@strongkeep/watchdog 0.1.1

package/dist/cli/init.js

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-init CLI — write the config pack into the subscriber's harness (D6).
+ *
+ * Usage:
+ *   strongkeep-init [--harness <dir>] [--kind claude-code|cursor]
+ *                   [--tier advise|propose|auto] [--feed-url <url>] [--dry-run]
+ *   strongkeep-init --help
+ *
+ * Token: read from STRONGKEEP_TOKEN or the local login state (~/.strongkeep/token, written by
+ * strongkeep-login). NEVER accepted on argv (would leak into shell history) and NEVER printed.
+ *
+ * Design: arg-parse + orchestration + exit only. All work is in ../init.ts (runInit).
+ */
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { realpathSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { AUTONOMY_TIERS } from '@strongkeep/core';
+import { runInit } from '../init.js';
+// ponytail(beta): beta Worker default; revert to 'https://feed.strongkeep.com/v1' at GA.
+const DEFAULT_FEED_URL = 'https://sk-feed-beta.gaurav-016.workers.dev';
+const HELP_TEXT = `strongkeep-init — write the StrongKeep config pack into your OWN agent harness
+
+Usage:
+  strongkeep-init [--harness <dir>] [--kind claude-code|cursor]
+                  [--tier advise|propose|auto] [--feed-url <url>] [--dry-run]
+                  [--no-poll] [--no-healthcheck]
+
+Defaults: --harness . | --kind claude-code | --tier propose
+Token: from $STRONGKEEP_TOKEN or ~/.strongkeep/token (run strongkeep-login) — never on argv.
+Optional during the beta: the beta feed is public-read; feed authenticity is still verified
+against the pinned public key.
+After writing the config pack, init runs a first feed poll (skip with --no-poll).
+Idempotent + non-destructive: existing hooks/servers/settings are preserved; edited files are
+backed up. Re-run any time (e.g. to change tier).`;
+/**
+ * Parse argv → options. Total; never throws. Token is NOT an argv field (read from env/login state).
+ */
+export function parseInitArgs(argv, cwd = process.cwd()) {
+    const opts = { harnessRoot: cwd, kind: 'claude-code', tier: 'propose', dryRun: false, showHelp: false, noHealthcheck: false, noPoll: false };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--help' || arg === '-h')
+            opts.showHelp = true;
+        else if (arg === '--dry-run')
+            opts.dryRun = true;
+        else if (arg === '--no-healthcheck')
+            opts.noHealthcheck = true;
+        else if (arg === '--no-poll')
+            opts.noPoll = true;
+        else if (arg === '--ingest-url') {
+            const val = argv[++i];
+            if (val === undefined)
+                return { ...opts, showHelp: true, error: '--ingest-url requires a URL' };
+            opts.ingestUrl = val;
+        }
+        else if (arg === '--staff') {
+            const val = argv[++i];
+            if (val === undefined)
+                return { ...opts, showHelp: true, error: '--staff requires a label' };
+            opts.staffLabel = val;
+        }
+        else if (arg === '--harness') {
+            const val = argv[++i];
+            if (val === undefined)
+                return { ...opts, showHelp: true, error: '--harness requires a dir' };
+            opts.harnessRoot = val;
+        }
+        else if (arg === '--kind') {
+            const val = argv[++i];
+            if (val !== 'claude-code' && val !== 'cursor')
+                return { ...opts, showHelp: true, error: '--kind must be claude-code or cursor' };
+            opts.kind = val;
+        }
+        else if (arg === '--tier') {
+            const val = argv[++i];
+            if (val === undefined || !AUTONOMY_TIERS.includes(val)) {
+                return { ...opts, showHelp: true, error: `--tier must be one of ${AUTONOMY_TIERS.join('|')}` };
+            }
+            opts.tier = val;
+        }
+        else if (arg === '--feed-url') {
+            const val = argv[++i];
+            if (val === undefined)
+                return { ...opts, showHelp: true, error: '--feed-url requires a URL' };
+            opts.feedUrl = val;
+        }
+        else {
+            return { ...opts, showHelp: true, error: `unknown argument "${arg}" (the token is never passed on argv)` };
+        }
+    }
+    return opts;
+}
+/** Resolve the per-tenant token from env or login state. Never from argv, never logged. */
+async function resolveToken() {
+    const fromEnv = process.env['STRONGKEEP_TOKEN'];
+    if (fromEnv !== undefined && fromEnv !== '')
+        return fromEnv;
+    try {
+        return (await readFile(join(homedir(), '.strongkeep', 'token'), 'utf8')).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+async function main() {
+    const opts = parseInitArgs(process.argv.slice(2));
+    if (opts.error)
+        process.stderr.write(`strongkeep-init: ${opts.error}\n\n`);
+    if (opts.showHelp) {
+        process.stdout.write(HELP_TEXT + '\n');
+        process.exit(opts.error ? 2 : 0);
+    }
+    const token = await resolveToken();
+    // ponytail(beta): token not required while the beta feed is public-read; UNCOMMENT this
+    // fail-closed block when beta ends.
