@strongkeep/watchdog 0.1.1

package/dist/fires.js

@@ -0,0 +1,36 @@
+/**
+ * Guardrail-fire log — the activity-lite source the Phase 3 health check reads.
+ *
+ * Phase 2 shipped the applied-actions undo log but nothing recorded guardrail FIRES. This
+ * module is that record: one append-only NDJSON line per fire, carrying ONLY
+ * { firedAt, ruleId } — never the matched command, never any content. The health check
+ * counts these per rule since the last report (@strongkeep/healthcheck activity-lite).
+ *
+ * SECURITY: the matched text / command is deliberately NOT written. A fire says "rule X
+ * triggered at time T" and nothing more — enough for a count, insufficient to leak what
+ * the user was doing. Append-only; a corrupt line is a reader's problem to skip, never a
+ * writer's to repair.
+ *
+ * ponytail: single NDJSON file, append = atomicity unit — mirrors the undo log's design.
+ */
+import { appendFile, mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+/** Basename of the fire log inside `.claude/strongkeep`. */
+export const FIRES_FILE = 'fires.ndjson';
+/**
+ * Append a fire to the log at `<strongkeepDir>/fires.ndjson`. Best-effort and non-throwing
+ * on a write failure (a guardrail must never crash the agent's tool call just because its
+ * telemetry line could not be written) — but it DOES create the directory if missing.
+ */
+export async function recordFire(strongkeepDir, ruleId, at = new Date()) {
+    const record = { firedAt: at.toISOString(), ruleId };
+    const path = join(strongkeepDir, FIRES_FILE);
+    try {
+        await mkdir(dirname(path), { recursive: true });
+        await appendFile(path, JSON.stringify(record) + '\n', 'utf8');
+    }
+    catch {
+        // Telemetry must not break the tool call — drop the line rather than throw.
+    }
+}
+//# sourceMappingURL=fires.js.map

package/dist/fires.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fires.js","sourceRoot":"","sources":["../src/fires.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAQzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,aAAqB,EAAE,MAAc,EAAE,KAAW,IAAI,IAAI,EAAE;IAC3F,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;AACH,CAAC"}

package/dist/guard-check.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Guard-rule evaluation — the PreToolUse check that reads guard-rules.yaml, matches a
+ * candidate command, records any fire (fires.ndjson), and returns the rule's action.
+ *
+ * This closes the Phase 2 gap: init wrote the rules file + hook wiring, but nothing
+ * evaluated a command against the rules or recorded a fire. This module is that evaluator.
+ * It stays true to the D6 least-privilege contract — it reads config + the command string
+ * passed to it, records a metadata-only fire, and returns advise/warn/block. It NEVER
+ * executes anything and never writes the command anywhere.
+ *
+ * ponytail: guard-rules.yaml is a tiny fixed shape (id / match / action per rule). We hand-
+ * parse those three fields with a line scanner rather than adding a YAML dependency — the
+ * same zero-dep discipline as the rest of the repo. A malformed rule line is skipped.
+ */
+/** A single guard rule, as parsed from guard-rules.yaml. */
+export interface GuardRule {
+    id: string;
+    /** Regex-source string matched (case-insensitively) against the candidate command. */
+    match: string;
+    action: 'advise' | 'warn' | 'block';
+    /** Optional plain-language reason shown to the user when the rule fires (why it's guarded). */
+    reason?: string;
+}
+/** Outcome of evaluating a command: which rules fired and the strongest action to take. */
+export interface GuardOutcome {
+    firedRuleIds: string[];
+    /** Strongest action among fired rules; 'allow' when nothing fired. */
+    action: 'allow' | 'advise' | 'warn' | 'block';
+    /** The full rules that fired, in file order (used to build the user-facing message). */
+    fired: GuardRule[];
+}
+/**
+ * Evaluate `command` against the harness's guard rules. Records a fire (metadata only) for
+ * each matching rule, then returns the fired ids + the strongest action. Never throws.
+ * @param strongkeepDir absolute `.claude/strongkeep` dir (rules + fire log live here).
+ */
+export declare function evaluateCommand(strongkeepDir: string, command: string, at?: Date): Promise<GuardOutcome>;
+/** Parse the fixed id/match/action shape of guard-rules.yaml. Hand-rolled, no YAML dep. */
+export declare function loadRules(path: string): Promise<GuardRule[]>;

package/dist/guard-check.js

@@ -0,0 +1,94 @@
+/**
+ * Guard-rule evaluation — the PreToolUse check that reads guard-rules.yaml, matches a
+ * candidate command, records any fire (fires.ndjson), and returns the rule's action.
