@shield-agent/kya 0.22.0 → 0.23.0

package/dist/commands/start.js

@@ -6,9 +6,9 @@
  * `.cursor/mcp.json` in cwd), user-level MCP configs for hosts with evidence
  * of installation (config file present, or the host's config dir exists),
  * and PreToolUse hooks for hook-capable hosts (claude, grok, kimi).
- * All go through merge-only logic — never clobber. The gateway bootstrap
+ * All go through merge-only logic - never clobber. The gateway bootstrap
  * (bootstrapGate) then imports third-party MCP servers found in those host
- * configs into gateways.json and routes them through the local gateway —
+ * configs into gateways.json and routes them through the local gateway -
  * warn-and-continue throughout, skippable via --no-gate / KYA_GATE=off.
  */
 import { existsSync, readFileSync } from "node:fs";
@@ -38,8 +38,8 @@ function errMsg(err) {
 }
 /**
  * Gate bootstrap for `kya start`: scaffold gateways.json, import third-party
- * servers discovered in host configs, then — only when there is something to
- * govern — install the binary, start the supervisor, and route the source
+ * servers discovered in host configs, then - only when there is something to
+ * govern - install the binary, start the supervisor, and route the source
  * hosts through the gateway (direct entries removed, originals backed up
  * under .kya/backups). Every step warns and continues: start never fails
  * because of the gateway, and host configs are only touched once the
@@ -57,7 +57,7 @@ export async function bootstrapGate(config, input) {
         servers = readGateways(env).servers;
     }
     catch (err) {
-        warnings.push(`gateways.json needs a hand fix (${errMsg(err)}) — gateway bootstrap skipped`);
+        warnings.push(`gateways.json needs a hand fix (${errMsg(err)}) - gateway bootstrap skipped`);
         return {
             imported: [],
             serverCount: 0,
@@ -65,7 +65,7 @@ export async function bootstrapGate(config, input) {
             backups: [],
             rewiredHosts: [],
             warnings,
-            summary: "gateway: gateways.json is not usable — fix it by hand, then re-run kya start",
+            summary: "gateway: gateways.json is not usable - fix it by hand, then re-run kya start",
         };
     }
     const importedIds = imported.map((s) => s.id);
@@ -77,7 +77,7 @@ export async function bootstrapGate(config, input) {
             backups: [],
             rewiredHosts: [],
             warnings,
-            summary: "gateway: no third-party MCP servers found — add one to any host config and re-run kya start",
+            summary: "gateway: no third-party MCP servers found - add one to any host config and re-run kya start",
         };
     }
     const ensure = input.deps?.ensureBinary ?? ((e) => ensureGateBinary({ env: e }));
@@ -85,7 +85,7 @@ export async function bootstrapGate(config, input) {
         await ensure(env);
     }
     catch (err) {
-        warnings.push(`gateway binary could not be installed (${errMsg(err)}) — continuing without the gateway; host configs untouched`);
+        warnings.push(`gateway binary could not be installed (${errMsg(err)}) - continuing without the gateway; host configs untouched`);
         return {
             imported: importedIds,
             serverCount: servers.length,
@@ -93,7 +93,7 @@ export async function bootstrapGate(config, input) {
             backups: [],
             rewiredHosts: [],
             warnings,
-            summary: `gateway: ${servers.length} server${servers.length === 1 ? "" : "s"} configured but the binary is unavailable (offline?) — re-run kya start when online`,
+            summary: `gateway: ${servers.length} server${servers.length === 1 ? "" : "s"} configured but the binary is unavailable (offline?) - re-run kya start when online`,
         };
     }
     const runGate = input.deps?.runGate ?? ((c, e) => runGateRun(c, { env: e }));
@@ -102,7 +102,7 @@ export async function bootstrapGate(config, input) {
         run = await runGate(config, env);
     }
     catch (err) {
-        warnings.push(`gateway failed to start (${errMsg(err)}) — continuing without it; host configs untouched`);
