@vyuhlabs/dxkit 2.12.0 → 2.13.0

package/dist/loop/ledger-cli.js

@@ -0,0 +1,95 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runLoopLedger = runLoopLedger;
+/**
+ * CLI for `vyuh-dxkit loop ledger [show | summarize | clear]`.
+ *
+ * A thin renderer over the pure ledger functions. The ledger is an
+ * audit trail ("what did the loop do?"), not a dashboard, so the output
+ * is deliberately plain text (or `--json` for tooling).
+ */
+const logger = __importStar(require("../logger"));
+const ledger_1 = require("./ledger");
+function renderEventLine(e) {
+    const verdict = e.allowed ? 'PASS ' : 'BLOCK';
+    const cont = e.stop_hook_active ? ' (continuation)' : '';
+    const nn = e.allowed ? '' : `, ${e.net_new_findings} net-new`;
+    return `${e.timestamp}  ${verdict}  guardrail=${e.guardrail_status}${nn}${cont}`;
+}
+async function runLoopLedger(cwd, action, opts) {
+    const act = action ?? 'show';
+    if (act === 'clear') {
+        const removed = (0, ledger_1.clearLedger)(cwd);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ cleared: removed }) + '\n');
+        }
+        else {
+            logger.info(removed ? 'Loop ledger cleared.' : 'No loop ledger to clear.');
+        }
+        return;
+    }
+    const events = (0, ledger_1.readLedger)(cwd);
+    if (act === 'summarize') {
+        const summary = (0, ledger_1.summarizeLedger)(events);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(summary, null, 2) + '\n');
+            return;
+        }
+        logger.header('Loop ledger summary');
+        logger.info(`Total postflights:        ${summary.total}`);
+        logger.info(`Allowed (clean stop):     ${summary.allowed}`);
+        logger.info(`Blocked completions:      ${summary.blocked}`);
+        logger.info(`Net-new findings blocked: ${summary.netNewBlocked}`);
+        logger.info(`Repaired after block:     ${summary.repairedAfterBlock}`);
+        logger.info(`Unrepaired sessions:      ${summary.unrepairedSessions}`);
+        return;
+    }
+    // Default: show.
+    const limit = opts.limit ? parseInt(opts.limit, 10) : undefined;
+    const shown = limit && Number.isFinite(limit) ? events.slice(-limit) : events;
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(shown, null, 2) + '\n');
+        return;
+    }
+    if (shown.length === 0) {
+        logger.info('Loop ledger is empty.');
+        return;
+    }
+    logger.header(`Loop ledger (${shown.length}${limit ? ` of ${events.length}` : ''} events)`);
+    for (const e of shown)
+        process.stdout.write(renderEventLine(e) + '\n');
+}
+//# sourceMappingURL=ledger-cli.js.map

package/dist/loop/ledger-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-cli.js","sourceRoot":"","sources":["../../src/loop/ledger-cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,sCAgDC;AAvED;;;;;;GAMG;AACH,kDAAoC;AACpC,qCAAsF;AAQtF,SAAS,eAAe,CAAC,CAAc;IACrC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,UAAU,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,SAAS,KAAK,OAAO,eAAe,CAAC,CAAC,gBAAgB,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;AACnF,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,MAA0B,EAC1B,IAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,MAAM,CAAC;IAE7B,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAA,oBAAW,EAAC,GAAG,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,iBAAiB;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,gBAAgB,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACzE,CAAC"}

