@shield-agent/kya 0.21.0 → 0.23.0

package/dist/commands/update.js

@@ -0,0 +1,96 @@
+/**
+ * `kya update` - explicit self-update to the latest npm version.
+ *
+ * Tries to detect the package manager that installed the current binary
+ * (npm/pnpm/yarn/volta) and run the appropriate global install command.
+ * Falls back to printing the manual install command when detection fails.
+ */
+import { realpathSync } from "node:fs";
+import { spawn } from "node:child_process";
+const defaultIo = {
+    log: (m) => console.log(m),
+    error: (m) => console.error(m),
+};
+export function detectPackageManager(execPath) {
+    let path = execPath;
+    try {
+        path = realpathSync(execPath);
+    }
+    catch {
+        /* path may not exist in tests or for deleted binaries; fall back to argv path */
+    }
+    const lower = path.toLowerCase();
+    if (lower.includes(".volta"))
+        return "volta";
+    if (lower.includes("_npx") || lower.includes(".npm/_npx") || lower.includes("npx"))
+        return "npx";
+    // pnpm global dir patterns: pnpm/global, .pnpm-store, or the pnpm-managed module path
+    if (lower.includes("pnpm/global") ||
+        lower.includes(".pnpm-store") ||
+        lower.includes("/pnpm/") ||
+        lower.includes("\\pnpm\\")) {
+        return "pnpm";
+    }
+    if (lower.includes("yarn/global") || lower.includes(".config/yarn"))
+        return "yarn";
+    // npm is the default; node_modules under an npm-managed global tree.
+    if (lower.includes("node_modules"))
+        return "npm";
+    return "unknown";
+}
+export function buildInstallCommand(manager) {
+    switch (manager) {
+        case "volta":
+            return { command: "volta", args: ["install", "@shield-agent/kya@latest"] };
+        case "pnpm":
+            return { command: "pnpm", args: ["add", "-g", "@shield-agent/kya@latest"] };
+        case "yarn":
+            return { command: "yarn", args: ["global", "add", "@shield-agent/kya@latest"] };
+        case "npm":
+            return { command: "npm", args: ["i", "-g", "@shield-agent/kya@latest"] };
+        case "npx":
+            return {
+                command: "npm",
+                args: ["i", "-g", "@shield-agent/kya@latest"],
+                hint: "npx runs a temporary copy. Install globally to keep updates:",
+            };
+        default:
+            return null;
+    }
+}
+export function manualUpdateCommand() {
+    return "npm i -g @shield-agent/kya@latest";
+}
+function defaultRun(command, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], { stdio: "inherit" });
+        child.on("error", reject);
+        child.on("close", (code) => resolve(code ?? 1));
+    });
+}
+export async function runUpdate(deps = {}) {
+    const io = deps.io ?? defaultIo;
+    const execPath = deps.execPath ?? (process.argv[1] ?? "");
+    const manager = detectPackageManager(execPath);
+    const install = buildInstallCommand(manager);
+    if (!install) {
+        io.log(`Could not detect the package manager that installed KYA.`);
+        io.log(`Run this manually: ${manualUpdateCommand()}`);
+        return 0;
+    }
+    if (install.hint) {
+        io.log(install.hint);
+    }
+    const commandStr = `${install.command} ${install.args.join(" ")}`;
+    io.log(`Running: ${commandStr}`);
+    const run = deps.run ?? defaultRun;
+    const code = await run(install.command, install.args);
+    if (code === 0) {
+        io.log("KYA updated. Restart your terminal or run `hash -r` if the old binary is still on PATH.");
+    }
+    else {
+        io.error(`Update command exited with code ${code}. Try running it manually:\n  ${commandStr}`);
+    }
+    return code;
+}
+//# sourceMappingURL=update.js.map

package/dist/commands/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C,MAAM,SAAS,GAAoB;IACjC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/B,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,sFAAsF;IACtF,IACE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7B,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,MAAM,CAAC;IACnF,qEAAqE;IACrE,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAuB;IAKzD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC7E,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC9E,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAClF,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC3E,KAAK,KAAK;YACR,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC;gBAC7C,IAAI,EAAE,8DAA8D;aACrE,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,mCAAmC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAuB;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B,EAAE;IAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACnE,EAAE,CAAC,GAAG,CAAC,sBAAsB,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,EAAE,CAAC,GAAG,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,EAAE,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;IACpG,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,KAAK,CAAC,mCAAmC,IAAI,iCAAiC,UAAU,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/wire-hooks.d.ts

