@vigil-guard/vge-cc-guard 0.9.0-beta.1

package/dist/shared/blocking-decision-choices.js

@@ -0,0 +1,40 @@
+export const BLOCKING_DECISION_CHOICES = [
+    {
+        key: '1',
+        choice: 'block',
+        label: 'Block',
+        shortLabel: 'block',
+        description: 'fail closed; deny or redact now and keep the content blocked',
+    },
+    {
+        key: '2',
+        choice: 'allow_once',
+        label: 'Allow once',
+        shortLabel: 'allow once',
+        description: 'allow only this exact hook call; ask again next time',
+    },
+    {
+        key: '3',
+        choice: 'allow_session',
+        label: 'Allow session',
+        shortLabel: 'allow session',
+        description: 'allow this exact resource until this session ends',
+    },
+];
+export function choiceFromDecisionKey(input) {
+    const normalized = input.trim();
+    return BLOCKING_DECISION_CHOICES.find((option) => option.key === normalized)?.choice ?? null;
+}
+export function decisionKeyForChoice(choice) {
+    const option = BLOCKING_DECISION_CHOICES.find((candidate) => candidate.choice === choice);
+    if (!option)
+        throw new Error(`unknown blocking decision choice: ${choice}`);
+    return option.key;
+}
+export function labelForDecisionChoice(choice) {
+    const option = BLOCKING_DECISION_CHOICES.find((candidate) => candidate.choice === choice);
+    if (!option)
+        throw new Error(`unknown blocking decision choice: ${choice}`);
+    return option.label;
+}
+//# sourceMappingURL=blocking-decision-choices.js.map

package/dist/shared/blocking-decision-choices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocking-decision-choices.js","sourceRoot":"","sources":["../../src/shared/blocking-decision-choices.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,yBAAyB,GAA4C;IAChF;QACE,GAAG,EAAE,GAAG;QACR,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,OAAO;QACnB,WAAW,EAAE,8DAA8D;KAC5E;IACD;QACE,GAAG,EAAE,GAAG;QACR,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,YAAY;QACxB,WAAW,EAAE,sDAAsD;KACpE;IACD;QACE,GAAG,EAAE,GAAG;QACR,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE,eAAe;QACtB,UAAU,EAAE,eAAe;QAC3B,WAAW,EAAE,mDAAmD;KACjE;CACF,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAA8B;IACjE,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1F,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,GAAG,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1F,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC"}

package/dist/shared/blocking-decision-reply.d.ts

@@ -0,0 +1,13 @@
+import type { BlockingDecisionChoice } from './types.js';
+export type ParsedBlockingDecisionReply = {
+    matched: true;
+    choice: BlockingDecisionChoice;
+    decisionId: string | null;
+    residual: string;
+    exact: boolean;
+} | {
+    matched: false;
+    looksLikeDecision: boolean;
+};
+export declare function parseBlockingDecisionReply(prompt: string): ParsedBlockingDecisionReply;
+//# sourceMappingURL=blocking-decision-reply.d.ts.map

package/dist/shared/blocking-decision-reply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocking-decision-reply.d.ts","sourceRoot":"","sources":["../../src/shared/blocking-decision-reply.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAWzD,MAAM,MAAM,2BAA2B,GACnC;IACE,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB,GACD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAA;CAAE,CAAC;AAsBnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CA4DtF"}

