@shield-agent/kya 0.23.1 → 0.24.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (114) hide show
  1. package/.cursor-plugin/plugin.json +2 -2
  2. package/.mcp.json +1 -1
  3. package/README.md +42 -10
  4. package/amp/settings.example.json +1 -1
  5. package/assets/report-activity.png +0 -0
  6. package/assets/report-certify.png +0 -0
  7. package/assets/report-changes.png +0 -0
  8. package/assets/report-gateway-backends.png +0 -0
  9. package/assets/report-gateway-listeners.png +0 -0
  10. package/assets/report-gateway-playground.png +0 -0
  11. package/assets/report-gateway-policies.png +0 -0
  12. package/assets/report-gateway-routes.png +0 -0
  13. package/assets/report-gateway.png +0 -0
  14. package/assets/report-overview.png +0 -0
  15. package/claude/claude_desktop_config.example.json +1 -1
  16. package/cline/cline_mcp_settings.example.json +1 -1
  17. package/copilot/mcp-config.example.json +1 -1
  18. package/dist/certify/context.d.ts +7 -0
  19. package/dist/certify/context.d.ts.map +1 -1
  20. package/dist/certify/context.js +9 -1
  21. package/dist/certify/context.js.map +1 -1
  22. package/dist/certify/evaluate.d.ts.map +1 -1
  23. package/dist/certify/evaluate.js +13 -1
  24. package/dist/certify/evaluate.js.map +1 -1
  25. package/dist/cli.d.ts.map +1 -1
  26. package/dist/cli.js +18 -4
  27. package/dist/cli.js.map +1 -1
  28. package/dist/commands/hook.d.ts +6 -0
  29. package/dist/commands/hook.d.ts.map +1 -1
  30. package/dist/commands/hook.js +203 -46
  31. package/dist/commands/hook.js.map +1 -1
  32. package/dist/commands/import-traces.d.ts +1 -1
  33. package/dist/commands/import-traces.d.ts.map +1 -1
  34. package/dist/commands/import-traces.js +10 -6
  35. package/dist/commands/import-traces.js.map +1 -1
  36. package/dist/commands/investigate.d.ts.map +1 -1
  37. package/dist/commands/investigate.js +4 -0
  38. package/dist/commands/investigate.js.map +1 -1
  39. package/dist/commands/notify-flush.d.ts.map +1 -1
  40. package/dist/commands/notify-flush.js +1 -1
  41. package/dist/commands/notify-flush.js.map +1 -1
  42. package/dist/importers/agt.d.ts +24 -0
  43. package/dist/importers/agt.d.ts.map +1 -0
  44. package/dist/importers/agt.js +242 -0
  45. package/dist/importers/agt.js.map +1 -0
  46. package/dist/importers/formats.d.ts +8 -5
  47. package/dist/importers/formats.d.ts.map +1 -1
  48. package/dist/importers/formats.js +16 -10
  49. package/dist/importers/formats.js.map +1 -1
  50. package/dist/importers/index.d.ts +17 -0
  51. package/dist/importers/index.d.ts.map +1 -1
  52. package/dist/importers/index.js +67 -18
  53. package/dist/importers/index.js.map +1 -1
  54. package/dist/investigate/incidents.d.ts +3 -1
  55. package/dist/investigate/incidents.d.ts.map +1 -1
  56. package/dist/investigate/incidents.js +4 -0
  57. package/dist/investigate/incidents.js.map +1 -1
  58. package/dist/investigate/index.d.ts +2 -0
  59. package/dist/investigate/index.d.ts.map +1 -1
  60. package/dist/investigate/index.js +2 -0
  61. package/dist/investigate/index.js.map +1 -1
  62. package/dist/investigate/last-run.d.ts +33 -0
  63. package/dist/investigate/last-run.d.ts.map +1 -0
  64. package/dist/investigate/last-run.js +157 -0
  65. package/dist/investigate/last-run.js.map +1 -0
  66. package/dist/node-upgrade.js +1 -1
  67. package/dist/node-upgrade.js.map +1 -1
  68. package/dist/notify/index.d.ts +1 -0
  69. package/dist/notify/index.d.ts.map +1 -1
  70. package/dist/notify/index.js +6 -0
  71. package/dist/notify/index.js.map +1 -1
  72. package/dist/notify/log.d.ts +45 -0
  73. package/dist/notify/log.d.ts.map +1 -0
  74. package/dist/notify/log.js +163 -0
  75. package/dist/notify/log.js.map +1 -0
  76. package/dist/notify/sender.d.ts +14 -0
  77. package/dist/notify/sender.d.ts.map +1 -1
  78. package/dist/notify/sender.js +32 -8
  79. package/dist/notify/sender.js.map +1 -1
  80. package/dist/offline-evaluate.d.ts +8 -0
  81. package/dist/offline-evaluate.d.ts.map +1 -1
  82. package/dist/offline-evaluate.js +19 -8
  83. package/dist/offline-evaluate.js.map +1 -1
  84. package/dist/otel/exporter.d.ts +5 -2
