@vigil-guard/vge-cc-guard 0.9.0-beta.1

package/dist/shared/config-schema.js

@@ -0,0 +1,281 @@
+import { z } from 'zod';
+import { isValidUrlAllowlistPattern, normalizeUrlAllowlistPattern, } from './url-allowlist.js';
+import { isValidCidr, isValidUrlGlobPattern, isValidUrlHostPattern, isValidUrlScheme, normalizeCidr, normalizeUrlGlobPattern, normalizeUrlHostPattern, normalizeUrlScheme, } from './url-patterns.js';
+import { isSafeVgeApiUrlFromEnv } from './vge-url.js';
+const toolPolicySchema = z.object({
+    gate: z.enum(['allow', 'block', 'ask']),
+    analyze_output: z.boolean(),
+});
+// Trim and strip control bytes — defends against pasted keys that carry a
+// trailing newline or whitespace into the Authorization header.
+const apiKey = z
+    .string()
+    .transform((s) => s.replace(/[\x00-\x1f\x7f]/g, '').trim());
+const clientId = z
+    .string()
+    .default('')
+    .transform((s) => s.replace(/[\x00-\x1f\x7f]/g, '').trim())
+    .pipe(z.string().max(128));
+const clientIdSource = z.enum(['auto', 'manual', 'disabled']).default('auto');
+const vgeApiUrl = z
+    .string()
+    .transform((s) => s.trim())
+    .refine((s) => {
+    try {
+        new URL(s);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, { message: 'api_url must be a valid URL' })
+    .refine(isSafeVgeApiUrlFromEnv, {
+    message: 'api_url must be an HTTPS VGE endpoint; local development endpoints require VGE_ALLOW_DEV_ENDPOINT=1',
+});
+const vgeKeyFingerprint = z.string().regex(/^sha256:[a-f0-9]{64}$/);
+const vgeConfigSchema = z.object({
+    api_url: vgeApiUrl,
+    client_id: clientId,
+    client_id_source: clientIdSource,
+    // Empty string is valid at schema level — daemon starts before user runs `vge-cc-guard config`.
+    // vge-client.ts validates non-empty key at call time.
+    api_key_input: apiKey,
+    api_key_output: apiKey.nullable().default(null),
+    verified_at: z.string().datetime().nullable().default(null),
+    verified_api_url: vgeApiUrl.nullable().default(null),
+    verified_input_key_fingerprint: vgeKeyFingerprint.nullable().default(null),
+    verified_output_key_fingerprint: vgeKeyFingerprint.nullable().default(null),
+    // Keep VGE analysis budgets aligned with the longest daemon-side HITL wait.
+    // Large prompt and attachment scans can be slow; the shim transport default
+    // must stay higher than these budgets.
+    posttool_budget_ms: z.number().int().min(500).max(120_000).default(120_000),
+    pretool_url_budget_ms: z.number().int().min(200).max(120_000).default(120_000),
+    pretool_url_total_deadline_ms: z.number().int().min(500).max(120_000).default(120_000),
+    userprompt_attachment_budget_ms: z.number().int().min(500).max(120_000).default(120_000),
+    userprompt_text_budget_ms: z.number().int().min(500).max(120_000).default(120_000),
+});
+const urlAccessBaselineDefaults = {
+    enabled: true,
+    default_action: 'allow',
+    presets: {
+        cloud_metadata: true,
+        unsafe_url_shapes: true,
+        oob_callback_collectors: false,
+        strict_internal_network: false,
+        public_paste_and_file_drops: false,
+    },
+    custom_deny: {
+        hosts: [],
+        cidrs: [],
+        schemes: [],
+        url_patterns: [],
+    },
+};
+const hostPatternSchema = z
+    .string()
+    .transform(normalizeUrlHostPattern)
+    .refine(isValidUrlHostPattern, {
+    message: 'must be a hostname, wildcard hostname, or IP literal',
+});
+const cidrSchema = z
+    .string()
+    .transform(normalizeCidr)
+    .refine(isValidCidr, {
+    message: 'must be CIDR notation such as 192.168.0.0/16',
+});
+const urlSchemeSchema = z
+    .string()
+    .transform(normalizeUrlScheme)
+    .refine(isValidUrlScheme, {
+    message: 'must be a scheme name without ://',
+});
+const urlGlobPatternSchema = z
+    .string()
+    .transform(normalizeUrlGlobPattern)
+    .refine(isValidUrlGlobPattern, {
+    message: 'must be a simple URL glob, not a regex',
+});
+const urlAccessBaselineSchema = z
+    .object({
+    enabled: z.boolean().default(urlAccessBaselineDefaults.enabled),
+    default_action: z.literal('allow').default(urlAccessBaselineDefaults.default_action),
+    presets: z
+        .object({
+        cloud_metadata: z.boolean().default(urlAccessBaselineDefaults.presets.cloud_metadata),
+        unsafe_url_shapes: z.boolean().default(urlAccessBaselineDefaults.presets.unsafe_url_shapes),
+        oob_callback_collectors: z.boolean().default(urlAccessBaselineDefaults.presets.oob_callback_collectors),
+        strict_internal_network: z.boolean().default(urlAccessBaselineDefaults.presets.strict_internal_network),
+        public_paste_and_file_drops: z.boolean().default(urlAccessBaselineDefaults.presets.public_paste_and_file_drops),
+    })
+        .default(urlAccessBaselineDefaults.presets),
+    custom_deny: z
+        .object({
+        hosts: z.array(hostPatternSchema).default(urlAccessBaselineDefaults.custom_deny.hosts),
+        cidrs: z.array(cidrSchema).default(urlAccessBaselineDefaults.custom_deny.cidrs),
+        schemes: z.array(urlSchemeSchema).default(urlAccessBaselineDefaults.custom_deny.schemes),
+        url_patterns: z
+            .array(urlGlobPatternSchema)
+            .default(urlAccessBaselineDefaults.custom_deny.url_patterns),
+    })
+        .default(urlAccessBaselineDefaults.custom_deny),
+})
+    .default(urlAccessBaselineDefaults);
+const vgeFailureModeDefaults = {
+    prompt_text: 'fail_closed',
+    prompt_attachment: 'fail_closed',
+    posttool_output: 'fail_closed',
+};
+const vgeFailureModeSchema = z
+    .object({
+    prompt_text: z.enum(['fail_closed', 'fail_open']).default(vgeFailureModeDefaults.prompt_text),
+    prompt_attachment: z.enum(['fail_closed', 'fail_open']).default(vgeFailureModeDefaults.prompt_attachment),
+    posttool_output: z.enum(['fail_closed', 'fail_open']).default(vgeFailureModeDefaults.posttool_output),
+})
+    .strict()
+    .default(vgeFailureModeDefaults);
+const vgeOverloadBackpressureDefaults = {
+    posttool_output: {
+        enabled: true,
+        // ADR-0006 keeps cooldowns short, bounded, and sidecar-local.
+        base_cooldown_ms: 2_000,