@@ -18,7 +18,7 @@ export declare function hookCommand(hostId: string): string;
 /**
  * Build the [[hooks]] TOML block for a command string. The command goes into
  * a TOML literal string (single quotes) so the embedded JSON-quoted paths are
- * safe — but a literal string cannot hold a single quote or a newline, so
+ * safe - but a literal string cannot hold a single quote or a newline, so
  * refuse those instead of writing invalid TOML into the user's config.
  */
 export declare function kimiHooksBlockText(command: string): string;

package/dist/commands/wire-hooks.js

@@ -1,5 +1,5 @@
 /**
- * Hook wiring — install `kya hook --host <id>` as a PreToolUse hook in a
+ * Hook wiring - install `kya hook --host <id>` as a PreToolUse hook in a
  * coding host's user config. Same write discipline as connect.ts: merge-only
  * for host-owned files (claude settings.json, kimi config.toml), whole-file
  * ownership for the kya-managed grok hook file, all writes symlink-safe and
@@ -9,7 +9,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { UsageError } from "../errors.js";
 import { atomicWriteSync } from "../fs-atomic.js";
-// imports from connect.ts are call-time only (shared fs/registry helpers) — safe cycle
+// imports from connect.ts are call-time only (shared fs/registry helpers) - safe cycle
 import { cliJsPath, CONNECT_REGISTRY, createTarget, writeTarget, } from "./connect.js";
 export const HOOK_HOSTS = ["claude", "grok", "kimi"];
 /** Whether a host has verified PreToolUse hook wiring. */
@@ -53,20 +53,20 @@ function wireClaudeSettings(path, force) {
         raw = JSON.parse(readFileSync(target, "utf8"));
     }
     catch {
-        // Never rewrite a host's real config we cannot parse — that destroys settings.
-        throw new UsageError(`${path} is not valid JSON — fix it by hand or back it up and delete it, then re-run the hook wiring`);
+        // Never rewrite a host's real config we cannot parse - that destroys settings.
+        throw new UsageError(`${path} is not valid JSON - fix it by hand or back it up and delete it, then re-run the hook wiring`);
     }
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-        throw new UsageError(`${path} is valid JSON but not an object — refusing to clobber it`);
+        throw new UsageError(`${path} is valid JSON but not an object - refusing to clobber it`);
     }
     const hooks = raw["hooks"];
     if (hooks !== undefined && (typeof hooks !== "object" || hooks === null || Array.isArray(hooks))) {
-        throw new UsageError(`${path} has "hooks" but it is not an object — refusing to clobber it`);
+        throw new UsageError(`${path} has "hooks" but it is not an object - refusing to clobber it`);
     }
     const hooksObj = (hooks ?? {});
     const preToolUse = hooksObj["PreToolUse"];
     if (preToolUse !== undefined && !Array.isArray(preToolUse)) {
-        throw new UsageError(`${path} has "hooks.PreToolUse" but it is not an array — refusing to clobber it`);
+        throw new UsageError(`${path} has "hooks.PreToolUse" but it is not an array - refusing to clobber it`);
     }
     const entries = (preToolUse ?? []);
     const isKyaEntry = (e) => e != null &&
@@ -104,7 +104,7 @@ function wireGrokHooks(path) {
 }
 const KIMI_HOOKS_HEADER_RE = /^[^\S\n]*\[\[hooks\]\][^\S\n]*(?:#.*)?$/m;
 // A plain [hooks] table or a top-level `hooks = …` scalar cannot coexist with
-// an appended [[hooks]] array — the result would be invalid TOML.
+// an appended [[hooks]] array - the result would be invalid TOML.
 const KIMI_PLAIN_HOOKS_TABLE_RE = /^[^\S\n]*\[hooks\]/m;
 // Deliberately stricter than its sibling: an indented `hooks = …` at top level
 // is rare, and a false-positive refusal is the safe direction here.
@@ -112,12 +112,12 @@ const KIMI_TOP_LEVEL_HOOKS_RE = /^hooks\s*=/m;
 /**
  * Build the [[hooks]] TOML block for a command string. The command goes into
  * a TOML literal string (single quotes) so the embedded JSON-quoted paths are
- * safe — but a literal string cannot hold a single quote or a newline, so
+ * safe - but a literal string cannot hold a single quote or a newline, so
  * refuse those instead of writing invalid TOML into the user's config.
  */
 export function kimiHooksBlockText(command) {
     if (command.includes("'") || command.includes("\n") || command.includes("\r")) {
-        throw new UsageError(`the kya hook command contains a single quote or newline and cannot be embedded in Kimi's TOML config — move the kya install to a path without quotes and re-run the hook wiring`);
+        throw new UsageError(`the kya hook command contains a single quote or newline and cannot be embedded in Kimi's TOML config - move the kya install to a path without quotes and re-run the hook wiring`);
     }
     return [
         "[[hooks]]",
@@ -132,13 +132,13 @@ function kimiHooksBlock(hostId) {
 }
 function assertKimiAppendable(path, text) {
     if (KIMI_PLAIN_HOOKS_TABLE_RE.test(text) || KIMI_TOP_LEVEL_HOOKS_RE.test(text)) {
-        throw new UsageError(`${path} already has a [hooks] table or a top-level hooks key — appending [[hooks]] would produce invalid TOML; fix the config by hand, then re-run the hook wiring`);
+        throw new UsageError(`${path} already has a [hooks] table or a top-level hooks key - appending [[hooks]] would produce invalid TOML; fix the config by hand, then re-run the hook wiring`);
     }
 }
 /**
  * Minimal TOML wiring for Kimi: append a [[hooks]] array element at EOF, skip
  * when the command identity already appears anywhere in the file (idempotent
- * by substring — quoted variants of our own block still match), --force
+ * by substring - quoted variants of our own block still match), --force
  * replaces the containing block (header line through the next table header or
  * EOF). Writes exactly the fields Kimi's config loader accepts.
  */
@@ -165,7 +165,7 @@ function wireKimiToml(path, force) {
     const headers = [...beforeIdentity.matchAll(new RegExp(KIMI_HOOKS_HEADER_RE.source, "gm"))];
     const start = headers.length === 0 ? -1 : headers[headers.length - 1].index;
     if (start === -1) {
-        // Identity outside any [[hooks]] block — not ours to rewrite.
+        // Identity outside any [[hooks]] block - not ours to rewrite.
         assertKimiAppendable(path, text);
         const sep = text.endsWith("\n") ? "" : "\n";
         atomicWriteSync(target, `${text}${sep}${block}`);
@@ -202,7 +202,7 @@ export function wireHook(input) {
             status = wireKimiToml(path, force);
             break;
         default:
-            throw new UsageError(`unknown hook host "${input.host}" — supported: ${HOOK_HOSTS.join(", ")}`);
+            throw new UsageError(`unknown hook host "${input.host}" - supported: ${HOOK_HOSTS.join(", ")}`);
     }
     return { host: key, label, path, status };
 }

