+}
+
+// src/checkpoint.ts
+import fs5 from "fs";
+import path4 from "path";
+function argSummary(argsJson, max = 100) {
+  try {
+    const obj = JSON.parse(argsJson);
+    const parts = [];
+    for (const [k, v] of Object.entries(obj)) {
+      const s = typeof v === "string" ? v : JSON.stringify(v);
+      parts.push(`${k}=${s.length > 60 ? s.slice(0, 57) + "..." : s}`);
+    }
+    const joined = parts.join(", ");
+    return joined.length > max ? joined.slice(0, max - 3) + "..." : joined || "{}";
+  } catch {
+    return argsJson.slice(0, max);
+  }
+}
+function buildBrief(sessionId, now = Date.now(), windowMs = 6 * 36e5, cfg = loadConfig()) {
+  const calls = callsSince(sessionId, now - windowMs, 1e3);
+  if (calls.length === 0) return "";
+  const shells = shellTools(cfg);
+  const edits = editTools(cfg);
+  const reads = readTools(cfg);
+  const searchesSet = searchTools(cfg);
+  const files = /* @__PURE__ */ new Map();
+  const commands = [];
+  const searches = [];
+  const failures = [];
+  for (const r of calls) {
+    const summary = argSummary(r.args_json, 90);
+    if (edits.has(r.tool_name) && r.file_path) {
+      const f = files.get(r.file_path) ?? { reads: 0, edits: 0 };
+      f.edits++;
+      files.set(r.file_path, f);
+    } else if (r.file_path && reads.has(r.tool_name)) {
+      const f = files.get(r.file_path) ?? { reads: 0, edits: 0 };
+      f.reads++;
+      files.set(r.file_path, f);
+    }
+    if (shells.has(r.tool_name)) commands.push(summary);
+    if (searchesSet.has(r.tool_name)) searches.push(summary);
+    if (r.status === "failure") failures.push(`${r.tool_name}: ${summary}`);
+  }
+  const lines = [];
+  lines.push("## Observed activity (auto-captured by agent-guard)");
+  lines.push("");
+  if (files.size > 0) {
+    lines.push("### Files touched");
+    for (const [f, c] of [...files.entries()].slice(0, 25)) {
+      lines.push(`- ${f} (read \xD7${c.reads}, edited \xD7${c.edits})`);
+    }
+    lines.push("");
+  }
+  if (commands.length > 0) {
+    lines.push("### Commands run (most recent last)");
+    for (const c of commands.slice(-10)) lines.push(`- ${c}`);
+    lines.push("");
+  }
+  if (searches.length > 0) {
+    lines.push("### Searches performed (results are already known \u2014 do not redo them)");
+    const seen = /* @__PURE__ */ new Set();
+    for (const s of searches.slice(-15)) {
+      if (seen.has(s)) continue;
+      seen.add(s);
+      lines.push(`- ${s}`);
+    }
+    lines.push("");
+  }
+  if (failures.length > 0) {
+    lines.push("### Failed calls (avoid repeating these)");
+    const seen = /* @__PURE__ */ new Set();
+    for (const f of failures.slice(-8)) {
+      if (seen.has(f)) continue;
+      seen.add(f);
+      lines.push(`- ${f}`);
+    }
+    lines.push("");
+  }
+  lines.push(`Total recorded tool calls in window: ${calls.length}`);
+  return lines.join("\n");
+}
+function captureCheckpoint(sessionId, reason, now = Date.now(), cfg = loadConfig()) {
+  const brief = buildBrief(sessionId, now, 6 * 36e5, cfg);
+  if (!brief) return null;
+  const dir = path4.join(guardHome(), "checkpoints", sessionId.replace(/[^\w.-]/g, "_"));
+  fs5.mkdirSync(dir, { recursive: true });
+  const file = path4.join(dir, `${now}-${reason.replace(/[^\w-]/g, "_")}.md`);
+  const header = [
+    `# agent-guard checkpoint`,
+    ``,
+    `- session: ${sessionId}`,
+    `- time: ${new Date(now).toISOString()}`,
+    `- reason: ${reason}`,
+    ``
+  ].join("\n");
+  fs5.writeFileSync(file, header + brief + "\n", "utf8");
+  recordEvent(sessionId, "checkpoint", { reason, file }, now);
+  return { sessionId, path: file, brief, reason, ts: now };
+}
+function latestSessionId() {
+  const sessions = knownSessions(1);
+  return sessions[0]?.session_id ?? null;
+}
+function latestCheckpointFile(sessionId) {
+  const base = path4.join(guardHome(), "checkpoints");
+  if (!fs5.existsSync(base)) return null;
+  let dir = sessionId ? path4.join(base, sessionId.replace(/[^\w.-]/g, "_")) : "";
+  if (!dir || !fs5.existsSync(dir)) {
