@shield-agent/kya 0.21.0 → 0.23.0

package/dist/commands/connect.js

@@ -1,12 +1,12 @@
 /**
- * kya connect <host> — wire Shield KYA MCP into a coding host's config file.
+ * kya connect <host> - wire Shield KYA MCP into a coding host's config file.
  * Idempotent create/merge/skip. Global (home) scope by default; --project for
  * hosts with project-level config. Hosts without a verified MCP config stay
  * copy-paste recipes (recipeOnly).
  *
  * Home-config writes are merge-only and symlink-safe: an existing target is
  * resolved with realpath and must be a regular file (dotfile setups symlink
- * ~/.claude.json & co. — writing the resolved regular file is supported).
+ * ~/.claude.json & co. - writing the resolved regular file is supported).
  */
 import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, realpathSync, statSync, } from "node:fs";
 import { homedir } from "node:os";
@@ -184,17 +184,17 @@ export function writeTarget(path) {
         real = realpathSync(path);
     }
     catch {
-        throw new UsageError(`${path} cannot be resolved — refusing to write`);
+        throw new UsageError(`${path} cannot be resolved - refusing to write`);
     }
     if (!statSync(real).isFile()) {
-        throw new UsageError(`${path} does not resolve to a regular file — refusing to write`);
+        throw new UsageError(`${path} does not resolve to a regular file - refusing to write`);
     }
     return real;
 }
 /**
  * Where a create should land. A dangling symlink (dotfiles target not yet
- * materialized) resolves to its link target — relative links resolve against
- * the link's directory — so the rename completes the link instead of
+ * materialized) resolves to its link target - relative links resolve against
+ * the link's directory - so the rename completes the link instead of
  * replacing it with a regular file.
  */
 export function createTarget(path) {
@@ -206,7 +206,7 @@ export function createTarget(path) {
         }
     }
     catch {
-        /* not a symlink or unreadable link — plain create below */
+        /* not a symlink or unreadable link - plain create below */
     }
     mkdirSync(dirname(path), { recursive: true });
     return path;
@@ -223,15 +223,15 @@ export function mergeJsonHostConfig(path, rootKey, block, force, serverKey = "sh
         raw = JSON.parse(readFileSync(target, "utf8"));
     }
     catch {
-        // Never rewrite a host's real config we cannot parse — that destroys settings.
-        throw new UsageError(`${path} is not valid JSON — fix it by hand or back it up and delete it, then re-run connect`);
+        // Never rewrite a host's real config we cannot parse - that destroys settings.
+        throw new UsageError(`${path} is not valid JSON - fix it by hand or back it up and delete it, then re-run connect`);
     }
     const existing = raw[rootKey];
     if (existing !== undefined && (typeof existing !== "object" || existing === null || Array.isArray(existing))) {
-        throw new UsageError(`${path} has "${rootKey}" but it is not an object — refusing to clobber it`);
+        throw new UsageError(`${path} has "${rootKey}" but it is not an object - refusing to clobber it`);
     }
     const servers = (existing ?? {});
-    // Presence of the key — even a null value — counts as wired: never touch it
+    // Presence of the key - even a null value - counts as wired: never touch it
     // without --force.
     if (Object.prototype.hasOwnProperty.call(servers, serverKey) && !force) {
         return "skipped";
@@ -276,7 +276,7 @@ function tomlGateTableBlock(url, dialect) {
  * Minimal TOML wiring for Grok/Codex: append the [mcp_servers.<key>] table at
  * EOF, skip when present, --force replaces the existing table block. An inline
  * `<key> = …` definition under [mcp_servers] cannot be merged safely as
- * text — refuse it with a clear error.
+ * text - refuse it with a clear error.
  */
 function mergeTomlHostConfig(path, hostId, force, dialect, serverKey = "shield-kya", gateUrl) {
     const re = grokRegexes(serverKey);
@@ -294,10 +294,10 @@ function mergeTomlHostConfig(path, hostId, force, dialect, serverKey = "shield-k
         return "skipped";
     if (!header) {
         if (re.quotedTable.test(text)) {
-            throw new UsageError(`${path} has a quoted [mcp_servers."${serverKey}"] table — appending an unquoted one would duplicate it; fix the header by hand, then re-run connect`);