  85. package/dist/otel/exporter.d.ts.map +1 -1
  86. package/dist/otel/exporter.js +8 -2
  87. package/dist/otel/exporter.js.map +1 -1
  88. package/dist/otel/stats.d.ts +21 -0
  89. package/dist/otel/stats.d.ts.map +1 -0
  90. package/dist/otel/stats.js +80 -0
  91. package/dist/otel/stats.js.map +1 -0
  92. package/dist/receipt/render-receipt.d.ts +31 -0
  93. package/dist/receipt/render-receipt.d.ts.map +1 -1
  94. package/dist/receipt/render-receipt.js +204 -2
  95. package/dist/receipt/render-receipt.js.map +1 -1
  96. package/dist/trail.d.ts +10 -0
  97. package/dist/trail.d.ts.map +1 -1
  98. package/dist/trail.js +7 -0
  99. package/dist/trail.js.map +1 -1
  100. package/droid/README.md +1 -1
  101. package/droid/mcp.example.json +1 -1
  102. package/gemini/settings.example.json +1 -1
  103. package/grok/README.md +1 -1
  104. package/kilo/kilo.example.json +1 -1
  105. package/kimi/mcp.example.json +1 -1
  106. package/kiro/mcp.example.json +1 -1
  107. package/manifest.json +1 -1
  108. package/mastracode/mcp.example.json +1 -1
  109. package/mcp.json +1 -1
  110. package/openai/codex.config.example.toml +1 -1
  111. package/opencode/opencode.example.json +1 -1
  112. package/package.json +2 -2
  113. package/qwen/settings.example.json +1 -1
  114. package/server.json +2 -2
@@ -1 +1 @@
1
- {"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAM3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAwFD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAqEnE"}
1
+ {"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAO3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,8GAA8G;IAC9G,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAkMD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA2GnE"}
@@ -1,13 +1,18 @@
1
1
  /**
2
2
  * kya hook - PreToolUse interception for hosts with native hooks
3
3
  * (Claude Code, Grok, Kimi Code). Offline local evaluate only: no network,
4
- * sub-second, fail-open on any internal error. DENY (local never-list)
5
- * blocks; REQUIRE_APPROVE records advisory unless --strict.
4
+ * sub-second, fail-open on any internal error unless --fail-closed (hosted).
5
+ * DENY (local never-list) blocks; REQUIRE_APPROVE records advisory unless
6
+ * --strict.
6
7
  */
7
- import { resolveConfig } from "../config.js";
8
+ import { createHash } from "node:crypto";
9
+ import { closeSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
10
+ import { join } from "node:path";
11
+ import { globalConfigDir, resolveConfig } from "../config.js";
8
12
  import { runEvalTool } from "./eval-tool.js";
9
13
  import { appendTrail, defaultSessionId, hostToProduct } from "../trail.js";
10
14
  import { deriveWireChangeFields } from "../diff-preview.js";
15
+ import { matchesNeverList } from "../offline-evaluate.js";
11
16
  import { maybeSpawnNotifyFlush } from "../notify/dispatch.js";
12
17
  function tokenCount(v) {
13
18
  return typeof v === "number" && Number.isFinite(v) && v >= 0
@@ -57,6 +62,9 @@ function parsePayload(stdinText) {
57
62
  toolName: (typeof p.tool_name === "string" && p.tool_name) ||
58
63
  (typeof p.toolName === "string" && p.toolName) ||
59
64
  undefined,
65
+ toolUseId: (typeof p.tool_use_id === "string" && p.tool_use_id) ||
66
+ (typeof p.toolUseId === "string" && p.toolUseId) ||
67
+ undefined,
60
68
  toolInput: p.tool_input ?? p.toolInput,
61
69
  usage: readUsageShape(p.usage) ?? readUsageShape(toolResponse?.usage),
62
70
  };
@@ -75,70 +83,219 @@ function deny(reason) {
75
83
  stderr: `${reason}\n`,
76
84
  };
77
85
  }
86
+ const SEEN_TTL_MS = 24 * 3600_000;
87
+ const PRUNE_EVERY_MS = 3600_000;
88
+ const MARKER_NAME = /^[0-9a-f]{64}$/;
89
+ /**
90
+ * Atomic once-per-call claim for side effects (trail, notify, ping), so a
91
+ * user-level hook and a plugin hook for the same call record once. Verdicts are
92
+ * still computed by every copy. Any filesystem problem, or a marker dir that is
93
+ * not a real directory owned by this user, counts as "first seen" (today's
94
+ * behavior: record). Markers older than 24 h are pruned at most hourly, and
95
+ * only regular files named like a marker are ever unlinked.