package/dist/loop/ledger.d.ts

@@ -0,0 +1,95 @@
+import type { LoopPreset } from './policy';
+/** Bump only on a breaking change to the event shape. */
+export declare const LEDGER_SCHEMA_VERSION = 1;
+/** Relative location of the ledger inside a repo. */
+export declare const LEDGER_DIR: string;
+export declare const LEDGER_FILE: string;
+/** Status of a deterministic check at the moment the Stop-gate ran. */
+export type CheckStatus = 'pass' | 'fail' | 'error' | 'not_configured' | 'skipped';
+/**
+ * One postflight event. Mirrors the schema in the loop pack spec so
+ * the ledger is stable across releases. Optional agent fields are
+ * populated when the hook payload carries them (agent teams / subagents).
+ */
+export interface LedgerEvent {
+    readonly schema_version: number;
+    readonly timestamp: string;
+    readonly event: 'Stop';
+    readonly session_id: string;
+    readonly agent_id?: string;
+    readonly agent_type?: string;
+    readonly cwd: string;
+    readonly branch: string;
+    readonly commit: string;
+    /** Loop posture in force when the gate ran (`security-only` /
+     *  `full-debt`). Optional for forward/backward compat — absent on
+     *  events written before presets existed. */
+    readonly preset?: LoopPreset;
+    /** Outcome of the dxkit guardrail check. */
+    readonly guardrail_status: CheckStatus;
+    /** Net-new findings that blocked completion (0 when guardrail passed). */
+    readonly net_new_findings: number;
+    /** Size of the prior baseline the current scan was diffed against. */
+    readonly baseline_findings: number;
+    /** Files changed relative to the baseline commit, when derivable. */
+    readonly files_changed: number;
+    /**
+     * Whether THIS event blocked the loop from stopping. A blocked event
+     * is the durable record of "the loop tried to declare done while
+     * unsafe." `allowed: true` events are clean completions (or a
+     * non-blocking allow after an un-fixable config error).
+     */
+    readonly allowed: boolean;
+    /**
+     * True when Claude was already continuing because a prior Stop-gate
+     * blocked this turn (the Claude Code `stop_hook_active` flag). Lets
+     * the summary distinguish "repaired on first try" from "needed N
+     * continuations."
+     */
+    readonly stop_hook_active: boolean;
+    readonly tests_status: CheckStatus;
+    readonly lint_status: CheckStatus;
+    readonly typecheck_status: CheckStatus;
+    readonly duration_ms: number;
+}
+/**
+ * Fill in the repo-derived fields (branch, commit) and stamp the
+ * schema version + timestamp, so callers only supply the outcome.
+ */
+export declare function buildLedgerEvent(cwd: string, fields: Omit<LedgerEvent, 'schema_version' | 'timestamp' | 'event' | 'branch' | 'commit'> & Partial<Pick<LedgerEvent, 'branch' | 'commit'>>): LedgerEvent;
+/**
+ * Append one event to the ledger. Creates `.dxkit/loop/` on demand.
+ * Best-effort: a ledger write must never abort the Stop-gate (the
+ * gate's verdict matters more than its audit line), so failures are
+ * swallowed and reported via the return value.
+ */
+export declare function appendLedgerEvent(cwd: string, event: LedgerEvent): boolean;
+/** Read every ledger event. Returns [] when the ledger is absent. */
+export declare function readLedger(cwd: string): LedgerEvent[];
+/** Remove the ledger file. Returns true when a file was deleted. */
+export declare function clearLedger(cwd: string): boolean;
+export interface LedgerSummary {
+    readonly total: number;
+    readonly allowed: number;
+    readonly blocked: number;
+    /** Total net-new findings across all blocked events. */
+    readonly netNewBlocked: number;
+    /**
+     * Sessions where a blocked Stop was later followed by a clean
+     * (allowed, guardrail-pass) Stop — i.e. the agent repaired the
+     * net-new findings after being blocked. The headline "repair-after-
+     * block" metric for the Loop-Safety study.
+     */
+    readonly repairedAfterBlock: number;
+    /** Sessions that were blocked at least once and never repaired. */
+    readonly unrepairedSessions: number;
+}
+/**
+ * Reduce a list of events to the audit-trail summary. Repair detection
+ * is per-session: a session counts as "repaired" if it has at least one
+ * blocked event AND a strictly-later allowed event with a passing
+ * guardrail. Order is taken from event position (the ledger is
+ * append-only, so file order is chronological).
+ */
+export declare function summarizeLedger(events: ReadonlyArray<LedgerEvent>): LedgerSummary;
+//# sourceMappingURL=ledger.d.ts.map

package/dist/loop/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../src/loop/ledger.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,qDAAqD;AACrD,eAAO,MAAM,UAAU,QAA8B,CAAC;AACtD,eAAO,MAAM,WAAW,QAAwC,CAAC;AAEjE,uEAAuE;AACvE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAEnF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;iDAE6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AA4BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,GACvF,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC,GAChD,WAAW,CASb;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAS1E;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE,CAqBrD;AAED,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOhD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,aAAa,CAuCjF"}