+    // if (token === undefined) {
+    //   process.stderr.write(
+    //     'strongkeep-init: no token found. Run strongkeep-login first (or set STRONGKEEP_TOKEN).\n',
+    //   );
+    //   process.exit(2);
+    // }
+    if (token === undefined) {
+        process.stderr.write('strongkeep-init: no feed token found; continuing (beta feed is public-read).\n');
+    }
+    try {
+        const result = await runInit({
+            harnessRoot: opts.harnessRoot,
+            kind: opts.kind,
+            feedUrl: opts.feedUrl ?? DEFAULT_FEED_URL,
+            ...(token !== undefined ? { token } : {}),
+            tier: opts.tier,
+            dryRun: opts.dryRun,
+            ...(opts.ingestUrl !== undefined ? { ingestUrl: opts.ingestUrl } : {}),
+            ...(opts.staffLabel !== undefined ? { staffLabel: opts.staffLabel } : {}),
+        });
+        const lines = result.changes.map((c) => `  ${c.action.padEnd(7)} ${c.path} — ${c.note}`);
+        if (result.backups.length > 0)
+            lines.push(`  backups: ${result.backups.join(', ')}`);
+        lines.push(opts.dryRun ? '(dry-run — nothing was written)' : 'protection configured.');
+        lines.push('next: run strongkeep-scan for your baseline security report.');
+        process.stdout.write(lines.join('\n') + '\n'); // summary never includes the token
+        // Beta 2-command flow: run the first feed poll right here (best-effort; init already
+        // succeeded, so a poll failure warns and continues — exit stays 0).
+        if (!opts.dryRun && !opts.noPoll) {
+            await autoFirstPoll(opts.harnessRoot);
+        }
+        // Cadence Q1: auto first-run of the health check (best-effort; never fails init).
+        if (!opts.dryRun && !opts.noHealthcheck) {
+            await autoFirstHealthcheck(opts.harnessRoot);
+        }
+        process.exit(0);
+    }
+    catch (err) {
+        process.stderr.write(`strongkeep-init: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(2);
+    }
+}
+/**
+ * Run the first feed poll after init (beta 2-command flow: init IS the setup, the poll
+ * happens inline). Best-effort: spawns the sibling poll bin (same dist/cli directory,
+ * realpath-safe URL resolution — the Phase 1 bin-path pattern) with inherited stdio so
+ * the user sees the freshness badge. A non-zero poll exit warns but never fails init:
+ * the config pack is already written and the hooks will poll again on next tool use.
+ */
+async function autoFirstPoll(harnessRoot) {
+    const { spawn } = await import('node:child_process');
+    const pollBin = fileURLToPath(new URL('./poll.js', import.meta.url));
+    await new Promise((resolveDone) => {
+        try {
+            const child = spawn(process.execPath, [pollBin, '--harness', harnessRoot], { stdio: 'inherit' });
+            child.on('error', () => {
+                process.stderr.write('strongkeep-init: first feed poll could not start; run strongkeep-poll manually.\n');
+                resolveDone();
+            });
+            child.on('close', (code) => {
+                if (code !== 0) {
+                    process.stderr.write('strongkeep-init: first feed poll did not succeed (init itself is complete; protection hooks will retry automatically).\n');
+                }
+                resolveDone();
+            });
+        }
+        catch {
+            resolveDone();
+        }
+    });
+}
+/**
+ * Run the first health check after init (cadence Q1). Best-effort: shells out to the
+ * healthcheck bin via npx so the watchdog does not take a runtime dependency on it. Any
+ * failure (bin absent, no network) is swallowed — init has already succeeded.