package/dist/commands/wrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../src/commands/wrap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,aAAa,EACb,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAMxB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAKvF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAEvD;AAoCD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAoFrB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU;;;;;;;;;EAMnD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAmB1D"}
+{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../src/commands/wrap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,aAAa,EACb,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAOxB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAKvF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAEvD;AAwCD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAoFrB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU;;;;;;;;;EAMnD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAmB1D"}

package/dist/commands/wrap.js

@@ -8,6 +8,7 @@ import { appendTrail, defaultSessionId } from "../trail.js";
 import { assertNoSecrets } from "../dash/render.js";
 import { deriveDiffPreview } from "../diff-preview.js";
 import { deriveTargetPath, deriveTrailSummary } from "../trail-summary.js";
+import { maybeSpawnNotifyFlush } from "../notify/dispatch.js";
 /** Shell-safe: DENY → 1, Hold ticket pending → 4, ALLOW or observe → 0. Never means a write ran. */
 export function verdictExitCode(verdict, observed) {
     const v = (verdict ?? "").toUpperCase();
@@ -34,7 +35,7 @@ function recordTrail(config, evalResult, mode, args) {
             diffPreview = "[redacted]";
         }
     }
-    appendTrail(config.cwd, {
+    const trailEvent = {
         ts: new Date().toISOString(),
         sessionId: defaultSessionId(),
         host: config.host,
@@ -47,7 +48,11 @@ function recordTrail(config, evalResult, mode, args) {
         ...(summary ? { summary } : {}),
         ...(diffPreview ? { diffPreview } : {}),
         ...(targetPath ? { targetPath } : {}),
-    });
+    };
+    appendTrail(config.cwd, trailEvent);
+    // Webhooks + OTLP export ride a detached helper; wrap never waits on the
+    // network. No-op unless a sink is configured.
+    maybeSpawnNotifyFlush({ env: process.env, cwd: config.cwd, event: trailEvent });
 }
 export async function runWrap(config, input, client) {
     const evalResult = await runEvalTool(config, input, client);
@@ -58,7 +63,7 @@ export async function runWrap(config, input, client) {
         return {
             eval: evalResult,
             sideEffect: "blocked",
-            next: "denied — do not execute; wrap never retries around the PEP",
+            next: "denied - do not execute; wrap never retries around the PEP",
         };
     }
     if (verdict !== "REQUIRE_APPROVE") {
@@ -67,8 +72,8 @@ export async function runWrap(config, input, client) {
             eval: evalResult,
             sideEffect: "blocked",
             next: verdict === "ALLOW"
-                ? "evaluate ALLOW — wrap still does not execute the side effect"
-                : "unknown verdict — treat as blocked",
+                ? "evaluate ALLOW - wrap still does not execute the side effect"
+                : "unknown verdict - treat as blocked",
         };
     }
     // REQUIRE_APPROVE: default observe (no second human prompt / no ticket)
@@ -78,7 +83,7 @@ export async function runWrap(config, input, client) {
             eval: evalResult,
             sideEffect: "blocked",
             observed: true,
-            next: "observed REQUIRE_APPROVE — recorded on trail, no Hold ticket (host still owns OK?). Use --hold or KYA_HOLD=1 for org Hold path",
+            next: "observed REQUIRE_APPROVE - recorded on trail, no Hold ticket (host still owns OK?). Use --hold or KYA_HOLD=1 for org Hold path",
         };
     }
     if (offline) {
@@ -119,7 +124,7 @@ export async function runWrap(config, input, client) {
         sideEffect: "blocked",
         approval,
         workItemId,
-        next: `pending ${approval.id} — kya approve --id ${approval.id} (human). wrap does not execute`,
+        next: `pending ${approval.id} - kya approve --id ${approval.id} (human). wrap does not execute`,
     };
 }
 export function wrapInputFromArgs(parsed) {