+            throw new UsageError(`${path} has a quoted [mcp_servers."${serverKey}"] table - appending an unquoted one would duplicate it; fix the header by hand, then re-run connect`);
         }
         if (re.inline.test(text)) {
-            throw new UsageError(`${path} defines ${serverKey} inline under [mcp_servers] — remove that line by hand, then re-run connect`);
+            throw new UsageError(`${path} defines ${serverKey} inline under [mcp_servers] - remove that line by hand, then re-run connect`);
         }
         const sep = text.length === 0 || text.endsWith("\n") ? "" : "\n";
         atomicWriteSync(target, `${text}${sep}${block}`);
@@ -330,24 +330,24 @@ export function wireHost(input) {
     const key = input.host.trim().toLowerCase();
     const spec = CONNECT_REGISTRY[key];
     if (!spec) {
-        throw new UsageError(`unknown host "${input.host}" — supported: ${knownHosts().join(", ")}`);
+        throw new UsageError(`unknown host "${input.host}" - supported: ${knownHosts().join(", ")}`);
     }
     if (spec.recipeOnly) {
-        throw new UsageError(`${spec.label} has no safe auto-wire — follow the copy-paste recipe in ${spec.recipeOnly}`);
+        throw new UsageError(`${spec.label} has no safe auto-wire - follow the copy-paste recipe in ${spec.recipeOnly}`);
     }
     const scope = input.scope ?? "global";
     const path = scope === "project"
         ? spec.projectPath?.(input.cwd)
         : spec.globalPath?.(input.home);
     if (!path) {
-        throw new UsageError(`${spec.label} has no ${scope}-scope config — try --${scope === "project" ? "global" : "project"}`);
+        throw new UsageError(`${spec.label} has no ${scope}-scope config - try --${scope === "project" ? "global" : "project"}`);
     }
     const status = mergeHostConfig(path, key, spec, Boolean(input.force), input.gateUrl ? "shield-kya-gate" : "shield-kya", input.gateUrl);
     return { host: key, label: spec.label, path, status, scope };
 }
 /** Per-host next-step line after wiring (accurate about restarts). */
 export function wireNextMessage(hostId, label, procs) {
-    const verify = "Verify: ask the agent to list its MCP tools — kya.policy_evaluate, kya.session_ingest, kya.request_approval should appear.";
+    const verify = "Verify: ask the agent to list its MCP tools - kya.policy_evaluate, kya.session_ingest, kya.request_approval should appear.";
     const reload = hostReload(hostId);
     return reload
         ? `${reloadMessage(reload, label, hostRunning(reload, procs))} ${verify}`
@@ -356,7 +356,7 @@ export function wireNextMessage(hostId, label, procs) {
 export async function runConnect(config, input, env = process.env) {
     const home = env.KYA_HOME?.trim() || homedir();
     if (input.hooks && !hookSupported(input.host)) {
-        throw new UsageError(`no hook wiring for ${input.host} — supported: claude, grok, kimi`);
+        throw new UsageError(`no hook wiring for ${input.host} - supported: claude, grok, kimi`);
     }
     const wired = wireHost({
         host: input.host,
@@ -374,7 +374,7 @@ export async function runConnect(config, input, env = process.env) {
             r = wireHook({ host: wired.host, home, force: input.force });
         }
         catch (err) {
-            // The MCP write already landed — say so, so the user knows the state.
+            // The MCP write already landed - say so, so the user knows the state.
             if (err instanceof UsageError) {
                 throw new UsageError(`${err.message} (note: MCP config was already wired at ${wired.path})`);
             }
@@ -397,14 +397,14 @@ export function formatConnectHuman(r) {
         ? "created"
         : r.status === "wired"
             ? "wired"
-            : "already wired (skipped — use --force to overwrite)";
+            : "already wired (skipped - use --force to overwrite)";
     const hooksVerb = r.hooksStatus === undefined
         ? undefined
         : r.hooksStatus === "created"
             ? "hooks created"
             : r.hooksStatus === "wired"
                 ? "hooks wired"
-                : "hooks already wired (skipped — use --force to overwrite)";
+                : "hooks already wired (skipped - use --force to overwrite)";
     return [
         `KYA connect ${r.host}`,
         `${verb}: ${r.path}`,

