@shield-agent/kya 0.24.1 → 0.25.0

package/dist/discover/catalog.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Known-tool catalog for endpoint discovery.
+ *
+ * The catalog maps a stable short id to display metadata and a default
+ * sanction. The defaults are advisory; the hosted console can override them.
+ * v1 deliberately has no UNSANCTIONED defaults - unknown tooling defaults to
+ * REVIEW so operators can inspect before classifying.
+ */
+export type DiscoveryCategory = "cli-agent" | "ide-extension" | "desktop-app" | "model-runtime" | "mcp-server" | "other";
+export type Sanction = "SANCTIONED" | "REVIEW" | "UNSANCTIONED";
+export interface CatalogEntry {
+    readonly name: string;
+    readonly vendor: string;
+    readonly category: DiscoveryCategory;
+    readonly defaultSanction: Sanction;
+}
+export interface CatalogEntryWithId extends CatalogEntry {
+    readonly id: string;
+    readonly binaries: readonly string[];
+    readonly appNames: readonly string[];
+    readonly extensionMarkers: readonly string[];
+    readonly defaultPorts: readonly number[];
+}
+/** Read-only catalog of tools the discovery scanner knows about. */
+export declare function discoveryCatalog(): ReadonlyMap<string, CatalogEntryWithId>;
+export declare function lookupDiscoveryId(id: string): CatalogEntryWithId | undefined;
+/** All binary names across the catalog, useful for PATH scanning. */
+export declare function knownDiscoveryBinaries(): ReadonlySet<string>;
+export declare function knownDiscoveryVendors(): readonly string[];
+//# sourceMappingURL=catalog.d.ts.map

package/dist/discover/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/discover/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,eAAe,GACf,aAAa,GACb,eAAe,GACf,YAAY,GACZ,OAAO,CAAC;AAEZ,MAAM,MAAM,QAAQ,GAAG,YAAY,GAAG,QAAQ,GAAG,cAAc,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;CACpC;AAoID,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAoBD,oEAAoE;AACpE,wBAAgB,gBAAgB,IAAI,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAE1E;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE5E;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,IAAI,WAAW,CAAC,MAAM,CAAC,CAM5D;AAED,wBAAgB,qBAAqB,IAAI,SAAS,MAAM,EAAE,CAQzD"}