+ *
+ * This closes the Phase 2 gap: init wrote the rules file + hook wiring, but nothing
+ * evaluated a command against the rules or recorded a fire. This module is that evaluator.
+ * It stays true to the D6 least-privilege contract — it reads config + the command string
+ * passed to it, records a metadata-only fire, and returns advise/warn/block. It NEVER
+ * executes anything and never writes the command anywhere.
+ *
+ * ponytail: guard-rules.yaml is a tiny fixed shape (id / match / action per rule). We hand-
+ * parse those three fields with a line scanner rather than adding a YAML dependency — the
+ * same zero-dep discipline as the rest of the repo. A malformed rule line is skipped.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { recordFire } from './fires.js';
+const ACTION_RANK = { allow: 0, advise: 1, warn: 2, block: 3 };
+/**
+ * Evaluate `command` against the harness's guard rules. Records a fire (metadata only) for
+ * each matching rule, then returns the fired ids + the strongest action. Never throws.
+ * @param strongkeepDir absolute `.claude/strongkeep` dir (rules + fire log live here).
+ */
+export async function evaluateCommand(strongkeepDir, command, at = new Date()) {
+    const rules = await loadRules(join(strongkeepDir, 'guard-rules.yaml'));
+    const firedRuleIds = [];
+    const fired = [];
+    let action = 'allow';
+    for (const rule of rules) {
+        if (matches(rule.match, command)) {
+            firedRuleIds.push(rule.id);
+            fired.push(rule);
+            if (ACTION_RANK[rule.action] > ACTION_RANK[action])
+                action = rule.action;
+            await recordFire(strongkeepDir, rule.id, at); // metadata only — never `command`
+        }
+    }
+    return { firedRuleIds, action, fired };
+}
+/** Parse the fixed id/match/action shape of guard-rules.yaml. Hand-rolled, no YAML dep. */
+export async function loadRules(path) {
+    let text;
+    try {
+        text = await readFile(path, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const rules = [];
+    let cur = {};
+    const flush = () => {
+        if (cur.id && cur.match !== undefined && (cur.action === 'advise' || cur.action === 'warn' || cur.action === 'block')) {
+            rules.push({ id: cur.id, match: cur.match, action: cur.action, ...(cur.reason ? { reason: cur.reason } : {}) });
+        }
+        cur = {};
+    };
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (line.startsWith('- id:')) {
+            flush();
+            cur.id = unquote(line.slice('- id:'.length).trim());
+        }
+        else if (line.startsWith('id:')) {
+            flush();
+            cur.id = unquote(line.slice('id:'.length).trim());
+        }
+        else if (line.startsWith('match:')) {
+            cur.match = unquote(line.slice('match:'.length).trim());
+        }
+        else if (line.startsWith('action:')) {
+            const a = unquote(line.slice('action:'.length).trim());
+            if (a === 'advise' || a === 'warn' || a === 'block')
+                cur.action = a;
+        }
+        else if (line.startsWith('reason:')) {
+            cur.reason = unquote(line.slice('reason:'.length).trim());
+        }
+    }
+    flush();
+    return rules;
+}
+/** Case-insensitive regex match; a bad regex source is treated as a literal substring. */
+function matches(source, command) {
+    try {
+        return new RegExp(source, 'i').test(command);
+    }
+    catch {
+        return command.toLowerCase().includes(source.toLowerCase());
+    }
+}
+function unquote(s) {
+    return s.replace(/^["']|["']$/g, '');
+}
+//# sourceMappingURL=guard-check.js.map

package/dist/guard-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-check.js","sourceRoot":"","sources":["../src/guard-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAqBxC,MAAM,WAAW,GAA2C,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAEvG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB,EAAE,OAAe,EAAE,KAAW,IAAI,IAAI,EAAE;IACjG,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,MAAM,GAA2B,OAAO,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzE,MAAM,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,kCAAkC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAuB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;YACtH,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,GAAG,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,KAAK,EAAE,CAAC;YACR,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,KAAK,EAAE,CAAC;YACR,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO;gBAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,SAAS,OAAO,CAAC,MAAc,EAAE,OAAe;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/init.d.ts

@@ -0,0 +1,105 @@
+/**
+ * strongkeep-init core — writes the config pack into the subscriber's OWN harness (D6).
+ * This is "consuming the feed" for v1: run init once, the harness consumes the feed forever.
