@trenchwork/erosolar 1.1.28 → 1.1.30

package/dist/core/usageTracker.js

@@ -1,128 +0,0 @@
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-const AUTH_FILE = path.join(os.homedir(), '.erosolar', 'auth.json');
-const PROJECT_ID = 'erosolar-1b0db';
-export async function reportUsageToFirebase(inputTokens, outputTokens) {
-    if (inputTokens === 0 && outputTokens === 0)
-        return;
-    try {
-        if (!fs.existsSync(AUTH_FILE))
-            return;
-        const data = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
-        if (!data.authenticated || !data.uid || !data.token)
-            return;
-        const url = `https://firestore.googleapis.com/v1/projects/${PROJECT_ID}/databases/(default)/documents:commit`;
-        const payload = {
-            writes: [
-                {
-                    transform: {
-                        document: `projects/${PROJECT_ID}/databases/(default)/documents/users/${data.uid}`,
-                        fieldTransforms: [
-                            {
-                                fieldPath: "inputTokens",
-                                increment: { integerValue: String(inputTokens) }
-                            },
-                            {
-                                fieldPath: "outputTokens",
-                                increment: { integerValue: String(outputTokens) }
-                            },
-                            {
-                                fieldPath: "totalTokens",
-                                increment: { integerValue: String(inputTokens + outputTokens) }
-                            }
-                        ]
-                    }
-                }
-            ]
-        };
-        // We do not await this critically to avoid blocking CLI flow, but since we are within an async function, we can await it
-        // Or we catch errors silently.
-        const response = await fetch(url, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${data.token}`
-            },
-            body: JSON.stringify(payload)
-        });
-        if (!response.ok) {
-            // If it fails with 404 NOT_FOUND, it might mean the document doesn't exist at all yet.
-            // We should create it first via a PATCH request if it doesn't exist.
-            if (response.status === 404 || response.status === 400) {
-                await createInitialDocument(data.uid, data.token, inputTokens, outputTokens);
-            }
-        }
-    }
-    catch (err) {
-        // Silent fail in CLI for telemetry
-    }
-}
-/**
- * Fetch the signed-in user's `users/{uid}` document and return their balance
- * in microdollars (1e-6 USD), or `null` if unavailable. Best-effort: returns
- * `null` on auth errors, network errors, or timeout — never throws.
- *
- * Used by the launch banner. The caller should pass a tight timeout (e.g.
- * 800ms) so a slow network doesn't block startup.
- */
-export async function fetchUserBalanceMicrodollars(timeoutMs = 1500) {
-    try {
-        if (!fs.existsSync(AUTH_FILE))
-            return null;
-        const data = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
-        if (!data.authenticated || !data.uid || !data.token)
-            return null;
-        const url = `https://firestore.googleapis.com/v1/projects/${PROJECT_ID}/databases/(default)/documents/users/${data.uid}`;
-        const ctrl = new AbortController();
-        const timer = setTimeout(() => ctrl.abort(), timeoutMs);
-        let res;
-        try {
-            res = await fetch(url, {
-                headers: { 'Authorization': `Bearer ${data.token}` },
-                signal: ctrl.signal,
-            });
-        }
-        finally {
-            clearTimeout(timer);
-        }
-        if (!res.ok)
-            return null;
-        const body = await res.json();
-        const f = body?.fields;
-        if (!f)
-            return null;
-        if (f.balanceMicrodollars?.integerValue != null)
-            return parseInt(f.balanceMicrodollars.integerValue, 10);
-        if (typeof f.balanceMicrodollars?.doubleValue === 'number')
-            return Math.round(f.balanceMicrodollars.doubleValue);
-        // Legacy: cents-based credits → microdollars (1 cent = 10_000 µ$).
-        if (f.credits?.integerValue != null)
-            return parseInt(f.credits.integerValue, 10) * 10_000;
-        if (typeof f.credits?.doubleValue === 'number')
-            return Math.round(f.credits.doubleValue * 10_000);
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-async function createInitialDocument(uid, token, inputTokens, outputTokens) {
-    const url = `https://firestore.googleapis.com/v1/projects/${PROJECT_ID}/databases/(default)/documents/users/${uid}`;
-    const payload = {
-        fields: {
-            inputTokens: { integerValue: String(inputTokens) },
-            outputTokens: { integerValue: String(outputTokens) },
-            totalTokens: { integerValue: String(inputTokens + outputTokens) }
-        }
-    };
-    await fetch(url, {
-        method: 'PATCH',
-        headers: {
-            'Content-Type': 'application/json',
-            'Authorization': `Bearer ${token}`
-        },
-        body: JSON.stringify(payload)
-    });
-}
-//# sourceMappingURL=usageTracker.js.map