package/dist/discover/catalog.js

@@ -0,0 +1,166 @@
+/**
+ * Known-tool catalog for endpoint discovery.
+ *
+ * The catalog maps a stable short id to display metadata and a default
+ * sanction. The defaults are advisory; the hosted console can override them.
+ * v1 deliberately has no UNSANCTIONED defaults - unknown tooling defaults to
+ * REVIEW so operators can inspect before classifying.
+ */
+const CATALOG_DEFS = [
+    {
+        id: "claude",
+        name: "Claude Code",
+        vendor: "Anthropic",
+        category: "cli-agent",
+        defaultSanction: "SANCTIONED",
+        binaries: ["claude", "claude-code"],
+        appNames: ["Claude", "Claude.app"],
+        extensionMarkers: ["anthropic", "claude"],
+    },
+    {
+        id: "cursor-agent",
+        name: "Cursor",
+        vendor: "Cursor Inc",
+        category: "cli-agent",
+        defaultSanction: "SANCTIONED",
+        binaries: ["cursor", "cursor-agent"],
+        appNames: ["Cursor", "Cursor.app"],
+        extensionMarkers: ["cursor"],
+    },
+    {
+        id: "codex",
+        name: "Codex CLI",
+        vendor: "OpenAI",
+        category: "cli-agent",
+        defaultSanction: "SANCTIONED",
+        binaries: ["codex"],
+        appNames: ["Codex"],
+        extensionMarkers: ["codex"],
+    },
+    {
+        id: "gemini",
+        name: "Gemini CLI",
+        vendor: "Google",
+        category: "cli-agent",
+        defaultSanction: "SANCTIONED",
+        binaries: ["gemini"],
+        appNames: ["Gemini"],
+        extensionMarkers: ["gemini"],
+    },
+    {
+        id: "opencode",
+        name: "OpenCode",
+        vendor: "OpenCode",
+        category: "cli-agent",
+        defaultSanction: "SANCTIONED",
+        binaries: ["opencode"],
+        appNames: ["OpenCode"],
+        extensionMarkers: ["opencode"],
+    },
+    {
+        id: "kyo",
+        name: "Kyo",
+        vendor: "Kyo",
+        category: "cli-agent",
+        defaultSanction: "REVIEW",
+        binaries: ["kyo"],
+        appNames: ["Kyo"],
+        extensionMarkers: ["kyo"],
+    },
+    {
+        id: "aider",
+        name: "Aider",
+        vendor: "Aider",
+        category: "cli-agent",
+        defaultSanction: "SANCTIONED",
+        binaries: ["aider"],
+        appNames: ["Aider"],
+        extensionMarkers: ["aider"],
+    },
+    {
+        id: "ollama",
+        name: "Ollama",
+        vendor: "Ollama",
+        category: "model-runtime",
+        defaultSanction: "SANCTIONED",
+        binaries: ["ollama"],
+        appNames: ["Ollama"],
+        extensionMarkers: ["ollama"],
+        defaultPorts: [11434],
+    },
+    {
+        id: "lm-studio",
+        name: "LM Studio",
+        vendor: "LM Studio",
+        category: "model-runtime",
+        defaultSanction: "SANCTIONED",
+        binaries: ["lmstudio", "lm-studio"],
+        appNames: ["LM Studio", "LMStudio"],
+        extensionMarkers: ["lmstudio"],
+        defaultPorts: [1234],
+    },
+    {
+        id: "llama-server",
+        name: "llama.cpp server",
+        vendor: "llama.cpp",
+        category: "model-runtime",
+        defaultSanction: "REVIEW",
+        binaries: ["llama-server", "llama-server.exe"],
+        appNames: ["llama-server"],
+        extensionMarkers: ["llama"],
+    },
+    {
+        id: "mcpserver",
+        name: "Generic MCP server",
+        vendor: "unknown",
+        category: "mcp-server",
+        defaultSanction: "REVIEW",
+        binaries: ["mcpserver"],
+        extensionMarkers: ["mcp"],
+    },
+];
+const ENTRIES = (() => {
+    const map = new Map();
+    for (const def of CATALOG_DEFS) {
+        map.set(def.id, {
+            id: def.id,
+            name: def.name,
+            vendor: def.vendor,
+            category: def.category,
+            defaultSanction: def.defaultSanction,
+            binaries: def.binaries ?? [],
+            appNames: def.appNames ?? [],
+            extensionMarkers: def.extensionMarkers ?? [],
+            defaultPorts: def.defaultPorts ?? [],
+        });
+    }
+    return map;
+})();
+/** Read-only catalog of tools the discovery scanner knows about. */
+export function discoveryCatalog() {
+    return ENTRIES;
+}
+export function lookupDiscoveryId(id) {
+    return ENTRIES.get(id);
+}
+/** All binary names across the catalog, useful for PATH scanning. */
+export function knownDiscoveryBinaries() {
+    const set = new Set();
+    for (const entry of ENTRIES.values()) {
+        for (const b of entry.binaries)
+            set.add(b);
+    }
+    return set;
+}
+export function knownDiscoveryVendors() {
+    const set = new Set();
+    for (const entry of ENTRIES.values()) {
+        if (entry.vendor && entry.vendor !== "unknown")
+            set.add(entry.vendor.toLowerCase());
+        set.add(entry.id.toLowerCase());
+        for (const m of entry.extensionMarkers)
+            set.add(m.toLowerCase());
+    }
+    return [...set];
+}
+//# sourceMappingURL=catalog.js.map