+        warnings.push(`gateway failed to start (${errMsg(err)}) - continuing without it; host configs untouched`);
         return {
             imported: importedIds,
             serverCount: servers.length,
@@ -110,7 +110,7 @@ export async function bootstrapGate(config, input) {
             backups: [],
             rewiredHosts: [],
             warnings,
-            summary: "gateway: configured but the listener did not come up — see `kya gate doctor`",
+            summary: "gateway: configured but the listener did not come up - see `kya gate doctor`",
         };
     }
     // Route only entries the gateway actually imported from that host: the gate
@@ -143,13 +143,13 @@ export async function bootstrapGate(config, input) {
             rewiredHosts.push(host);
         }
         catch (err) {
-            warnings.push(`${host}: could not route through the gateway (${errMsg(err)}) — its existing servers are kept`);
+            warnings.push(`${host}: could not route through the gateway (${errMsg(err)}) - its existing servers are kept`);
         }
     }
     const addr = run.url.replace(/^https?:\/\//, "");
     const summary = importedIds.length
         ? `gateway: ${importedIds.length} server${importedIds.length === 1 ? "" : "s"} imported (${importedIds.join(", ")}), gateway running on ${addr}` +
-            (backups.length ? " — originals backed up to .kya/backups/" : "")
+            (backups.length ? " - originals backed up to .kya/backups/" : "")
         : `gateway: running on ${addr} (${servers.length} server${servers.length === 1 ? "" : "s"}: ${servers.map((s) => s.id).join(", ")})`;
     return {
         imported: importedIds,
@@ -174,12 +174,12 @@ function seedTrailIfEmpty(cwd) {
         verdict: "ALLOW",
         reasonCode: "ALLOW",
         mode: "observe",
-        summary: "KYA started — wire MCP in your host, then wrap tools here",
+        summary: "KYA started - wire MCP in your host, then wrap tools here",
     });
 }
 /**
  * Config dirs that count as evidence a host is installed even before its
- * config file exists (home dir itself never counts — ~/.claude.json's parent
+ * config file exists (home dir itself never counts - ~/.claude.json's parent
  * is ~). Any other host qualifies only when its config file already exists.
  */
 const EVIDENCE_DIRS = {
@@ -285,8 +285,8 @@ export async function runStart(config, input = {}) {
                 running: false,
                 backups: [],
                 rewiredHosts: [],
-                warnings: [`gateway bootstrap failed (${errMsg(err)}) — continuing without it`],
-                summary: "gateway: bootstrap failed — kya start continues without the gateway",
+                warnings: [`gateway bootstrap failed (${errMsg(err)}) - continuing without it`],
+                summary: "gateway: bootstrap failed - kya start continues without the gateway",
             };
         }
     }
@@ -327,10 +327,10 @@ export async function runStart(config, input = {}) {
         reportPid,
         reportReused,
         next: `${hostNotes} ` +
-            "The report runs in the background — reopen with `kya receipt --open`, " +
+            "The report runs in the background - reopen with `kya receipt --open`, " +
             "stop with `kya stop`." +
             (hooksWired.length
-                ? " Hooks take effect in new sessions — claude, grok, and kimi all load hooks at session start."
+                ? " Hooks take effect in new sessions - claude, grok, and kimi all load hooks at session start."
                 : ""),
     };
 }
@@ -343,7 +343,7 @@ export function formatStartHuman(r) {
             ? `wired hosts: ${r.wiredHosts.map((h) => `${h.label} (${h.path})`).join(", ")}`
             : undefined,
         r.hooksWired.length
-            ? `hooks: ${r.hooksWired.map((h) => h.label).join(", ")} (PreToolUse interception — applies to new sessions)`
+            ? `hooks: ${r.hooksWired.map((h) => h.label).join(", ")} (PreToolUse interception - applies to new sessions)`
             : undefined,
         r.gate ? r.gate.summary : undefined,
         ...(r.gate?.warnings.map((w) => `gateway warning: ${w}`) ?? []),