package/dist/core/usageTracker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"usageTracker.js","sourceRoot":"","sources":["../../src/core/usageTracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AACpE,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAQpC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB,EAAE,YAAoB;IACnF,IAAI,WAAW,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO;IAEpD,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAEtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAa,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QAE5D,MAAM,GAAG,GAAG,gDAAgD,UAAU,uCAAuC,CAAC;QAC9G,MAAM,OAAO,GAAG;YACd,MAAM,EAAE;gBACN;oBACE,SAAS,EAAE;wBACT,QAAQ,EAAE,YAAY,UAAU,wCAAwC,IAAI,CAAC,GAAG,EAAE;wBAClF,eAAe,EAAE;4BACf;gCACE,SAAS,EAAE,aAAa;gCACxB,SAAS,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE;6BACjD;4BACD;gCACE,SAAS,EAAE,cAAc;gCACzB,SAAS,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;6BAClD;4BACD;gCACE,SAAS,EAAE,aAAa;gCACxB,SAAS,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC,EAAE;6BAChE;yBACF;qBACF;iBACF;aACF;SACF,CAAC;QAEF,yHAAyH;QACzH,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,uFAAuF;YACvF,qEAAqE;YACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mCAAmC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,SAAS,GAAG,IAAI;IACjE,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAa,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAEjE,MAAM,GAAG,GAAG,gDAAgD,UAAU,wCAAwC,IAAI,CAAC,GAAG,EAAE,CAAC;QACzH,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;gBACpD,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAK1B,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,mBAAmB,EAAE,YAAY,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzG,IAAI,OAAO,CAAC,CAAC,mBAAmB,EAAE,WAAW,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACjH,mEAAmE;QACnE,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;QAC1F,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,KAAa,EAAE,WAAmB,EAAE,YAAoB;IACxG,MAAM,GAAG,GAAG,gDAAgD,UAAU,wCAAwC,GAAG,EAAE,CAAC;IACpH,MAAM,OAAO,GAAG;QACd,MAAM,EAAE;YACN,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE;YAClD,YAAY,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;YACpD,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC,EAAE;SAClE;KACF,CAAC;IAEF,MAAM,KAAK,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,OAAO;QACf,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU,KAAK,EAAE;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC"}