+ */
+async function autoFirstHealthcheck(harnessRoot) {
+    const { spawn } = await import('node:child_process');
+    await new Promise((resolveDone) => {
+        try {
+            // -p <pkg> <bin>: the multi-arg form npx can actually resolve (bare `npx <pkg> <bin>`
+            // passes the bin name as an ARGUMENT to the package's default bin and breaks).
+            const child = spawn('npx', ['--no-install', '-p', '@strongkeep/healthcheck', 'strongkeep-healthcheck', '--send', '--root', harnessRoot], { stdio: 'ignore' });
+            child.on('error', () => resolveDone());
+            child.on('close', () => resolveDone());
+        }
+        catch {
+            resolveDone();
+        }
+    });
+}
+// ponytail: realpath main-guard, Phase 1 pattern (macOS /var vs /private/var symlink).
+if (isMainModule()) {
+    void main();
+}
+function isMainModule() {
+    const entry = process.argv[1];
+    if (entry === undefined)
+        return false;
+    try {
+        return fileURLToPath(import.meta.url) === realpathSync(entry);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=init.js.map

package/dist/cli/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAoB,MAAM,YAAY,CAAC;AAoBvD,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAEvE,MAAM,SAAS,GAAG;;;;;;;;;;;;;kDAagC,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAc,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IACvE,MAAM,IAAI,GAAmB,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7J,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;aACtD,IAAI,GAAG,KAAK,WAAW;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;aAC5C,IAAI,GAAG,KAAK,kBAAkB;YAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;aAC1D,IAAI,GAAG,KAAK,WAAW;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;aAC5C,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;YAChG,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YAC7F,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACxB,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YAC7F,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACzB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,QAAQ;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;YACjI,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9E,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,yBAAyB,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACjG,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,GAAmB,CAAC;QAClC,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9F,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,qBAAqB,GAAG,uCAAuC,EAAE,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,YAAY;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,wFAAwF;IACxF,oCAAoC;IACpC,6BAA6B;IAC7B,0BAA0B;IAC1B,kGAAkG;IAClG,OAAO;IACP,qBAAqB;IACrB,IAAI;IACJ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gBAAgB;YACzC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,mCAAmC;QAElF,qFAAqF;QACrF,oEAAoE;QACpE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QACD,kFAAkF;QAClF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,IAAI,OAAO,CAAO,CAAC,WAAW,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACjG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;gBAC1G,WAAW,EAAE,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0HAA0H,CAC3H,CAAC;gBACJ,CAAC;gBACD,WAAW,EAAE,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IACrD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,IAAI,OAAO,CAAO,CAAC,WAAW,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,sFAAsF;YACtF,+EAA+E;YAC/E,MAAM,KAAK,GAAG,KAAK,CACjB,KAAK,EACL,CAAC,cAAc,EAAE,IAAI,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,EAC5G,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YACvC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,KAAK,IAAI,EAAE,CAAC;AACd,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cli/login.d.ts

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-login CLI — store the per-tenant feed token in the local login state
+ * (~/.strongkeep/token) that strongkeep-init reads.
+ *
+ * Usage:
+ *   strongkeep-login            Prompt for the token (input hidden) and save it.
+ *   strongkeep-login --help
+ *
+ * SECURITY:
+ *  - The token is NEVER accepted on argv (shell-history leak) and NEVER printed or echoed —
+ *    the interactive prompt disables terminal echo; only a confirmation line is printed.
+ *  - When stdin is not a TTY (scripted use), one trimmed line is read from stdin instead:
+ *    `strongkeep-login < token-file` or `some-secret-store | strongkeep-login`.
+ *  - The token file is written mode 0600 (parent dir 0700), matching what init expects.
+ *  - Overwriting an existing token is fine (re-login) and is confirmed in the output.
+ *  - The token value never appears in any error message, either.
+ */
+/** Where the token lives — the exact path strongkeep-init's resolveToken reads. */
+export declare function defaultTokenPath(): string;
+/**
+ * Validate a candidate token's SHAPE (never its authenticity — the feed does that) and return
+ * the trimmed token. Throws on empty/whitespace, implausible length, or non-base64url chars.