96
+ * The key includes session_id when present: ids may repeat across sessions/hosts.
97
+ */
98
+ function claimToolUse(toolUseId, sessionId, env) {
99
+ const dir = join(globalConfigDir(env), "hook-seen");
100
+ try {
101
+ try {
102
+ mkdirSync(dir, { recursive: true, mode: 0o700 });
103
+ }
104
+ catch {
105
+ return true;
106
+ }
107
+ const st = lstatSync(dir);
108
+ if (!st.isDirectory() || (process.getuid && st.uid !== process.getuid()))
109
+ return true;
110
+ // JSON array so ("a:b","c") and ("a","b:c") cannot collide.
111
+ const key = sessionId ? JSON.stringify([sessionId, toolUseId]) : toolUseId;
112
+ try {
113
+ closeSync(openSync(join(dir, createHash("sha256").update(key).digest("hex")), "wx"));
114
+ }
115
+ catch (e) {
116
+ return e.code !== "EEXIST";
117
+ }
118
+ const stamp = join(dir, ".pruned");
119
+ let last = 0;
120
+ let stampOk = true;
121
+ try {
122
+ const ss = lstatSync(stamp);
123
+ stampOk = ss.isFile();
124
+ last = ss.mtimeMs;
125
+ }
126
+ catch { /* first run */ }
127
+ if (stampOk && Date.now() - last > PRUNE_EVERY_MS) {
128
+ writeFileSync(stamp, "");
129
+ utimesSync(stamp, new Date(), new Date());
130
+ for (const f of readdirSync(dir)) {
131
+ if (!MARKER_NAME.test(f))
132
+ continue;
133
+ try {
134
+ const fs = lstatSync(join(dir, f));
135
+ if (fs.isFile() && Date.now() - fs.mtimeMs > SEEN_TTL_MS)
136
+ unlinkSync(join(dir, f));
137
+ }
138
+ catch { /* raced with another pruner */ }
139
+ }
140
+ }
141
+ }
142
+ catch { /* marker trouble never fails the hook; record as before */ }
143
+ return true;
144
+ }
145
+ // ponytail: this timer cannot preempt the synchronous offline evaluate, config
146
+ // read or trail write. The host's own 5 s limit is only enforced as a block when
147
+ // the hosted plugin hook sets "onFailure": "block"; this timer covers async
148
+ // (injected or future HTTP) evaluators only.
149
+ function withTimeout(p, ms) {
150
+ let t;
151
+ return Promise.race([
152
+ p,
153
+ new Promise((_, rej) => { t = setTimeout(() => rej(new Error("KYA evaluate timed out")), ms); }),
154
+ ]).finally(() => clearTimeout(t));
155
+ }
156
+ /**
157
+ * Deny with a best-effort audit row and notify, so a block caused by an internal
158
+ * error is not invisible. Never throws. FAIL_CLOSED rows are deliberately NOT
159
+ * deduped by the tool_use_id claim: the other hook copy may have recorded an
160
+ * ALLOW, and the trail must also show that this copy blocked the call.
161
+ */
162
+ function auditedDeny(reason, reasonCode, input, payload, dedupe = false) {
163
+ try {
164
+ // Only for NEVER_EVENT: every hook copy reaches the same never-list verdict,
165
+ // so the claim only collapses duplicate rows/notifies and never the verdict.