package/dist/commands/wrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"wrap.js","sourceRoot":"","sources":["../../src/commands/wrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EACL,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAY3E,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAE,QAAkB;IAC7E,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAClB,MAAsB,EACtB,UAA0B,EAC1B,IAAoC,EACpC,IAAc;IAEd,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,YAAY,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE;QACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,gBAAgB,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO;QACpC,UAAU,EAAE,MAAM;QAClB,IAAI;QACJ,UAAU,EAAE,MAAM,KAAK,aAAa;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAsB,EACtB,KAQC,EACD,MAAsB;IAEtB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAE/E,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,4DAA4D;SACnE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EACF,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,8DAA8D;gBAChE,CAAC,CAAC,oCAAoC;SAC3C,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,IAAI;YACd,IAAI,EACF,gIAAgI;SACnI,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,uDAAuD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,MAAM;QACN,IAAI,aAAa,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;SACR,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;QACxB,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;QAC1C,OAAO;QACP,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU;KAC3C,CAAC,CAAC;IACH,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,SAAS;QACrB,QAAQ;QACR,UAAU;QACV,IAAI,EAAE,WAAW,QAAQ,CAAC,EAAE,uBAAuB,QAAQ,CAAC,EAAE,iCAAiC;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,SAAS;QACZ,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC/B,OAAO;QACL,YAAY,CAAC,CAAC,OAAO,EAAE;QACvB,eAAe,CAAC,CAAC,UAAU,EAAE;QAC7B,eAAe,MAAM,CAAC,UAAU,EAAE;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,SAAS;QAC9D,MAAM,CAAC,QAAQ;YACb,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7D,CAAC,CAAC,SAAS;QACb,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO;YACjB,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,SAAS;QACb,mCAAmC;KACpC;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}
+{"version":3,"file":"wrap.js","sourceRoot":"","sources":["../../src/commands/wrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EACL,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAY9D,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAE,QAAkB;IAC7E,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAClB,MAAsB,EACtB,UAA0B,EAC1B,IAAoC,EACpC,IAAc;IAEd,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,YAAY,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,gBAAgB,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO;QACpC,UAAU,EAAE,MAAM;QAClB,IAAI;QACJ,UAAU,EAAE,MAAM,KAAK,aAAa;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;IACF,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpC,yEAAyE;IACzE,8CAA8C;IAC9C,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAsB,EACtB,KAQC,EACD,MAAsB;IAEtB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAE/E,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,4DAA4D;SACnE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EACF,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,8DAA8D;gBAChE,CAAC,CAAC,oCAAoC;SAC3C,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,IAAI;YACd,IAAI,EACF,gIAAgI;SACnI,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,uDAAuD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,MAAM;QACN,IAAI,aAAa,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;SACR,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;QACxB,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;QAC1C,OAAO;QACP,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU;KAC3C,CAAC,CAAC;IACH,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,SAAS;QACrB,QAAQ;QACR,UAAU;QACV,IAAI,EAAE,WAAW,QAAQ,CAAC,EAAE,uBAAuB,QAAQ,CAAC,EAAE,iCAAiC;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,SAAS;QACZ,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC/B,OAAO;QACL,YAAY,CAAC,CAAC,OAAO,EAAE;QACvB,eAAe,CAAC,CAAC,UAAU,EAAE;QAC7B,eAAe,MAAM,CAAC,UAAU,EAAE;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,SAAS;QAC9D,MAAM,CAAC,QAAQ;YACb,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7D,CAAC,CAAC,SAAS;QACb,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO;YACjB,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,SAAS;QACb,mCAAmC;KACpC;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/config.d.ts