package/dist/loop/ledger.js

@@ -0,0 +1,201 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEDGER_FILE = exports.LEDGER_DIR = exports.LEDGER_SCHEMA_VERSION = void 0;
+exports.buildLedgerEvent = buildLedgerEvent;
+exports.appendLedgerEvent = appendLedgerEvent;
+exports.readLedger = readLedger;
+exports.clearLedger = clearLedger;
+exports.summarizeLedger = summarizeLedger;
+/**
+ * Loop ledger — an append-only audit trail of postflight (Stop-gate)
+ * events for autonomous coding loops.
+ *
+ * Every time the Stop-gate runs (whether it allows the loop to stop or
+ * blocks it on net-new findings), it appends one line to
+ * `.dxkit/loop/ledger.jsonl`. The ledger answers "what did the loop
+ * actually do?" — how many completions were blocked, how many net-new
+ * findings, and whether the agent repaired after a block.
+ *
+ * This is deliberately NOT a dashboard. It is a flat JSONL file so a
+ * loop can write to it from any process without coordination, and a
+ * human (or a benchmark harness) can `cat` / `jq` it directly.
+ */
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Bump only on a breaking change to the event shape. */
+exports.LEDGER_SCHEMA_VERSION = 1;
+/** Relative location of the ledger inside a repo. */
+exports.LEDGER_DIR = path.join('.dxkit', 'loop');
+exports.LEDGER_FILE = path.join(exports.LEDGER_DIR, 'ledger.jsonl');
+/** Best-effort current branch; empty string when not derivable. */
+function gitBranch(cwd) {
+    try {
+        return (0, child_process_1.execFileSync)('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/** Best-effort current commit SHA; empty string when not derivable. */
+function gitCommit(cwd) {
+    try {
+        return (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Fill in the repo-derived fields (branch, commit) and stamp the
+ * schema version + timestamp, so callers only supply the outcome.
+ */
+function buildLedgerEvent(cwd, fields) {
+    return {
+        schema_version: exports.LEDGER_SCHEMA_VERSION,
+        timestamp: new Date().toISOString(),
+        event: 'Stop',
+        branch: fields.branch ?? gitBranch(cwd),
+        commit: fields.commit ?? gitCommit(cwd),
+        ...fields,
+    };
+}
+/**
+ * Append one event to the ledger. Creates `.dxkit/loop/` on demand.
+ * Best-effort: a ledger write must never abort the Stop-gate (the
+ * gate's verdict matters more than its audit line), so failures are
+ * swallowed and reported via the return value.
+ */
+function appendLedgerEvent(cwd, event) {
+    try {
+        const dir = path.join(cwd, exports.LEDGER_DIR);
+        fs.mkdirSync(dir, { recursive: true });
+        fs.appendFileSync(path.join(cwd, exports.LEDGER_FILE), JSON.stringify(event) + '\n', 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read every ledger event. Returns [] when the ledger is absent. */
+function readLedger(cwd) {
+    const file = path.join(cwd, exports.LEDGER_FILE);
+    let raw;
+    try {
+        raw = fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const line of raw.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            out.push(JSON.parse(trimmed));
+        }
+        catch {
+            // Skip a corrupt line rather than failing the whole read — the
+            // ledger is append-only and a partial write shouldn't blind the
+            // summary to every other event.
+        }
+    }
+    return out;
+}
+/** Remove the ledger file. Returns true when a file was deleted. */
+function clearLedger(cwd) {
+    try {
+        fs.rmSync(path.join(cwd, exports.LEDGER_FILE));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Reduce a list of events to the audit-trail summary. Repair detection
+ * is per-session: a session counts as "repaired" if it has at least one
+ * blocked event AND a strictly-later allowed event with a passing
+ * guardrail. Order is taken from event position (the ledger is
+ * append-only, so file order is chronological).
+ */
+function summarizeLedger(events) {
+    let allowed = 0;
+    let blocked = 0;
+    let netNewBlocked = 0;
+    // Per-session timeline of (blocked?, repaired?) — repaired means a
+    // clean allowed+pass event appeared after the session's first block.
+    const blockedAt = new Map(); // session → index of first block
+    const repairedSessions = new Set();
+    const blockedSessions = new Set();
+    events.forEach((e, idx) => {
+        if (e.allowed)
+            allowed++;
+        else {
+            blocked++;
+            netNewBlocked += e.net_new_findings;
+        }
+        const sid = e.session_id || '(unknown)';
+        if (!e.allowed) {
+            blockedSessions.add(sid);
+            if (!blockedAt.has(sid))
+                blockedAt.set(sid, idx);
+        }
+        else if (e.guardrail_status === 'pass' &&
+            blockedAt.has(sid) &&
+            idx > blockedAt.get(sid)) {
+            repairedSessions.add(sid);
+        }
+    });
+    return {
+        total: events.length,
+        allowed,
+        blocked,
+        netNewBlocked,
+        repairedAfterBlock: repairedSessions.size,
+        unrepairedSessions: [...blockedSessions].filter((s) => !repairedSessions.has(s)).length,
+    };
+}
+//# sourceMappingURL=ledger.js.map