+ *
+ * What init writes into the harness (Journey B step 1):
+ *   (a) Guardrail HOOKS into .claude/settings.json (PreToolUse/PostToolUse) — auditable text
+ *       that, on each agent tool call, invokes the watchdog poll+pipeline against the cached feed.
+ *   (b) A RULES file (.claude/strongkeep/guard-rules.yaml) the hooks read.
+ *   (c) A /strongkeep-status SKILL (SKILL.md) so the human can query threats / applied changes.
+ *   (d) MCP config wiring the read-only strongkeep-mcp server for live feed queries.
+ *   (e) Local CONFIG: feed URL + per-tenant token + pinned public key + autonomy tier + cacheDir
+ *       — plus a scoped .gitignore so the token file cannot be committed by accident.
+ *
+ * SECURITY:
+ *  - init is IDEMPOTENT and NON-DESTRUCTIVE: it merges into existing config, backing up any
+ *    file it edits (so init itself is revertible), and never clobbers unrelated keys/hooks.
+ *  - The per-tenant token is written to the local, gitignored config file ONLY — never to a
+ *    committed file, never echoed into the returned summary/notes, never printed.
+ *  - The pinned public key is bundled with the watchdog (assets/), not fetched — trust anchor.
+ *  - init writes ONLY inside the chosen harness root. It performs no other side effects.
+ *
+ * The written hook text is the "thin stable mechanism"; it rarely changes. All fast-moving
+ * intelligence arrives as feed DATA, so init does not need re-running when threats update.
+ */
+import type { AutonomyTier } from '@strongkeep/core';
+/** Which harness to target. Determines file layout (.claude vs .cursor). */
+export type HarnessKind = 'claude-code' | 'cursor';
+export interface InitOptions {
+    /** Absolute harness root to write into. */
+    harnessRoot: string;
+    kind: HarnessKind;
+    /** Signed feed base URL. */
+    feedUrl: string;
+    /**
+     * Per-tenant token (from strongkeep-login). Written to local config only; never
+     * committed/logged. Optional: a public-read feed (e.g. the beta) needs no token.
+     */
+    token?: string;
+    /** Autonomy tier to set (SMB default = propose). */
+    tier: AutonomyTier;
+    /** If true, only report what WOULD be written (no writes). */
+    dryRun: boolean;
+    /** Override the bundled pinned public key (base64 SPKI). Used by tests + the fixture deploy kit. */
+    pinnedPublicKeyB64?: string;
+    /**
+     * Phase 3 (additive): per-tenant health-check ingest URL. Written to local config so
+     * `strongkeep-healthcheck --send` can auto-POST. Optional — omitted → email/paste only.
+     */
+    ingestUrl?: string;
+    /**
+     * Phase 3 (additive): the staff label this machine self-reports as in health checks.
+     * Optional — omitted → the health check derives username@hostname.
+     */
+    staffLabel?: string;
+}
+/** What init did (or would do, in dryRun) — for the CLI summary + tests. */
+export interface InitResult {
+    /** Files created/edited, with a note per file. Notes NEVER contain the token. */
+    changes: Array<{
+        path: string;
+        action: 'created' | 'merged' | 'skipped';
+        note: string;
+    }>;
+    /** Backups written for any edited file (so init is revertible). */
+    backups: string[];
+}
+/**
+ * Parse a PINNED_PUBLIC_KEY.txt-style text into the pinned key SET: every non-comment,
+ * non-empty line is a base64 SPKI key (tolerant: trims, skips `#` comments + blank lines).
+ * Multiple lines support key rotation — a future ceremony just adds the new key line.
+ */
+export declare function parsePinnedKeyLines(text: string): string[];
+/**
+ * Write (or, in dryRun, plan) the config pack into the harness. Idempotent + non-destructive.
+ */
+export declare function runInit(opts: InitOptions): Promise<InitResult>;
+/** The shape of the local config file strongkeep-init writes (read by the CLIs). */
+export interface LocalConfig {
+    feedUrl: string;
+    tier: AutonomyTier;
+    cacheDir: string;
+    /** Legacy single pinned key (base64 SPKI). Kept for configs written before the key-set change. */
+    pinnedPublicKey: string;
+    /** Canonical pinned key SET (base64 SPKI each). Absent in legacy configs → 1-element set. */
+    pinnedPublicKeys?: string[];
+    /** Per-tenant token. Absent when init ran without one (public-read feed). */
+    token?: string;
+    /** Phase 3 (additive): health-check ingest URL for `strongkeep-healthcheck --send`. */
+    ingestUrl?: string;
+    /** Phase 3 (additive): self-reported staff label for health checks. */
+    staffLabel?: string;
+}
+/** Load the local config for a harness (used by strongkeep-poll / -revert / -mcp). */
+export declare function loadLocalConfig(harnessRoot: string, kind?: HarnessKind): Promise<LocalConfig>;
+/**
+ * The pinned key set from a local config, as verify-ready keys. Backward compatible: a legacy
+ * config with only the single `pinnedPublicKey` string yields a 1-element set. Never fails
+ * open — a config with no key at all yields an EMPTY set, which every verify path rejects.