+ * SECURITY: error messages describe the problem but NEVER include the token value.
+ */
+export declare function validateTokenShape(raw: string): string;
+/**
+ * Validate + persist the token: parent dir 0700 (created if missing), file 0600. The explicit
+ * chmod covers the overwrite case (writeFile's mode only applies on create; re-login must not
+ * leave a pre-existing looser mode in place). Nothing is written if validation fails.
+ */
+export declare function writeToken(path: string, rawToken: string): Promise<void>;

package/dist/cli/login.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-login CLI — store the per-tenant feed token in the local login state
+ * (~/.strongkeep/token) that strongkeep-init reads.
+ *
+ * Usage:
+ *   strongkeep-login            Prompt for the token (input hidden) and save it.
+ *   strongkeep-login --help
+ *
+ * SECURITY:
+ *  - The token is NEVER accepted on argv (shell-history leak) and NEVER printed or echoed —
+ *    the interactive prompt disables terminal echo; only a confirmation line is printed.
+ *  - When stdin is not a TTY (scripted use), one trimmed line is read from stdin instead:
+ *    `strongkeep-login < token-file` or `some-secret-store | strongkeep-login`.
+ *  - The token file is written mode 0600 (parent dir 0700), matching what init expects.
+ *  - Overwriting an existing token is fine (re-login) and is confirmed in the output.
+ *  - The token value never appears in any error message, either.
+ */
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { realpathSync } from 'node:fs';
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { Writable } from 'node:stream';
+/** Where the token lives — the exact path strongkeep-init's resolveToken reads. */
+export function defaultTokenPath() {
+    return join(homedir(), '.strongkeep', 'token');
+}
+/** Plausible token bounds: long enough to be a real credential, short enough to be one line. */
+const MIN_TOKEN_LENGTH = 16;
+const MAX_TOKEN_LENGTH = 512;
+/** base64url charset — the shape StrongKeep tenant tokens are issued in. */
+const TOKEN_CHARSET = /^[A-Za-z0-9_-]+$/;
+/**
+ * Validate a candidate token's SHAPE (never its authenticity — the feed does that) and return
+ * the trimmed token. Throws on empty/whitespace, implausible length, or non-base64url chars.
+ * SECURITY: error messages describe the problem but NEVER include the token value.
+ */
+export function validateTokenShape(raw) {
+    const token = raw.trim();
+    if (token === '')
+        throw new Error('no token entered');
+    if (token.length < MIN_TOKEN_LENGTH) {
+        throw new Error(`token looks too short (${token.length} chars; expected at least ${MIN_TOKEN_LENGTH})`);
+    }
+    if (token.length > MAX_TOKEN_LENGTH) {
+        throw new Error(`token looks too long (${token.length} chars; expected at most ${MAX_TOKEN_LENGTH})`);
+    }
+    if (!TOKEN_CHARSET.test(token)) {
+        throw new Error('token contains characters outside the expected base64url set (A-Z a-z 0-9 - _)');
+    }
+    return token;
+}
+/**
+ * Validate + persist the token: parent dir 0700 (created if missing), file 0600. The explicit
+ * chmod covers the overwrite case (writeFile's mode only applies on create; re-login must not
+ * leave a pre-existing looser mode in place). Nothing is written if validation fails.
+ */
+export async function writeToken(path, rawToken) {
+    const token = validateTokenShape(rawToken);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, token + '\n', { encoding: 'utf8', mode: 0o600 });
+    await chmod(path, 0o600);
+}
+const HELP_TEXT = `strongkeep-login — save your per-tenant StrongKeep feed token to local login state
+
+Usage:
+  strongkeep-login          Prompt for the token (input hidden; piped stdin works too).