package/dist/core/userApproval.d.ts

@@ -1,95 +0,0 @@
-/**
- * Approved-user gate.
- *
- * The CLI ships offsec capabilities (Kali tools, AFL++, gdb, pwntools,
- * Ghidra MCP wiring). To prevent random Google accounts from picking
- * up the package and burning the shared key on toy targets, every
- * launch checks the user's email against `approved_users/{email}` in
- * Firestore. Misses get a `approval_requests/{uid}` doc written for
- * the operator to review, then the CLI exits with an explanatory
- * message.
- *
- * SSO is enforced two ways:
- *   1. The web sign-in page only offers Google.
- *   2. Firestore rules also check `request.auth.token.firebase.sign_in_provider == 'google.com'`
- *      so a non-SSO token (anonymous, password) can't read the
- *      approved_users doc — defense in depth.
- *
- * Email is the canonical identity here, lowercased + trimmed. UID is
- * recorded on the request doc so the admin can correlate but not used
- * as the primary key (UIDs are opaque; humans review by email).
- */
-export interface ApprovalResult {
-    approved: boolean;
-    email: string | null;
-    uid: string | null;
-    reason?: string;
-    revoked?: boolean;
-    profilesAllowed?: string[];
-}
-export declare function normalizeEmail(email: string): string;
-/**
- * Verify the currently-signed-in user is on the approved list.
- * Side-effect free; just reads. Errors are surfaced as `approved: false`
- * with a reason so the caller can decide whether to file a request
- * doc and/or surface the message.
- *
- * Optional `profile` arg restricts the check: if set, the user's
- * `profiles_allowed` must include either `*` (all) or this profile
- * name. Missing `profiles_allowed` is treated as permissive for
- * backward compatibility with the initial bootstrap docs that
- * predate the field. New approvals via `scripts/approve-user.mjs`
- * default to `['erosolar-code']` only — offsec profiles like
- * `variant-research` require an explicit grant.
- */
-export declare function checkApproval(profile?: string): Promise<ApprovalResult>;
-/**
- * Idempotently write `approval_requests/{uid}` so the admin sees a
- * pending request. Firestore rules let any authenticated user PATCH
- * their own request doc but no one can read a sibling's. Returning
- * `ok: true` doesn't mean approved — only that the request landed.
- */
-export declare function requestApproval(): Promise<{
-    ok: boolean;
-    reason?: string;
-}>;
-export interface ReviewerLogEntry {
-    toolName: string;
-    decision: 'approve' | 'refine' | 'veto';
-    reason: string;
-    source: 'heuristic' | 'llm' | 'disabled' | 'error';
-    /** Truncated/redacted args summary — full args are NOT logged. */
-    argsSummary: string;
-}
-/**
- * Append a reviewer-decision audit entry at
- * `reviewer_log/{uid}/decisions/{id}`. Best-effort: a failure here
- * doesn't block the agent (the in-process veto already happened).
- *
- * `argsSummary` is a short, sanitized rendering of the proposed args
- * — we deliberately do NOT log full args because they may contain
- * tokens or PII the user expected to stay local.
- */
-export declare function writeReviewerLog(entry: ReviewerLogEntry): Promise<{
-    ok: boolean;
-    reason?: string;
-}>;
-export interface UsageLogEntry {
-    profile: string;
-    model: string;
-    version: string;
-    platform: string;
-}
-/**
- * Append an audit-log entry at `usage_logs/{uid}/sessions/{sessionId}`.
- * Best-effort: a Firestore failure does NOT block the user's session
- * — logging is observability, not a runtime gate. Schema is
- * deliberately minimal (no prompt content, no env): just session
- * metadata so the operator can review patterns and detect abuse
- * without retaining user-visible content.
- */
-export declare function writeUsageLog(entry: UsageLogEntry): Promise<{
-    ok: boolean;
-    reason?: string;
-}>;
-//# sourceMappingURL=userApproval.d.ts.map

package/dist/core/userApproval.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"userApproval.d.ts","sourceRoot":"","sources":["../../src/core/userApproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AA6CD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA6C7E;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BjF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC;IACnD,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCzG;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCnG"}