166
+ if (dedupe && payload?.toolUseId && !claimToolUse(payload.toolUseId, payload.sessionId, input.env)) {
167
+ return deny(reason);
168
+ }
169
+ const trailCwd = payload?.cwd?.trim() || input.cwd;
170
+ const ev = {
171
+ ts: new Date().toISOString(),
172
+ sessionId: payload?.sessionId ?? defaultSessionId(input.env),
173
+ host: "ide",
174
+ product: hostToProduct(input.host),
175
+ toolId: payload?.toolName ?? "unknown",
176
+ verdict: "DENY",
177
+ reasonCode,
178
+ mode: "offline",
179
+ neverEvent: reasonCode === "NEVER_EVENT",
180
+ };
181
+ try {
182
+ appendTrail(trailCwd, ev, input.env);
183
+ }
184
+ catch { /* audit is best effort */ }
185
+ maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: ev });
186
+ }
187
+ catch { /* never block the deny itself */ }
188
+ return deny(reason);
189
+ }
190
+ // Non-PreToolUse hook events that legitimately carry no gate decision.
191
+ const OTHER_EVENT = /^(post[_-]?tool[_-]?use.*|stop|subagent[_-]?(start|stop)|permission[_-]?request|elicitation.*|session[_-]?(start|end)|user[_-]?prompt[_-]?submit|notification|pre[_-]?compact)$/i;
78
192
  export async function runHook(input) {
193
+ let payload;
79
194
  try {
80
- const payload = parsePayload(input.stdinText);
81
- if (!payload)
82
- return ALLOW;
83
- if (payload.event && !/^(PreToolUse|pre_tool_use)$/i.test(payload.event))
84
- return ALLOW;
85
- if (!payload.toolName)
195
+ payload = parsePayload(input.stdinText);
196
+ if (!payload) {
197
+ return input.failClosed ? auditedDeny("KYA fail-closed: unreadable hook payload", "FAIL_CLOSED", input) : ALLOW;
198
+ }
199
+ const isPre = !payload.event || /^(PreToolUse|pre[_-]tool[_-]use)$/i.test(payload.event);
200
+ // Fail-closed: an event name we do not recognize is evaluated, not waved through.
201
+ if (!isPre && (!input.failClosed || OTHER_EVENT.test(payload.event ?? "")))
86
202
  return ALLOW;
87
- const config = resolveConfig({
203
+ if (!payload.toolName) {
204
+ return input.failClosed ? auditedDeny("KYA fail-closed: hook payload has no tool_name", "FAIL_CLOSED", input, payload) : ALLOW;
205
+ }
206
+ const toolName = payload.toolName;
207
+ // A bad host in env or .kya/config.json must not swallow a never-list match:
208
+ // retry with the default host forced, so DENY blocks in both modes.
209
+ const resolve = (flags) => resolveConfig({
88
210
  cwd: input.cwd,
89
211
  env: input.env,
90
- flags: {},
212
+ flags,
91
213
  allowMissingApiKey: true,
92
214
  requireApiKey: false,
93
215
  offline: true,
94
216
  });
217
+ let config;
218
+ try {
219
+ config = resolve({});
220
+ }
221
+ catch (e) {
222
+ if (input.failClosed)
223
+ throw e;
224
+ config = resolve({ host: "ide" });
225
+ }
226
+ const cfg = config;
95
227
  const evaluate = input.evaluate ??
96
- (async (toolId, args) => (await runEvalTool(config, { toolId, args, offline: true })).response);
97
- const response = await evaluate(payload.toolName, payload.toolInput ?? {});
98
- // payload.cwd is host-supplied and only feeds the project-basename stamp;
99
- // the trail path itself comes from env/KYA_HOME - no traversal risk.
100
- const trailCwd = payload.cwd?.trim() || input.cwd;
101
- // Wire change fields (summary, diffPreview, targetPath) feed the receipt's
102
- // Changes tab; redaction + opt-out live inside deriveWireChangeFields.