+
+Writes ~/.strongkeep/token (mode 0600) — the file strongkeep-init reads. Re-running replaces
+the stored token (re-login). The token is never accepted on argv and never printed.`;
+/** Prompt on the TTY with echo DISABLED (readline output muted; prompt goes to stderr). */
+async function promptHidden(promptText) {
+    const muted = new Writable({
+        write(_chunk, _encoding, callback) {
+            callback(); // swallow all echo — the typed token must never appear on screen
+        },
+    });
+    const rl = createInterface({ input: process.stdin, output: muted, terminal: true });
+    process.stderr.write(promptText);
+    try {
+        return await new Promise((resolveAnswer) => rl.question('', resolveAnswer));
+    }
+    finally {
+        rl.close();
+        process.stderr.write('\n');
+    }
+}
+/** Scripted path: read exactly one line from (non-TTY) stdin. */
+async function readLineFromStdin() {
+    const rl = createInterface({ input: process.stdin, terminal: false });
+    try {
+        for await (const line of rl)
+            return line;
+        return '';
+    }
+    finally {
+        rl.close();
+    }
+}
+async function main() {
+    const argv = process.argv.slice(2);
+    if (argv.includes('--help') || argv.includes('-h')) {
+        process.stdout.write(HELP_TEXT + '\n');
+        process.exit(0);
+    }
+    if (argv.length > 0) {
+        // Refuse ALL positional/unknown args: the token must never travel via argv/shell history.
+        process.stderr.write('strongkeep-login: unexpected argument (the token is never passed on argv)\n\n' + HELP_TEXT + '\n');
+        process.exit(2);
+    }
+    try {
+        const raw = process.stdin.isTTY
+            ? await promptHidden('Paste your StrongKeep feed token (input hidden): ')
+            : await readLineFromStdin();
+        const path = defaultTokenPath();
+        await writeToken(path, raw);
+        // Confirmation ONLY — never the token value.
+        process.stdout.write(`token saved to ${path} (mode 0600). Next: strongkeep-init --tier propose\n`);
+        process.exit(0);
+    }
+    catch (err) {
+        process.stderr.write(`strongkeep-login: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(2);
+    }
+}
+// realpath main-guard, Phase 1 pattern (macOS /var vs /private/var symlink).
+if (isMainModule()) {
+    void main();
+}
+function isMainModule() {
+    const entry = process.argv[1];
+    if (entry === undefined)
+        return false;
+    try {
+        return fileURLToPath(import.meta.url) === realpathSync(entry);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/cli/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/cli/login.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,mFAAmF;AACnF,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,gGAAgG;AAChG,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,4EAA4E;AAC5E,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,MAAM,6BAA6B,gBAAgB,GAAG,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,MAAM,4BAA4B,gBAAgB,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,QAAgB;IAC7D,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,SAAS,GAAG;;;;;;oFAMkE,CAAC;AAErF,2FAA2F;AAC3F,KAAK,UAAU,YAAY,CAAC,UAAkB;IAC5C,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC;QACzB,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ;YAC/B,QAAQ,EAAE,CAAC,CAAC,iEAAiE;QAC/E,CAAC;KACF,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACtF,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,iBAAiB;IAC9B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,0FAA0F;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+EAA+E,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QACzH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK;YAC7B,CAAC,CAAC,MAAM,YAAY,CAAC,mDAAmD,CAAC;YACzE,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAChC,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,6CAA6C;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,sDAAsD,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,KAAK,IAAI,EAAE,CAAC;AACd,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cli/mcp.d.ts

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-mcp CLI — the read-only MCP server the harness wires in (Journey B step 1c) so
+ * the subscriber's agent can query the live feed (list_threats / get_playbook / check_my_setup).
+ *
+ * This is the CONSUMER-side entry point. It reuses the read-only MCP implementation from
+ * @strongkeep/core's serve.ts (serveMcp) but points it at the LOCAL, verified last-good
+ * feed cache (not a build directory), so it works offline and never serves unverified content
+ * (fail-safe D2 applies here too — the snapshot is re-verified against the pinned key on load).
+ *
+ * Usage:
+ *   strongkeep-mcp [--harness <dir>]   Run the stdio MCP server against the local verified feed cache.
+ *   strongkeep-mcp --help
+ *
+ * READ-ONLY: no tool here applies an action. Apply is exclusively the pipeline's job.
+ */
+export interface McpCliOptions {
+    harnessRoot: string;
+    showHelp: boolean;
+    error?: string;
+}
+/** Parse argv → options. Total; never throws. */
+export declare function parseMcpArgs(argv: string[], cwd?: string): McpCliOptions;

package/dist/cli/mcp.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-mcp CLI — the read-only MCP server the harness wires in (Journey B step 1c) so
+ * the subscriber's agent can query the live feed (list_threats / get_playbook / check_my_setup).