@@ -20,10 +20,10 @@ export interface ResolvedConfig {
     readonly json: boolean;
     /** When true, empty api key is allowed only for pure local file ops (init). */
     readonly allowMissingApiKey: boolean;
-    /** Offline sample evaluate (demo / CT) — no network, no paid cloud. */
+    /** Offline sample evaluate (demo / CT) - no network, no paid cloud. */
     readonly offline: boolean;
     /**
-     * When false (default), REQUIRE_APPROVE is recorded only — no Hold ticket /
+     * When false (default), REQUIRE_APPROVE is recorded only - no Hold ticket /
      * second human prompt. Armed by --hold / KYA_HOLD=1 / "gateMode":"hold" in
      * .kya/config.json (flags > env > config > observe, see resolveGateMode).
      */
@@ -43,14 +43,14 @@ export interface ResolveOptions {
 export declare function configDir(cwd: string): string;
 /** User-level home for KYA state; KYA_HOME overrides (tests, sandboxes). */
 export declare function kyaHome(env?: NodeJS.ProcessEnv): string;
-/** Global KYA state dir: <KYA_HOME|home>/.kya — home of the global trail. */
+/** Global KYA state dir: <KYA_HOME|home>/.kya - home of the global trail. */
 export declare function globalConfigDir(env?: NodeJS.ProcessEnv): string;
 export declare function configFilePath(cwd: string): string;
 export declare function readFileConfig(cwd: string): KyaFileConfig;
 export declare function writeFileConfig(cwd: string, patch: KyaFileConfig): KyaFileConfig;
 /**
  * Gate mode resolution, shared by the gate itself (wrap / hook / eval via
- * resolveConfig) and by `kya certify` — a certify "pass — gate mode is hold"
+ * resolveConfig) and by `kya certify` - a certify "pass - gate mode is hold"
  * is only an honest claim when both read this one resolver.
  *
  * Precedence: CLI flags (--offline / --hold) > env (KYA_OFFLINE / KYA_HOLD,

