@shield-agent/kya 0.32.7 → 0.33.1

package/dist/commands/doctor.js

@@ -0,0 +1,26 @@
+/**
+ * kya doctor - local checks. `--iocs` runs the IoC scan now and stores the result; without it the
+ * last stored result is shown. Advisory: exit code is 0 whatever the findings.
+ */
+import { iocEnabled } from "../ioc/spawn.js";
+import { iocLines } from "../ioc/format.js";
+import { readIocResult } from "../ioc/result.js";
+import { runIocScanAndStore } from "../ioc/scan.js";
+import { optInHint } from "../otel/map-attrs-optin.js";
+export async function runDoctor(log, opts) {
+    // OTLP map-attribute opt-in that a check refuses: one line on stderr, so stdout (and --json) stays the same.
+    const hint = opts.warn ? optInHint(opts.cwd) : undefined;
+    if (hint)
+        opts.warn(hint);
+    const result = opts.iocs ? await runIocScanAndStore(opts.env) : readIocResult(opts.env);
+    const enabled = iocEnabled(opts.env);
+    if (opts.json) {
+        log(JSON.stringify({ iocs: { enabled, ran: opts.iocs, result: result ?? null } }, null, 2));
+    }
+    else {
+        for (const line of iocLines(result, enabled))
+            log(line);
+    }
+    return 0;
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAA2B,EAC3B,IAAwJ;IAExJ,6GAA6G;IAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI;QAAE,IAAI,CAAC,IAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/eval-tool.d.ts

@@ -1,5 +1,6 @@
 import type { ResolvedConfig } from "../config.js";
 import { KyaHttpClient, type PolicyEvaluateResponse } from "../client.js";
+import type { GuardContext } from "../guard-pack.js";
 import type { ParsedArgs } from "../parse-args.js";
 export interface EvalToolResult {
     readonly response: PolicyEvaluateResponse;
@@ -15,6 +16,8 @@ export declare function runEvalTool(config: ResolvedConfig, input: {
     approvalStatus?: string;
     sandboxId?: string;
     offline?: boolean;
+    /** Guard pack context (cwd, home, env). Defaults to the process cwd and environment. */
+    guard?: GuardContext;
 }, client?: KyaHttpClient): Promise<EvalToolResult>;
 export declare function evalToolInputFromArgs(parsed: ParsedArgs): {
     toolId: string;

package/dist/commands/eval-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eval-tool.d.ts","sourceRoot":"","sources":["../../src/commands/eval-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAEL,aAAa,EACb,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAKtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC,CAwDzB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CA8BA;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAc9D"}
+{"version":3,"file":"eval-tool.d.ts","sourceRoot":"","sources":["../../src/commands/eval-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAEL,aAAa,EACb,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,EACD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC,CA8DzB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CA8BA;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAc9D"}

package/dist/commands/eval-tool.js

@@ -1,6 +1,7 @@
 import { buildEvaluateFromToolArgs, KyaHttpClient, } from "../client.js";
 import { UsageError } from "../errors.js";
 import { evaluateOffline } from "../offline-evaluate.js";
+import { loadProjectPolicy } from "../project-policy.js";
 import { deriveWireChangeFields } from "../diff-preview.js";
 import { findSampleTool } from "../sample-tools.js";
 import { flagBool, flagString } from "../parse-args.js";
@@ -27,7 +28,7 @@ export async function runEvalTool(config, input, client) {
         ? { ...req, actionClass, dataClass: sample?.dataClass }
         : req;
     if (input.offline || config.offline) {
-        const response = evaluateOffline(request, config.host);
+        const response = evaluateOffline(request, config.host, input.args, loadProjectPolicy(config.cwd), input.guard);
         return {
             response,
             toolId,

package/dist/commands/eval-tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"eval-tool.js","sourceRoot":"","sources":["../../src/commands/eval-tool.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AASxD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAsB,EACtB,KAQC,EACD,MAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY,IAAI,KAAK,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,CAAC;IAExC,MAAM,GAAG,GAAG,yBAAyB,CAAC;QACpC,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;QACtB,YAAY;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,0DAA0D;IAC1D,MAAM,OAAO,GACX,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;QACvD,CAAC,CAAC,GAAG,CAAC;IAEV,IAAI,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO;YACL,QAAQ;YACR,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,MAAM;QACN,IAAI,aAAa,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CACxC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CACzD,CAAC;IACF,OAAO;QACL,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;QAC/C,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IAStD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,IAAI,GAAY,EAAE,CAAC;IACvB,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAClD,OAAO;QACL,MAAM;QACN,IAAI;QACJ,YAAY;QACZ,WAAW;QACX,cAAc;QACd,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1B,OAAO;QACL,YAAY,CAAC,CAAC,OAAO,EAAE;QACvB,eAAe,CAAC,CAAC,UAAU,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE;QAC7D,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QAC5D,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QAC9D,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3D,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACtC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,SAAS;KACzE;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}