package/dist/commands/dash.js

@@ -12,7 +12,7 @@ import { runInvoke } from "./invoke.js";
 import { runKillAgent, runShrinkSession } from "./ops.js";
 import { runOrr } from "./orr.js";
 const AUTO_REFRESH_MS = 5_000;
-/** TUI ORR stays first_party only — Scorecard spawn is CLI-explicit (no env leak / stdin race). */
+/** TUI ORR stays first_party only - Scorecard spawn is CLI-explicit (no env leak / stdin race). */
 function deskOrr(cwd) {
     return runOrr({
         path: cwd,
@@ -200,7 +200,7 @@ export async function runDash(config, parsed, io, env) {
                     pasteBuf = "";
                     if (pending) {
                         pending = undefined;
-                        io.log("paste ignored — confirm cancelled");
+                        io.log("paste ignored - confirm cancelled");
                         void paint({ clear: false });
                     }
                 }
@@ -226,7 +226,7 @@ export async function runDash(config, parsed, io, env) {
                     void (async () => {
                         try {
                             if (!stillLive()) {
-                                io.log("offline mid-flight — aborted");
+                                io.log("offline mid-flight - aborted");
                                 return;
                             }
                             if (job.kind === "kill") {
@@ -242,7 +242,7 @@ export async function runDash(config, parsed, io, env) {
                                 io.log(`clearance ${sh.from} → ${sh.to}`);
                             }
                             else if (job.kind === "decide") {
-                                // Machine sk_* keys must not decide — JWT / kya.approve only.
+                                // Machine sk_* keys must not decide - JWT / kya.approve only.
                                 if (isMachineApiKey(config.apiKey ?? "")) {
                                     io.log(`Machine API keys cannot ${job.decision} from the TUI. Run: kya ${job.decision} --id ${job.id}`);
                                     return;

package/dist/commands/gate-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-serve.d.ts","sourceRoot":"","sources":["../../src/commands/gate-serve.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,eAAe,CAAC,CA8G3B;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7D"}
+{"version":3,"file":"gate-serve.d.ts","sourceRoot":"","sources":["../../src/commands/gate-serve.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,eAAe,CAAC,CA6H3B;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7D"}

package/dist/commands/gate-serve.js

@@ -1,7 +1,7 @@
 /**
  * Hidden supervisor: runs the OTLP receiver and the gateway binary as its
  * child in the foreground, publishing `<global .kya>/gate-server.json` once
- * up. Spawned detached by `kya gate run` — never invoked by users directly.
+ * up. Spawned detached by `kya gate run` - never invoked by users directly.
  * SIGTERM/SIGINT (or a dead binary child) shuts both down.
  */
 import { randomUUID } from "node:crypto";
@@ -32,7 +32,7 @@ export async function startGateSupervisor(input) {
         });
     }
     catch (err) {
-        throw new UsageError(`gate OTLP receiver could not bind 127.0.0.1:${otlpPort} — ${err instanceof Error ? err.message : String(err)}`);
+        throw new UsageError(`gate OTLP receiver could not bind 127.0.0.1:${otlpPort} - ${err instanceof Error ? err.message : String(err)}`);
     }
     const child = spawn(binary, ["-f", gateYamlPath(env)], {
         stdio: ["ignore", "inherit", "inherit"],
@@ -68,7 +68,7 @@ export async function startGateSupervisor(input) {
             });
         }
         catch {
-            /* sync is best-effort — never crash the supervisor */
+            /* sync is best-effort - never crash the supervisor */
         }
     }
     // Initial running sync + 60s heartbeat (only when credentials are configured).
@@ -77,7 +77,11 @@ export async function startGateSupervisor(input) {
         ? setInterval(() => doHostedSync("running", true), 60_000)
         : undefined;
     let shutdownFn = () => { };
-    const waitUntilClosed = new Promise((resolve) => {
+    // A binary that cannot be started (missing, not executable) is reported on the ChildProcess 'error'
+    // event, which would be an uncaught exception with no listener and kill the supervisor before any
+    // cleanup (state file, telemetry `end`). Treat it as a failed start: shut down, then reject.
+    let startError;
+    const waitUntilClosed = new Promise((resolve, reject) => {
         let closing = false;
         const shutdown = () => {
             if (closing)
@@ -102,14 +106,24 @@ export async function startGateSupervisor(input) {
                 .catch(() => undefined)
                 .finally(() => {
                 clearGateState(env, process.pid);
-                resolve();
+                if (startError)
+                    reject(startError);
+                else
+                    resolve();
             });
         };
         shutdownFn = shutdown;
         process.once("SIGINT", shutdown);
         process.once("SIGTERM", shutdown);
         child.once("exit", () => shutdown());
+        child.once("error", (err) => {
+            startError = new UsageError(`gate binary could not be started (${binary}): ${err instanceof Error ? err.message : String(err)}`);
+            shutdown();
+        });
     });
+    // The rejection is for whoever awaits waitUntilClosed; without this a start failure that lands before
+    // the caller attaches its handler would be reported as an unhandled rejection and kill the process.
+    waitUntilClosed.catch(() => undefined);
     return {
         pid: process.pid,
         childPid: child.pid ?? undefined,