package/dist/discover/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/discover/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmCH,MAAM,YAAY,GAA0B;IAC1C;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;QACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;QAClC,gBAAgB,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;KAC1C;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;QACpC,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,gBAAgB,EAAE,CAAC,OAAO,CAAC;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,gBAAgB,EAAE,CAAC,QAAQ,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,CAAC,UAAU,CAAC;QACtB,QAAQ,EAAE,CAAC,UAAU,CAAC;QACtB,gBAAgB,EAAE,CAAC,UAAU,CAAC;KAC/B;IACD;QACE,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,QAAQ;QACzB,QAAQ,EAAE,CAAC,KAAK,CAAC;QACjB,QAAQ,EAAE,CAAC,KAAK,CAAC;QACjB,gBAAgB,EAAE,CAAC,KAAK,CAAC;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,gBAAgB,EAAE,CAAC,OAAO,CAAC;KAC5B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,eAAe;QACzB,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,YAAY,EAAE,CAAC,KAAK,CAAC;KACtB;IACD;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,eAAe;QACzB,eAAe,EAAE,YAAY;QAC7B,QAAQ,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;QACnC,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACnC,gBAAgB,EAAE,CAAC,UAAU,CAAC;QAC9B,YAAY,EAAE,CAAC,IAAI,CAAC;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,eAAe;QACzB,eAAe,EAAE,QAAQ;QACzB,QAAQ,EAAE,CAAC,cAAc,EAAE,kBAAkB,CAAC;QAC9C,QAAQ,EAAE,CAAC,cAAc,CAAC;QAC1B,gBAAgB,EAAE,CAAC,OAAO,CAAC;KAC5B;IACD;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,QAAQ;QACzB,QAAQ,EAAE,CAAC,WAAW,CAAC;QACvB,gBAAgB,EAAE,CAAC,KAAK,CAAC;KAC1B;CACO,CAAC;AAUX,MAAM,OAAO,GAA4C,CAAC,GAAG,EAAE;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;YACd,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;YAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;YAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,EAAE;YAC5C,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,EAAE,CAAC;AAEL,oEAAoE;AACpE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACpF,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/dist/discover/push.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Hosted sync for discovery snapshots.
+ *
+ * Pushes the local endpoint inventory to `POST /api/v1/kya/endpoints` on the
+ * hosted console. This is fire-and-forget from the scanner's perspective: it
+ * returns an outcome object so the CLI can print status, but it never throws.
+ */
+import type { DiscoverySnapshot } from "./scan.js";
+export interface PushOptions {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+    readonly fetchFn?: typeof fetch;
+    readonly timeoutMs?: number;
+}
+export interface PushResult {
+    readonly ok: boolean;
+    readonly status: number;
+    readonly error?: string;
+}
+export declare function pushDiscoverySnapshot(snapshot: DiscoverySnapshot, opts: PushOptions): Promise<PushResult>;
+//# sourceMappingURL=push.d.ts.map

package/dist/discover/push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../src/discover/push.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,UAAU,CAAC,CA2BrB"}

package/dist/discover/push.js

@@ -0,0 +1,40 @@
+/**
+ * Hosted sync for discovery snapshots.
+ *
+ * Pushes the local endpoint inventory to `POST /api/v1/kya/endpoints` on the
+ * hosted console. This is fire-and-forget from the scanner's perspective: it
+ * returns an outcome object so the CLI can print status, but it never throws.
+ */
+import { CLI_VERSION } from "../version.js";
+function stripTrailingSlash(url) {
+    return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+export async function pushDiscoverySnapshot(snapshot, opts) {
+    const baseUrl = stripTrailingSlash(opts.baseUrl.trim());
+    const url = `${baseUrl}/api/v1/kya/endpoints`;
+    const fetchFn = opts.fetchFn ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? 10_000;
+    try {
+        const res = await fetchFn(url, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${opts.apiKey.trim()}`,
+                "Content-Type": "application/json; charset=utf-8",
+                "User-Agent": `shield-agent-kya-cli/${CLI_VERSION}`,
+            },
+            body: JSON.stringify(snapshot),
+            signal: AbortSignal.timeout(timeoutMs),
+            redirect: "error",
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            return { ok: false, status: res.status, error: `HTTP ${res.status}${text ? ` ${text}` : ""}` };
+        }
+        return { ok: true, status: res.status };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, status: 0, error: message };
+    }
+}
+//# sourceMappingURL=push.js.map