package/dist/config.js

@@ -11,7 +11,7 @@ export function configDir(cwd) {
 export function kyaHome(env = process.env) {
     return env.KYA_HOME?.trim() || homedir();
 }
-/** Global KYA state dir: <KYA_HOME|home>/.kya — home of the global trail. */
+/** Global KYA state dir: <KYA_HOME|home>/.kya - home of the global trail. */
 export function globalConfigDir(env = process.env) {
     return join(kyaHome(env), ".kya");
 }
@@ -67,7 +67,7 @@ function fileGateMode(file) {
 }
 /**
  * Gate mode resolution, shared by the gate itself (wrap / hook / eval via
- * resolveConfig) and by `kya certify` — a certify "pass — gate mode is hold"
+ * resolveConfig) and by `kya certify` - a certify "pass - gate mode is hold"
  * is only an honest claim when both read this one resolver.
  *
  * Precedence: CLI flags (--offline / --hold) > env (KYA_OFFLINE / KYA_HOLD,
@@ -106,7 +106,7 @@ export function resolveConfig(options = {}) {
     const tenantHint = env.KYA_TENANT_HINT;
     const json = flags["json"] === true || flags["json"] === "true";
     // Gate mode: flags > env (KYA_OFFLINE/KYA_HOLD) > "gateMode" in
-    // .kya/config.json > observe — the same precedence resolveGateMode
+    // .kya/config.json > observe - the same precedence resolveGateMode
     // reports, so the gate and `kya certify` can never disagree. Flags/env
     // win as a tier: the config key applies only when no flag/env gate
     // switch is set.
@@ -115,12 +115,12 @@ export function resolveConfig(options = {}) {
     const configMode = flagEnvOffline || flagEnvHold ? undefined : fileGateMode(file);
     const offline = options.offline === true || flagEnvOffline || configMode === "offline";
     const holdEnabled = flagEnvHold || configMode === "hold";
-    // Offline sample evaluate never hits the control plane — no API key required.
+    // Offline sample evaluate never hits the control plane - no API key required.
     const requireApiKey = offline
         ? false
         : (options.requireApiKey ?? !options.allowMissingApiKey);
     if (requireApiKey && (!apiKey || apiKey.trim() === "")) {
-        throw new AuthRequiredError("KYA_API_KEY is empty or missing — refuse silent allow-all against control plane (use --offline for local sample evaluate)");
+        throw new AuthRequiredError("KYA_API_KEY is empty or missing - refuse silent allow-all against control plane (use --offline for local sample evaluate)");
     }
     if (!baseUrl && !offline) {
         throw new UsageError("KYA_BASE_URL is required");

package/dist/dash/dash.d.ts

@@ -51,7 +51,7 @@ export interface DashSnapshot {
     }[];
 }
 export declare function renderDash(config: ResolvedConfig, options: DashOptions, env?: NodeJS.ProcessEnv): Promise<DashSnapshot>;
-/** Offline sample used by tests — production PEP is HTTP. */
+/** Offline sample used by tests - production PEP is HTTP. */
 export declare function offlinePolicyPair(): {
     deny: PolicyEvaluateResponse;
     requireApprove: PolicyEvaluateResponse;

package/dist/dash/dash.js

@@ -191,7 +191,7 @@ async function loadCases(client) {
         if (!Array.isArray(rows)) {
             return [
                 "Cases list is not available on this plane.",
-                "Use the web console /app/kya/cases (observational — not a PEP).",
+                "Use the web console /app/kya/cases (observational - not a PEP).",
             ];
         }
         return casesBody(rows);
@@ -199,7 +199,7 @@ async function loadCases(client) {
     catch {
         return [
             "GET /api/v1/kya/cases is not on this plane yet.",
-            "Use the web console /app/kya/cases. Observational only — does not approve submit.",
+            "Use the web console /app/kya/cases. Observational only - does not approve submit.",
         ];
     }
 }
@@ -220,7 +220,7 @@ async function loadEdge(client) {
         return { error: "edge status unavailable" };
     }
 }
-/** Offline sample used by tests — production PEP is HTTP. */
+/** Offline sample used by tests - production PEP is HTTP. */
 export function offlinePolicyPair() {
     return {
         deny: evaluateOffline({

package/dist/dash/entitlement.d.ts

@@ -25,7 +25,7 @@ export interface ResolveEntitlementInput {
     readonly now?: Date;
     readonly licensePublicKeyPem?: string;
 }
-/** Placeholder verify key — real issuers replace via KYA_LICENSE_PUBKEY. */
+/** Placeholder verify key - real issuers replace via KYA_LICENSE_PUBKEY. */
 export declare const DEFAULT_LICENSE_PUBKEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA//////////////////////////////////////////8=\n-----END PUBLIC KEY-----\n";
 export declare function isEnterprisePane(pane: string): pane is EnterprisePane;
 export declare function paneAllowed(ent: Entitlement, pane: DashPane): boolean;

package/dist/dash/entitlement.js

@@ -16,7 +16,7 @@ export const FREE_PANES = [
     "mcp",
     "sandbox",
 ];
-/** Placeholder verify key — real issuers replace via KYA_LICENSE_PUBKEY. */
+/** Placeholder verify key - real issuers replace via KYA_LICENSE_PUBKEY. */
 export const DEFAULT_LICENSE_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEA//////////////////////////////////////////8=
 -----END PUBLIC KEY-----