+ */
+export declare function pinnedKeysFromConfig(config: LocalConfig): Array<{
+    keyId: string;
+    bytes: Uint8Array;
+}>;
+/** The strongkeep state dir for a harness kind (where undo log + cache live). */
+export declare function strongkeepDir(kind?: HarnessKind): string;

package/dist/init.js

@@ -0,0 +1,283 @@
+/**
+ * strongkeep-init core — writes the config pack into the subscriber's OWN harness (D6).
+ * This is "consuming the feed" for v1: run init once, the harness consumes the feed forever.
+ *
+ * What init writes into the harness (Journey B step 1):
+ *   (a) Guardrail HOOKS into .claude/settings.json (PreToolUse/PostToolUse) — auditable text
+ *       that, on each agent tool call, invokes the watchdog poll+pipeline against the cached feed.
+ *   (b) A RULES file (.claude/strongkeep/guard-rules.yaml) the hooks read.
+ *   (c) A /strongkeep-status SKILL (SKILL.md) so the human can query threats / applied changes.
+ *   (d) MCP config wiring the read-only strongkeep-mcp server for live feed queries.
+ *   (e) Local CONFIG: feed URL + per-tenant token + pinned public key + autonomy tier + cacheDir
+ *       — plus a scoped .gitignore so the token file cannot be committed by accident.
+ *
+ * SECURITY:
+ *  - init is IDEMPOTENT and NON-DESTRUCTIVE: it merges into existing config, backing up any
+ *    file it edits (so init itself is revertible), and never clobbers unrelated keys/hooks.
+ *  - The per-tenant token is written to the local, gitignored config file ONLY — never to a
+ *    committed file, never echoed into the returned summary/notes, never printed.
+ *  - The pinned public key is bundled with the watchdog (assets/), not fetched — trust anchor.
+ *  - init writes ONLY inside the chosen harness root. It performs no other side effects.
+ *
+ * The written hook text is the "thin stable mechanism"; it rarely changes. All fast-moving
+ * intelligence arrives as feed DATA, so init does not need re-running when threats update.
+ */
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readIfExists, backupFile } from './appliers/fs-guard.js';
+/**
+ * Resolve a watchdog CLI bin to an absolute path (relative to this compiled module, i.e.
+ * dist/cli/<bin>). init bakes the resolved path into the harness hooks at write time — no npx,
+ * no PATH lookup, no "could not determine executable to run" (which fails OPEN: Claude Code
+ * treats a hook-execution error as non-blocking, so a broken hook = no protection).
+ * ponytail: for the ephemeral `npx @strongkeep/watchdog init` model the package can live in a
+ * temp npx cache that may be cleaned, staling this path; the production hardening is to copy a
+ * self-contained guard script into the harness. For workspace / local / global installs it is stable.
+ */
+function watchdogBinPath(binFile) {
+    return fileURLToPath(new URL(`./cli/${binFile}`, import.meta.url));
+}
+/** Same, wrapped as a shell `node "<path>"` command for a hook `command` string. */
+function watchdogBinCommand(binFile) {
+    return `node ${JSON.stringify(watchdogBinPath(binFile))}`;
+}
+/** The auditable hook command (thin stable mechanism — polls the feed + runs the pipeline). */
+const GUARD_HOOK_COMMAND = watchdogBinCommand('poll.js');
+/**
+ * The PreToolUse guard-check command (Phase 3, additive): evaluates the candidate command
+ * against guard-rules.yaml, records metadata-only fires to fires.ndjson, and denies on block.
+ */
+const GUARD_CHECK_COMMAND = watchdogBinCommand('guard-check.js');
+/** Marker used to recognise our own hook entries on re-runs (idempotency). */
+const HOOK_MARKER = 'strongkeep';
+/** Starter guard rules — DATA read by the hooks; updated later via update_rule_file actions. */
+const STARTER_RULES = `# StrongKeep guard rules (data — read by the strongkeep guard hooks, never executed)
+# Updated via signed update_rule_file feed actions. Edit freely; this file is yours.