103
- const changeFields = deriveWireChangeFields(payload.toolName, payload.toolInput ?? {}, input.env);
104
- const trailEvent = {
105
- ts: new Date().toISOString(),
106
- sessionId: payload.sessionId ?? defaultSessionId(input.env),
107
- host: config.host,
108
- product: hostToProduct(input.host),
109
- toolId: response.toolId ?? payload.toolName,
110
- verdict: response.verdict,
111
- reasonCode: response.reasonCode ?? "",
112
- mode: "offline",
113
- neverEvent: response.reasonCode === "NEVER_EVENT",
114
- argsHash: response.argsHash,
115
- ...(changeFields ?? {}),
116
- ...(payload.usage?.tokensIn !== undefined
117
- ? { tokensIn: payload.usage.tokensIn }
118
- : {}),
119
- ...(payload.usage?.tokensOut !== undefined
120
- ? { tokensOut: payload.usage.tokensOut }
121
- : {}),
122
- };
228
+ (async (toolId, args) => (await runEvalTool(cfg, { toolId, args, offline: true })).response);
229
+ const evaluating = Promise.resolve().then(() => evaluate(toolName, payload?.toolInput ?? {}));
230
+ const response = input.failClosed
231
+ ? await withTimeout(evaluating, input.evalTimeoutMs ?? 4000)
232
+ : await evaluating;
233
+ // The verdict exists: nothing below may lose a DENY, so side-effect errors
234
+ // are contained here and never reach the outer catch.
235
+ let firstSeen = true;
123
236
  try {
124
- appendTrail(trailCwd, trailEvent, input.env);
237
+ // payload.cwd is host-supplied and only feeds the project-basename stamp;
238
+ // the trail path itself comes from env/KYA_HOME - no traversal risk.
239
+ const trailCwd = payload.cwd?.trim() || input.cwd;
240
+ // Wire change fields (summary, diffPreview, targetPath) feed the receipt's
241
+ // Changes tab; redaction + opt-out live inside deriveWireChangeFields.
242
+ const changeFields = deriveWireChangeFields(toolName, payload.toolInput ?? {}, input.env);
243
+ const trailEvent = {
244
+ ts: new Date().toISOString(),
245
+ sessionId: payload.sessionId ?? defaultSessionId(input.env),
246
+ host: cfg.host,
247
+ product: hostToProduct(input.host),
248
+ toolId: response.toolId ?? toolName,
249
+ verdict: response.verdict,
250
+ reasonCode: response.reasonCode ?? "",
251
+ mode: "offline",
252
+ neverEvent: response.reasonCode === "NEVER_EVENT",
253
+ argsHash: response.argsHash,
254
+ ...(changeFields ?? {}),
255
+ ...(payload.usage?.tokensIn !== undefined ? { tokensIn: payload.usage.tokensIn } : {}),
256
+ ...(payload.usage?.tokensOut !== undefined ? { tokensOut: payload.usage.tokensOut } : {}),
257
+ };
258
+ firstSeen = payload.toolUseId ? claimToolUse(payload.toolUseId, payload.sessionId, input.env) : true;
259
+ if (firstSeen) {
260
+ try {
261
+ appendTrail(trailCwd, trailEvent, input.env);
262
+ }
263
+ catch {
264
+ /* observe path never breaks the gate */
265
+ }
266
+ // Webhooks + OTLP export ride a detached helper; the hook never waits on
267
+ // the network. No-op unless a sink is configured.
268
+ maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: trailEvent });
269
+ }
125
270
  }
126
271
  catch {
127
272
  /* observe path never breaks the gate */
128
273
  }
129
- // Webhooks + OTLP export ride a detached helper; the hook never waits on
130
- // the network. No-op unless a sink is configured.
131
- maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: trailEvent });
132
274
  if (response.verdict === "DENY") {
133
- return deny(`KYA denied ${payload.toolName}: ${response.reasonCode}`);
275
+ return { ...deny(`KYA denied ${toolName}: ${response.reasonCode}`), firstSeen };
134
276
  }
135
277
  if (input.strict && response.verdict === "REQUIRE_APPROVE") {
136
- return deny(`KYA strict mode: ${payload.toolName} requires approval (${response.reasonCode})`);
278
+ return { ...deny(`KYA strict mode: ${toolName} requires approval (${response.reasonCode})`), firstSeen };
137
279
  }
138
- return ALLOW;
280
+ return { ...ALLOW, firstSeen };
139
281
  }
140
282
  catch {
141
- return ALLOW; // fail-open: hook errors must never block the user's agent
283
+ // Default fail-open: hook errors must never block the user's agent, with one
284
+ // exception: the never-list depends on the tool name only, so it still blocks
285
+ // when config parsing, arg hashing or anything else threw (a repo-shipped
286
+ // .kya/config.json or a deeply nested tool_input must not disable it).
287
+ // --fail-closed (hosted): enforcement must not silently lapse.
288
+ try {
289
+ // A never-list tool is logged as such in both modes (hosted counts stay right).