package/dist/dash/render.js

@@ -42,7 +42,7 @@ export function enterpriseNavLine(ent, active) {
             .map((p) => (p === active ? `[${p.toUpperCase()}]` : p))
             .join("  ")}`);
     }
-    return clip("ent:  (hidden on FREE — set KYA_DASH_PLAN=enterprise to unlock)");
+    return clip("ent:  (hidden on FREE - set KYA_DASH_PLAN=enterprise to unlock)");
 }
 export function lockedPane(pane) {
     return [
@@ -91,7 +91,7 @@ export function assertNoSecrets(text, extra) {
         /\bsession=[^\s;&"']{8,}/i,
         /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/i,
         /-----END [A-Z0-9 ]*PRIVATE KEY-----/i,
-        // Keyword assignments require a realistically long value — short benign
+        // Keyword assignments require a realistically long value - short benign
         // mentions ("refreshed token: ab12cd34") must not DoS every render.
         /\b(password|passwd|secret|token|api[_-]?key)\s*[:=]\s*(?!\[redacted\])[^\s#"']{16,}/i,
         /\bxox[baprs]-[A-Za-z0-9-]{10,}/i,

package/dist/dash/screens/enterprise.js

@@ -5,12 +5,12 @@ export function dashboardBody(k) {
         "",
         ...table(["kpi", "value"], [
             ["pending approvals", String(k.pendingApprovals)],
-            ["agents registered", Number.isFinite(k.agentCount) ? String(k.agentCount) : "—"],
-            ["observed sessions", String(k.sessionCount ?? "—")],
-            ["high-risk sessions", String(k.highRiskSessions ?? "—")],
-            ["policy denies", String(k.policyDeny ?? "—")],
-            ["approve required", String(k.approveRequired ?? "—")],
-            ["approve granted", String(k.approveGranted ?? "—")],
+            ["agents registered", Number.isFinite(k.agentCount) ? String(k.agentCount) : "-"],
+            ["observed sessions", String(k.sessionCount ?? "-")],
+            ["high-risk sessions", String(k.highRiskSessions ?? "-")],
+            ["policy denies", String(k.policyDeny ?? "-")],
+            ["approve required", String(k.approveRequired ?? "-")],
+            ["approve granted", String(k.approveGranted ?? "-")],
         ]),
         "",
         "Actions that change production still wait for a person.",
@@ -18,7 +18,7 @@ export function dashboardBody(k) {
 }
 export function casesBody(rows) {
     return [
-        "Evidence & cases (optional disputes pack). Observational — does not approve submit.",
+        "Evidence & cases (optional disputes pack). Observational - does not approve submit.",
         "",
         ...table(["id", "status", "amount"], rows.map((c) => [c.id, c.status ?? "", c.amount ?? ""])),
     ];
@@ -32,14 +32,14 @@ export function metricsBody(m) {
 }
 export function edgeBody(flags) {
     return [
-        "Edge / Gatekeeper (read-only). Complement — not a second PEP.",
+        "Edge / Gatekeeper (read-only). Complement - not a second PEP.",
         "",
         ...table(["flag", "value"], Object.entries(flags).map(([k, v]) => [k, String(v)])),
     ];
 }
 export function settingsBody(lines) {
     return [
-        "Settings (licensed). Team / SSO / keys / billing — same surfaces as the web console.",
+        "Settings (licensed). Team / SSO / keys / billing - same surfaces as the web console.",
         "",
         ...(lines.length ? lines : ["Connect a plane to load tenant settings."]),
     ];

package/dist/dash/screens/free.js

@@ -10,7 +10,7 @@ export function homeBody(input) {
         `offline      ${input.offline ? "yes (sample tools, not production PEP)" : "no"}`,
         `api key      ${input.hasApiKey ? "set" : "empty (fail-closed on live panes)"}`,
         `plane        ${input.offline ? "offline" : input.baseUrl}`,
-        `agentId      ${input.agentId ?? "(none — kya register-agent)"}`,
+        `agentId      ${input.agentId ?? "(none - kya register-agent)"}`,
         "",
         "2 policy (e force-eval / w wrap)   3 agents (k kill, confirm y)",
         "4 approvals (i invoke)             5 sessions (b/R shrink, confirm y)",
@@ -34,7 +34,7 @@ export function policyOfflineBody() {
         env: { host: "ide" },
     });
     return [
-        "Policy playground (offline sample — not the production PEP).",
+        "Policy playground (offline sample - not the production PEP).",
         "Sole PEP in production is Shield HTTP evaluate.",
         "",
         ...table(["tool", "verdict", "reason"], [
@@ -84,7 +84,7 @@ export function agentsLiveBody(rows, cursor = 0) {
 export function sandboxBody(input) {
     const lines = [
         "Sandbox (opt-in Firecracker wrap). Not MCP. Never auto-exec.",
-        `KYA_SANDBOX   ${input.backend || "(unset — set mock|firecracker)"}`,
+        `KYA_SANDBOX   ${input.backend || "(unset - set mock|firecracker)"}`,
         "Spawn/exec go through evaluate first. DENY / Hold block side effects.",
         "",
     ];
@@ -137,7 +137,7 @@ export function sessionsLiveBody(rows, cursor = 0) {
 }
 export function orrBody(summary) {
     return [
-        "ORR board (reporting only — not a second PEP).",
+        "ORR board (reporting only - not a second PEP).",
         "Scanners are evidence. Sole PEP remains Shield KYA.",
         "",
         summary
@@ -152,7 +152,7 @@ export function mcpBody(input) {
         "  kya serve-mcp --port 13920",
         "  tools: kya.policy_evaluate | kya.session_ingest | kya.request_approval",
         `host         ${input.host}`,
-        `api key      ${input.hasApiKey ? "set" : "empty — serve-mcp will fail-closed"}`,
+        `api key      ${input.hasApiKey ? "set" : "empty - serve-mcp will fail-closed"}`,
         "Dash will not start the server (it would steal this TTY).",
     ];
 }