+#
+# 'block' denies the AGENT's tool call (PreToolUse exit 2). A user's manual bash
+# (e.g. \`! rm -rf ...\` typed into the harness) is NOT a tool call, so it never reaches
+# this guard — you keep full manual control; only the AGENT is stopped.
+version: 1
+rules:
+  # ponytail: covers the common rm -rf / -fr / split-flag forms; extend if you see novel spellings.
+  - id: gr-001-destructive-commands
+    match: "rm -rf|rm -fr|rm -r -f|rm -f -r"
+    action: block
+    reason: "Recursive force-delete (rm -rf) can permanently and irreversibly wipe files or whole directories. This is the AI-agent-wiped-my-home-directory class of incident."
+  - id: gr-002-skip-permissions
+    match: "dangerously-skip-permissions"
+    action: block
+    reason: "This flag turns off the agent's own permission prompts, removing the safety checks that stop unintended or malicious actions."
+  - id: gr-003-risky-history
+    match: "git reset --hard|DROP TABLE"
+    action: warn
+    reason: "Destructive to your git history or database (git reset --hard / DROP TABLE). Allowed, but flagged so you notice before data is lost."
+`;
+/** Layout per harness kind. */
+function layout(kind) {
+    if (kind === 'claude-code') {
+        return {
+            settingsFile: '.claude/settings.json',
+            mcpFile: '.mcp.json',
+            strongkeepDir: '.claude/strongkeep',
+            skillFile: '.claude/skills/strongkeep-status/SKILL.md',
+        };
+    }
+    // cursor: MCP config only — no hooks/skills surface in v1 (noted in the change list).
+    return {
+        settingsFile: undefined,
+        mcpFile: '.cursor/mcp.json',
+        strongkeepDir: '.cursor/strongkeep',
+        skillFile: undefined,
+    };
+}
+/** Absolute path of a bundled asset (assets/ ships beside dist/ in the published package). */
+function assetPath(rel) {
+    return join(dirname(fileURLToPath(import.meta.url)), '../assets', rel);
+}
+/**
+ * Parse a PINNED_PUBLIC_KEY.txt-style text into the pinned key SET: every non-comment,
+ * non-empty line is a base64 SPKI key (tolerant: trims, skips `#` comments + blank lines).
+ * Multiple lines support key rotation — a future ceremony just adds the new key line.
+ */
+export function parsePinnedKeyLines(text) {
+    return text
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l !== '' && !l.startsWith('#'));
+}
+/** Read the bundled pinned public key set (assets/PINNED_PUBLIC_KEY.txt): all key lines. */
+async function bundledPinnedKeysB64() {
+    const keys = parsePinnedKeyLines(await readFile(assetPath('PINNED_PUBLIC_KEY.txt'), 'utf8'));
+    if (keys.length === 0)
+        throw new Error('bundled PINNED_PUBLIC_KEY.txt has no key line');
+    return keys;
+}
+/** Read the bundled /strongkeep-status skill body. */
+async function bundledSkill() {
+    return readFile(assetPath('skill/SKILL.md'), 'utf8');
+}
+/** Read the bundled /strongkeep-healthcheck skill body (Phase 3), or null if not bundled. */
+async function bundledHealthcheckSkill() {
+    try {
+        return await readFile(assetPath('healthcheck-skill/SKILL.md'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write (or, in dryRun, plan) the config pack into the harness. Idempotent + non-destructive.
+ */
+export async function runInit(opts) {
+    const result = { changes: [], backups: [] };
+    const files = layout(opts.kind);
+    /** Write a file if its content differs; back up an existing file before editing it. */
+    const writeManaged = async (relPath, content, mergeNote) => {
+        const absPath = join(opts.harnessRoot, relPath);
+        const existing = await readIfExists(absPath);
+        const existingText = existing === undefined ? undefined : new TextDecoder().decode(existing);
+        if (existingText === content) {
+            result.changes.push({ path: relPath, action: 'skipped', note: 'already up to date' });
+            return;
+        }
+        if (!opts.dryRun) {
+            if (existing !== undefined)
+                result.backups.push(await backupFile(opts.harnessRoot, absPath));
+            await mkdir(dirname(absPath), { recursive: true });
+            await writeFile(absPath, content, 'utf8');
+        }
+        result.changes.push({
+            path: relPath,
+            action: existing === undefined ? 'created' : 'merged',
+            note: mergeNote,
+        });
+    };
+    // (a) Guard hooks — MERGED into existing settings, never clobbering unrelated keys/hooks.