package/dist/commands/stop.d.ts

@@ -1,5 +1,5 @@
 /**
- * `kya stop` — stop the background live-receipt server started by `kya start`.
+ * `kya stop` - stop the background live-receipt server started by `kya start`.
  * `--all` additionally sweeps orphaned `receipt-serve` daemons from other
  * cwds or older installs that the cwd state file does not know about.
  */

package/dist/commands/stop.js

@@ -1,5 +1,5 @@
 /**
- * `kya stop` — stop the background live-receipt server started by `kya start`.
+ * `kya stop` - stop the background live-receipt server started by `kya start`.
  * `--all` additionally sweeps orphaned `receipt-serve` daemons from other
  * cwds or older installs that the cwd state file does not know about.
  */
@@ -23,7 +23,7 @@ export async function runStop(cwd, options = {}) {
     let stale = false;
     if (state) {
         if (pidAlive(state.pid) && !isReceiptDaemonProcess(state.pid)) {
-            // Planted or recycled pid — never signal a foreign process.
+            // Planted or recycled pid - never signal a foreign process.
             clearDaemonState(cwd);
             stale = true;
         }
@@ -43,7 +43,7 @@ export async function runStop(cwd, options = {}) {
     if (options.all) {
         const platform = options.platform ?? process.platform;
         if (platform === "win32") {
-            // tasklist exposes no command lines, so orphans cannot be identified —
+            // tasklist exposes no command lines, so orphans cannot be identified -
             // report the limitation instead of claiming none are running.
             sweepUnsupported = true;
             extraStopped = [];
@@ -64,7 +64,7 @@ export async function runStop(cwd, options = {}) {
             extraStopped = extra;
         }
     }
-    // --all also stops the local gateway (kya gate run) — supervisor, binary
+    // --all also stops the local gateway (kya gate run) - supervisor, binary
     // child, plus orphan sweeps of stray gate-serve supervisors and kya-gate
     // binaries.
     let gateStopped = false;
@@ -104,13 +104,13 @@ export async function runStop(cwd, options = {}) {
 export function formatStopHuman(r) {
     const lines = [];
     if (r.stale) {
-        lines.push(`state file was stale (pid ${r.pid} is not the report server) — cleared it`);
+        lines.push(`state file was stale (pid ${r.pid} is not the report server) - cleared it`);
     }
     else {
         lines.push(r.stopped ? `stopped report server (pid ${r.pid})` : "no report server running");
     }
     if (r.sweepUnsupported) {
-        lines.push("sweep of other receipt daemons is not supported on this platform (win32) — any orphans must be stopped manually");
+        lines.push("sweep of other receipt daemons is not supported on this platform (win32) - any orphans must be stopped manually");
     }
     else if (r.extraStopped) {
         lines.push(r.extraStopped.length > 0

package/dist/commands/update.d.ts

@@ -0,0 +1,19 @@
+export type PackageManager = "npm" | "pnpm" | "yarn" | "volta" | "npx" | "unknown";
+export interface UpdateCommandIo {
+    readonly log: (msg: string) => void;
+    readonly error: (msg: string) => void;
+}
+export declare function detectPackageManager(execPath: string): PackageManager;
+export declare function buildInstallCommand(manager: PackageManager): {
+    command: string;
+    args: readonly string[];
+    hint?: string;
+} | null;
+export declare function manualUpdateCommand(): string;
+export interface UpdateCommandDeps {
+    readonly execPath?: string;
+    readonly run?: (command: string, args: readonly string[]) => Promise<number>;
+    readonly io?: UpdateCommandIo;
+}
+export declare function runUpdate(deps?: UpdateCommandDeps): Promise<number>;
+//# sourceMappingURL=update.d.ts.map

package/dist/commands/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;AAEnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAOD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAuBrE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,IAAI,CAmBP;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAUD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B7E"}