package/dist/loop/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../src/loop/ledger.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0GA,4CAaC;AAQD,8CASC;AAGD,gCAqBC;AAGD,kCAOC;AA0BD,0CAuCC;AA3OD;;;;;;;;;;;;;GAaG;AACH,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAG7B,yDAAyD;AAC5C,QAAA,qBAAqB,GAAG,CAAC,CAAC;AAEvC,qDAAqD;AACxC,QAAA,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACzC,QAAA,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAU,EAAE,cAAc,CAAC,CAAC;AAoDjE,mEAAmE;AACnE,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE;YAChE,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;YAChD,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,GAAW,EACX,MACiD;IAEjD,OAAO;QACL,cAAc,EAAE,6BAAqB;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC;QACvC,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,GAAW,EAAE,KAAkB;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAU,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAgB,UAAU,CAAC,GAAW;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAW,CAAC,CAAC;IACzC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,gEAAgE;YAChE,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAW,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAmBD;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,MAAkC;IAChE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,iCAAiC;IAC9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;aACpB,CAAC;YACJ,OAAO,EAAE,CAAC;YACV,aAAa,IAAI,CAAC,CAAC,gBAAgB,CAAC;QACtC,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,WAAW,CAAC;QACxC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;aAAM,IACL,CAAC,CAAC,gBAAgB,KAAK,MAAM;YAC7B,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAClB,GAAG,GAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAY,EACpC,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM;QACpB,OAAO;QACP,OAAO;QACP,aAAa;QACb,kBAAkB,EAAE,gBAAgB,CAAC,IAAI;QACzC,kBAAkB,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;KACxF,CAAC;AACJ,CAAC"}

package/dist/loop/policy.d.ts

@@ -0,0 +1,35 @@
+import { type BrownfieldPolicy } from '../baseline/policy';
+/**
+ * The two shipped loop postures.
+ *   - `security-only` (default): block only on net-new secrets + crit/high
+ *     security + crit/high reachable dependency vulns. test-gap + quality
+ *     are NOT blocked — they warn. Cost-bounded; safe to run unattended.
+ *   - `full-debt`: block on every net-new finding (adds test-gap +
+ *     quality). Exhaustive but can drive an open-ended repair; opt-in.
+ */
+export type LoopPreset = 'security-only' | 'full-debt';
+/** The cost-bounded default — the posture an unattended loop gets unless
+ *  the repo explicitly opts into `full-debt`. */
+export declare const DEFAULT_LOOP_PRESET: LoopPreset;
+/** Resolved loop posture: the policy the Stop-gate hands to the guardrail,
+ *  plus the preset name that produced it (recorded in the ledger). */
+export interface ResolvedLoopPolicy {
+    readonly policy: BrownfieldPolicy;
+    readonly preset: LoopPreset;
+}
+/**
+ * Resolve the active loop preset. Precedence (mirrors the other
+ * `DXKIT_LOOP_*` knobs the Stop-gate already honours):
+ *   1. `DXKIT_LOOP_PRESET` env var (benchmark / CI override).
+ *   2. `.dxkit/policy.json` → `loop.preset`.
+ *   3. `DEFAULT_LOOP_PRESET` (`security-only`).
+ */
+export declare function resolveLoopPreset(cwd: string): LoopPreset;
+/**
+ * Build the loop-scoped policy: the repo's base `BrownfieldPolicy`
+ * (confidence thresholds, baseline mode, drift handling preserved) with
+ * its `block` list + `blockRules` REPLACED by the active preset's. Only
+ * the Stop-gate calls this — see the scope note at the top of the file.
+ */
+export declare function resolveLoopPolicy(cwd: string): ResolvedLoopPolicy;
+//# sourceMappingURL=policy.d.ts.map

package/dist/loop/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/loop/policy.ts"],"names":[],"mappings":"AA0BA,OAAO,EAEL,KAAK,gBAAgB,EAGtB,MAAM,oBAAoB,CAAC;AAG5B;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,WAAW,CAAC;AAEvD;iDACiD;AACjD,eAAO,MAAM,mBAAmB,EAAE,UAA4B,CAAC;AA8C/D;sEACsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAuBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAIzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAYjE"}