package/dist/commands/gate-serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate-serve.js","sourceRoot":"","sources":["../../src/commands/gate-serve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAqB,MAAM,0BAA0B,CAAC;AAahF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,iBAAiB,EAAE,QAAQ,UAAU,EAAE,EAAE;YACzC,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,+CAA+C,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAiB,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE;QACnE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;QACvC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE;KAChB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,cAAc,CACZ;QACE,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG;QACH,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,SAAS;KACV,EACD,GAAG,CACJ,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IAErD,SAAS,YAAY,CAAC,KAAyB,EAAE,KAAe;QAC9D,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAC/B,IAAI,CAAC;YACH,KAAK,mBAAmB,CAAC;gBACvB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG;gBACH,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC;gBACjC,eAAe,EACb,KAAK,KAAK,SAAS;oBACjB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE;oBACrF,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE;gBACrC,OAAO;gBACP,MAAM;gBACN,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,iBAAiB;QACjC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,UAAU,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;IACtC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACpD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,SAAS;gBAAE,aAAa,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,YAAY,CAAC,oBAAoB,CAAC,CAAC;YACnC,KAAK,QAAQ;iBACV,KAAK,EAAE;iBACP,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;iBACtB,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,UAAU,GAAG,QAAQ,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,KAAK,CAAC,GAAG,IAAI,SAAS;QAChC,GAAG;QACH,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,eAAe;QACf,IAAI,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,CAAC,eAAe,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"gate-serve.js","sourceRoot":"","sources":["../../src/commands/gate-serve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAqB,MAAM,0BAA0B,CAAC;AAahF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;IAEvD,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,iBAAiB,EAAE,QAAQ,UAAU,EAAE,EAAE;YACzC,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,+CAA+C,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAiB,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE;QACnE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;QACvC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE;KAChB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,oBAAoB,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,cAAc,CACZ;QACE,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG;QACH,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,SAAS;KACV,EACD,GAAG,CACJ,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IAErD,SAAS,YAAY,CAAC,KAAyB,EAAE,KAAe;QAC9D,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAC/B,IAAI,CAAC;YACH,KAAK,mBAAmB,CAAC;gBACvB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG;gBACH,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC;gBACjC,eAAe,EACb,KAAK,KAAK,SAAS;oBACjB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE;oBACrF,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE;gBACrC,OAAO;gBACP,MAAM;gBACN,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,iBAAiB;QACjC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,UAAU,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;IACtC,oGAAoG;IACpG,kGAAkG;IAClG,6FAA6F;IAC7F,IAAI,UAA6B,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,SAAS;gBAAE,aAAa,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,YAAY,CAAC,oBAAoB,CAAC,CAAC;YACnC,KAAK,QAAQ;iBACV,KAAK,EAAE;iBACP,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;iBACtB,OAAO,CAAC,GAAG,EAAE;gBACZ,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,UAAU;oBAAE,MAAM,CAAC,UAAU,CAAC,CAAC;;oBAC9B,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC;QACF,UAAU,GAAG,QAAQ,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC1B,UAAU,GAAG,IAAI,UAAU,CACzB,qCAAqC,MAAM,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;YACF,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sGAAsG;IACtG,oGAAoG;IACpG,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEvC,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,KAAK,CAAC,GAAG,IAAI,SAAS;QAChC,GAAG;QACH,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,eAAe;QACf,IAAI,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,CAAC,eAAe,CAAC;AAC/B,CAAC"}

package/dist/commands/gate.d.ts

@@ -67,7 +67,7 @@ export interface GateRunResult {
 }
 /**
  * Generate the gateway YAML from gateways.json, then spawn the detached
- * supervisor (OTLP receiver + gateway binary child). Requires the binary —
+ * supervisor (OTLP receiver + gateway binary child). Requires the binary -
  * never downloads; `kya gate setup` is the only downloader. Success is
  * reported only after the listener actually answers.
  */