package/dist/commands/update.js

@@ -0,0 +1,96 @@
+/**
+ * `kya update` - explicit self-update to the latest npm version.
+ *
+ * Tries to detect the package manager that installed the current binary
+ * (npm/pnpm/yarn/volta) and run the appropriate global install command.
+ * Falls back to printing the manual install command when detection fails.
+ */
+import { realpathSync } from "node:fs";
+import { spawn } from "node:child_process";
+const defaultIo = {
+    log: (m) => console.log(m),
+    error: (m) => console.error(m),
+};
+export function detectPackageManager(execPath) {
+    let path = execPath;
+    try {
+        path = realpathSync(execPath);
+    }
+    catch {
+        /* path may not exist in tests or for deleted binaries; fall back to argv path */
+    }
+    const lower = path.toLowerCase();
+    if (lower.includes(".volta"))
+        return "volta";
+    if (lower.includes("_npx") || lower.includes(".npm/_npx") || lower.includes("npx"))
+        return "npx";
+    // pnpm global dir patterns: pnpm/global, .pnpm-store, or the pnpm-managed module path
+    if (lower.includes("pnpm/global") ||
+        lower.includes(".pnpm-store") ||
+        lower.includes("/pnpm/") ||
+        lower.includes("\\pnpm\\")) {
+        return "pnpm";
+    }
+    if (lower.includes("yarn/global") || lower.includes(".config/yarn"))
+        return "yarn";
+    // npm is the default; node_modules under an npm-managed global tree.
+    if (lower.includes("node_modules"))
+        return "npm";
+    return "unknown";
+}
+export function buildInstallCommand(manager) {
+    switch (manager) {
+        case "volta":
+            return { command: "volta", args: ["install", "@shield-agent/kya@latest"] };
+        case "pnpm":
+            return { command: "pnpm", args: ["add", "-g", "@shield-agent/kya@latest"] };
+        case "yarn":
+            return { command: "yarn", args: ["global", "add", "@shield-agent/kya@latest"] };
+        case "npm":
+            return { command: "npm", args: ["i", "-g", "@shield-agent/kya@latest"] };
+        case "npx":
+            return {
+                command: "npm",
+                args: ["i", "-g", "@shield-agent/kya@latest"],
+                hint: "npx runs a temporary copy. Install globally to keep updates:",
+            };
+        default:
+            return null;
+    }
+}
+export function manualUpdateCommand() {
+    return "npm i -g @shield-agent/kya@latest";
+}
+function defaultRun(command, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], { stdio: "inherit" });
+        child.on("error", reject);
+        child.on("close", (code) => resolve(code ?? 1));
+    });
+}
+export async function runUpdate(deps = {}) {
+    const io = deps.io ?? defaultIo;
+    const execPath = deps.execPath ?? (process.argv[1] ?? "");
+    const manager = detectPackageManager(execPath);
+    const install = buildInstallCommand(manager);
+    if (!install) {
+        io.log(`Could not detect the package manager that installed KYA.`);
+        io.log(`Run this manually: ${manualUpdateCommand()}`);
+        return 0;
+    }
+    if (install.hint) {
+        io.log(install.hint);
+    }
+    const commandStr = `${install.command} ${install.args.join(" ")}`;
+    io.log(`Running: ${commandStr}`);
+    const run = deps.run ?? defaultRun;
+    const code = await run(install.command, install.args);
+    if (code === 0) {
+        io.log("KYA updated. Restart your terminal or run `hash -r` if the old binary is still on PATH.");
+    }
+    else {
+        io.error(`Update command exited with code ${code}. Try running it manually:\n  ${commandStr}`);
+    }
+    return code;
+}
+//# sourceMappingURL=update.js.map

package/dist/commands/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C,MAAM,SAAS,GAAoB;IACjC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/B,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,sFAAsF;IACtF,IACE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7B,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,MAAM,CAAC;IACnF,qEAAqE;IACrE,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAuB;IAKzD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC7E,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC9E,KAAK,MAAM;YACT,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAClF,KAAK,KAAK;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC3E,KAAK,KAAK;YACR,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,CAAC;gBAC7C,IAAI,EAAE,8DAA8D;aACrE,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,mCAAmC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAuB;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B,EAAE;IAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACnE,EAAE,CAAC,GAAG,CAAC,sBAAsB,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,EAAE,CAAC,GAAG,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,EAAE,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;IACpG,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,KAAK,CAAC,mCAAmC,IAAI,iCAAiC,UAAU,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/wire-hooks.d.ts

@@ -18,7 +18,7 @@ export declare function hookCommand(hostId: string): string;
 /**
  * Build the [[hooks]] TOML block for a command string. The command goes into
  * a TOML literal string (single quotes) so the embedded JSON-quoted paths are
- * safe — but a literal string cannot hold a single quote or a newline, so
+ * safe - but a literal string cannot hold a single quote or a newline, so
  * refuse those instead of writing invalid TOML into the user's config.
  */
 export declare function kimiHooksBlockText(command: string): string;