package/dist/loop/policy.js

@@ -0,0 +1,151 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_LOOP_PRESET = void 0;
+exports.resolveLoopPreset = resolveLoopPreset;
+exports.resolveLoopPolicy = resolveLoopPolicy;
+/**
+ * Loop policy presets — a curated blocking posture scoped to autonomous
+ * coding loops ONLY.
+ *
+ * ──────────────────────────────────────────────────────────────────────
+ *  SCOPE: this layer is read by exactly one consumer — the Stop-gate
+ *  (`src/loop/stop-gate.ts`). The CI / PR guardrail (`vyuh-dxkit baseline
+ *  check`) and `createBaseline` resolve the shared `BrownfieldPolicy`
+ *  directly via `resolvePolicy` and NEVER read `loop.preset`. So setting a
+ *  preset changes how an unattended loop blocks WITHOUT silently
+ *  downgrading a repo's CI posture. The `loop.*` namespace in
+ *  `.dxkit/policy.json` and the `Loop`-prefixed names here both signal
+ *  that boundary.
+ * ──────────────────────────────────────────────────────────────────────
+ *
+ * Why a loop-only posture exists: in CI a guardrail block just fails a
+ * check a human then reads — blocking on every debt class (test-gap,
+ * quality) is fine. In a loop a block instead FEEDS THE MODEL a repair
+ * instruction, so blocking on open-ended debt makes the agent grind on it
+ * unattended (writing tests / refactoring until the gap closes), which is
+ * expensive and unbounded. The default loop posture therefore blocks only
+ * on the unambiguous, must-fix security class; the open-ended debt classes
+ * are an explicit opt-in.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const policy_1 = require("../baseline/policy");
+/** The cost-bounded default — the posture an unattended loop gets unless
+ *  the repo explicitly opts into `full-debt`. */
+exports.DEFAULT_LOOP_PRESET = 'security-only';
+/** The security class: secrets, crit/high SAST, crit/high reachable dep
+ *  vulns. Shared by both presets — full-debt is this plus the debt rules. */
+const SECURITY_BLOCK_RULES = {
+    newSecret: true,
+    newCriticalSecurity: true,
+    newHighSecurity: true,
+    newCriticalDependencyVulnerability: true,
+    newHighReachableDependencyVulnerability: true,
+    // Open-ended debt — OFF in security-only (warn, never block in a loop).
+    newUntestedChangedSource: false,
+    newSevereQualityIssueInChangedFiles: false,
+};
+const PRESETS = Object.freeze({
+    'security-only': {
+        // Empty generic block list: nothing auto-blocks by status alone, so
+        // test-gap + quality net-new findings warn but never block the loop.
+        // Blocking comes solely from SECURITY_BLOCK_RULES.
+        block: [],
+        blockRules: SECURITY_BLOCK_RULES,
+    },
+    'full-debt': {
+        // Any net-new finding blocks (generic `added`), plus every escalation.
+        block: ['added'],
+        blockRules: {
+            ...SECURITY_BLOCK_RULES,
+            newUntestedChangedSource: true,
+            newSevereQualityIssueInChangedFiles: true,
+        },
+    },
+});
+function isLoopPreset(v) {
+    return v === 'security-only' || v === 'full-debt';
+}
+/**
+ * Read `loop.preset` from `.dxkit/policy.json`. Best-effort: a missing /
+ * malformed file or absent `loop` block yields `undefined` so the caller
+ * falls back to the default. Read here (not via `resolvePolicy`) so the
+ * loop concept stays out of the shared `BrownfieldPolicy` schema.
+ */
+function readPresetFromPolicyFile(cwd) {
+    try {
+        const raw = fs.readFileSync(path.join(cwd, policy_1.DEFAULT_POLICY_FILENAME), 'utf8');
+        const parsed = JSON.parse(raw);
+        const preset = parsed.loop?.preset;
+        return isLoopPreset(preset) ? preset : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolve the active loop preset. Precedence (mirrors the other
+ * `DXKIT_LOOP_*` knobs the Stop-gate already honours):
+ *   1. `DXKIT_LOOP_PRESET` env var (benchmark / CI override).
+ *   2. `.dxkit/policy.json` → `loop.preset`.
+ *   3. `DEFAULT_LOOP_PRESET` (`security-only`).
+ */
+function resolveLoopPreset(cwd) {
+    const env = process.env.DXKIT_LOOP_PRESET;
+    if (isLoopPreset(env))
+        return env;
+    return readPresetFromPolicyFile(cwd) ?? exports.DEFAULT_LOOP_PRESET;
+}
+/**
+ * Build the loop-scoped policy: the repo's base `BrownfieldPolicy`
+ * (confidence thresholds, baseline mode, drift handling preserved) with
+ * its `block` list + `blockRules` REPLACED by the active preset's. Only
+ * the Stop-gate calls this — see the scope note at the top of the file.
+ */
+function resolveLoopPolicy(cwd) {
+    const base = (0, policy_1.resolvePolicy)(undefined, cwd);
+    const preset = resolveLoopPreset(cwd);
+    const def = PRESETS[preset];
+    return {
+        preset,
+        policy: {
+            ...base,
+            block: def.block,
+            blockRules: def.blockRules,
+        },
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/loop/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/loop/policy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+HA,8CAIC;AAQD,8CAYC;AAvJD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,+CAK4B;AAa5B;iDACiD;AACpC,QAAA,mBAAmB,GAAe,eAAe,CAAC;AAc/D;6EAC6E;AAC7E,MAAM,oBAAoB,GAAyB;IACjD,SAAS,EAAE,IAAI;IACf,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,IAAI;IACrB,kCAAkC,EAAE,IAAI;IACxC,uCAAuC,EAAE,IAAI;IAC7C,wEAAwE;IACxE,wBAAwB,EAAE,KAAK;IAC/B,mCAAmC,EAAE,KAAK;CAC3C,CAAC;AAEF,MAAM,OAAO,GAA4C,MAAM,CAAC,MAAM,CAAC;IACrE,eAAe,EAAE;QACf,oEAAoE;QACpE,qEAAqE;QACrE,mDAAmD;QACnD,KAAK,EAAE,EAAE;QACT,UAAU,EAAE,oBAAoB;KACjC;IACD,WAAW,EAAE;QACX,uEAAuE;QACvE,KAAK,EAAE,CAAC,OAAO,CAAC;QAChB,UAAU,EAAE;YACV,GAAG,oBAAoB;YACvB,wBAAwB,EAAE,IAAI;YAC9B,mCAAmC,EAAE,IAAI;SAC1C;KACF;CACF,CAAC,CAAC;AASH,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,WAAW,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gCAAuB,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QACnC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC1C,IAAI,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,2BAAmB,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,IAAI,GAAG,IAAA,sBAAa,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO;QACL,MAAM;QACN,MAAM,EAAE;YACN,GAAG,IAAI;YACP,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B;KACF,CAAC;AACJ,CAAC"}