package/dist/core/userApproval.js

@@ -1,239 +0,0 @@
-/**
- * Approved-user gate.
- *
- * The CLI ships offsec capabilities (Kali tools, AFL++, gdb, pwntools,
- * Ghidra MCP wiring). To prevent random Google accounts from picking
- * up the package and burning the shared key on toy targets, every
- * launch checks the user's email against `approved_users/{email}` in
- * Firestore. Misses get a `approval_requests/{uid}` doc written for
- * the operator to review, then the CLI exits with an explanatory
- * message.
- *
- * SSO is enforced two ways:
- *   1. The web sign-in page only offers Google.
- *   2. Firestore rules also check `request.auth.token.firebase.sign_in_provider == 'google.com'`
- *      so a non-SSO token (anonymous, password) can't read the
- *      approved_users doc — defense in depth.
- *
- * Email is the canonical identity here, lowercased + trimmed. UID is
- * recorded on the request doc so the admin can correlate but not used
- * as the primary key (UIDs are opaque; humans review by email).
- */
-import { FIREBASE_PROJECT_ID, getAuthStatus, getValidIdToken } from './auth.js';
-const FIRESTORE_BASE = `https://firestore.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/databases/(default)/documents`;
-export function normalizeEmail(email) {
-    return email.trim().toLowerCase();
-}
-function readArrayOfStrings(field) {
-    const arr = field?.arrayValue?.values;
-    if (!Array.isArray(arr))
-        return undefined;
-    return arr
-        .map((v) => v.stringValue)
-        .filter((v) => typeof v === 'string');
-}
-async function fetchApprovalDoc(email) {
-    const idToken = await getValidIdToken();
-    const url = `${FIRESTORE_BASE}/approved_users/${encodeURIComponent(email)}`;
-    const res = await fetch(url, {
-        headers: { Authorization: `Bearer ${idToken}`, Accept: 'application/json' },
-    });
-    if (res.status === 404)
-        return null;
-    if (!res.ok) {
-        const body = await res.text().catch(() => '<no body>');
-        throw new Error(`Firestore ${res.status} reading approved_users/${email}: ${body.slice(0, 200)}`);
-    }
-    const doc = (await res.json());
-    const approved = doc.fields?.['approved']?.booleanValue === true;
-    const revoked = doc.fields?.['revoked']?.booleanValue === true;
-    const profilesAllowed = readArrayOfStrings(doc.fields?.['profiles_allowed']);
-    return { approved, revoked, profilesAllowed };
-}
-/**
- * Verify the currently-signed-in user is on the approved list.
- * Side-effect free; just reads. Errors are surfaced as `approved: false`
- * with a reason so the caller can decide whether to file a request
- * doc and/or surface the message.
- *
- * Optional `profile` arg restricts the check: if set, the user's
- * `profiles_allowed` must include either `*` (all) or this profile
- * name. Missing `profiles_allowed` is treated as permissive for
- * backward compatibility with the initial bootstrap docs that
- * predate the field. New approvals via `scripts/approve-user.mjs`
- * default to `['erosolar-code']` only — offsec profiles like
- * `variant-research` require an explicit grant.
- */
-export async function checkApproval(profile) {
-    const status = getAuthStatus();
-    if (!status.authenticated) {
-        return { approved: false, email: null, uid: null, reason: 'not signed in' };
-    }
-    const email = status.email ? normalizeEmail(status.email) : null;
-    const uid = status.uid ?? null;
-    if (!email) {
-        return { approved: false, email, uid, reason: 'no email on auth token (SSO required)' };
-    }
-    try {
-        const doc = await fetchApprovalDoc(email);
-        if (!doc) {
-            return { approved: false, email, uid, reason: 'email not on approved-users list' };
-        }
-        if (!doc.approved) {
-            return { approved: false, email, uid, reason: 'email not on approved-users list' };
-        }
-        if (doc.revoked) {
-            return {
-                approved: false,
-                email,
-                uid,
-                reason: 'access revoked — contact the operator',
-                revoked: true,
-                profilesAllowed: doc.profilesAllowed,
-            };
-        }
-        if (profile && doc.profilesAllowed && doc.profilesAllowed.length > 0) {
-            const allowed = doc.profilesAllowed.includes('*') || doc.profilesAllowed.includes(profile);
-            if (!allowed) {
-                return {
-                    approved: false,
-                    email,
-                    uid,
-                    reason: `profile "${profile}" not granted to this account (allowed: ${doc.profilesAllowed.join(', ')})`,
-                    profilesAllowed: doc.profilesAllowed,
-                };
-            }
-        }
-        return { approved: true, email, uid, profilesAllowed: doc.profilesAllowed };
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        return { approved: false, email, uid, reason: `approval check failed: ${msg}` };
-    }
-}
-/**
- * Idempotently write `approval_requests/{uid}` so the admin sees a
- * pending request. Firestore rules let any authenticated user PATCH