package/dist/commands/wire-hooks.js

@@ -1,5 +1,5 @@
 /**
- * Hook wiring — install `kya hook --host <id>` as a PreToolUse hook in a
+ * Hook wiring - install `kya hook --host <id>` as a PreToolUse hook in a
  * coding host's user config. Same write discipline as connect.ts: merge-only
  * for host-owned files (claude settings.json, kimi config.toml), whole-file
  * ownership for the kya-managed grok hook file, all writes symlink-safe and
@@ -9,7 +9,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { UsageError } from "../errors.js";
 import { atomicWriteSync } from "../fs-atomic.js";
-// imports from connect.ts are call-time only (shared fs/registry helpers) — safe cycle
+// imports from connect.ts are call-time only (shared fs/registry helpers) - safe cycle
 import { cliJsPath, CONNECT_REGISTRY, createTarget, writeTarget, } from "./connect.js";
 export const HOOK_HOSTS = ["claude", "grok", "kimi"];
 /** Whether a host has verified PreToolUse hook wiring. */
@@ -53,20 +53,20 @@ function wireClaudeSettings(path, force) {
         raw = JSON.parse(readFileSync(target, "utf8"));
     }
     catch {
-        // Never rewrite a host's real config we cannot parse — that destroys settings.
-        throw new UsageError(`${path} is not valid JSON — fix it by hand or back it up and delete it, then re-run the hook wiring`);
+        // Never rewrite a host's real config we cannot parse - that destroys settings.
+        throw new UsageError(`${path} is not valid JSON - fix it by hand or back it up and delete it, then re-run the hook wiring`);
     }
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-        throw new UsageError(`${path} is valid JSON but not an object — refusing to clobber it`);
+        throw new UsageError(`${path} is valid JSON but not an object - refusing to clobber it`);
     }
     const hooks = raw["hooks"];
     if (hooks !== undefined && (typeof hooks !== "object" || hooks === null || Array.isArray(hooks))) {
-        throw new UsageError(`${path} has "hooks" but it is not an object — refusing to clobber it`);
+        throw new UsageError(`${path} has "hooks" but it is not an object - refusing to clobber it`);
     }
     const hooksObj = (hooks ?? {});
     const preToolUse = hooksObj["PreToolUse"];
     if (preToolUse !== undefined && !Array.isArray(preToolUse)) {
-        throw new UsageError(`${path} has "hooks.PreToolUse" but it is not an array — refusing to clobber it`);
+        throw new UsageError(`${path} has "hooks.PreToolUse" but it is not an array - refusing to clobber it`);
     }
     const entries = (preToolUse ?? []);
     const isKyaEntry = (e) => e != null &&
@@ -104,7 +104,7 @@ function wireGrokHooks(path) {
 }
 const KIMI_HOOKS_HEADER_RE = /^[^\S\n]*\[\[hooks\]\][^\S\n]*(?:#.*)?$/m;
 // A plain [hooks] table or a top-level `hooks = …` scalar cannot coexist with
-// an appended [[hooks]] array — the result would be invalid TOML.
+// an appended [[hooks]] array - the result would be invalid TOML.
 const KIMI_PLAIN_HOOKS_TABLE_RE = /^[^\S\n]*\[hooks\]/m;
 // Deliberately stricter than its sibling: an indented `hooks = …` at top level
 // is rare, and a false-positive refusal is the safe direction here.
@@ -112,12 +112,12 @@ const KIMI_TOP_LEVEL_HOOKS_RE = /^hooks\s*=/m;
 /**
  * Build the [[hooks]] TOML block for a command string. The command goes into
  * a TOML literal string (single quotes) so the embedded JSON-quoted paths are
- * safe — but a literal string cannot hold a single quote or a newline, so
+ * safe - but a literal string cannot hold a single quote or a newline, so
  * refuse those instead of writing invalid TOML into the user's config.
  */
 export function kimiHooksBlockText(command) {
     if (command.includes("'") || command.includes("\n") || command.includes("\r")) {
-        throw new UsageError(`the kya hook command contains a single quote or newline and cannot be embedded in Kimi's TOML config — move the kya install to a path without quotes and re-run the hook wiring`);
+        throw new UsageError(`the kya hook command contains a single quote or newline and cannot be embedded in Kimi's TOML config - move the kya install to a path without quotes and re-run the hook wiring`);
     }
     return [
         "[[hooks]]",
@@ -132,13 +132,13 @@ function kimiHooksBlock(hostId) {
 }
 function assertKimiAppendable(path, text) {
     if (KIMI_PLAIN_HOOKS_TABLE_RE.test(text) || KIMI_TOP_LEVEL_HOOKS_RE.test(text)) {
-        throw new UsageError(`${path} already has a [hooks] table or a top-level hooks key — appending [[hooks]] would produce invalid TOML; fix the config by hand, then re-run the hook wiring`);
+        throw new UsageError(`${path} already has a [hooks] table or a top-level hooks key - appending [[hooks]] would produce invalid TOML; fix the config by hand, then re-run the hook wiring`);
     }
 }
 /**
  * Minimal TOML wiring for Kimi: append a [[hooks]] array element at EOF, skip
  * when the command identity already appears anywhere in the file (idempotent
- * by substring — quoted variants of our own block still match), --force
+ * by substring - quoted variants of our own block still match), --force
  * replaces the containing block (header line through the next table header or
  * EOF). Writes exactly the fields Kimi's config loader accepts.
  */
@@ -165,7 +165,7 @@ function wireKimiToml(path, force) {
     const headers = [...beforeIdentity.matchAll(new RegExp(KIMI_HOOKS_HEADER_RE.source, "gm"))];
     const start = headers.length === 0 ? -1 : headers[headers.length - 1].index;
     if (start === -1) {
-        // Identity outside any [[hooks]] block — not ours to rewrite.
+        // Identity outside any [[hooks]] block - not ours to rewrite.
         assertKimiAppendable(path, text);
         const sep = text.endsWith("\n") ? "" : "\n";
         atomicWriteSync(target, `${text}${sep}${block}`);
@@ -202,7 +202,7 @@ export function wireHook(input) {
             status = wireKimiToml(path, force);
             break;
         default:
-            throw new UsageError(`unknown hook host "${input.host}" — supported: ${HOOK_HOSTS.join(", ")}`);
+            throw new UsageError(`unknown hook host "${input.host}" - supported: ${HOOK_HOSTS.join(", ")}`);
     }
     return { host: key, label, path, status };
 }