290
+ if (payload?.toolName && matchesNeverList(payload.toolName)) {
291
+ return auditedDeny(`KYA denied ${payload.toolName}: NEVER_EVENT`, "NEVER_EVENT", input, payload, true);
292
+ }
293
+ }
294
+ catch { /* fall through */ }
295
+ if (input.failClosed) {
296
+ return auditedDeny("KYA fail-closed: internal error, tool call denied", "FAIL_CLOSED", input, payload);
297
+ }
298
+ return ALLOW;
142
299
  }
143
300
  }
144
301
  //# sourceMappingURL=hook.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAiC9D,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GACT,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC;QAC5D,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC;QACxD,SAAS,CAAC;IACZ,MAAM,YAAY,GAChB,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACvF,CAAC,CAAE,CAAC,CAAC,aAAyC;QAC9C,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YACtF,CAAC,CAAE,CAAC,CAAC,YAAwC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,KAAK;QACL,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EACN,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC9C,SAAS;QACX,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS;QACtC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAElE,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC,IAAI;QACN,MAAM,EAAE,GAAG,MAAM,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,IAAI;YACxB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;YACd,CAAC,KAAK,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE,CACvC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;QAClD,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,YAAY,GAAG,sBAAsB,CACzC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,IAAI,EAAE,EACvB,KAAK,CAAC,GAAG,CACV,CAAC;QACF,MAAM,UAAU,GAAG;YACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;YAC3D,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ;YAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;YACrC,IAAI,EAAE,SAAkB;YACxB,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,aAAa;YACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,yEAAyE;QACzE,kDAAkD;QAClD,qBAAqB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5E,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,cAAc,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,oBAAoB,OAAO,CAAC,QAAQ,uBAAuB,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,2DAA2D;IAC3E,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAwC9D,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GACT,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC;QAC5D,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC;QACxD,SAAS,CAAC;IACZ,MAAM,YAAY,GAChB,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACvF,CAAC,CAAE,CAAC,CAAC,aAAyC;QAC9C,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YACtF,CAAC,CAAE,CAAC,CAAC,YAAwC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,KAAK;QACL,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EACN,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC9C,SAAS;QACX,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC;YACpD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS;QACtC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAElE,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC,IAAI;QACN,MAAM,EAAE,GAAG,MAAM,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,EAAE,GAAG,QAAQ,CAAC;AAClC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,SAAiB,EAAE,SAA6B,EAAE,GAAsB;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAChF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,4DAA4D;QAC5D,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAQ,CAA2B,CAAC,IAAI,KAAK,QAAQ,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,cAAc,EAAE,CAAC;YAClD,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzB,UAAU,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,SAAS;gBACnC,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;oBACnC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,GAAG,WAAW;wBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrF,CAAC;gBAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,6CAA6C;AAC7C,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,IAAI,CAAiB,CAAC;IACtB,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KACxG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,MAAc,EACd,UAAyC,EACzC,KAAgB,EAChB,OAAqB,EACrB,MAAM,GAAG,KAAK;IAEd,IAAI,CAAC;QACH,6EAA6E;QAC7E,6EAA6E;QAC7E,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;QACnD,MAAM,EAAE,GAAG;YACT,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5D,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,IAAI,SAAS;YACtC,OAAO,EAAE,MAAM;YACf,UAAU;YACV,IAAI,EAAE,SAAkB;YACxB,UAAU,EAAE,UAAU,KAAK,aAAa;SACzC,CAAC;QACF,IAAI,CAAC;YAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;QAClF,qBAAqB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,uEAAuE;AACvE,MAAM,WAAW,GAAG,kLAAkL,CAAC;AAEvM,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB;IAC5C,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,0CAA0C,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClH,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,kFAAkF;QAClF,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,gDAAgD,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjI,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAElC,6EAA6E;QAC7E,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,KAA6B,EAAE,EAAE,CAChD,aAAa,CAAC;YACZ,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK;YACL,kBAAkB,EAAE,IAAI;YACxB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACL,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,KAAK,CAAC,UAAU;gBAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC;QACnB,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;YACd,CAAC,KAAK,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE,CACvC,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU;YAC/B,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;YAC5D,CAAC,CAAC,MAAM,UAAU,CAAC;QAErB,2EAA2E;QAC3E,sDAAsD;QACtD,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;YAClD,2EAA2E;YAC3E,uEAAuE;YACvE,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1F,MAAM,UAAU,GAAG;gBACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC3D,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ;gBACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;gBACrC,IAAI,EAAE,SAAkB;gBACxB,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,aAAa;gBACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;gBACvB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1F,CAAC;YACF,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrG,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;gBACD,yEAAyE;gBACzE,kDAAkD;gBAClD,qBAAqB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,EAAE,GAAG,IAAI,CAAC,oBAAoB,QAAQ,uBAAuB,QAAQ,CAAC,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;QAC3G,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,8EAA8E;QAC9E,0EAA0E;QAC1E,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,CAAC;YACH,gFAAgF;YAChF,IAAI,OAAO,EAAE,QAAQ,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,OAAO,WAAW,CAAC,cAAc,OAAO,CAAC,QAAQ,eAAe,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,WAAW,CAAC,mDAAmD,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
@@ -1,6 +1,6 @@
1
1
  /**
2
2
  * kya import - convert foreign trace exports (LangSmith, Langfuse, Phoenix,
3
- * OTel JSON) into local trail events so the receipt/certify sees them.