+        max_cooldown_ms: 10_000,
+        half_open_jitter_min_ms: 250,
+        half_open_jitter_max_ms: 750,
+    },
+};
+const posttoolBackpressureSchema = z
+    .object({
+    enabled: z.boolean().default(vgeOverloadBackpressureDefaults.posttool_output.enabled),
+    base_cooldown_ms: z.number().int().min(0).default(vgeOverloadBackpressureDefaults.posttool_output.base_cooldown_ms),
+    max_cooldown_ms: z.number().int().min(0).default(vgeOverloadBackpressureDefaults.posttool_output.max_cooldown_ms),
+    half_open_jitter_min_ms: z.number().int().min(0).default(vgeOverloadBackpressureDefaults.posttool_output.half_open_jitter_min_ms),
+    half_open_jitter_max_ms: z.number().int().min(0).default(vgeOverloadBackpressureDefaults.posttool_output.half_open_jitter_max_ms),
+})
+    .strict()
+    .refine((value) => value.base_cooldown_ms <= value.max_cooldown_ms, {
+    message: 'base_cooldown_ms must be less than or equal to max_cooldown_ms',
+    path: ['base_cooldown_ms'],
+})
+    .refine((value) => value.half_open_jitter_min_ms <= value.half_open_jitter_max_ms, {
+    message: 'half_open_jitter_min_ms must be less than or equal to half_open_jitter_max_ms',
+    path: ['half_open_jitter_min_ms'],
+});
+const vgeOverloadBackpressureSchema = z
+    .object({
+    posttool_output: posttoolBackpressureSchema.default(vgeOverloadBackpressureDefaults.posttool_output),
+})
+    .strict()
+    .default(vgeOverloadBackpressureDefaults);
+const ccContractDefaults = {
+    auto_probe_enabled: true,
+    auto_probe_timeout_ms: 5_000,
+};
+const ccContractSchema = z
+    .object({
+    auto_probe_enabled: z.boolean().default(ccContractDefaults.auto_probe_enabled),
+    auto_probe_timeout_ms: z.number().int().min(1_000).max(15_000).default(ccContractDefaults.auto_probe_timeout_ms),
+})
+    .strict()
+    .default(ccContractDefaults);
+const policyConfigSchema = z.object({
+    credential_protection: z.boolean().default(true),
+    prompt_text_analysis: z.enum(['enforce', 'off']).default('enforce'),
+    prompt_attachment_analysis: z.enum(['enforce', 'off']).default('enforce'),
+    subagent_output_analysis: z.enum(['enforce', 'off']).default('enforce'),
+    vge_failure_mode: vgeFailureModeSchema,
+    vge_overload_backpressure: vgeOverloadBackpressureSchema,
+    cc_contract: ccContractSchema,
+    session_idle_ttl_hours: z.number().int().min(1).max(168).default(24),
+    // Legacy compatibility field retained so existing config files continue to parse.
+    // PRD_2.5 replacement support is gated by live Claude Code contract status
+    // and per-tool schema support instead.
+    enable_l0_output_replacement: z.boolean().default(true),
+    url_allowlist: z
+        .array(z
+        .string()
+        .transform(normalizeUrlAllowlistPattern)
+        .refine(isValidUrlAllowlistPattern, {
+        message: 'must be a hostname or wildcard hostname pattern such as *.example.com',
+    }))
+        .default([]),
+    url_access_baseline: urlAccessBaselineSchema,
+    // PRD_2 §7.5 — how long the daemon holds a hook open waiting on a TUI
+    // resolver decision. Must stay below the shim transport timeout.
+    decision_timeout_ms: z.number().int().min(5_000).max(120_000).default(120_000),
+    // PRD_2 §7.4 — heartbeat freshness window. If no resolver heartbeat is newer
+    // than this, broker fails closed without enqueuing.
+    resolver_heartbeat_stale_ms: z.number().int().min(2_000).max(60_000).default(10_000),
+});
+export const configSchema = z.object({
+    version: z.literal('1.0.0'),
+    vge: vgeConfigSchema,
+    tools: z.record(z.string(), toolPolicySchema),
+    policy: policyConfigSchema,
+});
+export const DEFAULT_CONFIG = {
+    version: '1.0.0',
+    vge: {
+        api_url: 'https://api.vigilguard',
+        client_id: '',
+        client_id_source: 'auto',
+        api_key_input: '',
+        api_key_output: null,
+        verified_at: null,
+        verified_api_url: null,
+        verified_input_key_fingerprint: null,
+        verified_output_key_fingerprint: null,
+        posttool_budget_ms: 120_000,
+        pretool_url_budget_ms: 120_000,
+        pretool_url_total_deadline_ms: 120_000,
+        userprompt_attachment_budget_ms: 120_000,
+        userprompt_text_budget_ms: 120_000,
+    },
+    tools: {
+        Bash: { gate: 'allow', analyze_output: true },
+        Read: { gate: 'allow', analyze_output: true },
+        Grep: { gate: 'allow', analyze_output: true },
+        Glob: { gate: 'allow', analyze_output: false },
+        WebSearch: { gate: 'allow', analyze_output: true },
+        WebFetch: { gate: 'allow', analyze_output: true },
+        Write: { gate: 'block', analyze_output: false },
+        Edit: { gate: 'block', analyze_output: false },
+        Task: { gate: 'allow', analyze_output: false },
+        '*': { gate: 'ask', analyze_output: false },
+    },
+    policy: {
+        credential_protection: true,
+        prompt_text_analysis: 'enforce',
+        prompt_attachment_analysis: 'enforce',
+        subagent_output_analysis: 'enforce',
+        vge_failure_mode: {
+            prompt_text: 'fail_closed',
+            prompt_attachment: 'fail_closed',
+            posttool_output: 'fail_closed',
+        },
+        vge_overload_backpressure: vgeOverloadBackpressureDefaults,
+        cc_contract: ccContractDefaults,
+        session_idle_ttl_hours: 24,
+        enable_l0_output_replacement: true,
+        url_allowlist: [],
+        url_access_baseline: {
+            enabled: true,
+            default_action: 'allow',
+            presets: {
+                cloud_metadata: true,
+                unsafe_url_shapes: true,
+                oob_callback_collectors: false,
+                strict_internal_network: false,
+                public_paste_and_file_drops: false,
+            },
+            custom_deny: {
+                hosts: [],
+                cidrs: [],
+                schemes: [],
+                url_patterns: [],
+            },
+        },
+        decision_timeout_ms: 120_000,
+        resolver_heartbeat_stale_ms: 10_000,
+    },
+};
+//# sourceMappingURL=config-schema.js.map