package/dist/commands/wrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../src/commands/wrap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,aAAa,EACb,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAMxB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAKvF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAEvD;AAoCD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAoFrB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU;;;;;;;;;EAMnD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAmB1D"}
+{"version":3,"file":"wrap.d.ts","sourceRoot":"","sources":["../../src/commands/wrap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,aAAa,EACb,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAOxB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAKvF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAEvD;AAwCD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAoFrB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU;;;;;;;;;EAMnD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAmB1D"}

package/dist/commands/wrap.js

@@ -8,6 +8,7 @@ import { appendTrail, defaultSessionId } from "../trail.js";
 import { assertNoSecrets } from "../dash/render.js";
 import { deriveDiffPreview } from "../diff-preview.js";
 import { deriveTargetPath, deriveTrailSummary } from "../trail-summary.js";
+import { maybeSpawnNotifyFlush } from "../notify/dispatch.js";
 /** Shell-safe: DENY → 1, Hold ticket pending → 4, ALLOW or observe → 0. Never means a write ran. */
 export function verdictExitCode(verdict, observed) {
     const v = (verdict ?? "").toUpperCase();
@@ -34,7 +35,7 @@ function recordTrail(config, evalResult, mode, args) {
             diffPreview = "[redacted]";
         }
     }
-    appendTrail(config.cwd, {
+    const trailEvent = {
         ts: new Date().toISOString(),
         sessionId: defaultSessionId(),
         host: config.host,
@@ -47,7 +48,11 @@ function recordTrail(config, evalResult, mode, args) {
         ...(summary ? { summary } : {}),
         ...(diffPreview ? { diffPreview } : {}),
         ...(targetPath ? { targetPath } : {}),
-    });
+    };
+    appendTrail(config.cwd, trailEvent);
+    // Webhooks + OTLP export ride a detached helper; wrap never waits on the
+    // network. No-op unless a sink is configured.
+    maybeSpawnNotifyFlush({ env: process.env, cwd: config.cwd, event: trailEvent });
 }
 export async function runWrap(config, input, client) {
     const evalResult = await runEvalTool(config, input, client);
@@ -58,7 +63,7 @@ export async function runWrap(config, input, client) {
         return {
             eval: evalResult,
             sideEffect: "blocked",
-            next: "denied — do not execute; wrap never retries around the PEP",
+            next: "denied - do not execute; wrap never retries around the PEP",
         };
     }
     if (verdict !== "REQUIRE_APPROVE") {
@@ -67,8 +72,8 @@ export async function runWrap(config, input, client) {
             eval: evalResult,
             sideEffect: "blocked",
             next: verdict === "ALLOW"
-                ? "evaluate ALLOW — wrap still does not execute the side effect"
-                : "unknown verdict — treat as blocked",
+                ? "evaluate ALLOW - wrap still does not execute the side effect"
+                : "unknown verdict - treat as blocked",
         };
     }
     // REQUIRE_APPROVE: default observe (no second human prompt / no ticket)
@@ -78,7 +83,7 @@ export async function runWrap(config, input, client) {
             eval: evalResult,
             sideEffect: "blocked",
             observed: true,
-            next: "observed REQUIRE_APPROVE — recorded on trail, no Hold ticket (host still owns OK?). Use --hold or KYA_HOLD=1 for org Hold path",
+            next: "observed REQUIRE_APPROVE - recorded on trail, no Hold ticket (host still owns OK?). Use --hold or KYA_HOLD=1 for org Hold path",
         };
     }
     if (offline) {
@@ -119,7 +124,7 @@ export async function runWrap(config, input, client) {
         sideEffect: "blocked",
         approval,
         workItemId,
-        next: `pending ${approval.id} — kya approve --id ${approval.id} (human). wrap does not execute`,
+        next: `pending ${approval.id} - kya approve --id ${approval.id} (human). wrap does not execute`,
     };
 }
 export function wrapInputFromArgs(parsed) {