+    if (files.settingsFile !== undefined) {
+        const absPath = join(opts.harnessRoot, files.settingsFile);
+        const existing = await readIfExists(absPath);
+        const settings = existing === undefined ? {} : JSON.parse(new TextDecoder().decode(existing));
+        const hooks = (settings['hooks'] ?? {});
+        settings['hooks'] = hooks;
+        let added = 0;
+        /** Add a command hook to a phase iff that exact command is not already present. */
+        const ensureHook = (phase, command) => {
+            const arr = Array.isArray(hooks[phase]) ? hooks[phase] : [];
+            hooks[phase] = arr;
+            // Compare the actual command field, not a JSON.stringify substring: the resolved
+            // `node "<abs path>"` command contains quotes that JSON-escaping would mangle, breaking
+            // idempotency. Match the exact command string on any nested hook entry.
+            const present = arr.some((h) => {
+                const nested = h?.hooks;
+                return Array.isArray(nested) && nested.some((x) => x?.command === command);
+            });
+            if (!present) {
+                arr.push({ matcher: '*', hooks: [{ type: 'command', command }] });
+                added++;
+            }
+        };
+        // Poll on both phases (feed apply). Guard-check on PreToolUse (rule fires + block).
+        ensureHook('PreToolUse', GUARD_HOOK_COMMAND);
+        ensureHook('PostToolUse', GUARD_HOOK_COMMAND);
+        ensureHook('PreToolUse', GUARD_CHECK_COMMAND);
+        await writeManaged(files.settingsFile, JSON.stringify(settings, null, 2) + '\n', added > 0 ? `merged ${added} strongkeep guard hook(s); existing hooks + settings preserved` : 'guard hooks present');
+    }
+    else {
+        result.changes.push({ path: '(hooks)', action: 'skipped', note: `${opts.kind} has no hooks surface in v1` });
+    }
+    // (b) Rules file.
+    await writeManaged(join(files.strongkeepDir, 'guard-rules.yaml'), STARTER_RULES, 'starter guard rules written');
+    // (c) Skills: /strongkeep-status (Phase 2) + /strongkeep-healthcheck (Phase 3, additive).
+    if (files.skillFile !== undefined) {
+        await writeManaged(files.skillFile, await bundledSkill(), '/strongkeep-status skill installed');
+        const healthcheckSkill = await bundledHealthcheckSkill();
+        if (healthcheckSkill !== null) {
+            await writeManaged('.claude/skills/strongkeep-healthcheck/SKILL.md', healthcheckSkill, '/strongkeep-healthcheck skill installed');
+        }
+    }
+    // (d) MCP wiring — ADDITIVE merge; pre-existing servers survive untouched.
+    {
+        const absPath = join(opts.harnessRoot, files.mcpFile);
+        const existing = await readIfExists(absPath);
+        const mcp = existing === undefined ? {} : JSON.parse(new TextDecoder().decode(existing));
+        const servers = (mcp['mcpServers'] ?? {});
+        mcp['mcpServers'] = servers;
+        if (servers['strongkeep'] === undefined) {
+            servers['strongkeep'] = { command: 'node', args: [watchdogBinPath('mcp.js')] };
+        }
+        await writeManaged(files.mcpFile, JSON.stringify(mcp, null, 2) + '\n', 'strongkeep-mcp wired in additively');
+    }
+    // (e) Local config: token + pinned key set + tier + cacheDir. Token lands HERE and nowhere else.
+    // A caller-supplied single key (tests / deploy-kit scripts) becomes a 1-element set.
+    const pinnedKeys = opts.pinnedPublicKeyB64 !== undefined ? [opts.pinnedPublicKeyB64] : await bundledPinnedKeysB64();
+    const cacheDir = join(files.strongkeepDir, 'cache');
+    const localConfig = {
+        feedUrl: opts.feedUrl,
+        tier: opts.tier,
+        cacheDir,
+        // Legacy single-key field kept so older readers (e.g. strongkeep-verify.sh, previously
+        // installed CLIs) still find a key; pinnedPublicKeys is the canonical set.
+        pinnedPublicKey: pinnedKeys[0],
+        pinnedPublicKeys: pinnedKeys,
+        // Token omitted entirely when not provided (public-read feed): no empty/placeholder value.
+        ...(opts.token !== undefined ? { token: opts.token } : {}),
+        // Phase 3 (additive): health-check transport + identity. Omitted when not provided.