package/dist/loop/scaffold.d.ts

@@ -0,0 +1,26 @@
+import type { ShipInstallResult } from '../ship-installers';
+import { type LoopPreset } from './policy';
+/** The command Claude Code runs on Stop. Kept in one place so the
+ *  installer, doctor, and any future tooling agree on the exact string. */
+export declare const STOP_HOOK_COMMAND = "npx vyuh-dxkit hook stop-gate";
+interface LoopScaffoldOpts {
+    /**
+     * Explicit loop posture to write into `.dxkit/policy.json`. When set
+     * (init with `--loop-preset`), it OVERRIDES any existing preset. When
+     * omitted (bare init re-run, or update), an existing preset is PRESERVED
+     * and `security-only` is seeded only if none exists — so an upgrade
+     * never silently resets a user's chosen posture.
+     */
+    readonly preset?: LoopPreset;
+}
+/** True when `.claude/settings.json` already registers the Stop-gate. Used
+ *  by `update`'s install-flag detection so an upgrade refreshes the loop
+ *  surface only on repos that opted into it. */
+export declare function isClaudeLoopInstalled(cwd: string): boolean;
+/**
+ * Scaffold the loop pack into `cwd`. Additive + idempotent: safe to run on
+ * a fresh repo or re-run on one that already has settings/CLAUDE.md/policy.
+ */
+export declare function installClaudeLoop(cwd: string, opts?: LoopScaffoldOpts): ShipInstallResult;
+export {};
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/loop/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/loop/scaffold.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAEhE;2EAC2E;AAC3E,eAAO,MAAM,iBAAiB,kCAAkC,CAAC;AA0BjE,UAAU,gBAAgB;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAWD;;gDAEgD;AAChD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAY1D;AA2ID;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,iBAAiB,CAM7F"}