package/dist/commands/wrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"wrap.js","sourceRoot":"","sources":["../../src/commands/wrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EACL,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAY3E,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAE,QAAkB;IAC7E,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAClB,MAAsB,EACtB,UAA0B,EAC1B,IAAoC,EACpC,IAAc;IAEd,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,YAAY,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE;QACtB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,gBAAgB,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO;QACpC,UAAU,EAAE,MAAM;QAClB,IAAI;QACJ,UAAU,EAAE,MAAM,KAAK,aAAa;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAsB,EACtB,KAQC,EACD,MAAsB;IAEtB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAE/E,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,4DAA4D;SACnE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EACF,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,8DAA8D;gBAChE,CAAC,CAAC,oCAAoC;SAC3C,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,IAAI;YACd,IAAI,EACF,gIAAgI;SACnI,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,uDAAuD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,MAAM;QACN,IAAI,aAAa,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;SACR,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;QACxB,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;QAC1C,OAAO;QACP,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU;KAC3C,CAAC,CAAC;IACH,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,SAAS;QACrB,QAAQ;QACR,UAAU;QACV,IAAI,EAAE,WAAW,QAAQ,CAAC,EAAE,uBAAuB,QAAQ,CAAC,EAAE,iCAAiC;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,SAAS;QACZ,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC/B,OAAO;QACL,YAAY,CAAC,CAAC,OAAO,EAAE;QACvB,eAAe,CAAC,CAAC,UAAU,EAAE;QAC7B,eAAe,MAAM,CAAC,UAAU,EAAE;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,SAAS;QAC9D,MAAM,CAAC,QAAQ;YACb,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7D,CAAC,CAAC,SAAS;QACb,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO;YACjB,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,SAAS;QACb,mCAAmC;KACpC;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}
+{"version":3,"file":"wrap.js","sourceRoot":"","sources":["../../src/commands/wrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EACL,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAY9D,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAE,QAAkB;IAC7E,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAClB,MAAsB,EACtB,UAA0B,EAC1B,IAAoC,EACpC,IAAc;IAEd,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,YAAY,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,gBAAgB,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO;QACpC,UAAU,EAAE,MAAM;QAClB,IAAI;QACJ,UAAU,EAAE,MAAM,KAAK,aAAa;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;IACF,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpC,yEAAyE;IACzE,8CAA8C;IAC9C,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAsB,EACtB,KAQC,EACD,MAAsB;IAEtB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAE/E,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,4DAA4D;SACnE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EACF,OAAO,KAAK,OAAO;gBACjB,CAAC,CAAC,8DAA8D;gBAChE,CAAC,CAAC,oCAAoC;SAC3C,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,IAAI;YACd,IAAI,EACF,gIAAgI;SACnI,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,uDAAuD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,MAAM;QACN,IAAI,aAAa,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;SACR,CAAC,CAAC;IACL,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;QACxB,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;QAC1C,OAAO;QACP,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU;KAC3C,CAAC,CAAC;IACH,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,SAAS;QACrB,QAAQ;QACR,UAAU;QACV,IAAI,EAAE,WAAW,QAAQ,CAAC,EAAE,uBAAuB,QAAQ,CAAC,EAAE,iCAAiC;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,SAAS;QACZ,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC/B,OAAO;QACL,YAAY,CAAC,CAAC,OAAO,EAAE;QACvB,eAAe,CAAC,CAAC,UAAU,EAAE;QAC7B,eAAe,MAAM,CAAC,UAAU,EAAE;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,SAAS;QAC9D,MAAM,CAAC,QAAQ;YACb,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7D,CAAC,CAAC,SAAS;QACb,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO;YACjB,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,SAAS;QACb,mCAAmC;KACpC;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/config.d.ts