+{"version":3,"file":"eval-tool.js","sourceRoot":"","sources":["../../src/commands/eval-tool.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AASxD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAsB,EACtB,KAUC,EACD,MAAsB;IAEtB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY,IAAI,KAAK,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,CAAC;IAExC,MAAM,GAAG,GAAG,yBAAyB,CAAC;QACpC,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;QACtB,YAAY;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,0DAA0D;IAC1D,MAAM,OAAO,GACX,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;QACvD,CAAC,CAAC,GAAG,CAAC;IAEV,IAAI,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,eAAe,CAC9B,OAAO,EACP,MAAM,CAAC,IAAI,EACX,KAAK,CAAC,IAAI,EACV,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,EAC7B,KAAK,CAAC,KAAK,CACZ,CAAC;QACF,OAAO;YACL,QAAQ;YACR,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;YAC/C,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,MAAM;QACN,IAAI,aAAa,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CACxC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CACzD,CAAC;IACF,OAAO;QACL,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;QAC/C,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IAStD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,IAAI,GAAY,EAAE,CAAC;IACvB,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAClD,OAAO;QACL,MAAM;QACN,IAAI;QACJ,YAAY;QACZ,WAAW;QACX,cAAc;QACd,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1B,OAAO;QACL,YAAY,CAAC,CAAC,OAAO,EAAE;QACvB,eAAe,CAAC,CAAC,UAAU,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE;QAC7D,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QAC5D,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QAC9D,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3D,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACtC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,SAAS;KACzE;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/commands/export.d.ts

@@ -0,0 +1,33 @@
+import { type ParsedArgs } from "../parse-args.js";
+import type { TrailEventLike } from "../map/types.js";
+export declare const EXPORT_FORMATS: readonly ["agent-flow"];
+export type ExportFormat = (typeof EXPORT_FORMATS)[number];
+export interface ExportOptions {
+    readonly format: ExportFormat;
+    readonly days: number;
+    readonly session?: string;
+    readonly out?: string;
+    /** Replace an existing --out file. */
+    readonly force: boolean;
+}
+export declare function exportOptionsFromArgs(parsed: ParsedArgs): ExportOptions;
+export interface AgentFlowEvent {
+    time: number;
+    type: "agent_spawn" | "tool_call_start" | "tool_call_end";
+    payload: Record<string, string>;
+}
+/** A third-party MCP tool name can be any length. A longer one is replaced by its hash: a cut could keep a secret-shaped prefix. */
+export declare const TOOL_MAX = 200;
+export declare function toolLabel(toolId: string): string;
+/** JSON.stringify keeps U+2028 and U+2029 raw. Readers that split lines on them (readline) would break the line. */
+export declare function jsonLine(value: unknown): string;
+/**
+ * Pure mapper. Rows are ordered by time, then by file order, so the same trail gives the same bytes.
+ * One `agent_spawn` per session at its first row, then a start and an end event per row at the same time.
+ */
+export declare function toAgentFlow(events: readonly TrailEventLike[], salt: string): AgentFlowEvent[];
+export declare function runExport(opts: ExportOptions, io: {
+    log: (line: string) => void;
+    error: (line: string) => void;
+}, cwd: string, env: NodeJS.ProcessEnv): Promise<number>;
+//# sourceMappingURL=export.d.ts.map

package/dist/commands/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/commands/export.ts"],"names":[],"mappings":"AAWA,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAIzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAItD,eAAO,MAAM,cAAc,yBAA0B,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CAevE;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,aAAa,GAAG,iBAAiB,GAAG,eAAe,CAAC;IAC1D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAGD,oIAAoI;AACpI,eAAO,MAAM,QAAQ,MAAM,CAAC;AAE5B,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,oHAAoH;AACpH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CA+B7F;AAGD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAClE,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAgCjB"}

package/dist/commands/export.js

@@ -0,0 +1,121 @@
+/**
+ * `kya export --format agent-flow`: the local trail as an agent-flow JSONL event log. Local only. Never changes a verdict.