+        ...(opts.ingestUrl !== undefined ? { ingestUrl: opts.ingestUrl } : {}),
+        ...(opts.staffLabel !== undefined ? { staffLabel: opts.staffLabel } : {}),
+    };
+    {
+        const relPath = join(files.strongkeepDir, 'config.local.json');
+        const absPath = join(opts.harnessRoot, relPath);
+        const content = JSON.stringify(localConfig, null, 2) + '\n';
+        const existing = await readIfExists(absPath);
+        const existingText = existing === undefined ? undefined : new TextDecoder().decode(existing);
+        if (existingText === content) {
+            result.changes.push({ path: relPath, action: 'skipped', note: 'already up to date' });
+        }
+        else {
+            if (!opts.dryRun) {
+                if (existing !== undefined)
+                    result.backups.push(await backupFile(opts.harnessRoot, absPath));
+                await mkdir(dirname(absPath), { recursive: true });
+                await writeFile(absPath, content, { encoding: 'utf8', mode: 0o600 });
+            }
+            // Note deliberately does NOT echo any config value — the token must never leave this file.
+            result.changes.push({
+                path: relPath,
+                action: existing === undefined ? 'created' : 'merged',
+                note: opts.token !== undefined
+                    ? 'local config written (feed URL, tier, cache dir, pinned key, token — token stays in this file only)'
+                    : 'local config written (feed URL, tier, cache dir, pinned key — no token, public-read feed)',
+            });
+        }
+    }
+    // Scoped .gitignore: belt-and-braces so the token file + cache can never be committed.
+    await writeManaged(join(files.strongkeepDir, '.gitignore'), 'config.local.json\ncache/\nbackups/\nhook-packs/\n', 'scoped gitignore for token/cache');
+    return result;
+}
+/** Load the local config for a harness (used by strongkeep-poll / -revert / -mcp). */
+export async function loadLocalConfig(harnessRoot, kind = 'claude-code') {
+    const files = layout(kind);
+    const path = join(harnessRoot, files.strongkeepDir, 'config.local.json');
+    return JSON.parse(await readFile(path, 'utf8'));
+}
+/**
+ * The pinned key set from a local config, as verify-ready keys. Backward compatible: a legacy
+ * config with only the single `pinnedPublicKey` string yields a 1-element set. Never fails
+ * open — a config with no key at all yields an EMPTY set, which every verify path rejects.
+ */
+export function pinnedKeysFromConfig(config) {
+    const b64s = config.pinnedPublicKeys !== undefined && config.pinnedPublicKeys.length > 0
+        ? config.pinnedPublicKeys
+        : typeof config.pinnedPublicKey === 'string' && config.pinnedPublicKey !== ''
+            ? [config.pinnedPublicKey]
+            : [];
+    return b64s.map((b64, i) => ({ keyId: `pinned-${i + 1}`, bytes: new Uint8Array(Buffer.from(b64, 'base64')) }));
+}
+/** The strongkeep state dir for a harness kind (where undo log + cache live). */
+export function strongkeepDir(kind = 'claude-code') {
+    return layout(kind).strongkeepDir;
+}
+//# sourceMappingURL=init.js.map

package/dist/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA0ClE;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,SAAS,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,+FAA+F;AAC/F,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;AAEjE,8EAA8E;AAC9E,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC,gGAAgG;AAChG,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBrB,CAAC;AAEF,+BAA+B;AAC/B,SAAS,MAAM,CAAC,IAAiB;IAM/B,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,YAAY,EAAE,uBAAuB;YACrC,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,2CAA2C;SACvD,CAAC;IACJ,CAAC;IACD,sFAAsF;IACtF,OAAO;QACL,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,kBAAkB;QAC3B,aAAa,EAAE,oBAAoB;QACnC,SAAS,EAAE,SAAS;KACrB,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,oBAAoB;IACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sDAAsD;AACtD,KAAK,UAAU,YAAY;IACzB,OAAO,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,uBAAuB;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC7C,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhC,uFAAuF;IACvF,MAAM,YAAY,GAAG,KAAK,EAAE,OAAe,EAAE,OAAe,EAAE,SAAiB,EAAiB,EAAE;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7F,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACrD,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,0FAA0F;IAC1F,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,QAAQ,GACZ,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAA6B,CAAC;QAC5G,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QACnE,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,mFAAmF;QACnF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,OAAe,EAAQ,EAAE;YAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,KAAK,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;YACnB,iFAAiF;YACjF,wFAAwF;YACxF,wEAAwE;YACxE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAI,CAAyB,EAAE,KAAK,CAAC;gBACjD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA2B,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;YACxG,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClE,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC,CAAC;QACF,oFAAoF;QACpF,UAAU,