package/dist/commands/gate.js

@@ -1,5 +1,5 @@
 /**
- * `kya gate` — local MCP gateway: govern + audit tool calls to any MCP server.
+ * `kya gate` - local MCP gateway: govern + audit tool calls to any MCP server.
  *
  *   init    scaffold .kya/gateways.json (recipes for the well-known servers)
  *   setup   install the pinned gateway binary to .kya/bin (only downloader)
@@ -36,7 +36,7 @@ export function runGateInit(env = process.env) {
         created: r.created,
         next: r.created
             ? "move a recipe into \"servers\" and fill its placeholders, then `kya gate setup && kya gate run`"
-            : "gateways.json already exists — edit it, then `kya gate run`",
+            : "gateways.json already exists - edit it, then `kya gate run`",
     };
 }
 export async function runGateSetup(env = process.env) {
@@ -54,7 +54,7 @@ export function bindScopeFromYaml(env) {
         yaml = readFileSync(gateYamlPath(env), "utf8");
     }
     catch {
-        return { loopbackOnly: false, detail: "no generated config yet — `kya gate run` generates one" };
+        return { loopbackOnly: false, detail: "no generated config yet - `kya gate run` generates one" };
     }
     const hasRule = yaml.includes("networkAuthorization:") && yaml.includes("127.0.0.0/8") && yaml.includes("::1");
     const listenersOff = yaml.includes('statsAddr: "off"') && yaml.includes('readinessAddr: "off"');
@@ -63,7 +63,7 @@ export function bindScopeFromYaml(env) {
         loopbackOnly,
         detail: loopbackOnly
             ? "loopback-only (L4 allowlist 127.0.0.0/8 + ::1; stats/readiness/admin listeners off)"
-            : "WARNING: generated config is missing the loopback allowlist or listener offs — re-run `kya gate run`",
+            : "WARNING: generated config is missing the loopback allowlist or listener offs - re-run `kya gate run`",
     };
 }
 async function probeListener(state) {
@@ -102,7 +102,7 @@ export async function runGateDoctor(env = process.env) {
 }
 /**
  * Generate the gateway YAML from gateways.json, then spawn the detached
- * supervisor (OTLP receiver + gateway binary child). Requires the binary —
+ * supervisor (OTLP receiver + gateway binary child). Requires the binary -
  * never downloads; `kya gate setup` is the only downloader. Success is
  * reported only after the listener actually answers.
  */
@@ -110,7 +110,7 @@ export async function runGateRun(config, input = {}) {
     const env = input.env ?? process.env;
     const bin = inspectGateBinary(env);
     if (!bin.present) {
-        throw new KyaError(`gateway binary not installed — run \`kya gate setup\` first (expected at ${gateBinaryPath(env)})`, "GATE_BINARY_MISSING");
+        throw new KyaError(`gateway binary not installed - run \`kya gate setup\` first (expected at ${gateBinaryPath(env)})`, "GATE_BINARY_MISSING");
     }
     const gateways = readGateways(env);
     const yaml = generateGatewayYaml(gateways);
@@ -127,7 +127,7 @@ export async function runGateRun(config, input = {}) {
     };
     const existing = readGateState(env);
     if (existing && pidAlive(existing.pid) && isGateDaemonProcess(existing.pid)) {
-        // Never rewrite gate.yaml under a live process — the gateway watches the
+        // Never rewrite gate.yaml under a live process - the gateway watches the
         // file. Compare and report drift instead.
         let drift = false;
         try {
@@ -153,8 +153,8 @@ export async function runGateRun(config, input = {}) {
             reused: true,
             ...(drift ? { drift } : {}),