+ * Each line is `{"time": <s since the first row>, "type": ..., "payload": {...}}`. The payload holds only a hashed session,
+ * the tool id, the verdict, the reason code, the target class, the device id and the mode. No args, hashes or paths.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { dirname, resolve } from "node:path";
+import { installSalt } from "../device-id.js";
+import { UsageError } from "../errors.js";
+import { writeFileSync } from "node:fs";
+import { ensureOutDir, projectWritePath, underRoot, writeOutFile } from "../fs-atomic.js";
+import { flagBool, flagString } from "../parse-args.js";
+import { sessionHash, targetOf } from "../map/build.js";
+import { loadTrailEvents } from "../map/load.js";
+import { scanMapOutput } from "../map/page.js";
+import { trailPath } from "../trail.js";
+import { daysFromArgs } from "./map.js";
+export const EXPORT_FORMATS = ["agent-flow"];
+export function exportOptionsFromArgs(parsed) {
+    const format = parsed.flags["format"];
+    if (typeof format !== "string" || !EXPORT_FORMATS.includes(format)) {
+        throw new UsageError(`--format must be one of: ${EXPORT_FORMATS.join(", ")} (for example --format agent-flow)`);
+    }
+    const days = daysFromArgs(parsed);
+    if (parsed.flags["session"] === true)
+        throw new UsageError("--session needs a session id");
+    if (parsed.flags["out"] === true)
+        throw new UsageError("--out needs a file path, for example --out flow.jsonl");
+    return {
+        format: format,
+        days,
+        session: flagString(parsed.flags, "session"),
+        out: flagString(parsed.flags, "out"),
+        force: flagBool(parsed.flags, "force"),
+    };
+}
+const DEVICE_ID = /^[0-9a-f]{16}$/;
+/** A third-party MCP tool name can be any length. A longer one is replaced by its hash: a cut could keep a secret-shaped prefix. */
+export const TOOL_MAX = 200;
+export function toolLabel(toolId) {
+    return toolId.length <= TOOL_MAX ? toolId : `tool:${createHash("sha256").update(toolId, "utf8").digest("hex").slice(0, 16)}`;
+}
+/** JSON.stringify keeps U+2028 and U+2029 raw. Readers that split lines on them (readline) would break the line. */
+export function jsonLine(value) {
+    return JSON.stringify(value).replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+/**
+ * Pure mapper. Rows are ordered by time, then by file order, so the same trail gives the same bytes.
+ * One `agent_spawn` per session at its first row, then a start and an end event per row at the same time.
+ */
+export function toAgentFlow(events, salt) {
+    const rows = events
+        .map((e, i) => ({ e, i, ms: Date.parse(e.ts) }))
+        .filter((r) => Number.isFinite(r.ms))
+        .sort((a, b) => a.ms - b.ms || a.i - b.i);
+    if (rows.length === 0)
+        return [];
+    const t0 = rows[0].ms;
+    const seen = new Set();
+    const out = [];
+    for (const { e, ms } of rows) {
+        const time = (ms - t0) / 1000;
+        const agent = sessionHash(salt, e.product ?? "unknown", e.sessionId);
+        const device = typeof e.deviceId === "string" && DEVICE_ID.test(e.deviceId) ? { deviceId: e.deviceId } : {};
+        if (!seen.has(agent)) {
+            seen.add(agent);
+            out.push({ time, type: "agent_spawn", payload: { name: agent, sessionId: agent, ...device } });
+        }
+        const call = {
+            agent,
+            sessionId: agent,
+            tool: toolLabel(e.toolId),
+            verdict: e.verdict,
+            reasonCode: e.reasonCode,
+            targetClass: targetOf(e).cls,
+            mode: e.mode,
+            ...device,
+        };
+        out.push({ time, type: "tool_call_start", payload: call });
+        out.push({ time, type: "tool_call_end", payload: call });
+    }
+    return out;
+}
+export async function runExport(opts, io, cwd, env) {
+    const salt = installSalt(env) ?? randomBytes(16).toString("hex");
+    const { events } = await loadTrailEvents({ path: trailPath(cwd, env), days: opts.days, now: new Date(), session: opts.session });
+    const lines = toAgentFlow(events, salt).map(jsonLine);
+    if (lines.length === 0) {
+        io.error(`No events in the last ${opts.days} days. Nothing to export.`);
+        return 0;
+    }
+    const body = `${lines.join("\n")}\n`;
+    scanMapOutput(body);
+    if (opts.out === undefined) {
+        io.log(body.trimEnd());
+        return 0;
+    }
+    const target = resolve(cwd, opts.out);
+    // The project root already exists. ensureOutDir would check the root's parent and refuse it.