package/dist/shared/config-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-schema.js","sourceRoot":"","sources":["../../src/shared/config-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAIH,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,MAAM,GAAG,CAAC;KACb,MAAM,EAAE;KACR,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,OAAO,CAAC,EAAE,CAAC;KACX,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1D,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAE7B,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;IACZ,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;KAC7C,MAAM,CAAC,sBAAsB,EAAE;IAC9B,OAAO,EAAE,qGAAqG;CAC/G,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAEpE,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,QAAQ;IACnB,gBAAgB,EAAE,cAAc;IAChC,gGAAgG;IAChG,sDAAsD;IACtD,aAAa,EAAE,MAAM;IACrB,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3D,gBAAgB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,8BAA8B,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1E,+BAA+B,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,uCAAuC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3E,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9E,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACtF,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxF,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CACnF,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,OAAgB;IAChC,OAAO,EAAE;QACP,cAAc,EAAE,IAAI;QACpB,iBAAiB,EAAE,IAAI;QACvB,uBAAuB,EAAE,KAAK;QAC9B,uBAAuB,EAAE,KAAK;QAC9B,2BAA2B,EAAE,KAAK;KACnC;IACD,WAAW,EAAE;QACX,KAAK,EAAE,EAAc;QACrB,KAAK,EAAE,EAAc;QACrB,OAAO,EAAE,EAAc;QACvB,YAAY,EAAE,EAAc;KAC7B;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,SAAS,CAAC,uBAAuB,CAAC;KAClC,MAAM,CAAC,qBAAqB,EAAE;IAC7B,OAAO,EAAE,sDAAsD;CAChE,CAAC,CAAC;AAEL,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,SAAS,CAAC,aAAa,CAAC;KACxB,MAAM,CAAC,WAAW,EAAE;IACnB,OAAO,EAAE,8CAA8C;CACxD,CAAC,CAAC;AAEL,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,SAAS,CAAC,kBAAkB,CAAC;KAC7B,MAAM,CAAC,gBAAgB,EAAE;IACxB,OAAO,EAAE,mCAAmC;CAC7C,CAAC,CAAC;AAEL,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,SAAS,CAAC,uBAAuB,CAAC;KAClC,MAAM,CAAC,qBAAqB,EAAE;IAC7B,OAAO,EAAE,wCAAwC;CAClD,CAAC,CAAC;AAEL,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,cAAc,CAAC;IACpF,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,cAAc,CAAC;QACrF,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC3F,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAC1C,yBAAyB,CAAC,OAAO,CAAC,uBAAuB,CAC1D;QACD,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACvG,2BAA2B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAC9C,yBAAyB,CAAC,OAAO,CAAC,2BAA2B,CAC9D;KACF,CAAC;SACD,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC;IAC7C,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,KAAK,CAAC;QACtF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,KAAK,CAAC;QAC/E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,OAAO,CAAC;QACxF,YAAY,EAAE,CAAC;aACZ,KAAK,CAAC,oBAAoB,CAAC;aAC3B,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC,YAAY,CAAC;KAC/D,CAAC;SACD,OAAO,CAAC,yBAAyB,CAAC,WAAW,CAAC;CAClD,CAAC;KACD,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEtC,MAAM,sBAAsB,GAAG;IAC7B,WAAW,EAAE,aAAsB;IACnC,iBAAiB,EAAE,aAAsB;IACzC,eAAe,EAAE,aAAsB;CACxC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC;IAC7F,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,iBAAiB,CAAC;IACzG,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,eAAe,CAAC;CACtG,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAEnC,MAAM,+BAA+B,GAAG;IACtC,eAAe,EAAE;QACf,OAAO,EAAE,IAAI;QACb,8DAA8D;QAC9D,gBAAgB,EAAE,KAAK;QACvB,eAAe,EAAE,MAAM;QACvB,uBAAuB,EAAE,GAAG;QAC5B,uBAAuB,EAAE,GAAG;KAC7B;CACF,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC,eAAe,CAAC,OAAO,CAAC;IACrF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAC/C,+BAA+B,CAAC,eAAe,CAAC,gBAAgB,CACjE;IACD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAC9C,+BAA+B,CAAC,eAAe,CAAC,eAAe,CAChE;IACD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CACtD,+BAA+B,CAAC,eAAe,CAAC,uBAAuB,CACxE;IACD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CACtD,+BAA+B,CAAC,eAAe,CAAC,uBAAuB,CACxE;CACF,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,eAAe,EAAE;IAClE,OAAO,EAAE,gEAAgE;IACzE,IAAI,EAAE,CAAC,kBAAkB,CAAC;CAC3B,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,uBAAuB,IAAI,KAAK,CAAC,uBAAuB,EAAE;IACjF,OAAO,EAAE,+EAA+E;IACxF,IAAI,EAAE,CAAC,yBAAyB,CAAC;CAClC,CAAC,CAAC;AAEL,MAAM,6BAA6B,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,eAAe,EAAE,0BAA0B,CAAC,OAAO,CAAC,+BAA+B,CAAC,eAAe,CAAC;CACrG,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAE5C,MAAM,kBAAkB,GAAG;IACzB,kBAAkB,EAAE,IAAI;IACxB,qBAAqB,EAAE,KAAK;CAC7B,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,kBAAkB,CAAC;IAC9E,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CACpE,kBAAkB,CAAC,qBAAqB,CACzC;CACF,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAE/B,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACnE,0BAA0B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzE,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACvE,gBAAgB,EAAE,oBAAoB;IACtC,yBAAyB,EAAE,6BAA6B;IACxD,WAAW,EAAE,gBAAgB;IAC7B,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,kFAAkF;IAClF,2EAA2E;IAC3E,uCAAuC;IACvC,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvD,aAAa,EAAE,CAAC;SACb,KAAK,CACJ,CAAC;SACE,MAAM,EAAE;SACR,SAAS,CAAC,4BAA4B,CAAC;SACvC,MAAM,CAAC,0BAA0B,EAAE;QAClC,OAAO,EAAE,uEAAuE;KACjF,CAAC,CACL;SACA,OAAO,CAAC,EAAE,CAAC;IACd,mBAAmB,EAAE,uBAAuB;IAC5C,sEAAsE;IACtE,iEAAiE;IACjE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9E,6EAA6E;IAC7E,oDAAoD;IACpD,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACrF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3B,GAAG,EAAE,eAAe;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;IAC7C,MAAM,EAAE,kBAAkB;CAC3B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,cAAc,GAAW;IACpC,OAAO,EAAE,OAAO;IAChB,GAAG,EAAE;QACH,OAAO,EAAE,wBAAwB;QACjC,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,MAAM;QACxB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,8BAA8B,EAAE,IAAI;QACpC,+BAA+B,EAAE,IAAI;QACrC,kBAAkB,EAAE,OAAO;QAC3B,qBAAqB,EAAE,OAAO;QAC9B,6BAA6B,EAAE,OAAO;QACtC,+BAA+B,EAAE,OAAO;QACxC,yBAAyB,EAAE,OAAO;KACnC;IACD,KAAK,EAAE;QACL,IAAI,EAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAG;QACnD,IAAI,EAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAG;QACnD,IAAI,EAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAG;QACnD,IAAI,EAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;QACnD,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAG;QACnD,QAAQ,EAAG,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAG;QACnD,KAAK,EAAM,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;QACnD,IAAI,EAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;QACnD,IAAI,EAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;QACnD,GAAG,EAAQ,EAAE,IAAI,EAAE,KAAK,EAAI,cAAc,EAAE,KAAK,EAAE;KACpD;IACD,MAAM,EAAE;QACN,qBAAqB,EAAE,IAAI;QAC3B,oBAAoB,EAAE,SAAS;QAC/B,0BAA0B,EAAE,SAAS;QACrC,wBAAwB,EAAE,SAAS;QACnC,gBAAgB,EAAE;YAChB,WAAW,EAAE,aAAa;YAC1B,iBAAiB,EAAE,aAAa;YAChC,eAAe,EAAE,aAAa;SAC/B;QACD,yBAAyB,EAAE,+BAA+B;QAC1D,WAAW,EAAE,kBAAkB;QAC/B,sBAAsB,EAAE,EAAE;QAC1B,4BAA4B,EAAE,IAAI;QAClC,aAAa,EAAE,EAAE;QACjB,mBAAmB,EAAE;YACnB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;YACvB,OAAO,EAAE;gBACP,cAAc,EAAE,IAAI;gBACpB,iBAAiB,EAAE,IAAI;gBACvB,uBAAuB,EAAE,KAAK;gBAC9B,uBAAuB,EAAE,KAAK;gBAC9B,2BAA2B,EAAE,KAAK;aACnC;YACD,WAAW,EAAE;gBACX,KAAK,EAAE,EAAE;gBACT,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,EAAE;gBACX,YAAY,EAAE,EAAE;aACjB;SACF;QACD,mBAAmB,EAAE,OAAO;QAC5B,2BAA2B,EAAE,MAAM;KACpC;CACF,CAAC"}