3
+ * OTel JSON, the AGT audit log) into local trail events so the receipt/certify sees them.
4
4
  */
5
5
  import type { ParsedArgs } from "../parse-args.js";
6
6
  import { type ImportSource } from "../importers/index.js";
@@ -1 +1 @@
1
- {"version":3,"file":"import-traces.d.ts","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAI1E;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAC5D,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAQjB"}
1
+ {"version":3,"file":"import-traces.d.ts","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAI1E;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAC5D,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAWjB"}
@@ -1,18 +1,22 @@
1
1
  import { flagString } from "../parse-args.js";
2
- import { importTraces, renderImportSummary, } from "../importers/index.js";
3
- const SOURCES = ["langsmith", "langfuse", "phoenix", "otel"];
2
+ import { defaultAgtAuditPath, importTraces, renderImportSummary, } from "../importers/index.js";
3
+ const SOURCES = ["langsmith", "langfuse", "phoenix", "otel", "agt"];
4
4
  export function importOptionsFromArgs(parsed) {
5
5
  const rawFrom = flagString(parsed.flags, "from")?.toLowerCase();
6
6
  const from = SOURCES.find((s) => s === rawFrom);
7
- return { from, file: parsed.positionals[0] };
7
+ return { from, file: flagString(parsed.flags, "file") ?? parsed.positionals[0] };
8
8
  }
9
9
  export async function runImport(opts, io, cwd, env) {
10
- if (!opts.from || !opts.file) {
11
- io.error("Usage: kya import --from <langsmith|langfuse|phoenix|otel> <file>");
10
+ // agt reads AGT's own audit log, so --file is optional there.
11
+ const file = opts.file ?? (opts.from === "agt" ? defaultAgtAuditPath(env) : undefined);
12
+ if (!opts.from || !file) {
13
+ io.error("Usage: kya import --from <langsmith|langfuse|phoenix|otel|agt> <file> | --file <path>");
12
14
  return 2;
13
15
  }
14
- const result = await importTraces({ from: opts.from, file: opts.file, cwd, env });
16
+ const result = await importTraces({ from: opts.from, file, cwd, env });
15
17
  io.log(renderImportSummary(result));
18
+ for (const w of result.warnings ?? [])
19
+ io.error(`warning: ${w}`);
16
20
  return result.imported === 0 && result.errors.length > 0 ? 1 : 0;
17
21
  }
18
22
  //# sourceMappingURL=import-traces.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"import-traces.js","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,OAAO,GAA4B,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAOtF,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,EAA4D,EAC5D,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,EAAE,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC"}
1
+ {"version":3,"file":"import-traces.js","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,OAAO,GAA4B,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAO7F,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,EAA4D,EAC5D,GAAW,EACX,GAAsB;IAEtB,8DAA8D;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,EAAE,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"investigate.d.ts","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,qBAAqB,CAEpF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,qBAAqB,EAC3B,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAmBjB"}
1
+ {"version":3,"file":"investigate.d.ts","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAYnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,qBAAqB,CAEpF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,qBAAqB,EAC3B,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAsBjB"}
@@ -1,12 +1,16 @@
1
1
  import { flagBool } from "../parse-args.js";
2
2
  import { readTrail } from "../trail.js";
3
3
  import { investigateTrail, renderInvestigateReport, } from "../investigate/index.js";
4
+ import { buildInvestigateLastRun, writeInvestigateLastRun, } from "../investigate/last-run.js";
4
5
  export function investigateOptionsFromArgs(parsed) {
5
6
  return { json: flagBool(parsed.flags, "json") };
6
7
  }
7
8
  export async function runInvestigate(opts, io, cwd, env) {
8
9
  const events = readTrail(cwd, env);
9
10
  const result = investigateTrail(events);
11
+ // Persist a compact summary for the report's Investigations section;
12
+ // best-effort, a failed write never changes the command outcome.