             next: drift
-                ? "config changed since gateway started — `kya gate stop && kya gate run` to apply"
-                : "gateway already running — `kya gate stop` first to reload config",
+                ? "config changed since gateway started - `kya gate stop && kya gate run` to apply"
+                : "gateway already running - `kya gate stop` first to reload config",
         };
     }
     clearGateState(env);
@@ -174,7 +174,7 @@ export async function runGateRun(config, input = {}) {
     const fail = async () => {
         await killGateProcessTree(pid, readGateState(env)?.childPid);
         clearGateState(env);
-        throw new KyaError(`gateway failed to start — see ${logPath}`, "GATE_START_FAILED");
+        throw new KyaError(`gateway failed to start - see ${logPath}`, "GATE_START_FAILED");
     };
     let probingSince = -1;
     for (let waited = 0; waited < 10_000; waited += 100) {
@@ -204,7 +204,7 @@ export async function runGateRun(config, input = {}) {
                 configPath: gateYamlPath(env),
                 logPath,
                 reused: false,
-                next: `point your host at ${state.url}/mcp (server key shield-kya-gate) — ` +
+                next: `point your host at ${state.url}/mcp (server key shield-kya-gate) - ` +
                     "`kya connect <host> --gate` wires it; `kya gate stop` stops everything.",
             };
         }
@@ -259,7 +259,7 @@ export async function runGateStop(env = process.env, input = {}) {
         return { stopped: false };
     }
     if (pidAlive(state.pid) && !isGateDaemonProcess(state.pid)) {
-        // Planted or recycled pid — never signal a foreign process.
+        // Planted or recycled pid - never signal a foreign process.
         clearGateState(env);
         triggerHostedSyncFromEnv({ cwd: input.cwd ?? process.cwd(), env, state: "configured-stopped" });
         return { stopped: false, pid: state.pid, stale: true };
@@ -287,12 +287,12 @@ export function formatGateDoctorHuman(r) {
         "KYA gate doctor",
         r.binary.present
             ? `binary: ${r.binary.path}${r.binary.version ? ` (${r.binary.version})` : ""}`
-            : `binary: missing — run \`kya gate setup\``,
+            : `binary: missing - run \`kya gate setup\``,
         `config: ${r.config.path} (${r.config.servers} server${r.config.servers === 1 ? "" : "s"})`,
         `bind scope: ${r.bindScope.detail}`,
         r.listener.running
             ? `listener: ${r.listener.url} (${r.listener.healthy ? "healthy" : "not answering"})`
-            : "listener: not running — `kya gate run`",
+            : "listener: not running - `kya gate run`",
         syncLine,
     ].join("\n");
 }
@@ -300,13 +300,13 @@ function formatLastSync(last) {
     if (!last)
         return "";
     const status = last.ok ? "ok" : "failed";
-    const detail = last.error ? ` — ${last.error}` : "";
+    const detail = last.error ? ` - ${last.error}` : "";
     return ` (last sync: ${status}${detail})`;
 }
 export function gateSubcommand(parsed) {
     const sub = parsed.positionals[0];
     if (sub === "init" || sub === "setup" || sub === "doctor" || sub === "status" || sub === "run" || sub === "stop") {
-        // `status` is an alias for `doctor` — same output, hosted sync line included.
+        // `status` is an alias for `doctor` - same output, hosted sync line included.
         return sub === "status" ? "doctor" : sub;
     }
     throw new UsageError("Usage: kya gate <init|setup|doctor|status|run|stop>");