package/dist/shared/daemon-token.d.ts

@@ -0,0 +1,7 @@
+export declare const DAEMON_TOKEN_HEADER = "X-VGE-CC-Guard-Token";
+export declare function resolveDaemonTokenPath(): string;
+export declare function rotateDaemonToken(): string;
+export declare function readDaemonToken(): string | null;
+export declare function tokenHeader(token: string): Record<string, string>;
+export declare function tokenMatches(expected: string, actual: unknown): boolean;
+//# sourceMappingURL=daemon-token.d.ts.map

package/dist/shared/daemon-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-token.d.ts","sourceRoot":"","sources":["../../src/shared/daemon-token.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAO1D,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAM/C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAWvE"}

package/dist/shared/daemon-token.js

@@ -0,0 +1,45 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { writePrivateFileSync } from './private-file.js';
+export const DAEMON_TOKEN_HEADER = 'X-VGE-CC-Guard-Token';
+const TOKEN_COMPARE_BYTES = 64;
+function configDir() {
+    return process.env['VGE_CC_GUARD_CONFIG_DIR'] ?? path.join(os.homedir(), '.vge-cc-guard');
+}
+export function resolveDaemonTokenPath() {
+    return path.join(configDir(), 'daemon-token');
+}
+export function rotateDaemonToken() {
+    const token = crypto.randomBytes(32).toString('base64url');
+    const tokenPath = resolveDaemonTokenPath();
+    fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
+    writePrivateFileSync(tokenPath, token);
+    return token;
+}
+export function readDaemonToken() {
+    try {
+        return fs.readFileSync(resolveDaemonTokenPath(), 'utf-8').trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function tokenHeader(token) {
+    return { [DAEMON_TOKEN_HEADER]: token };
+}
+export function tokenMatches(expected, actual) {
+    if (typeof actual !== 'string' || !expected || !actual)
+        return false;
+    const expectedBytes = Buffer.from(expected);
+    const actualBytes = Buffer.from(actual);
+    const left = Buffer.alloc(TOKEN_COMPARE_BYTES);
+    const right = Buffer.alloc(TOKEN_COMPARE_BYTES);
+    expectedBytes.copy(left, 0, 0, Math.min(expectedBytes.length, TOKEN_COMPARE_BYTES));
+    actualBytes.copy(right, 0, 0, Math.min(actualBytes.length, TOKEN_COMPARE_BYTES));
+    const sameLength = expectedBytes.length === actualBytes.length && expectedBytes.length <= TOKEN_COMPARE_BYTES;
+    const sameValue = crypto.timingSafeEqual(left, right);
+    return sameLength && sameValue;
+}
+//# sourceMappingURL=daemon-token.js.map