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAC7C,UAAU,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAC9C,UAAU,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAC9C,MAAM,YAAY,CAChB,KAAK,CAAC,YAAY,EAClB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACxC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,gEAAgE,CAAC,CAAC,CAAC,qBAAqB,CACpH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,kBAAkB;IAClB,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,6BAA6B,CAAC,CAAC;IAEhH,0FAA0F;IAC1F,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,YAAY,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAChG,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACzD,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,YAAY,CAChB,gDAAgD,EAChD,gBAAgB,EAChB,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,CAAC;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,GAAG,GACP,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAA6B,CAAC;QAC5G,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;QACrE,GAAG,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;QAC5B,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,oCAAoC,CAAC,CAAC;IAC/G,CAAC;IAED,iGAAiG;IACjG,qFAAqF;IACrF,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC;IACpH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ;QACR,uFAAuF;QACvF,2EAA2E;QAC3E,eAAe,EAAE,UAAU,CAAC,CAAC,CAAE;QAC/B,gBAAgB,EAAE,UAAU;QAC5B,2FAA2F;QAC3F,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,oFAAoF;QACpF,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IACF,CAAC;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7F,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC7F,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,2FAA2F;YAC3F,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBACrD,IAAI,EACF,IAAI,CAAC,KAAK,KAAK,SAAS;oBACtB,CAAC,CAAC,qGAAqG;oBACvG,CAAC,CAAC,2FAA2F;aAClG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,MAAM,YAAY,CAChB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC,EACvC,oDAAoD,EACpD,kCAAkC,CACnC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAmBD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAmB,EAAE,OAAoB,aAAa;IAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgB,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,MAAM,IAAI,GACR,MAAM,CAAC,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QACzE,CAAC,CAAC,MAAM,CAAC,gBAAgB;QACzB,CAAC,CAAC,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE;YAC3E,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;YAC1B,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,OAAoB,aAAa;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;AACpC,CAAC"}

package/dist/pipeline.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Apply pipeline — the orchestrator that ties verified entries → autonomy → applier → undo.
+ * This is the runtime the harness hook invokes on each poll (steady state, Journey B step 2).
+ *
+ * For each VERIFIED, parsed entry (from feed-client.pollFeed), for each of its actions:
+ *   1. decideDisposition(action, consumerTier, entryTier)  (autonomy.ts)
+ *   2. report  → surface to the human, no write.
+ *      stage   → applyAction(dryRun:true) → write a 'staged' UndoRecord + a pending diff file
+ *                (the PR-style pending change a human approves via {@link applyStaged}).
+ *      apply   → applyAction(dryRun:false) → append 'applied' UndoRecord.
+ *   3. All apply/stage outcomes append to the audit/undo log; a refused action is counted and
+ *      reported, never silently dropped.
+ *
+ * The pipeline NEVER executes an entry body and NEVER runs feed-supplied text; it only routes
+ * closed-vocabulary actions to allowlisted appliers. Crash-safety (D3): every applier writes
+ * its byte-exact out-of-log BACKUP before touching a target file, so prior state is
+ * recoverable on disk even if the process dies between the write and the log append.
+ */
+import type { ParsedEntry, AutonomyTier } from '@strongkeep/core';
+import type { ApplyContext } from './appliers/applier.js';
+export interface PipelineConfig {
+    consumerTier: AutonomyTier;
+    applyCtx: ApplyContext;
+    /** Directory holding the undo/audit log (+ pending/ staged diffs). */
+    logDir: string;
+}
+/** Summary of one pipeline run for the UI / dashboard heartbeat. */
+export interface PipelineRunSummary {
+    reported: number;
+    staged: number;
+    applied: number;
+    refused: number;
+    /** Plain-language lines for the human (report advisories, refusal reasons, apply summaries). */
+    messages: string[];
+}
+/** Where staged PR-style diffs are written, under the log dir. */
+export declare const PENDING_DIR = "pending";
+/**
+ * Process all verified entries through the autonomy → applier → undo pipeline.
+ * Aggregates per-action failures (refusals) instead of aborting the whole run.
+ */
+export declare function runPipeline(entries: ParsedEntry[], config: PipelineConfig): Promise<PipelineRunSummary>;
+/**
+ * Human-approval path for a staged change: apply a previously-staged record for real and log
+ * the transition under the SAME record id (staged → applied → revertible). This is the
+ * "human applies the PR-style diff" step of the propose tier.
+ */
+export declare function applyStaged(recordId: string, config: PipelineConfig): Promise<{
+    summary: string;
+}>;