+ *
+ * This is the CONSUMER-side entry point. It reuses the read-only MCP implementation from
+ * @strongkeep/core's serve.ts (serveMcp) but points it at the LOCAL, verified last-good
+ * feed cache (not a build directory), so it works offline and never serves unverified content
+ * (fail-safe D2 applies here too — the snapshot is re-verified against the pinned key on load).
+ *
+ * Usage:
+ *   strongkeep-mcp [--harness <dir>]   Run the stdio MCP server against the local verified feed cache.
+ *   strongkeep-mcp --help
+ *
+ * READ-ONLY: no tool here applies an action. Apply is exclusively the pipeline's job.
+ */
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { serveMcp } from '@strongkeep/core';
+import { lastGoodDir } from '../feed-client.js';
+import { loadLocalConfig, pinnedKeysFromConfig } from '../init.js';
+const HELP_TEXT = `strongkeep-mcp — read-only MCP server over the LOCAL verified feed cache
+
+Usage:
+  strongkeep-mcp [--harness <dir>]
+
+Tools: list_threats / get_playbook / check_my_setup. Read-only; works offline; serves nothing
+that has not passed signature + hash verification against the pinned StrongKeep key.`;
+/** Parse argv → options. Total; never throws. */
+export function parseMcpArgs(argv, cwd = process.cwd()) {
+    const opts = { harnessRoot: cwd, showHelp: false };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--help' || arg === '-h')
+            opts.showHelp = true;
+        else if (arg === '--harness') {
+            const val = argv[++i];
+            if (val === undefined)
+                return { ...opts, showHelp: true, error: '--harness requires a dir' };
+            opts.harnessRoot = val;
+        }
+        else
+            return { ...opts, showHelp: true, error: `unknown argument "${arg}"` };
+    }
+    return opts;
+}
+async function main() {
+    const opts = parseMcpArgs(process.argv.slice(2));
+    if (opts.error)
+        process.stderr.write(`strongkeep-mcp: ${opts.error}\n\n`);
+    if (opts.showHelp) {
+        process.stdout.write(HELP_TEXT + '\n');
+        process.exit(opts.error ? 2 : 0);
+    }
+    try {
+        const harnessRoot = resolve(opts.harnessRoot);
+        const config = await loadLocalConfig(harnessRoot);
+        // Serve the verified LOCAL snapshot, pinned to the bundled/configured key SET (never
+        // self-declared; legacy single-key configs yield a 1-element set).
+        await serveMcp(lastGoodDir(join(harnessRoot, config.cacheDir)), pinnedKeysFromConfig(config));
+        process.exit(0);
+    }
+    catch (err) {
+        process.stderr.write(`strongkeep-mcp: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(2);
+    }
+}
+if (isMainModule()) {
+    void main();
+}
+function isMainModule() {
+    const entry = process.argv[1];
+    if (entry === undefined)
+        return false;
+    try {
+        return fileURLToPath(import.meta.url) === realpathSync(entry);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=mcp.js.map

package/dist/cli/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/cli/mcp.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQnE,MAAM,SAAS,GAAG;;;;;;qFAMmE,CAAC;AAEtF,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,IAAc,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IACtE,MAAM,IAAI,GAAkB,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;aACtD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YAC7F,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACzB,CAAC;;YAAM,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,qBAAqB,GAAG,GAAG,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;QAClD,qFAAqF;QACrF,mEAAmE;QACnE,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,KAAK,IAAI,EAAE,CAAC;AACd,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cli/poll.d.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+/**
+ * strongkeep-poll CLI — the invocable the init-written guard hooks call: poll the signed feed
+ * (verify → parse, D2 fail-safe) and run the apply pipeline under the configured autonomy tier.
+ *
+ * Usage:
+ *   strongkeep-poll [--harness <dir>]
+ *   strongkeep-poll --help
+ *
+ * This is the "thin stable mechanism" runtime (D6): reading it end-to-end shows everything the
+ * watchdog can do to this machine — verify, then route closed-vocabulary actions to the
+ * allowlisted appliers, with undo records. No shell, no body execution, no telemetry.
+ */
+export interface PollCliOptions {
+    harnessRoot: string;
+    showHelp: boolean;
+    error?: string;
+}
+/** Parse argv → options. Total; never throws. */
+export declare function parsePollArgs(argv: string[], cwd?: string): PollCliOptions;