package/dist/shared/daemon-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-token.js","sourceRoot":"","sources":["../../src/shared/daemon-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,sBAAsB,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAe;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAChD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACpF,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,IAAI,mBAAmB,CAAC;IAC9G,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,UAAU,IAAI,SAAS,CAAC;AACjC,CAAC"}

package/dist/shared/detect-os-user.d.ts

@@ -0,0 +1,8 @@
+export type DetectionSource = 'sudo' | 'os' | 'fallback';
+export interface DetectedUser {
+    value: string;
+    source: DetectionSource;
+}
+export declare function detectOsUser(): DetectedUser;
+export declare function __resetCacheForTests(): void;
+//# sourceMappingURL=detect-os-user.d.ts.map

package/dist/shared/detect-os-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-os-user.d.ts","sourceRoot":"","sources":["../../src/shared/detect-os-user.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,IAAI,GAAG,UAAU,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,CAAC;CACzB;AA4BD,wBAAgB,YAAY,IAAI,YAAY,CAI3C;AAED,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/shared/detect-os-user.js

@@ -0,0 +1,34 @@
+import { userInfo } from 'node:os';
+let cachedUser;
+function sanitizeUsername(username) {
+    return username.replace(/[\x00-\x1f\x7f]/g, '').trim().slice(0, 128);
+}
+function fallbackUser() {
+    return { value: 'unknown', source: 'fallback' };
+}
+function readSudoUser() {
+    const username = process.env['SUDO_USER'];
+    if (!username)
+        return undefined;
+    const sanitized = sanitizeUsername(username);
+    return sanitized ? { value: sanitized, source: 'sudo' } : undefined;
+}
+function readOsUser() {
+    try {
+        const username = sanitizeUsername(userInfo().username);
+        return username ? { value: username, source: 'os' } : fallbackUser();
+    }
+    catch {
+        return fallbackUser();
+    }
+}
+export function detectOsUser() {
+    if (cachedUser)
+        return cachedUser;
+    cachedUser = readSudoUser() ?? readOsUser();
+    return cachedUser;
+}
+export function __resetCacheForTests() {
+    cachedUser = undefined;
+}
+//# sourceMappingURL=detect-os-user.js.map

package/dist/shared/detect-os-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-os-user.js","sourceRoot":"","sources":["../../src/shared/detect-os-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AASnC,IAAI,UAAoC,CAAC;AAEzC,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,UAAU,GAAG,YAAY,EAAE,IAAI,UAAU,EAAE,CAAC;IAC5C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,UAAU,GAAG,SAAS,CAAC;AACzB,CAAC"}

package/dist/shared/effective-client-id.d.ts

@@ -0,0 +1,6 @@
+import type { Config } from './config-schema.js';
+import { type DetectionSource } from './detect-os-user.js';
+export type EffectiveClientIdSource = 'config-manual' | 'disabled' | `auto-${DetectionSource}`;
+export declare function effectiveClientId(config: Config): string | undefined;
+export declare function effectiveClientIdSource(config: Config): EffectiveClientIdSource;
+//# sourceMappingURL=effective-client-id.d.ts.map

package/dist/shared/effective-client-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-client-id.d.ts","sourceRoot":"","sources":["../../src/shared/effective-client-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEzE,MAAM,MAAM,uBAAuB,GAC/B,eAAe,GACf,UAAU,GACV,QAAQ,eAAe,EAAE,CAAC;AAE9B,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASpE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAS/E"}

package/dist/shared/effective-client-id.js

@@ -0,0 +1,22 @@
+import { detectOsUser } from './detect-os-user.js';
+export function effectiveClientId(config) {
+    switch (config.vge.client_id_source) {
+        case 'manual':
+            return config.vge.client_id.trim() || undefined;
+        case 'disabled':
+            return undefined;
+        case 'auto':
+            return detectOsUser().value;
+    }
+}
+export function effectiveClientIdSource(config) {
+    switch (config.vge.client_id_source) {
+        case 'manual':
+            return 'config-manual';
+        case 'disabled':
+            return 'disabled';
+        case 'auto':
+            return `auto-${detectOsUser().source}`;
+    }
+}
+//# sourceMappingURL=effective-client-id.js.map

package/dist/shared/effective-client-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-client-id.js","sourceRoot":"","sources":["../../src/shared/effective-client-id.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAwB,MAAM,qBAAqB,CAAC;AAOzE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,QAAQ,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;QAClD,KAAK,UAAU;YACb,OAAO,SAAS,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,YAAY,EAAE,CAAC,KAAK,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,QAAQ,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC;QACzB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,QAAQ,YAAY,EAAE,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/shared/ipc-address.d.ts