+    if (resolve(dirname(target)) !== resolve(cwd))
+        ensureOutDir(dirname(target), cwd);
+    if (opts.force) {
+        // Atomic replace, owner read and write only, also when the old file was wider. A link at the target is replaced, not followed.
+        writeOutFile(target, body, cwd, 0o600);
+    }
+    else {
+        // Exclusive create: no window between a check and the write, and an existing file or symlink is never replaced.
+        const dest = underRoot(target, cwd) ? projectWritePath(target, cwd) : target;
+        try {
+            writeFileSync(dest, body, { flag: "wx", mode: 0o600 });
+        }
+        catch (err) {
+            if (err.code === "EEXIST")
+                throw new UsageError(`${target} exists. Pass --force to replace it.`);
+            throw err;
+        }
+    }
+    io.error(`${lines.length} lines written to ${target}`);
+    return 0;
+}
+//# sourceMappingURL=export.js.map

package/dist/commands/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/commands/export.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,YAAY,CAAU,CAAC;AAYtD,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,UAAU,CAAC,4BAA4B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;IAChH,OAAO;QACL,MAAM,EAAE,MAAsB;QAC9B,IAAI;QACJ,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;QAC5C,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;QACpC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC;AAQD,MAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC,oIAAoI;AACpI,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAE5B,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/H,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAiC,EAAE,IAAY;IACzE,MAAM,IAAI,GAAG,MAAM;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAA2B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,IAAI,GAAG;YACX,KAAK;YACL,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG;YAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,MAAM;SACV,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAmB,EACnB,EAAkE,EAClE,GAAW,EACX,GAAsB;IAEtB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACjI,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,EAAE,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACrC,aAAa,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,6FAA6F;IAC7F,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;QAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,+HAA+H;QAC/H,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,gHAAgH;QAChH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7E,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,MAAM,sCAAsC,CAAC,CAAC;YAC5H,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,qBAAqB,MAAM,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAO3D,OAAO,EAAoH,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEzK,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,8GAA8G;IAC9G,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACvF,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAwND,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA4GnE"}
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAW3D,OAAO,EAAoH,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEzK,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,8GAA8G;IAC9G,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACvF,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAyRD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA2HnE"}

package/dist/commands/hook.js

@@ -3,7 +3,7 @@
  * (Claude Code, Codex, Grok, Kimi Code; Gemini CLI BeforeTool). Default: offline local evaluate only, no
  * network, sub-second, fail-open on any internal error unless --fail-closed.
  * DENY (local never-list) blocks; REQUIRE_APPROVE records advisory unless
- * --strict. With --plane-config (beta) it evaluates on the hosted plane and
+ * --strict. With --plane-config (preview) it evaluates on the hosted plane and
  * fails closed (runHostedHook below; --plane-shadow records without blocking).
  */
 import { createHash } from "node:crypto";
@@ -12,8 +12,12 @@ import { isAbsolute, join } from "node:path";
 import { configFilePath, globalConfigDir, resolveConfig } from "../config.js";
 import { runEvalTool } from "./eval-tool.js";
 import { appendTrail, defaultSessionId, hostToProduct } from "../trail.js";
+import { trailMapFields } from "../trail-map-fields.js";
 import { deriveWireChangeFields } from "../diff-preview.js";
 import { matchesNeverList } from "../offline-evaluate.js";
+import { neverListInputMatch } from "../never-list-input.js";
+import { GUARD_DEFAULTS, guardContextFrom, guardHint, guardPackMatch, readGuardConfig } from "../guard-pack.js";
+import { isNeverCode } from "../never-code.js";
 import { maybeSpawnNotifyFlush } from "../notify/dispatch.js";
 import { computeArgsHash } from "../hash.js";
 import { evaluateHosted, hostedDecision, hostedEnvProblem, loadPlaneConfig, PlaneError, scrubNetworkEnv } from "./hosted-hook.js";
@@ -54,7 +58,23 @@ function geminiMcpToolId(raw) {
 const isBeforeTool = (event) => /^BeforeTool$/i.test(event ?? "");
 /** Gemini CLI reads the decision from stdout JSON (`decision`), not hookSpecificOutput: `--host gemini` or a BeforeTool payload. */
 const geminiShape = (input, p) => input.host.trim().toLowerCase() === "gemini" || isBeforeTool(p?.event);
-/** Accept snake_case (Claude/Kimi) and camelCase (Grok) envelopes. */
+/**
+ * Copilot CLI camelCase preToolUse sends `toolArgs` as a JSON string. Parse it so the
+ * input rules and the trail see an object; a bad string stays a string (the rules then
+ * fail open, as for any unparseable input). No size cap: the whole payload was already
+ * parsed above, and a cap here would let padding turn a long command into an allow.