package/dist/discover/push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../src/discover/push.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAgB5C,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAA2B,EAC3B,IAAiB;IAEjB,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,OAAO,uBAAuB,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;gBAC7C,cAAc,EAAE,iCAAiC;gBACjD,YAAY,EAAE,wBAAwB,WAAW,EAAE;aACpD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YACtC,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/discover/scan.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Endpoint discovery scanner.
+ *
+ * Collects a best-effort inventory of AI agents, IDE extensions, desktop apps,
+ * model runtimes, and MCP servers present on the local workstation. The scanner
+ * only inspects paths and config files; it never executes discovered binaries
+ * and never connects to runtime ports.
+ */
+import type { DiscoveryCategory } from "./catalog.js";
+export type Confidence = "high" | "medium" | "low";
+export interface DiscoveryEvidence {
+    readonly path?: string;
+    readonly version?: string;
+    readonly port?: number;
+    readonly command?: string;
+    readonly configPath?: string;
+}
+export interface DiscoveryFinding {
+    readonly id: string;
+    readonly name: string;
+    readonly vendor: string;
+    readonly category: DiscoveryCategory;
+    readonly source: string;
+    readonly confidence: Confidence;
+    readonly evidence: DiscoveryEvidence;
+}
+export interface DiscoveryCoverage {
+    readonly attempted: readonly string[];
+    readonly unavailable: readonly string[];
+    readonly truncated: boolean;
+}
+export interface DiscoverySnapshot {
+    readonly endpointUid: string;
+    readonly hostnameHash: string;
+    readonly os: "darwin" | "linux" | "win32" | "unknown";
+    readonly capturedAt: string;
+    readonly inventory: readonly DiscoveryFinding[];
+    readonly coverage: DiscoveryCoverage;
+}
+export interface ScanOptions {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly cwd?: string;
+    readonly now?: Date;
+    /** Injected fs-ish object for tests. */
+    readonly fs?: ScanFs;
+    /** Override PATH directories (defaults to process.env.PATH). */
+    readonly pathDirs?: readonly string[];
+    /** Override home dir used for redaction (defaults to os.homedir()). */
+    readonly homeDir?: string;
+    /** Override OS platform (defaults to process.platform). */
+    readonly platform?: string;
+}
+export interface ScanFs {
+    existsSync(path: string): boolean;
+    statSync(path: string): {
+        isFile(): boolean;
+        isDirectory(): boolean;
+        mode: number;
+        size: number;
+    };
+    readdirSync(path: string): readonly string[];
+    readFileSync(path: string, encoding: "utf8"): string;
+}
+export declare function buildEndpointId(os: DiscoverySnapshot["os"]): {
+    endpointUid: string;
+    hostnameHash: string;
+};
+export declare function scanCliBinaries(pathDirs: readonly string[], fs: ScanFs, platformName: string): DiscoveryFinding[];
+export declare function scanIdeExtensions(extensionRoots: readonly string[], fs: ScanFs): DiscoveryFinding[];
+export declare function scanDesktopApps(appDirs: readonly string[], fs: ScanFs, platformName: string): DiscoveryFinding[];
+export declare function scanModelRuntimes(pathDirs: readonly string[], fs: ScanFs, platformName: string): DiscoveryFinding[];
+export declare function scanMcpServers(configPaths: readonly string[], fs: ScanFs): DiscoveryFinding[];
+export declare function scanEndpoint(options?: ScanOptions): DiscoverySnapshot;
+//# sourceMappingURL=scan.d.ts.map

package/dist/discover/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/discover/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,MAAM;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,IAAI,OAAO,CAAC;QAAC,WAAW,IAAI,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClG,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CACtD;AA8DD,wBAAgB,eAAe,CAAC,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAOA;AA4DD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GACnB,gBAAgB,EAAE,CA+BpB;AAED,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,EAAE,EAAE,MAAM,GACT,gBAAgB,EAAE,CAuDpB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GACnB,gBAAgB,EAAE,CAuCpB;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GACnB,gBAAgB,EAAE,CAoEpB;AA2BD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,EAAE,EAAE,MAAM,GACT,gBAAgB,EAAE,CA2BpB;AAaD,wBAAgB,YAAY,CAAC,OAAO,GAAE,WAAgB,GAAG,iBAAiB,CAgDzE"}