@@ -0,0 +1,10 @@
+type IpcAddressOptions = {
+    platform?: NodeJS.Platform;
+    username?: string;
+    userInfo?: () => {
+        username: string;
+    };
+};
+export declare function getIpcAddress(opts?: IpcAddressOptions): string;
+export {};
+//# sourceMappingURL=ipc-address.d.ts.map

package/dist/shared/ipc-address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipc-address.d.ts","sourceRoot":"","sources":["../../src/shared/ipc-address.ts"],"names":[],"mappings":"AAIA,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,GAAE,iBAAsB,GAAG,MAAM,CASlE"}

package/dist/shared/ipc-address.js

@@ -0,0 +1,33 @@
+import * as crypto from 'crypto';
+import * as os from 'os';
+import * as path from 'path';
+export function getIpcAddress(opts = {}) {
+    const override = process.env['VGE_CC_GUARD_IPC'];
+    if (override?.trim())
+        return override;
+    const platform = opts.platform ?? process.platform;
+    if (platform === 'win32')
+        return getWindowsPipeAddress(opts);
+    const base = process.env['VGE_CC_GUARD_CONFIG_DIR'] ?? path.join(os.homedir(), '.vge-cc-guard');
+    return path.join(base, 'daemon.sock');
+}
+function getWindowsPipeAddress(opts) {
+    const userHash = hashPrefix(opts.username ?? getWindowsUsername(opts.userInfo));
+    const configDir = process.env['VGE_CC_GUARD_CONFIG_DIR'];
+    if (!configDir)
+        return `\\\\.\\pipe\\vge-cc-guard-${userHash}`;
+    const configHash = hashPrefix(path.win32.resolve(configDir));
+    return `\\\\.\\pipe\\vge-cc-guard-${userHash}-${configHash}`;
+}
+function hashPrefix(input) {
+    return crypto.createHash('sha256').update(input).digest('hex').slice(0, 8);
+}
+function getWindowsUsername(userInfo) {
+    try {
+        return userInfo ? userInfo().username : os.userInfo().username;
+    }
+    catch {
+        return process.env['USERNAME'] ?? process.env['USER'] ?? 'unknown';
+    }
+}
+//# sourceMappingURL=ipc-address.js.map

package/dist/shared/ipc-address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipc-address.js","sourceRoot":"","sources":["../../src/shared/ipc-address.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAQ7B,MAAM,UAAU,aAAa,CAAC,OAA0B,EAAE;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,QAAQ,EAAE,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE7D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB;IACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS;QAAE,OAAO,6BAA6B,QAAQ,EAAE,CAAC;IAE/D,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,OAAO,6BAA6B,QAAQ,IAAI,UAAU,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAqC;IAC/D,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/shared/ipc-protocol.d.ts

@@ -0,0 +1,60 @@
+export interface ShimRequest {
+    event: 'sessionstart' | 'userprompt' | 'pretool' | 'posttool' | 'sessionend' | 'subagentstart' | 'subagentstop';
+    payload: Record<string, unknown>;
+}
+export interface SessionStartResponse {
+    event: 'sessionstart';
+    ccOutput: null;
+}
+export interface SessionEndResponse {
+    event: 'sessionend';
+    ccOutput: null;
+}
+export interface SubagentStartResponse {
+    event: 'subagentstart';
+    ccOutput: null;
+}
+export interface SubagentStopResponse {
+    event: 'subagentstop';
+    ccOutput: {
+        decision?: 'block';
+        reason?: string;
+    } | null;
+}
+export interface UserPromptResponse {
+    event: 'userprompt';
+    ccOutput: {
+        decision?: 'block';
+        reason?: string;
+        continue?: false;
+        stopReason?: string;
+        hookSpecificOutput?: {
+            hookEventName: 'UserPromptSubmit';
+            additionalContext?: string;
+        };
+    } | null;
+}
+export interface PreToolResponse {
+    event: 'pretool';
+    ccOutput: {
+        hookSpecificOutput: {
+            hookEventName: 'PreToolUse';
+            permissionDecision: 'allow' | 'deny' | 'ask';
+            permissionDecisionReason?: string;
+        };
+    };
+}
+export interface PostToolResponse {
+    event: 'posttool';
+    ccOutput: {
+        continue?: false;
+        stopReason?: string;
+        hookSpecificOutput?: {
+            hookEventName: 'PostToolUse';
+            updatedToolOutput?: unknown;
+            additionalContext?: string;
+        };
+    } | null;
+}
+export type DaemonResponse = SessionStartResponse | SessionEndResponse | SubagentStartResponse | SubagentStopResponse | UserPromptResponse | PreToolResponse | PostToolResponse;
+//# sourceMappingURL=ipc-protocol.d.ts.map