+ */
+function parseToolArgs(v) {
+    if (typeof v !== "string")
+        return v;
+    try {
+        return JSON.parse(v);
+    }
+    catch {
+        return v;
+    }
+}
+/** Accept snake_case (Claude/Kimi) and camelCase (Grok, Copilot) envelopes. */
 function parsePayload(stdinText) {
     let raw;
     try {
@@ -87,11 +107,27 @@ function parsePayload(stdinText) {
         toolUseId: (typeof p.tool_use_id === "string" && p.tool_use_id) ||
             (typeof p.toolUseId === "string" && p.toolUseId) ||
             undefined,
-        toolInput: p.tool_input ?? p.toolInput,
+        toolInput: p.tool_input ?? p.toolInput ?? parseToolArgs(p.toolArgs),
         usage: readUsageShape(p.usage) ?? readUsageShape(toolResponse?.usage),
     };
 }
 const ALLOW = { exitCode: 0, stdout: "", stderr: "" };
+/**
+ * Deny text. An input-rule hit names its rule id; the never-list cannot be overridden. A guard pack
+ * hit names its rule id and says what to do instead. It does not say where the allowlist lives: that file
+ * is writable by the agent, so the text points at the docs for the person. Never carries command text,
+ * a path or a matched secret.
+ */
+function denyReason(toolName, reasonCode, ruleId) {
+    if (reasonCode === "NEVER_EVENT" && ruleId) {
+        return `KYA denied ${toolName}: NEVER_EVENT (rule ${ruleId}; never-list rules cannot be overridden)`;
+    }
+    if (isNeverCode(reasonCode) && reasonCode !== "NEVER_EVENT" && ruleId) {
+        const hint = guardHint(ruleId);
+        return `KYA denied ${toolName}: ${reasonCode} (${ruleId}).${hint ? ` ${hint}` : ""} Ask the user; see docs/guard-pack.md.`;
+    }
+    return `KYA denied ${toolName}: ${reasonCode}`;
+}
 function deny(reason, gemini = false) {
     // Gemini parses stdout JSON whatever the exit code, and a JSON body without `decision` means allow.
     const body = gemini
@@ -181,7 +217,7 @@ function withTimeout(p, ms) {
  * deduped by the tool_use_id claim: the other hook copy may have recorded an
  * ALLOW, and the trail must also show that this copy blocked the call.
  */
-function auditedDeny(reason, reasonCode, input, payload, dedupe = false) {
+function auditedDeny(reason, reasonCode, input, payload, dedupe = false, ruleId) {
     try {
         // Only for NEVER_EVENT: every hook copy reaches the same never-list verdict,
         // so the claim only collapses duplicate rows/notifies and never the verdict.
@@ -198,17 +234,50 @@ function auditedDeny(reason, reasonCode, input, payload, dedupe = false) {
             verdict: "DENY",
             reasonCode,
             mode: "offline",
-            neverEvent: reasonCode === "NEVER_EVENT",
+            neverEvent: isNeverCode(reasonCode),
+            ...(ruleId ? { neverRule: ruleId } : {}),
+            ...trailMapFields(payload?.toolName ?? "unknown", payload?.toolInput, trailCwd, input.env),
         };
         try {
             appendTrail(trailCwd, ev, input.env);
         }
         catch { /* audit is best effort */ }
-        maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: ev });
+        maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: ev, projectDir: trailCwd });
     }
     catch { /* never block the deny itself */ }
     return deny(reason, geminiShape(input, payload));
 }
+/** cwd and env for the guard pack: the host's cwd when it sent an absolute one, else the hook's. */
+function guardContextFor(payload, input) {
+    const c = payload?.cwd?.trim();
+    return guardContextFrom(c && isAbsolute(c) ? c : input.cwd, input.env);
+}
+/**
+ * A malformed guard config falls back to the defaults. Say so once an hour in the trail, so a person
+ * who edited `~/.kya/config.json` and sees no effect can find out why. Never throws.