package/dist/shared/blocking-decision-reply.js

@@ -0,0 +1,78 @@
+import { choiceFromDecisionKey } from './blocking-decision-choices.js';
+const DECISION_COMMAND_WINDOW = 4096;
+const DECISION_ID_PATTERN = 'dec_[A-Za-z0-9_-]{16,}';
+const EXACT_DECISION_COMMAND_PATTERN = new RegExp(`^vge\\s+(allow-session|allow|block)\\s+(${DECISION_ID_PATTERN})(?:\\s+([\\s\\S]*))?$`, 'i');
+const VGE_DECISION_PREFIX_PATTERN = /^vge\s+(?:allow-session|allow|block)(?:\s|$)/i;
+function boundedCommandText(prompt) {
+    return prompt.slice(0, DECISION_COMMAND_WINDOW).trim();
+}
+function exactCommandChoice(verb) {
+    const normalized = verb.toLowerCase();
+    if (normalized === 'allow-session')
+        return 'allow_session';
+    if (normalized === 'allow')
+        return 'allow_once';
+    return 'block';
+}
+function looksLikeDecisionText(trimmed) {
+    return (/^(?:1|2|3)(?:\s|$)/.test(trimmed) ||
+        /^block$/i.test(trimmed) ||
+        /^(?:allow(?:-|\s+|_)once|allow(?:-|\s+|_)session|allow\s+for\s+session)(?:\s|$)/i.test(trimmed) ||
+        VGE_DECISION_PREFIX_PATTERN.test(trimmed));
+}
+export function parseBlockingDecisionReply(prompt) {
+    const trimmed = boundedCommandText(prompt);
+    const exact = trimmed.match(EXACT_DECISION_COMMAND_PATTERN);
+    if (exact) {
+        const verb = exact[1] ?? 'block';
+        const decisionId = exact[2] ?? null;
+        const residual = exactCommandChoice(verb) === 'block' ? '' : (exact[3]?.trim() ?? '');
+        return {
+            matched: true,
+            choice: exactCommandChoice(verb),
+            decisionId,
+            residual,
+            exact: true,
+        };
+    }
+    if (VGE_DECISION_PREFIX_PATTERN.test(trimmed)) {
+        return { matched: false, looksLikeDecision: true };
+    }
+    const numericChoice = choiceFromDecisionKey(trimmed.split(/\s+/, 1)[0] ?? '');
+    if (numericChoice === 'block' && trimmed === '1') {
+        return { matched: true, choice: 'block', decisionId: null, residual: '', exact: false };
+    }
+    if (numericChoice === 'allow_once' && /^2(?:\s+([\s\S]*))?$/.test(trimmed)) {
+        const residual = trimmed.match(/^2(?:\s+([\s\S]*))?$/)?.[1]?.trim() ?? '';
+        return { matched: true, choice: 'allow_once', decisionId: null, residual, exact: false };
+    }
+    if (numericChoice === 'allow_session' && /^3(?:\s+([\s\S]*))?$/.test(trimmed)) {
+        const residual = trimmed.match(/^3(?:\s+([\s\S]*))?$/)?.[1]?.trim() ?? '';
+        return { matched: true, choice: 'allow_session', decisionId: null, residual, exact: false };
+    }
+    const allowSession = trimmed.match(/^(?:(?:vge\s+)?allow(?:-|\s+|_)session|(?:vge\s+)?allow\s+for\s+session)(?:\s+([\s\S]*))?$/i);
+    if (allowSession) {
+        return {
+            matched: true,
+            choice: 'allow_session',
+            decisionId: null,
+            residual: allowSession[1]?.trim() ?? '',
+            exact: false,
+        };
+    }
+    const allowOnce = trimmed.match(/^(?:(?:vge\s+)?allow(?:-|\s+|_)once)(?:\s+([\s\S]*))?$/i);
+    if (allowOnce) {
+        return {
+            matched: true,
+            choice: 'allow_once',
+            decisionId: null,
+            residual: allowOnce[1]?.trim() ?? '',
+            exact: false,
+        };
+    }
+    if (/^(?:vge\s+)?block$/i.test(trimmed)) {
+        return { matched: true, choice: 'block', decisionId: null, residual: '', exact: false };
+    }
+    return { matched: false, looksLikeDecision: looksLikeDecisionText(trimmed) };
+}
+//# sourceMappingURL=blocking-decision-reply.js.map

package/dist/shared/blocking-decision-reply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocking-decision-reply.js","sourceRoot":"","sources":["../../src/shared/blocking-decision-reply.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AACrD,MAAM,8BAA8B,GAAG,IAAI,MAAM,CAC/C,2CAA2C,mBAAmB,wBAAwB,EACtF,GAAG,CACJ,CAAC;AACF,MAAM,2BAA2B,GAAG,+CAA+C,CAAC;AAYpF,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,UAAU,KAAK,eAAe;QAAE,OAAO,eAAe,CAAC;IAC3D,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,OAAO,CACL,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,kFAAkF,CAAC,IAAI,CAAC,OAAO,CAAC;QAChG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;QACjC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAChC,UAAU;YACV,QAAQ;YACR,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,aAAa,KAAK,OAAO,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,aAAa,KAAK,YAAY,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,aAAa,KAAK,eAAe,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,6FAA6F,CAAC,CAAC;IAClI,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC3F,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACpC,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;AAC/E,CAAC"}