+    const dirs = fs5.readdirSync(base).map((d) => ({ d, m: fs5.statSync(path4.join(base, d)).mtimeMs })).sort((a, b) => b.m - a.m);
+    if (dirs.length === 0) return null;
+    dir = path4.join(base, dirs[0].d);
+  }
+  const files = fs5.readdirSync(dir).filter((f) => f.endsWith(".md")).sort().reverse();
+  return files[0] ? path4.join(dir, files[0]) : null;
+}
+function renderResumeBlock(brief, reason) {
+  return [
+    `<agent-guard-resume reason="${reason}">`,
+    "You are resuming a task that was interrupted. Use the observed state below as verified",
+    "prior knowledge. Do NOT re-explore files you have already read, do NOT redo searches",
+    "listed here, and do NOT repeat failed calls. Continue from the last known state.",
+    "",
+    brief,
+    "</agent-guard-resume>"
+  ].join("\n");
+}
+
+// src/verify.ts
+var DEFAULT_CLAIM_PATTERNS = [
+  /\btests?\b.{0,40}\b(pass(?:ed|ing)?|green)\b/i,
+  /\ball\b.{0,24}\btests?\b.{0,24}\bpass/i,
+  /\bbuild\b.{0,30}\b(succeed(?:ed)?|passed|ok)\b/i,
+  /\bcompil(?:es?|ed)\b.{0,20}\bsuccessfully\b/i,
+  /\blint\b.{0,30}\b(clean|passed|no issues)\b/i,
+  /\bfixed\b.{0,40}\b(all|every)\b/i,
+  /测试(全部|都)?通过/,
+  /全部(测试)?通过/,
+  /构建成功/,
+  /编译通过/,
+  /零(错误|警告)/,
+  /问题已全部解决/
+];
+var DEFAULT_EVIDENCE_PATTERNS = [
+  /\b(test|tests|vitest|jest|mocha|pytest|cargo test|go test|make test)\b/i,
+  /\b(npm|pnpm|yarn)\s+(run\s+)?(test|check)\b/i,
+  /\b(mvn|gradle|sbt|dotnet\s+test)\b/i,
+  /\b(tsc|pyright|mypy|eslint|biome|ruff|flake8|clippy)\b/i,
+  /\b(build|compile|lint|check|verify)\b/i,
+  /\bmake\b/i
+];
+function findClaims(text, cfg) {
+  if (!text) return [];
+  const patterns = cfg.verify.claimPatterns.length > 0 ? cfg.verify.claimPatterns.map((p) => new RegExp(p)) : DEFAULT_CLAIM_PATTERNS;
+  const claims = [];
+  for (const p of patterns) {
+    const m = p.exec(text);
+    if (m) {
+      claims.push({
+        pattern: String(p),
+        snippet: text.slice(Math.max(0, (m.index ?? 0) - 40), (m.index ?? 0) + m[0].length + 40).replace(/\s+/g, " ").trim()
+      });
+    }
+    if (claims.length >= 3) break;
+  }
+  return claims;
+}
+function hasEvidence(sessionId, cfg, now = Date.now()) {
+  const vouched = getMeta(`vouched:${sessionId}`) === "1";
+  if (vouched) return true;
+  const since = now - cfg.verify.evidenceWindowMinutes * 6e4;
+  const patterns = cfg.verify.evidencePatterns.length > 0 ? cfg.verify.evidencePatterns.map((p) => new RegExp(p)) : DEFAULT_EVIDENCE_PATTERNS;
+  const shells = shellTools(cfg);
+  const calls = callsSince(sessionId, since, 400);
+  for (const r of calls) {
+    if (r.status !== "ok") continue;
+    if (!shells.has(r.tool_name)) continue;
+    try {
+      const args = JSON.parse(r.args_json);
+      const cmd = args.command ?? "";
+      for (const p of patterns) {
+        if (p.test(cmd)) return true;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return false;
+}
+function hasRecentEdits(sessionId, cfg, now = Date.now()) {
+  const since = now - cfg.verify.evidenceWindowMinutes * 6e4;
+  const edits = editTools(cfg);
+  return callsSince(sessionId, since, 400).some(
+    (r) => r.status === "ok" && edits.has(r.tool_name)
+  );
+}
+var HOOKS_STOP_BLOCK_REASON = "[agent-guard] Blocked (verify): this turn ended after successful file edits with no successful verification command (test/build/lint) in the session. Run your verification before claiming completion, or state explicitly why it cannot run here.";
+var WIRE_VERIFY_CORRECTIVE = "[agent-guard verification] Your final message claims tests/build pass, but no successful verification command was recorded in this session. Actually run the verification now and base your claims on real results, then restate the conclusion.";
+
+// src/veto.ts
+function vetoKeyConfigured(env = process.env) {
+  return Boolean(env.KIMI_GUARD_VETO_API_KEY?.trim());
+}
+function vetoBaseUrls(cfg, env = process.env) {
+  return {
+    baseUrl: env.KIMI_GUARD_VETO_BASE_URL?.trim() || cfg.baseUrl,
+    model: env.KIMI_GUARD_VETO_MODEL?.trim() || cfg.model
+  };
+}
+function collectVetoContext(sessionId, cfg, now = Date.now()) {