+ */
+function noteGuardConfigProblem(ctx, input, payload) {
+    try {
+        const { problem } = readGuardConfig(ctx.home);
+        if (!problem)
+            return;
+        const hour = new Date().toISOString().slice(0, 13);
+        if (!claimToolUse(`guard-config:${hour}`, undefined, input.env))
+            return;
+        appendTrail(payload?.cwd?.trim() || input.cwd, {
+            ts: new Date().toISOString(),
+            sessionId: payload?.sessionId ?? defaultSessionId(input.env),
+            host: "ide",
+            product: hostToProduct(input.host),
+            toolId: "kya:guard-config",
+            verdict: "ALLOW",
+            reasonCode: "GUARD_CONFIG_INVALID",
+            mode: "offline",
+            summary: `guard config ignored (${problem}); defaults in force`,
+        }, input.env);
+    }
+    catch { /* best effort */ }
+}
 // Non-PreToolUse hook events that legitimately carry no gate decision.
 const OTHER_EVENT = /^(post[_-]?tool[_-]?use.*|stop|subagent[_-]?(start|stop)|permission[_-]?request|elicitation.*|session[_-]?(start|end)|user[_-]?prompt[_-]?submit|notification|pre[_-]?compact)$/i;
 export async function runHook(input) {
@@ -248,8 +317,10 @@ export async function runHook(input) {
             config = resolve({ host: "ide" });
         }
         const cfg = config;
+        const guardCtx = guardContextFor(payload, input);
+        noteGuardConfigProblem(guardCtx, input, payload);
         const evaluate = input.evaluate ??
-            (async (toolId, args) => (await runEvalTool(cfg, { toolId, args, offline: true })).response);
+            (async (toolId, args) => (await runEvalTool(cfg, { toolId, args, offline: true, guard: guardCtx })).response);
         const evaluating = Promise.resolve().then(() => evaluate(toolName, payload?.toolInput ?? {}));
         const response = input.failClosed
             ? await withTimeout(evaluating, input.evalTimeoutMs ?? 4000)
@@ -261,9 +332,12 @@ export async function runHook(input) {
             // payload.cwd is host-supplied and only feeds the project-basename stamp;
             // the trail path itself comes from env/KYA_HOME - no traversal risk.
             const trailCwd = payload.cwd?.trim() || input.cwd;
+            // Map fields come from the raw input, before the secret strip below: a never deny or a secret read keeps its class.
+            const mapFields = trailMapFields(toolName, payload.toolInput ?? {}, trailCwd, input.env);
             // Wire change fields (summary, diffPreview, targetPath) feed the receipt's
             // Changes tab; redaction + opt-out live inside deriveWireChangeFields.
-            const changeFields = deriveWireChangeFields(toolName, payload.toolInput ?? {}, input.env);
+            // A secret-shaped write is denied because its text is a secret: no preview of that text reaches the trail.
+            const changeFields = response.reasonCode === "NEVER_SECRET_WRITE" ? undefined : deriveWireChangeFields(toolName, payload.toolInput ?? {}, input.env);
             const trailEvent = {
                 ts: new Date().toISOString(),
                 sessionId: payload.sessionId ?? defaultSessionId(input.env),
@@ -273,8 +347,10 @@ export async function runHook(input) {
                 verdict: response.verdict,
                 reasonCode: response.reasonCode ?? "",
                 mode: "offline",
-                neverEvent: response.reasonCode === "NEVER_EVENT",
+                neverEvent: isNeverCode(response.reasonCode),
+                ...(response.ruleId ? { neverRule: response.ruleId } : {}),
                 argsHash: response.argsHash,
+                ...mapFields,
                 ...(changeFields ?? {}),
                 ...(payload.usage?.tokensIn !== undefined ? { tokensIn: payload.usage.tokensIn } : {}),
                 ...(payload.usage?.tokensOut !== undefined ? { tokensOut: payload.usage.tokensOut } : {}),
@@ -289,14 +365,14 @@ export async function runHook(input) {
                 }
                 // Webhooks + OTLP export ride a detached helper; the hook never waits on
                 // the network. No-op unless a sink is configured.
-                maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: trailEvent });
+                maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: trailEvent, projectDir: trailCwd });
             }
         }
         catch {
             /* observe path never breaks the gate */
         }
         if (response.verdict === "DENY") {
-            return { ...deny(`KYA denied ${toolName}: ${response.reasonCode}`, geminiShape(input, payload)), firstSeen };
+            return { ...deny(denyReason(toolName, response.reasonCode, response.ruleId), geminiShape(input, payload)), firstSeen };
         }
         if (input.strict && response.verdict === "REQUIRE_APPROVE") {
             return { ...deny(`KYA strict mode: ${toolName} requires approval (${response.reasonCode})`, geminiShape(input, payload)), firstSeen };
@@ -311,8 +387,16 @@ export async function runHook(input) {
         // --fail-closed (hosted): enforcement must not silently lapse.
         try {
             // A never-list tool is logged as such in both modes (hosted counts stay right).