- * their own request doc but no one can read a sibling's. Returning
- * `ok: true` doesn't mean approved — only that the request landed.
- */
-export async function requestApproval() {
-    const status = getAuthStatus();
-    if (!status.authenticated || !status.uid) {
-        return { ok: false, reason: 'not signed in' };
-    }
-    try {
-        const idToken = await getValidIdToken();
-        const url = `${FIRESTORE_BASE}/approval_requests/${encodeURIComponent(status.uid)}`;
-        const body = {
-            fields: {
-                email: { stringValue: status.email ?? '' },
-                uid: { stringValue: status.uid },
-                requestedAt: { timestampValue: new Date().toISOString() },
-                status: { stringValue: 'pending' },
-            },
-        };
-        const res = await fetch(url, {
-            method: 'PATCH',
-            headers: { Authorization: `Bearer ${idToken}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify(body),
-        });
-        if (!res.ok) {
-            const txt = await res.text().catch(() => '<no body>');
-            return { ok: false, reason: `Firestore ${res.status}: ${txt.slice(0, 200)}` };
-        }
-        return { ok: true };
-    }
-    catch (err) {
-        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    }
-}
-/**
- * Append a reviewer-decision audit entry at
- * `reviewer_log/{uid}/decisions/{id}`. Best-effort: a failure here
- * doesn't block the agent (the in-process veto already happened).
- *
- * `argsSummary` is a short, sanitized rendering of the proposed args
- * — we deliberately do NOT log full args because they may contain
- * tokens or PII the user expected to stay local.
- */
-export async function writeReviewerLog(entry) {
-    const status = getAuthStatus();
-    if (!status.authenticated || !status.uid) {
-        return { ok: false, reason: 'not signed in' };
-    }
-    try {
-        const idToken = await getValidIdToken();
-        const id = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-        const url = `${FIRESTORE_BASE}/reviewer_log/${encodeURIComponent(status.uid)}/decisions?documentId=${encodeURIComponent(id)}`;
-        const body = {
-            fields: {
-                uid: { stringValue: status.uid },
-                email: { stringValue: status.email ?? '' },
-                loggedAt: { timestampValue: new Date().toISOString() },
-                toolName: { stringValue: entry.toolName },
-                decision: { stringValue: entry.decision },
-                reason: { stringValue: entry.reason.slice(0, 200) },
-                source: { stringValue: entry.source },
-                argsSummary: { stringValue: entry.argsSummary.slice(0, 500) },
-            },
-        };
-        const res = await fetch(url, {
-            method: 'POST',
-            headers: { Authorization: `Bearer ${idToken}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify(body),
-        });
-        if (!res.ok) {
-            const txt = await res.text().catch(() => '<no body>');
-            return { ok: false, reason: `Firestore ${res.status}: ${txt.slice(0, 200)}` };
-        }
-        return { ok: true };
-    }
-    catch (err) {
-        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    }
-}
-/**
- * Append an audit-log entry at `usage_logs/{uid}/sessions/{sessionId}`.
- * Best-effort: a Firestore failure does NOT block the user's session
- * — logging is observability, not a runtime gate. Schema is
- * deliberately minimal (no prompt content, no env): just session
- * metadata so the operator can review patterns and detect abuse
- * without retaining user-visible content.
- */
-export async function writeUsageLog(entry) {
-    const status = getAuthStatus();
-    if (!status.authenticated || !status.uid) {
-        return { ok: false, reason: 'not signed in' };
-    }
-    try {
-        const idToken = await getValidIdToken();
-        const sessionId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-        const url = `${FIRESTORE_BASE}/usage_logs/${encodeURIComponent(status.uid)}/sessions?documentId=${encodeURIComponent(sessionId)}`;
-        const body = {
-            fields: {
-                uid: { stringValue: status.uid },
-                email: { stringValue: status.email ?? '' },
-                startedAt: { timestampValue: new Date().toISOString() },
-                profile: { stringValue: entry.profile },
-                model: { stringValue: entry.model },
-                version: { stringValue: entry.version },
-                platform: { stringValue: entry.platform },
-            },
-        };
-        const res = await fetch(url, {
-            method: 'POST',
-            headers: { Authorization: `Bearer ${idToken}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify(body),
-        });
-        if (!res.ok) {
-            const txt = await res.text().catch(() => '<no body>');
-            return { ok: false, reason: `Firestore ${res.status}: ${txt.slice(0, 200)}` };
-        }
-        return { ok: true };
-    }
-    catch (err) {
-        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    }
-}
-//# sourceMappingURL=userApproval.js.map