@@ -20,10 +20,10 @@ export interface ResolvedConfig {
     readonly json: boolean;
     /** When true, empty api key is allowed only for pure local file ops (init). */
     readonly allowMissingApiKey: boolean;
-    /** Offline sample evaluate (demo / CT) — no network, no paid cloud. */
+    /** Offline sample evaluate (demo / CT) - no network, no paid cloud. */
     readonly offline: boolean;
     /**
-     * When false (default), REQUIRE_APPROVE is recorded only — no Hold ticket /
+     * When false (default), REQUIRE_APPROVE is recorded only - no Hold ticket /
      * second human prompt. Armed by --hold / KYA_HOLD=1 / "gateMode":"hold" in
      * .kya/config.json (flags > env > config > observe, see resolveGateMode).
      */
@@ -43,14 +43,14 @@ export interface ResolveOptions {
 export declare function configDir(cwd: string): string;
 /** User-level home for KYA state; KYA_HOME overrides (tests, sandboxes). */
 export declare function kyaHome(env?: NodeJS.ProcessEnv): string;
-/** Global KYA state dir: <KYA_HOME|home>/.kya — home of the global trail. */
+/** Global KYA state dir: <KYA_HOME|home>/.kya - home of the global trail. */
 export declare function globalConfigDir(env?: NodeJS.ProcessEnv): string;
 export declare function configFilePath(cwd: string): string;
 export declare function readFileConfig(cwd: string): KyaFileConfig;
 export declare function writeFileConfig(cwd: string, patch: KyaFileConfig): KyaFileConfig;
 /**
  * Gate mode resolution, shared by the gate itself (wrap / hook / eval via
- * resolveConfig) and by `kya certify` — a certify "pass — gate mode is hold"
+ * resolveConfig) and by `kya certify` - a certify "pass - gate mode is hold"
  * is only an honest claim when both read this one resolver.
  *
  * Precedence: CLI flags (--offline / --hold) > env (KYA_OFFLINE / KYA_HOLD,

package/dist/config.js

@@ -11,7 +11,7 @@ export function configDir(cwd) {
 export function kyaHome(env = process.env) {
     return env.KYA_HOME?.trim() || homedir();
 }
-/** Global KYA state dir: <KYA_HOME|home>/.kya — home of the global trail. */
+/** Global KYA state dir: <KYA_HOME|home>/.kya - home of the global trail. */
 export function globalConfigDir(env = process.env) {
     return join(kyaHome(env), ".kya");
 }
@@ -67,7 +67,7 @@ function fileGateMode(file) {
 }
 /**
  * Gate mode resolution, shared by the gate itself (wrap / hook / eval via
- * resolveConfig) and by `kya certify` — a certify "pass — gate mode is hold"
+ * resolveConfig) and by `kya certify` - a certify "pass - gate mode is hold"
  * is only an honest claim when both read this one resolver.
  *
  * Precedence: CLI flags (--offline / --hold) > env (KYA_OFFLINE / KYA_HOLD,
@@ -106,7 +106,7 @@ export function resolveConfig(options = {}) {
     const tenantHint = env.KYA_TENANT_HINT;
     const json = flags["json"] === true || flags["json"] === "true";
     // Gate mode: flags > env (KYA_OFFLINE/KYA_HOLD) > "gateMode" in
-    // .kya/config.json > observe — the same precedence resolveGateMode
+    // .kya/config.json > observe - the same precedence resolveGateMode
     // reports, so the gate and `kya certify` can never disagree. Flags/env
     // win as a tier: the config key applies only when no flag/env gate
     // switch is set.
@@ -115,12 +115,12 @@ export function resolveConfig(options = {}) {
     const configMode = flagEnvOffline || flagEnvHold ? undefined : fileGateMode(file);
     const offline = options.offline === true || flagEnvOffline || configMode === "offline";
     const holdEnabled = flagEnvHold || configMode === "hold";
-    // Offline sample evaluate never hits the control plane — no API key required.
+    // Offline sample evaluate never hits the control plane - no API key required.
     const requireApiKey = offline
         ? false
         : (options.requireApiKey ?? !options.allowMissingApiKey);
     if (requireApiKey && (!apiKey || apiKey.trim() === "")) {
-        throw new AuthRequiredError("KYA_API_KEY is empty or missing — refuse silent allow-all against control plane (use --offline for local sample evaluate)");
+        throw new AuthRequiredError("KYA_API_KEY is empty or missing - refuse silent allow-all against control plane (use --offline for local sample evaluate)");
     }
     if (!baseUrl && !offline) {
         throw new UsageError("KYA_BASE_URL is required");

package/dist/dash/dash.d.ts

@@ -51,7 +51,7 @@ export interface DashSnapshot {
     }[];
 }
 export declare function renderDash(config: ResolvedConfig, options: DashOptions, env?: NodeJS.ProcessEnv): Promise<DashSnapshot>;
-/** Offline sample used by tests — production PEP is HTTP. */
+/** Offline sample used by tests - production PEP is HTTP. */
 export declare function offlinePolicyPair(): {
     deny: PolicyEvaluateResponse;
     requireApprove: PolicyEvaluateResponse;