-            if (payload?.toolName && matchesNeverList(payload.toolName)) {
-                return auditedDeny(`KYA denied ${payload.toolName}: NEVER_EVENT`, "NEVER_EVENT", input, payload, true);
+            if (payload?.toolName) {
+                const inputHit = neverListInputMatch(payload.toolName, payload.toolInput, undefined, payload.cwd?.trim() || input.cwd);
+                if (inputHit || matchesNeverList(payload.toolName)) {
+                    return auditedDeny(denyReason(payload.toolName, "NEVER_EVENT", inputHit?.rule), "NEVER_EVENT", input, payload, true, inputHit?.rule);
+                }
+                // Guard pack with its defaults: the fallback never reads config, so a broken or hostile one cannot lift a deny here.
+                const guardHit = guardPackMatch(payload.toolName, payload.toolInput, guardContextFor(payload, input), GUARD_DEFAULTS);
+                if (guardHit) {
+                    return auditedDeny(denyReason(payload.toolName, guardHit.code, guardHit.rule), guardHit.code, input, payload, true, guardHit.rule);
+                }
             }
         }
         catch { /* fall through */ }
@@ -325,8 +409,10 @@ export async function runHook(input) {
 /** Env that steers the OSS hook and is ignored in hosted mode (design T2/T3). */
 const HOSTED_IGNORED_ENV = ["KYA_OFFLINE", "KYA_BASE_URL", "KYA_API_KEY", "SHIELD_API_KEY", "KYA_AGENT_ID", "KYA_HOME", "KYA_HOST", "KYA_NOTIFY_WEBHOOK", "KYA_OTLP_EXPORT_ENDPOINT"];
 /**
- * Hosted mode. Order: payload, local never-list, env and config checks, plane
- * call, then a raise-only merge in which the local never-list always wins.
+ * Hosted mode. Order: payload, local never-list, local guard pack, env and config checks, plane
+ * call, then a raise-only merge in which the local never-list, then the guard pack, always win.
+ * The guard pack has the same rules, codes and user-level config as the local hook; only the
+ * failure stance differs (hosted fails closed).
  * Every failure is a deny (fail-closed) unless --plane-shadow, which records
  * the would-be verdict and allows. Nothing here reads resolveConfig, the repo's
  * .kya/config.json or KYA_* env, so none of them can downgrade this path.
@@ -350,6 +436,8 @@ async function runHostedHook(input, plane) {
         stderrNotes.push("KYA hosted mode: KYA_* env and the project .kya/config.json are ignored");
     // Crash path state: unknown until the local never-list has been evaluated below.
     hostedDecision.neverList = "unknown";
+    hostedDecision.code = undefined;
+    hostedDecision.rule = undefined;
     let payload;
     let verdict;
     let response;
@@ -367,15 +455,28 @@ async function runHostedHook(input, plane) {
     }
     const toolName = payload?.toolName;
     let neverListed = false;
-    // The local never-list runs first, before any env, config or plane code, and is stored so a
-    // crash later can never lower it (crashDecision). A throw leaves it "unknown", which denies.
+    let neverRule;
+    let guardHit;
+    // The local never-list and the guard pack run first, before any env, config or plane code, and
+    // are stored so a crash later can never lower them (crashDecision). A throw leaves it "unknown",
+    // which denies. The guard config is the user-level file under the hosted $HOME only.
     try {
         if (toolName) {
-            neverListed = matchesNeverList(toolName);
-            hostedDecision.neverList = neverListed ? "deny" : "clear";
+            neverRule = neverListInputMatch(toolName, payload?.toolInput, undefined, payload?.cwd?.trim() || input.cwd)?.rule;
+            neverListed = matchesNeverList(toolName) || neverRule !== undefined;
+            if (!neverListed) {
+                const ctx = guardContextFor(payload, input);
+                guardHit = guardPackMatch(toolName, payload?.toolInput, ctx, readGuardConfig(ctx.home).config);
+                if (homeOk)
+                    noteGuardConfigProblem(ctx, { ...input, env: stateEnv }, payload);
+            }
+            hostedDecision.neverList = neverListed || guardHit ? "deny" : "clear";
+            hostedDecision.code = neverListed ? "NEVER_EVENT" : guardHit?.code;
+            hostedDecision.rule = neverListed ? neverRule : guardHit?.rule;
         }
     }
     catch { /* stays unknown */ }
+    const localDeny = neverListed || guardHit !== undefined;
     if (!payload || !toolName) {
         verdict = {
             verdict: "DENY",
@@ -413,6 +514,7 @@ async function runHostedHook(input, plane) {
                 now: plane.now,
                 sleep: plane.sleep,
                 random: plane.random,
+                withholdChange: guardHit?.code === "NEVER_SECRET_WRITE",
             });
         }
         catch (e) {
@@ -422,7 +524,10 @@ async function runHostedHook(input, plane) {
         }
         // Raise-only merge: the local never-list beats any plane answer or failure.