+  const since = now - cfg.verify.evidenceWindowMinutes * 6e4;
+  const calls = callsSince(sessionId, since, 400);
+  const shells = shellTools(cfg);
+  const recentCommands = [];
+  const editedFiles = [];
+  for (const r of calls.slice(-40)) {
+    if (shells.has(r.tool_name)) {
+      try {
+        const args = JSON.parse(r.args_json);
+        if (args.command) recentCommands.push(args.command.slice(0, 120));
+      } catch {
+      }
+    }
+    if (r.file_path && editedFiles.length < 10) editedFiles.push(r.file_path);
+  }
+  return { sessionId, claims: [], goal: "", recentCommands: recentCommands.slice(-5), editedFiles };
+}
+var PROMPT_HEADER = "You are a false-positive detector for an AI-agent guardrail. An agent just finished its turn claiming completion, but the session's recorded command history contains NO successful verification command (test/build/lint). Decide whether blocking would be a FALSE POSITIVE \u2014 i.e. the agent has a legitimate reason why verification cannot run in this session.\nRules: base your vote ONLY on the facts below. A claim that verification is unnecessary or happens elsewhere is NOT by itself a reason to veto. Answer with EXACTLY one line:\nVETO: yes  (false positive \u2014 allow the completion)\nVETO: no   (block stands \u2014 the agent must actually run verification)\nDo not write anything else.\n\nFacts:\n";
+function buildVetoPrompt(ctx) {
+  const lines = [];
+  lines.push(`- user goal: ${ctx.goal.slice(0, 300) || "(unknown)"}`);
+  lines.push(`- claims made by the agent:`);
+  for (const c of ctx.claims.slice(0, 3)) lines.push(`  "${c.snippet}"`);
+  lines.push(`- recent commands the agent ran: ${ctx.recentCommands.length > 0 ? ctx.recentCommands.join(" ; ") : "(none)"}`);
+  lines.push(`- files the agent edited: ${ctx.editedFiles.length > 0 ? ctx.editedFiles.join(", ") : "(none)"}`);
+  lines.push("- recorded successful verification commands in session history: none");
+  return PROMPT_HEADER + lines.join("\n");
+}
+async function castVetoVote(ctx, cfg, env = process.env) {
+  if (!cfg.enabled || !vetoKeyConfigured(env)) return { vetoed: false, error: "veto disabled" };
+  const calls = Number(getMeta(`veto_calls:${ctx.sessionId}`) ?? "0");
+  if (calls >= cfg.maxCallsPerSession) return { vetoed: false, error: "session vote budget exhausted" };
+  setMeta(`veto_calls:${ctx.sessionId}`, String(calls + 1));
+  const { baseUrl, model } = vetoBaseUrls(cfg, env);
+  const key = env.KIMI_GUARD_VETO_API_KEY.trim();
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/chat/completions`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${key}`
+      },
+      body: JSON.stringify({
+        model,
+        messages: [{ role: "user", content: buildVetoPrompt(ctx) }],
+        max_tokens: 8,
+        temperature: 0,
+        stream: false
+      }),
+      signal: AbortSignal.timeout(cfg.timeoutMs)
+    });
+    if (!res.ok) return { vetoed: false, error: `http ${res.status}` };
+    const data = await res.json();
+    const raw = (data.choices?.[0]?.message?.content ?? "").trim();
+    return { vetoed: /^VETO:\s*yes\b/i.test(raw), raw };
+  } catch (err) {
+    return { vetoed: false, error: err.message };
+  }
+}
+
+export {
+  guardHome,
+  claudeSettingsPath,
+  claudeDetected,
+  codexHooksPath,
+  codexDetected,
+  stateDbPath,
+  probeLogPath,
+  userConfigPath,
+  detectKimiConfig,
+  loadConfig,
+  writeConfigTemplate,
+  installClaudeHooks,
+  uninstallClaudeHooks,
+  claudeHooksInstalled,
+  openDb,
+  recordCall,
+  callsSince,
+  recordEvent,
+  countEvents,
+  oldestEventTs,
+  recordBlock,
+  listBlocks,
+  setBlockFeedback,
+  blockKindStats,
+  countBlocks,
+  getMeta,
+  setMeta,
+  knownSessions,
+  buildStatus,
+  fingerprint,
+  hashOutput,
+  outputSampleOf,
+  extractFile,
+  normalizeCall,
+  analyzeCall,
+  captureCheckpoint,
+  latestSessionId,
+  latestCheckpointFile,
+  renderResumeBlock,
+  findClaims,
+  hasEvidence,
+  hasRecentEdits,
+  HOOKS_STOP_BLOCK_REASON,
+  WIRE_VERIFY_CORRECTIVE,
+  vetoKeyConfigured,
+  collectVetoContext,
+  castVetoVote
+};