package/dist/core/userApproval.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"userApproval.js","sourceRoot":"","sources":["../../src/core/userApproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEhF,MAAM,cAAc,GAAG,gDAAgD,mBAAmB,gCAAgC,CAAC;AAW3H,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAaD,SAAS,kBAAkB,CAAC,KAAsB;IAChD,MAAM,GAAG,GAAG,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,GAAG;SACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACvD,CAAC;AAQD,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,cAAc,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KAC5E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,2BAA2B,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC;IAC/D,MAAM,eAAe,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,KAAK;gBACL,GAAG;gBACH,MAAM,EAAE,uCAAuC;gBAC/C,OAAO,EAAE,IAAI;gBACb,eAAe,EAAE,GAAG,CAAC,eAAe;aACrC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3F,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,KAAK;oBACL,GAAG;oBACH,MAAM,EAAE,YAAY,OAAO,2CAA2C,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACvG,eAAe,EAAE,GAAG,CAAC,eAAe;iBACrC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,0BAA0B,GAAG,EAAE,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,cAAc,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG;YACX,MAAM,EAAE;gBACN,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE;gBAC1C,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE;gBAChC,WAAW,EAAE,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;gBACzD,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;aACnC;SACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACnF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,CAAC;AACH,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAuB;IAC5D,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,GAAG,cAAc,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,GAAG;YACX,MAAM,EAAE;gBACN,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE;gBAChC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE;gBAC1C,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;gBACtD,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE;gBACzC,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE;gBACzC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACnD,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE;gBACrC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aAC9D;SACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACnF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,CAAC;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,GAAG,cAAc,eAAe,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClI,MAAM,IAAI,GAAG;YACX,MAAM,EAAE;gBACN,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE;gBAChC,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE;gBAC1C,SAAS,EAAE,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;gBACvD,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE;gBACvC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE;gBACnC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE;gBACvC,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE;aAC1C;SACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACnF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,CAAC;AACH,CAAC"}

package/dist/headless/interactiveShell.d.ts

@@ -1,22 +0,0 @@
-/**
- * Interactive Shell - Full interactive CLI experience with rich UI.
- *
- * Usage:
- *   agi                    # Start interactive shell
- *   agi "initial prompt"   # Start with initial prompt
- *
- * Features:
- * - Rich terminal UI with status bar
- * - Command history
- * - Streaming responses
- * - Tool execution display
- * - Ctrl+C to interrupt
- */
-export interface InteractiveShellOptions {
-    argv: string[];
-}
-/**
- * Run the fully interactive shell with rich UI.
- */
-export declare function runInteractiveShell(options: InteractiveShellOptions): Promise<void>;
-//# sourceMappingURL=interactiveShell.d.ts.map

package/dist/headless/interactiveShell.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"interactiveShell.d.ts","sourceRoot":"","sources":["../../src/headless/interactiveShell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuJH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAMD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDzF"}