package/dist/shared/build-stamp.d.ts

@@ -0,0 +1,7 @@
+export interface BuildStamp {
+    binaryPath: string;
+    binarySha256: string;
+    packageVersion: string;
+}
+export declare function currentBuildStamp(binaryPath?: string): BuildStamp;
+//# sourceMappingURL=build-stamp.d.ts.map

package/dist/shared/build-stamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-stamp.d.ts","sourceRoot":"","sources":["../../src/shared/build-stamp.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,UAAU,CASjE"}

package/dist/shared/build-stamp.js

@@ -0,0 +1,23 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+export function currentBuildStamp(binaryPath) {
+    const resolvedBinaryPath = fs.realpathSync(binaryPath ?? process.argv[1] ?? process.execPath);
+    const binarySha256 = crypto.createHash('sha256').update(fs.readFileSync(resolvedBinaryPath)).digest('hex');
+    return {
+        binaryPath: resolvedBinaryPath,
+        binarySha256,
+        packageVersion: readPackageVersion(),
+    };
+}
+function readPackageVersion() {
+    const modulePath = fileURLToPath(import.meta.url);
+    const packagePath = path.resolve(path.dirname(modulePath), '../../package.json');
+    const parsed = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+    if (typeof parsed.version !== 'string' || parsed.version.trim() === '') {
+        throw new Error('package.json does not contain a version');
+    }
+    return parsed.version;
+}
+//# sourceMappingURL=build-stamp.js.map

package/dist/shared/build-stamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-stamp.js","sourceRoot":"","sources":["../../src/shared/build-stamp.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAQpC,MAAM,UAAU,iBAAiB,CAAC,UAAmB;IACnD,MAAM,kBAAkB,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE3G,OAAO;QACL,UAAU,EAAE,kBAAkB;QAC9B,YAAY;QACZ,cAAc,EAAE,kBAAkB,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAA0B,CAAC;IACzF,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC"}

package/dist/shared/config-io.d.ts

@@ -0,0 +1,41 @@
+import { type Config } from './config-schema.js';
+export declare function resolveConfigPath(): string;
+export declare function loadActiveConfigFromString(raw: string): Config;
+export declare function loadActiveConfig(): Config;
+export declare function readConfigOrDefault(): Config;
+export declare function readConfigStrict(): Config;
+export type SaveOk = {
+    ok: true;
+    path: string;
+    backupPath: string | null;
+};
+export type SaveErr = {
+    ok: false;
+    error: 'schema' | 'io';
+    message: string;
+    details?: unknown;
+};
+export type SaveOutcome = SaveOk | SaveErr;
+export declare function saveConfig(next: Config): SaveOutcome;
+export interface RedactedConfig {
+    version: string;
+    vge: {
+        api_url: string;
+        client_id: string;
+        client_id_source: Config['vge']['client_id_source'];
+        api_key_input: string;
+        api_key_output: string;
+        verified_at: string;
+    };
+    tools: Config['tools'];
+    policy: Config['policy'];
+}
+export declare function writeRedactedExport(c: Config): {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    message: string;
+};
+export declare function redactConfig(c: Config): RedactedConfig;
+//# sourceMappingURL=config-io.d.ts.map

package/dist/shared/config-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-io.d.ts","sourceRoot":"","sources":["../../src/shared/config-io.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgC,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/E,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAGzC;AAED,MAAM,MAAM,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAC3E,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3C,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAqCpD;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE;QACH,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACpD,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;CAC1B;AAYD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAW1G;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,cAAc,CAetD"}