package/dist/commands/hook.d.ts

@@ -5,7 +5,7 @@ export interface HookInput {
     readonly stdinText: string;
     readonly env: NodeJS.ProcessEnv;
     readonly cwd: string;
-    /** Test seam — defaults to the offline runEvalTool path. */
+    /** Test seam - defaults to the offline runEvalTool path. */
     readonly evaluate?: (toolId: string, args: unknown) => Promise<PolicyEvaluateResponse>;
 }
 export interface HookResult {

package/dist/commands/hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAK3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAuDD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAsDnE"}
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAM3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAwFD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAqEnE"}

package/dist/commands/hook.js

@@ -1,5 +1,5 @@
 /**
- * kya hook — PreToolUse interception for hosts with native hooks
+ * kya hook - PreToolUse interception for hosts with native hooks
  * (Claude Code, Grok, Kimi Code). Offline local evaluate only: no network,
  * sub-second, fail-open on any internal error. DENY (local never-list)
  * blocks; REQUIRE_APPROVE records advisory unless --strict.
@@ -7,7 +7,27 @@
 import { resolveConfig } from "../config.js";
 import { runEvalTool } from "./eval-tool.js";
 import { appendTrail, defaultSessionId, hostToProduct } from "../trail.js";
-import { deriveTargetPath, deriveTrailSummary } from "../trail-summary.js";
+import { deriveWireChangeFields } from "../diff-preview.js";
+import { maybeSpawnNotifyFlush } from "../notify/dispatch.js";
+function tokenCount(v) {
+    return typeof v === "number" && Number.isFinite(v) && v >= 0
+        ? Math.floor(v)
+        : undefined;
+}
+/** Accept input_tokens/output_tokens (Claude/Kimi) and inputTokens/outputTokens. */
+function readUsageShape(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const u = raw;
+    const tokensIn = tokenCount(u.input_tokens ?? u.inputTokens);
+    const tokensOut = tokenCount(u.output_tokens ?? u.outputTokens);
+    if (tokensIn === undefined && tokensOut === undefined)
+        return undefined;
+    return {
+        ...(tokensIn !== undefined ? { tokensIn } : {}),
+        ...(tokensOut !== undefined ? { tokensOut } : {}),
+    };
+}
 /** Accept snake_case (Claude/Kimi) and camelCase (Grok) envelopes. */
 function parsePayload(stdinText) {
     let raw;
@@ -23,6 +43,11 @@ function parsePayload(stdinText) {
     const event = (typeof p.hook_event_name === "string" && p.hook_event_name) ||
         (typeof p.hookEventName === "string" && p.hookEventName) ||
         undefined;
+    const toolResponse = p.tool_response && typeof p.tool_response === "object" && !Array.isArray(p.tool_response)
+        ? p.tool_response
+        : p.toolResponse && typeof p.toolResponse === "object" && !Array.isArray(p.toolResponse)
+            ? p.toolResponse
+            : undefined;
     return {
         event,
         sessionId: (typeof p.session_id === "string" && p.session_id) ||
@@ -33,6 +58,7 @@ function parsePayload(stdinText) {
             (typeof p.toolName === "string" && p.toolName) ||
             undefined,
         toolInput: p.tool_input ?? p.toolInput,
+        usage: readUsageShape(p.usage) ?? readUsageShape(toolResponse?.usage),
     };
 }
 const ALLOW = { exitCode: 0, stdout: "", stderr: "" };
@@ -70,28 +96,39 @@ export async function runHook(input) {
             (async (toolId, args) => (await runEvalTool(config, { toolId, args, offline: true })).response);
         const response = await evaluate(payload.toolName, payload.toolInput ?? {});
         // payload.cwd is host-supplied and only feeds the project-basename stamp;
-        // the trail path itself comes from env/KYA_HOME — no traversal risk.
+        // the trail path itself comes from env/KYA_HOME - no traversal risk.
         const trailCwd = payload.cwd?.trim() || input.cwd;
-        const targetPath = deriveTargetPath(payload.toolInput ?? {});
+        // Wire change fields (summary, diffPreview, targetPath) feed the receipt's
+        // Changes tab; redaction + opt-out live inside deriveWireChangeFields.
+        const changeFields = deriveWireChangeFields(payload.toolName, payload.toolInput ?? {}, input.env);
+        const trailEvent = {
+            ts: new Date().toISOString(),
+            sessionId: payload.sessionId ?? defaultSessionId(input.env),
+            host: config.host,
+            product: hostToProduct(input.host),
+            toolId: response.toolId ?? payload.toolName,
+            verdict: response.verdict,
+            reasonCode: response.reasonCode ?? "",
+            mode: "offline",
+            neverEvent: response.reasonCode === "NEVER_EVENT",
+            argsHash: response.argsHash,
+            ...(changeFields ?? {}),
+            ...(payload.usage?.tokensIn !== undefined
+                ? { tokensIn: payload.usage.tokensIn }
+                : {}),
+            ...(payload.usage?.tokensOut !== undefined
+                ? { tokensOut: payload.usage.tokensOut }
+                : {}),
+        };
         try {
-            appendTrail(trailCwd, {
-                ts: new Date().toISOString(),
-                sessionId: payload.sessionId ?? defaultSessionId(input.env),
-                host: config.host,
-                product: hostToProduct(input.host),
-                toolId: response.toolId ?? payload.toolName,
-                verdict: response.verdict,
-                reasonCode: response.reasonCode ?? "",
-                mode: "offline",
-                neverEvent: response.reasonCode === "NEVER_EVENT",
-                argsHash: response.argsHash,
-                summary: deriveTrailSummary(payload.toolName, payload.toolInput ?? {}),
-                ...(targetPath ? { targetPath } : {}),
-            }, input.env);
+            appendTrail(trailCwd, trailEvent, input.env);
         }
         catch {
             /* observe path never breaks the gate */
         }
+        // Webhooks + OTLP export ride a detached helper; the hook never waits on
+        // the network. No-op unless a sink is configured.
+        maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: trailEvent });
         if (response.verdict === "DENY") {
             return deny(`KYA denied ${payload.toolName}: ${response.reasonCode}`);
         }