package/dist/diff-preview.d.ts

@@ -18,7 +18,7 @@ export interface WireChangeFields {
 }
 /**
  * The three change fields the hosted plane persists on the tool event.
- * Undefined when opted out or when nothing safe/useful was derivable —
+ * Undefined when opted out or when nothing safe/useful was derivable -
  * evaluate still happens, the fields are simply omitted from the body.
  */
 export declare function deriveWireChangeFields(toolId: string, args?: unknown, env?: NodeJS.ProcessEnv): WireChangeFields | undefined;

package/dist/diff-preview.js

@@ -1,6 +1,6 @@
 /**
  * Clipped, redacted change preview for the activity receipt.
- * Never persists full patches — hard caps + redaction only.
+ * Never persists full patches - hard caps + redaction only.
  */
 import { deriveTargetPath, deriveTrailSummary, redactTrailText } from "./trail-summary.js";
 import { assertNoSecrets } from "./dash/render.js";
@@ -203,7 +203,7 @@ export function sendPreviewsEnabled(env = process.env) {
 }
 /**
  * The three change fields the hosted plane persists on the tool event.
- * Undefined when opted out or when nothing safe/useful was derivable —
+ * Undefined when opted out or when nothing safe/useful was derivable -
  * evaluate still happens, the fields are simply omitted from the body.
  */
 export function deriveWireChangeFields(toolId, args, env = process.env) {

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-/** Fail-closed CLI / client errors — never silent allow-all. */
+/** Fail-closed CLI / client errors - never silent allow-all. */
 export declare class KyaError extends Error {
     readonly code: string;
     readonly exitCode: number;

package/dist/errors.js

@@ -1,4 +1,4 @@
-/** Fail-closed CLI / client errors — never silent allow-all. */
+/** Fail-closed CLI / client errors - never silent allow-all. */
 export class KyaError extends Error {
     code;
     exitCode;

package/dist/fs-atomic.d.ts

@@ -2,7 +2,7 @@
  * Crash-safe write: tmp file in the same directory, then rename onto the
  * target (atomic on POSIX and win32 within one volume). A mid-write crash
  * leaves the original config intact; the tmp file is removed best-effort.
- * An existing target's file mode is carried over — a rename would otherwise
+ * An existing target's file mode is carried over - a rename would otherwise
  * turn a 0600 config into the umask default.
  */
 export declare function atomicWriteSync(target: string, content: string): void;

package/dist/fs-atomic.js

@@ -7,7 +7,7 @@ import { chmodSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs"
  * Crash-safe write: tmp file in the same directory, then rename onto the
  * target (atomic on POSIX and win32 within one volume). A mid-write crash
  * leaves the original config intact; the tmp file is removed best-effort.
- * An existing target's file mode is carried over — a rename would otherwise
+ * An existing target's file mode is carried over - a rename would otherwise
  * turn a 0600 config into the umask default.
  */
 export function atomicWriteSync(target, content) {
@@ -18,7 +18,7 @@ export function atomicWriteSync(target, content) {
             mode = statSync(target).mode;
         }
         catch {
-            /* new file — keep default mode */
+            /* new file - keep default mode */
         }
         writeFileSync(tmp, content, "utf8");
         if (mode !== undefined) {