package/dist/shared/config-io.js

@@ -0,0 +1,105 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { configSchema, DEFAULT_CONFIG } from './config-schema.js';
+import { chmodPrivateSync, writePrivateFileSync } from './private-file.js';
+export function resolveConfigPath() {
+    const dir = process.env['VGE_CC_GUARD_CONFIG_DIR'];
+    return dir
+        ? path.join(dir, 'config.json')
+        : path.join(os.homedir(), '.vge-cc-guard', 'config.json');
+}
+export function loadActiveConfigFromString(raw) {
+    return configSchema.parse(JSON.parse(raw));
+}
+export function loadActiveConfig() {
+    const p = resolveConfigPath();
+    if (!fs.existsSync(p))
+        return configSchema.parse(DEFAULT_CONFIG);
+    return loadActiveConfigFromString(fs.readFileSync(p, 'utf8'));
+}
+export function readConfigOrDefault() {
+    return loadActiveConfig();
+}
+export function readConfigStrict() {
+    const p = resolveConfigPath();
+    return loadActiveConfigFromString(fs.readFileSync(p, 'utf8'));
+}
+export function saveConfig(next) {
+    const parsed = configSchema.safeParse(next);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            error: 'schema',
+            message: 'config failed schema validation',
+            details: parsed.error.flatten(),
+        };
+    }
+    const target = resolveConfigPath();
+    const tmp = target + '.tmp';
+    const bak = target + '.bak';
+    const json = JSON.stringify(parsed.data, null, 2);
+    try {
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        writePrivateFileSync(tmp, json);
+        const previous = fs.existsSync(target) ? fs.readFileSync(target) : null;
+        fs.renameSync(tmp, target);
+        chmodPrivateSync(target);
+        if (previous) {
+            writePrivateFileSync(bak, previous);
+        }
+        return { ok: true, path: target, backupPath: previous ? bak : null };
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch { /* tmp may not exist */ }
+        return {
+            ok: false,
+            error: 'io',
+            message: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+function redactKey(k) {
+    if (!k)
+        return '(not set)';
+    const m = /^(vg_(?:test|live)_)(.{0,})$/.exec(k);
+    if (!m)
+        return '(invalid format)';
+    const tail = m[2] ?? '';
+    if (tail.length <= 4)
+        return `${m[1]}****`;
+    const stars = '*'.repeat(Math.max(4, Math.min(tail.length - 4, 20)));
+    return `${m[1]}${stars}${tail.slice(-4)}`;
+}
+export function writeRedactedExport(c) {
+    try {
+        const dir = path.dirname(resolveConfigPath());
+        fs.mkdirSync(dir, { recursive: true });
+        const file = path.join(dir, `config.export-${Date.now()}.txt`);
+        const body = JSON.stringify(redactConfig(c), null, 2);
+        writePrivateFileSync(file, body);
+        return { ok: true, path: file };
+    }
+    catch (err) {
+        return { ok: false, message: err instanceof Error ? err.message : String(err) };
+    }
+}
+export function redactConfig(c) {
+    return {
+        version: c.version,
+        vge: {
+            api_url: c.vge.api_url,
+            client_id: c.vge.client_id || '(not set)',
+            client_id_source: c.vge.client_id_source,
+            api_key_input: redactKey(c.vge.api_key_input),
+            api_key_output: c.vge.api_key_output === null ? '(reuses Input)' : redactKey(c.vge.api_key_output),
+            verified_at: c.vge.verified_at ?? '(never)',
+        },
+        tools: c.tools,
+        policy: c.policy,
+    };
+}
+//# sourceMappingURL=config-io.js.map

package/dist/shared/config-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-io.js","sourceRoot":"","sources":["../../src/shared/config-io.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAe,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE3E,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACnD,OAAO,GAAG;QACR,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,OAAO,0BAA0B,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC9B,OAAO,0BAA0B,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,iCAAiC;YAC1C,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExD,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEzB,IAAI,QAAQ,EAAE,CAAC;YACb,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAgBD,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IAC3B,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC9C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,EAAE;YACH,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO;YACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW;YACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB;YACxC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;YAC7C,cAAc,EACZ,CAAC,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;YACpF,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,SAAS;SAC5C;QACD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC;AACJ,CAAC"}