package/dist/commands/hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AA0B3E,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GACT,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC;QAC5D,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC;QACxD,SAAS,CAAC;IACZ,OAAO;QACL,KAAK;QACL,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EACN,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC9C,SAAS;QACX,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAElE,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC,IAAI;QACN,MAAM,EAAE,GAAG,MAAM,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,IAAI;YACxB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;YACd,CAAC,KAAK,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE,CACvC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;QAClD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE;gBACpB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC3D,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ;gBAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;gBACrC,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,aAAa;gBACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;gBACtE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,cAAc,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,oBAAoB,OAAO,CAAC,QAAQ,uBAAuB,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,2DAA2D;IAC3E,CAAC;AACH,CAAC"}
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAiC9D,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GACT,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC;QAC5D,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC;QACxD,SAAS,CAAC;IACZ,MAAM,YAAY,GAChB,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACvF,CAAC,CAAE,CAAC,CAAC,aAAyC;QAC9C,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YACtF,CAAC,CAAE,CAAC,CAAC,YAAwC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,KAAK;QACL,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EACN,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC9C,SAAS;QACX,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS;QACtC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAElE,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC,IAAI;QACN,MAAM,EAAE,GAAG,MAAM,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,IAAI;YACxB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;YACd,CAAC,KAAK,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE,CACvC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;QAClD,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,YAAY,GAAG,sBAAsB,CACzC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,IAAI,EAAE,EACvB,KAAK,CAAC,GAAG,CACV,CAAC;QACF,MAAM,UAAU,GAAG;YACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;YAC3D,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ;YAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;YACrC,IAAI,EAAE,SAAkB;YACxB,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,aAAa;YACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,yEAAyE;QACzE,kDAAkD;QAClD,qBAAqB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5E,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,cAAc,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,oBAAoB,OAAO,CAAC,QAAQ,uBAAuB,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,2DAA2D;IAC3E,CAAC;AACH,CAAC"}

package/dist/commands/import-traces.d.ts

@@ -0,0 +1,16 @@
+/**
+ * kya import - convert foreign trace exports (LangSmith, Langfuse, Phoenix,
+ * OTel JSON) into local trail events so the receipt/certify sees them.
+ */
+import type { ParsedArgs } from "../parse-args.js";
+import { type ImportSource } from "../importers/index.js";
+export interface ImportCliOptions {
+    readonly from: ImportSource | undefined;
+    readonly file: string | undefined;
+}
+export declare function importOptionsFromArgs(parsed: ParsedArgs): ImportCliOptions;
+export declare function runImport(opts: ImportCliOptions, io: {
+    log: (s: string) => void;
+    error: (s: string) => void;
+}, cwd: string, env: NodeJS.ProcessEnv): Promise<number>;
+//# sourceMappingURL=import-traces.d.ts.map

package/dist/commands/import-traces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-traces.d.ts","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAI1E;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAC5D,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/commands/import-traces.js

@@ -0,0 +1,18 @@
+import { flagString } from "../parse-args.js";
+import { importTraces, renderImportSummary, } from "../importers/index.js";
+const SOURCES = ["langsmith", "langfuse", "phoenix", "otel"];
+export function importOptionsFromArgs(parsed) {
+    const rawFrom = flagString(parsed.flags, "from")?.toLowerCase();
+    const from = SOURCES.find((s) => s === rawFrom);
+    return { from, file: parsed.positionals[0] };
+}
+export async function runImport(opts, io, cwd, env) {
+    if (!opts.from || !opts.file) {
+        io.error("Usage: kya import --from <langsmith|langfuse|phoenix|otel> <file>");
+        return 2;
+    }
+    const result = await importTraces({ from: opts.from, file: opts.file, cwd, env });
+    io.log(renderImportSummary(result));
+    return result.imported === 0 && result.errors.length > 0 ? 1 : 0;
+}
+//# sourceMappingURL=import-traces.js.map

package/dist/commands/import-traces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-traces.js","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,OAAO,GAA4B,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAOtF,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,EAA4D,EAC5D,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,EAAE,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/commands/init.js

@@ -45,7 +45,7 @@ export function initFromArgs(parsed, cwd = process.cwd()) {
     const force = parsed.flags["force"] === true || parsed.flags["force"] === "true";
     return runInit({ cwd, baseUrl, host, force });
 }
-const ENV_EXAMPLE = `# Shield KYA light install — copy to .env (never commit secrets)
+const ENV_EXAMPLE = `# Shield KYA light install - copy to .env (never commit secrets)
 # Docs: docs/guides/kya-light-install.md
 
 # Control plane origin (hosted or local free console)