package/dist/shared/ipc-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipc-protocol.d.ts","sourceRoot":"","sources":["../../src/shared/ipc-protocol.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,eAAe,GAAG,cAAc,CAAC;IAChH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EACJ;QACE,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GACD,IAAI,CAAC;CACV;AAGD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EACJ;QACE,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE;YACnB,aAAa,EAAE,kBAAkB,CAAC;YAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;KACH,GACD,IAAI,CAAC;CACV;AAID,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE;QACR,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY,CAAC;YAC5B,kBAAkB,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;YAC7C,wBAAwB,CAAC,EAAE,MAAM,CAAC;SACnC,CAAC;KACH,CAAC;CACH;AAGD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EACJ;QACE,QAAQ,CAAC,EAAE,KAAK,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE;YACnB,aAAa,EAAE,aAAa,CAAC;YAC7B,iBAAiB,CAAC,EAAE,OAAO,CAAC;YAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;KACH,GACD,IAAI,CAAC;CACV;AAED,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,eAAe,GACf,gBAAgB,CAAC"}

package/dist/shared/ipc-protocol.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ipc-protocol.js.map

package/dist/shared/ipc-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipc-protocol.js","sourceRoot":"","sources":["../../src/shared/ipc-protocol.ts"],"names":[],"mappings":""}

package/dist/shared/path-match.d.ts

@@ -0,0 +1,4 @@
+export declare function pathStartsWith(candidatePath: string, parentPath: string, opts?: {
+    platform?: NodeJS.Platform;
+}): boolean;
+//# sourceMappingURL=path-match.d.ts.map

package/dist/shared/path-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-match.d.ts","sourceRoot":"","sources":["../../src/shared/path-match.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,CAC5B,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAAO,GACxC,OAAO,CAYT"}

package/dist/shared/path-match.js

@@ -0,0 +1,15 @@
+import * as path from 'path';
+export function pathStartsWith(candidatePath, parentPath, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    const pathApi = platform === 'win32' ? path.win32 : path.posix;
+    const normalizedCandidate = pathApi.normalize(candidatePath);
+    const normalizedParent = pathApi.normalize(parentPath);
+    const caseSensitive = platform !== 'win32';
+    const candidate = caseSensitive ? normalizedCandidate : normalizedCandidate.toLowerCase();
+    const parent = caseSensitive ? normalizedParent : normalizedParent.toLowerCase();
+    if (candidate === parent)
+        return true;
+    const parentWithSeparator = parent.endsWith(pathApi.sep) ? parent : `${parent}${pathApi.sep}`;
+    return candidate.startsWith(parentWithSeparator);
+}
+//# sourceMappingURL=path-match.js.map

package/dist/shared/path-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-match.js","sourceRoot":"","sources":["../../src/shared/path-match.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,UAAU,cAAc,CAC5B,aAAqB,EACrB,UAAkB,EAClB,OAAuC,EAAE;IAEzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,QAAQ,KAAK,OAAO,CAAC;IAC3C,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;IAC1F,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC;IAEjF,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9F,OAAO,SAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AACnD,CAAC"}

package/dist/shared/private-file.d.ts

@@ -0,0 +1,17 @@
+export type PrivateFilePlatform = NodeJS.Platform;
+export declare function chmodPrivateSync(filePath: string, opts?: {
+    platform?: PrivateFilePlatform;
+}): void;
+export declare function chmodPrivateDirectorySync(directoryPath: string, opts?: {
+    platform?: PrivateFilePlatform;
+}): void;
+export declare function writePrivateFileSync(filePath: string, content: string | Buffer, opts?: {
+    platform?: PrivateFilePlatform;
+}): void;
+export declare function writePrivateFileAtomicSync(filePath: string, content: string | Buffer, opts?: {
+    platform?: PrivateFilePlatform;
+}): void;
+export declare function appendPrivateFileSync(filePath: string, content: string | Buffer, opts?: {
+    platform?: PrivateFilePlatform;
+}): void;
+//# sourceMappingURL=private-file.d.ts.map

package/dist/shared/private-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-file.d.ts","sourceRoot":"","sources":["../../src/shared/private-file.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC;AAwClD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAC5C,IAAI,CAON;AAED,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAC5C,IAAI,CAON;AAmBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAC5C,IAAI,CAgBN;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAC5C,IAAI,CAuBN;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAC5C,IAAI,CAgBN"}