13
+ writeInvestigateLastRun(buildInvestigateLastRun(result, events), env);
10
14
  if (opts.json) {
11
15
  io.log(JSON.stringify({
12
16
  findings: result.findings,
@@ -1 +1 @@
1
- {"version":3,"file":"investigate.js","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,UAAU,0BAA0B,CAAC,MAAkB;IAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B,EAC3B,EAAgC,EAChC,GAAW,EACX,GAAsB;IAEtB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,EAAE,CAAC,GAAG,CACJ,IAAI,CAAC,SAAS,CACZ;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;SAC1C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
1
+ {"version":3,"file":"investigate.js","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAMpC,MAAM,UAAU,0BAA0B,CAAC,MAAkB;IAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B,EAC3B,EAAgC,EAChC,GAAW,EACX,GAAsB;IAEtB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,qEAAqE;IACrE,iEAAiE;IACjE,uBAAuB,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,EAAE,CAAC,GAAG,CACJ,IAAI,CAAC,SAAS,CACZ;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;SAC1C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"notify-flush.d.ts","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAWA,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAqCjB"}
1
+ {"version":3,"file":"notify-flush.d.ts","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAWA,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAsCjB"}
@@ -40,7 +40,7 @@ export async function runNotifyFlush(env, cwd) {
40
40
  ...(event.host ? { host: event.host } : {}),
41
41
  ...(event.tokensIn !== undefined ? { tokensIn: event.tokensIn } : {}),
42
42
  ...(event.tokensOut !== undefined ? { tokensOut: event.tokensOut } : {}),
43
- }, otlp).catch(() => undefined);
43
+ }, otlp, env).catch(() => undefined);
44
44
  }
45
45
  return 0;
46
46
  }
@@ -1 +1 @@
1
- {"version":3,"file":"notify-flush.js","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAyB,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAsB,EACtB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,8EAA8E;IAC9E,MAAM,UAAU,GAAG;QACjB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,GAAG,cAAc,CAAC,GAAG,CAAC;KACH,CAAC;IACtB,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,iBAAiB,CACrB;YACE,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,EACD,IAAI,CACL,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
1
+ {"version":3,"file":"notify-flush.js","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAyB,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAsB,EACtB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,8EAA8E;IAC9E,MAAM,UAAU,GAAG;QACjB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,GAAG,cAAc,CAAC,GAAG,CAAC;KACH,CAAC;IACtB,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,iBAAiB,CACrB;YACE,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,EACD,IAAI,EACJ,GAAG,CACJ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
@@ -0,0 +1,24 @@
1
+ import type { ImportResult } from "./index.js";
2
+ /** Override AGT itself honours for its audit path. */
3
+ export declare const AGT_AUDIT_PATH_ENV = "AGT_CLAUDE_AUDIT_PATH";
4
+ export declare function defaultAgtAuditPath(env?: NodeJS.ProcessEnv): string;
5
+ export type ChainResult = {
6
+ readonly ok: true;
7
+ } | {
8
+ readonly ok: false;
9
+ readonly index: number;
10
+ readonly reason: string;
11
+ };
12
+ /** Mirror of AGT's verifyAuditEntries, but reports the first bad index instead of a boolean. */
13
+ export declare function verifyAgtChain(entries: readonly unknown[], seamHash: string | null): ChainResult;
14
+ export interface AgtImportOptions {
15
+ /** Path, for messages only. */
16
+ readonly file: string;
17
+ /** File content, already read under the shared size cap and file-type rules. */
18
+ readonly text: string;
19
+ readonly cwd: string;
20
+ readonly env?: NodeJS.ProcessEnv;
21
+ }
22
+ /** Import one AGT audit log. Returns errors (never throws) on a bad or unreadable file. */
23
+ export declare function importAgt(opts: AgtImportOptions): ImportResult;
24
+ //# sourceMappingURL=agt.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"agt.d.ts","sourceRoot":"","sources":["../../src/importers/agt.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ/C,sDAAsD;AACtD,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEhF;AAyBD,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAqB5E,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAchG;AAsFD,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,CAiF9D"}