         if (neverListed) {
-            verdict = { verdict: "DENY", reasonCode: "NEVER_EVENT", reason: `KYA denied ${toolName}: NEVER_EVENT`, dedupe: true };
+            verdict = { verdict: "DENY", reasonCode: "NEVER_EVENT", reason: denyReason(toolName, "NEVER_EVENT", neverRule), dedupe: true, ruleId: neverRule };
+        }
+        else if (guardHit) {
+            verdict = { verdict: "DENY", reasonCode: guardHit.code, reason: denyReason(toolName, guardHit.code, guardHit.rule), dedupe: true, ruleId: guardHit.rule };
         }
         else if (failure || !response) {
             const f = failure ?? { code: "FAIL_CLOSED", message: "internal error" };
@@ -442,9 +547,9 @@ async function runHostedHook(input, plane) {
     }
     const blocks = verdict.verdict === "DENY" ||
         (input.strict && verdict.verdict === "REQUIRE_APPROVE");
-    // Shadow never blocks, except the LOCAL never-list. Keyed to the local evaluation, never to the
-    // plane's reason code: the plane answers NEVER_EVENT for every registered DENY-tier tool.
-    const enforce = blocks && (!plane.shadow || neverListed);
+    // Shadow never blocks, except the LOCAL never-list and guard pack. Keyed to the local evaluation,
+    // never to the plane's reason code: the plane answers NEVER_EVENT for every registered DENY-tier tool.
+    const enforce = blocks && (!plane.shadow || localDeny);
     let firstSeen = true;
     try {
         firstSeen = recordHostedRow(input, stateEnv, homeOk, home, payload, verdict, response, plane.shadow, configIgnored);
@@ -482,7 +587,8 @@ function recordHostedRow(input, stateEnv, homeOk, home, payload, verdict, respon
     let changeFields;
     try {
         argsHash ??= payload?.toolName ? computeArgsHash(payload.toolInput ?? {}) : undefined;
-        changeFields = payload?.toolName ? deriveWireChangeFields(toolName, payload.toolInput ?? {}, input.env) : undefined;
+        // A secret-shaped write is denied because its text is a secret: no preview of that text reaches the trail.
+        changeFields = payload?.toolName && verdict.reasonCode !== "NEVER_SECRET_WRITE" ? deriveWireChangeFields(toolName, payload.toolInput ?? {}, input.env) : undefined;
     }
     catch { /* row without hash or preview */ }
     const ev = {
@@ -494,8 +600,10 @@ function recordHostedRow(input, stateEnv, homeOk, home, payload, verdict, respon
         verdict: verdict.verdict,
         reasonCode: verdict.reasonCode,
         mode: input.strict ? "hold" : "observe",
-        neverEvent: verdict.reasonCode === "NEVER_EVENT",
+        neverEvent: isNeverCode(verdict.reasonCode),
+        ...(verdict.ruleId ? { neverRule: verdict.ruleId } : {}),
         ...(argsHash ? { argsHash } : {}),
+        ...trailMapFields(toolName, payload?.toolInput, payload?.cwd?.trim() || input.cwd, stateEnv),
         ...(changeFields ?? {}),
         ...(payload?.usage?.tokensIn !== undefined ? { tokensIn: payload.usage.tokensIn } : {}),
         ...(payload?.usage?.tokensOut !== undefined ? { tokensOut: payload.usage.tokensOut } : {}),
@@ -507,7 +615,8 @@ function recordHostedRow(input, stateEnv, homeOk, home, payload, verdict, respon
     }
     catch { /* best effort */ }
     // cwd = home: only the user-level notify config applies, never a repo's sinks.
-    maybeSpawnNotifyFlush({ env: stateEnv, cwd: home, event: ev });
+    // projectDir is the call's project, so the map-attribute opt-in check sees the repo even though cwd is home.
+    maybeSpawnNotifyFlush({ env: stateEnv, cwd: home, event: ev, projectDir: payload?.cwd?.trim() || input.cwd });
     return true;
 }
 //# sourceMappingURL=hook.js.map